4 ms·

Enforcing expiry of root certificates on a device which no longer gets root certificate store updates is essentially creating “planned obsolescence”. I know it'

• tialaramex 5y ago
  Right. Fusing things like this makes sense. If you have a year old Chrome that's still running but is blocked from updating itself, it doesn't do some of its security checks, "Huh," it says to itself, "I am out-of-date" and some checks it would normally require are disabled because it has no way to know what should be checked a year later. This makes it less safe than a brand-new Chrome. But, duh, of course it is, it also doesn't have the last twelve months of security fixes, meaning there are twelve months worth of publicly known security flaws in your browser. Android's choice in this makes a lot of sense. If you get root trust store updates, then you stop trusting old roots and trust new ones instead but if you're no longer getting updates then just do the best you can with what you have.