16 ms·

Android 14 blocks all modification of system certificates, even as root?

329 points by pimterry 3y ago

NoZebra120vClip 3y ago
I'm not sure of the implications here, so, two questions: (1) What effect does this have on user-installed credentials, such as a certificate for OpenVPN? I used to be able to install those myself, with a few taps. They did produce the ominous message about someone monitoring my network activity, of course. (2) Will users still be able to disable CAs in preferences? I routinely go through the list of CAs and disable anything I don't trust, mainly based on country of origin, so China, Russia, Turkey get shut off, et. al. Will this functionality still be available in Android 14?
- pimterry 3y ago
  1. No effect, as far as I can tell. User-installed credentials for other cases are unchanged, this just affects system-managed CA certificates 2. Yes - you can still manually soft-remove CAs through the Settings UI
- redleader55 3y ago
  There are several ways[1] for an Android app to trust a CA: - by default, using the system installed CAs - if specified in the app manifest, it can trust the user installed CAs - included with the app, also in the manifest, it can trust any CA the author of the app decided to trust [1] https://developer.android.com/training/articles/security-config https://developer.android.com/training/articles/security-con...
dvngnt_ 3y ago
the more they move towards apple levels of control, the less reason people have to sick with android.
- shortrounddev2 3y ago
  I use android because I dislike the Apple ecosystem and UI design. They could disable all side-loading of apps and I would still use Android because I just don't use mobile as my primary driver. For me, phones are for texting and browsing Reddit while I shit.
  - diogenes4 3y ago
    Hah, I have exactly the opposite reaction as you: I think Android is a complete mess in terms of usability. The big differentiator, though, is your social network. Having iMessages and FaceTime is about 95% of the value of the phone/tablet for me because my friends heavily, heavily use them.
    - shortrounddev2 3y ago
      I use Line (kind of like a Japanese/Korean whatsapp) to communicate with my wife's family (Wife, sisters in law, mother in law), I use Facebook to communicate with my parents, and I don't have any friends to communicate with on other platforms, so I don't miss iMessage (maybe I don't have friends because I don't have iMessage). Otherwise the apps define most of the UI. Android is basically an app launcher to me.
    - gambiting 3y ago
      I think it's the case of knowing what you know. IOS design language depends a lot on being familiar with iOS already - I think a lot of Android design is dictated to be understandable by people who really haven't used a phone before so things are a bit clearer and more obvious. I know when I use my wife's iPhone it's so frustrating because it feels like you should be able to do action X but there isn't any clear way on how to achieve it - I ask my wife and she shows me that it's hidden behind some invisible menu or gesture and I'm like "how were you supposed to know this???" And she just shrugs "it always worked like this". Ok, I guess, but that's really poor for discoverability.
  - hbn 3y ago
    > I just don't use mobile as my primary driver. For me, phones are for texting and browsing Reddit while I shit. That's the reason I use an iPhone. I don't need a bunch of customization and homescreen tinkering, I just want a thing that gets the job done and is easy to troubleshoot.
- toolz 3y ago
  not sure how typical I am, but I don't buy android for really any other reason than I can get brand new smartphone that does everything I want for under $200 and has multiple sim slots (which makes international travel much easier) At this point apple or anyone else would have to beat the cheap android handily for me to consider switching and that seems like a tough market to beat. I'm always impressed by how well cheap androids work when compared to their 3-4x more expensive counterparts.
  - jackdh 3y ago
    You can pick up second hand ( good condition ) iPhone's for not much more. I would also then argue iPhone's last longer and tend to get more updates for longer than their android counterparts. They can support multiple ESim's now which I've had fantastic experience with when travelling abroad. Apps like Ubigi make it super easy to switch to a local sim.
    - mrguyorama 3y ago
      The problem with used iPhones is that the hardware is still powerful enough to run modern iOS, the battery only has about a year left to live so unless you budget in a battery replacement, you're basically tethered. This may finally be clearing up, but Apple's iPhone batteries from the previous decade were abysmal and had no headroom for aging. That's why they were doing the stupid downclocking of older iPhones, because the battery could no longer deliver the power to run full bore without browning out.
- simiones 3y ago
  Lots of people choose Android entirely unrelated to control - especially as this change apparently only affects users of rooted Android devices, which are an extremely small minority of Android users. Other reasons include price, interop with other non-Apple devices, and just a preference for the usability of Android vs iOS.
- deleted 3y ago
  [deleted]
- CatWChainsaw 3y ago
  But phones are a duopoly for the average person. What would they leave android for?
varispeed 3y ago
Obviously governments can't have an operating system where users can do as they please, e.g. bypassing government mandated MITM certificates so they can spy on citizens. So the groundwork is being prepared for coming things like Online Safety Bill here in the UK, where all communication will likely be under surveillance and so you won't be able to mod your phone to "opt out". It's a shame that such resourceful company like Google bends over to some control-freak right wing governments like we have.
- LocalH 3y ago
  > It's a shame that such resourceful company like Google bends over to some control-freak right wing governments like we have. Why wouldn't they? They obviously see an opportunity to grab even more control over the Internet than they already have.
- surajrmal 3y ago
  It's strange that you jump straight to thinking the government is involved. Moving most system components to be updatable independently of the core os is a good thing. Google should be taking these steps. Not being able to update apex files makes sense as any update will quickly overwrite your changes. This change just moves the bar for modification to be controlling the remote update source. I'm sure it will still be possible to alter that and therefore gain control. This would be similar to how you handle DNS.
- SpaghettiCthulu 3y ago
  Do you consider the Democrats right-wing? How about the CCP? Authoritarian, sure, but there is authoritarianism on both ends of the political spectrum.
  - cumshitpiss 3y ago
    American democrats would be considered right wing in other nations e.g. europe
- jeroenhd 3y ago
  Kazakhstan actually tried a government mandated CA certificate. It's causing constant "you are being watched" notifications on phones that loaded the certificate. Certificate security was increased in Andeoid and other opeeating systemsm exactly because of this threat. Every OS except Android receives regular CA updates, including them various Linuxes. Android devices are still trusting known bad actors like Startcom exactly because there's no way to update just the CA store (and cheap Chinese brands definitely won't release full system updates for this after dropping support a year after the phone came out). You can disable the toggle for every system CA in your phone's settings if you want. That is, unless you think the big bad UK government bugged your phone to hide the CA that's been planted there, but if that's part of your threat model, the government certificate may be hidden on your phone already
ylyn 3y ago
Isn't this just how mounts work? If you have a something mounted to /apex/whatever and each app has a separate mount namespace, then mounting over /apex/whatever in your namespace wouldn't change anything in any other mount namespace. You'd need to either just alter the filesystem directly, or enter the other apps' mount namespaces and mount your tmpfs there too. Shared mounts might be useful here. Not sure. I'd need to take a closer look at what is going on here. But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root.
- pseg134 3y ago
  [flagged]
- pimterry 3y ago
  > But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root. Yes, I think in practice that's true. The end result is still a big problem though! > Isn't this just how mounts work? If you have a something mounted to /apex/whatever and each app has a separate mount namespace, then mounting over /apex/whatever in your namespace wouldn't change anything in any other mount namespace. The latter 'separate mount namespace' here is the surprising bit. Previously, you could open a shell, mount things into the filesystem (or just modify it directly) and apps would happily read files from those mounts. Now, for these cacert files, that's not the case, and additionally with the new approach direct modification is impossible. Before this change, I wasn't even aware that Android apps were using their own mount namespaces! There's very little documentation on exactly how that works and I'm not sure if there's been a case where its been clearly visible until now.
- auveair 3y ago
  > But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root. Technology is very convenient when it's complex enough to find an excuse to fit your business objective (see manifest v3).
curiousgal 3y ago
I mean if they were willing to mess with something that was completely unbroken like the quick access tiles for WiFi/data back in Android 11 (or was it 12?) I wouldn't put it past them to mess with anything else.
kevincox 3y ago
Android isn't really open. In order to have a "certified" device you need to remove user control. For example users by default aren't even allowed to access app's "private" data. That was enough to get me to move to something where I am in control. But if you move away from a "certified" ROM then you start to fail SafetyNet (or its successors) and many apps will refuse to work. Those apps want to make sure that the user isn't in control of their devices, they want to make sure Google or a "trusted party" is. They say this is to ensure the security of your device that logs into your bank or whatever, but I guarantee that my LineageOS updated this week is more secure than my stock Google ROM that got its last update 3 years ago. If Google really wanted to prove security with SafetyNet they would stop attesting devices that haven't been updated. But it isn't about device security, it is about ensuring that the device is controlled by a big corporation, not the user.
- varispeed 3y ago
  This banking apps requirement is laughable if you can manage you bank accounts through the internet browser. I mean there are some banks that only work with an app, but majority of banks in my country work through the browser just fine. That being said, I have a separate phone just for bank apps and turn it on only when I need to use it for banking.
  - zb3 3y ago
    > This banking apps requirement is laughable if you can manage you bank accounts through the internet browser. I mean there are some banks that only work with an app, but majority of banks in my country work through the browser just fine. Well, that's exacly why Google has proposed WEI - to make sure they no longer do, and the user is practically forced to have a device that has bundled Google spyware.
    - Izkata 3y ago
      > WEI Link so people don't need to go looking: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940
bonyt 3y ago
I think android is - and has been - more heavy-handed than Apple here. Even when you could install and trust a new root CA, some apps can and would ignore this. Apps can use certificate pinning on both iOS and Android, but apps by default on Android just ignore user-added CAs by default on Android 7+, since 2016[1]. On iOS, the process of trusting a root CA is (rightfully) tricky, requiring you to install a profile and jump through some hoops with some scary warnings, but in my experience most apps will trust it unless they're using pinning. [1]: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...
- moelf 3y ago
  huh, but on iOS you have apps that can ignore your VPN connection... https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-connection-for-some-services/ https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-co...
  - jeroenhd 3y ago
    The same is true on Android for processes with system capabilities/root, I believe, because they can bind sockets to a specific interface and bypass the VPN you use.
- jeroenhd 3y ago
  I can honestly see why Google did this in Android 7. Android, being much closer to a normal computer than iOS, has a huge stalkerware problem. Stalkerware isn't stopped by prompts, weaponises backwards compatibility, and includes all manner of abuse. On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes. I would love the option to actually trust CA certificates I install (especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings), but I don't think this feature is important enough for the dozens of techies using them day to day considering the risk to every other Android user on the planet. In this case there's no evil Google conspiracy to thwart the plans of your local IT department, this is just a side effect of Google's excellent sandboxing improvement and long overdue CA store update mechanism. I'm sure Magisk modules will appear to work around this problem. The existing Magisk modules will be broken for a while but that's par for the course after major Android updates. I'll write a module myself if I have to.
nottorp 3y ago
This sounds nice for security, hell for some developers but: What happens in 2-3 years when this version of Android is abandoned? You pray the hardcoded certificates will last you a couple more years?
- idiotsecant 3y ago
  Objective achieved : consumer buys new phone.
- arusahni 3y ago
  They're updatable via Google Play starting with 14, so not tied to OS updates.
  - nottorp 3y ago
    But google will abandon this Android version fairly soon as we all know… what Google Play updates in 6 years?
    - arusahni 3y ago
      Google already guarantees Pixel security updates for 5 years, so I'd say that's at least the baseline. When Google removed Play Services support for the 4.x series they were 9 years old at that point.
      - nottorp 3y ago
        Google and guarantees in the same sentence? https://arstechnica.com/gadgets/2023/08/google-kills-two-year-pixel-pass-subscription-after-just-22-months/ https://arstechnica.com/gadgets/2023/08/google-kills-two-yea... Random example that even has pixel in it. Not to mention the other randomly canceled services.
        arusahni 3y ago
        /shrug you do you.
chc4 3y ago
I mean, you still have root and APEX packages aren't doing anything tricky specifically to stymie modifications - they're just mounted file systems. You're still going to be able to modify system certificates, it's just going to be less convenient and need something more than dropping a single file to a folder. Hell, the code is even still falling back to the old file system path if the APEX mount doesn't exist, so you could just delete the entire module and go back to the old method.
- pimterry 3y ago
  > Hell, the code is even still falling back to the old file system path if the APEX mount doesn't exist, so you could just delete the entire module and go back to the old method. That's covered in the article - no, you can't do this. If you entirely unmount the apex module from the filesystem from a root shell, so the CA certificates aren't visible anywhere on the filesystem, apps will still read them successfully. And the OS blocks RW mounting of APEX modules so you can't delete the cacerts directory within the module either. It looks like apps have separate namespaced mounts, managed by the OS itself from boot. Effectively they're containerized, and as part of launching all applications the OS is mounting the certs directly into the process's view of the world. If you can find a way to modify the filesystem the apps see from a root shell, that would be great! I'd love to hear about it. But believe me that I've tried quite a few of the obvious things already.
  - chc4 3y ago
    APEX namespace membership is managed by the ld.txt config file for the dynamic linker, iirc. You can probably just remove the com.android.conscrypt line, or remove the entire conscrypt APEX package from the system and unpack the libs into /system/lib64 instead. Or patch the linker not check APEX signatures, and repack it without the CA folder. Or unmount the conscrypt APEX mount and replace it with a FUSE mount that proxies everything else the CA folder. Or...a bunch of different other methods.
phh 3y ago
As an author of an old root for Android, and of a modern generic custom ROMs, and other Android OS stuff: The title is, and forever will be wrong. When we say you're root in Android, you're actually root. You can actually do whatever you want [1]. Magisk (the now modern "root" for Android) now includes stuff to even "edit" Java code, so even if it's hidden deep somewhere, you should still be able to access it. (Even if somehow it moves from Java to native code, we'll still find ways, don't worry) The fact that the author didn't manage to do it doesn't mean it's not possible. I could guess what's the author issue (I have two ideas in mind: 1. it requires stop;start to restart zygote, because zygote cached CAs, 2. it needs to switch to correct mount namespace before doing the commands), but I won't try it, I got tired of working on closed-source Android stuff. > More investigation is required and it's hard to know the full implications of that now, but for the many forks of Android like GrapheneOS & LineageOS, and for advanced device configuration tools like Magisk and its many modules, it probably spells trouble. I just don't understand this. GrapheneOS and LineageOS team have full source-code access. They can do whatever they please with it. (The limitation being that Google breaks stuff at an incredible rate, and following is a bit annoying) Anyway, I hope that Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to custom ROMs. (In my dreams I make a "OwnerDroid", an Android fork where the security model doesn't have the first line saying "the user is an enemy", but even though I developed some tiny bricks of it, the overall project would take a huge amount of work) [1] Except for some kernel-level protections, but GKI reduces that risk.
- DistractionRect 3y ago
  Armchairing here, but from a quick gloss over the article it seems like it should be quite easy to stub out: > this new approach reads certificates from /apex/com.android.conscrypt/cacerts, when it exists. Much like the how the current work arounds for safetynet, hiding root, and hiding magisk work, it should be possible to hide /apex/com.android.conscrypt/cacerts from select processes as needed to make it fail over to the old way.
- pimterry 3y ago
  The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools. Now, you can't do that. Of course, with full source code access anything is _possible_. You can absolutely build your own Android system images from scratch disabling all these modules to work around this, and it's certainly possible for GrapheneOS/LineageOS to handle that too - but it will create a bunch of new work, and diverging from Android's implementations of core components may mean more work in future. And for most affected users "first, build your own system image" is significantly beyond their comfort zone and level of time commitment. There will be other solutions eventually - it may be possible by digging through the namespacing and modifying the mounts of target processes individually to disable this, or there might be a way to somehow build & install your own APEX modules in a way that Android will trust, to replace the system module and thereby modify this directory, or who knows what else. There will certainly be per-process fixes possible with Frida, with hooks targeted to individual applications. More ideas welcome too :-D Despite all that though, it's still going to be a major problem that makes it harder for users to fully control their own devices.
g1a55er 3y ago
Isn’t it well known in the Android modding community how to replace and make custom APEXs? E.g. XDA has some good documentation. That seems like the right way to solve this problem. [1] https://www.xda-developers.com/android-q-apex-biggest-thing-since-project-treble/ https://www.xda-developers.com/android-q-apex-biggest-thing-... [2] https://www.xda-developers.com/android-10-custom-boot-animations/ https://www.xda-developers.com/android-10-custom-boot-animat...
ZeWaren 3y ago
I have a private PKI I use to connect to my self-hosted software: email server, calendar provider, notes server, photo sync tool, etc. I NEED to be able to add my root cert to the list of certified authorities. I don't need to change anything to the system provided list. I just need to add mine. It's my device, I'd like to be able to change anything if I want to.
- gh02t 3y ago
  Same for me, but don't a lot of corporate IT policies deploy root certificates to devices too? You'd think there has to be a way to do it.
  - jeroenhd 3y ago
    User certificates still work fine. Apps have to opt into the user CA store (many of them don't) but any app deployed by IT should be fine. Chrome works, Firefox can be made to work, and I believe the Gmail app also works with user CA certificates.
    - gh02t 3y ago
      Thanks for the clarification, I was pretty confused by the article on this detail myself. Per app opt seems like a reasonable compromise for my use as long as the browser recognizes my CA, as that's the one I care about.
      - jeroenhd 3y ago
        The biggest issue is that the developer needs to opt in, the user can't decide "my email client should trust this certificate".
- severino 3y ago
  I was also confused about that. I don't use an Android phone currently, but I remember you could add your own CA certificates to an Android phone -without being root, just using some option under settings- and at least applications like the web browser would trust them. And I'm not talking about long ago. So I couldn't understand if the need of rooting your device to install custom certificates was for something different.
jchw 3y ago
I'm daily driving a Pinephone Pro. Interesting note out there: Chase.com tries really, really, really hard to block you from using non-standard browsers (like Librewolf) as well as phone/tablet browsers (it will try to force you to use the mobile application.) At least until WEI becomes mandatory, this isn't really a serious problem, since these braindead measures are all easily bypassed. However, I am interested if there is any potential legal avenue to pursue given that Chase is a bank. My first guess would be ADA compliance, but I'm not sure. At this point, I'm so fed up that I am not sure if it is an empty threat anymore to say that I'm interested in filing lawsuits over this. (I realize this is a tangent, but it's relevant because it underscores yet another facet of how leaving the oligopoly of mobile phone operating systems is damn near impossible. Android will just keep getting worse, probably even if the Linux phone niche miraculously grows to a couple percentage points; we need something.)
- horsawlarway 3y ago
  Dark ages are a-coming. Seriously. We are going to have an age of digital serfdom. You will use a device provided to you by some "benevolent" corporation. They will own every aspect of that device and you will only be allowed to drive it if you give them money (pay your access fee today!). They will lock down most other avenues, general computing will be reserved for "corporate" use only, and while there will be a "free web", it will be fairly technical and user hostile, and the vast majority of marketplaces (ex: anything that touches money) will avoid it like the plague.
  - jchw 3y ago
    None of us individually can fix the problem we're faced with, but I'll tell you what we can do: Be the biggest possible pains in the ass about it, and that's exactly what I intend to do. I'm planning on digging my heels as deep as they go and just causing as much trouble for everyone. Believe me, if my browser gets blocked based on user agent, the owners will hear about it. I will bypass it. (I am bypassing it in many cases.) If you try to push me to a mobile app, I'm either going to find a way to use your website, or I'm taking my business elsewhere at basically any cost necessary. For me, the end of the open web is scorched earth. I intend to gain approximately nothing from this, and I don't care.
GenericDev 3y ago
I'm so sick of this. I don't feel like I own my devices anymore.
- deleted 3y ago
  [deleted]
- exabrial 3y ago
  Don't worry, you don't. Just wait until they lobby and make it illegal do to do so! This will come under one of the following guises: 1. Save The Children 2. Save The Planet 3. Save the Tax revenue 4. Anti-Terrorism
- jeroenhd 3y ago
  Why not buy a phone with known good LineageOS support if you're afraid Google may update your phone? You can audit and compile the entire OS yourself and disable any CA certificates you may dislike.
  - GenericDev 3y ago
    Or. Hear me out. Why don't these companies actually give me back the ability to control my devices? Why is the onus on me? Why don't these fuckers do the right thing. So tired of this what-aboutism bullshit.
    - jeroenhd 3y ago
      You're buying their phones, not the phones of companies that give you full control. Most customers care more about not having to wonder about security than about having the ability to flash a new kernel. Show companies that there's money to be made by buying devices to your liking or you'll be subject to design decisions made for the vast majority of customers. Why should companies care about your specific wishes over everyone else's if you're not putting your money where your mouth is? They exist to make money, they're no government or charity. Everybody has been screaming at Google about how Google can't keep Android up to date since Android 2.1 launched. The geneewl comsensus is that if you wqnt updates and security, you need to buy an iPhone. They're finally fixing this problem but every step along the way the percentage of a percentage complains that they're the victim of Google's conspiracy.
bitsandboots 3y ago
So many good comments here, but I keep thinking about how thankful I am that PCs don't work like smartphones, and it's sad it's regressed to this point. Android has so thoroughly defeated itself, that I feel crazy to say I'm thankful that microsoft doesn't run the PC world like google runs the smartphone world. Windows itself is a bastion of stability and sanity compared to android. Things do not need to be upgraded prior to the hardware actually breaking of old age. Beyond that, just like google, microsoft doesnt control the entire hardware-software pipeline. But just like google, microsoft is in a place of power where they could have made it incredibly inconvenient to own your PC, by dictating norms through a store, or discouraging any deviation of environment by safetynet. My memory is bad here, but did this sort of thing ever end in antitrust lawsuits for microsoft in the past? And, when can we look forward to the same for google?
- jeroenhd 3y ago
  Windows has had regular CA updates for about two decade now. If anything, Android works more like Windows at this point. Microsoft has also added tons of DRM to Windows (which they later broke). Remote attestation is built into the OS as well. Google has inconvenienced Android developers by altering the Android internals you weren't supposed to rely on anyway; Microsoft does this all the time as well. We may need to wait a few weeks for an updated Magisk module. Honestly, it's really notm that bad. Just don't click the update button on the five or six devices that will receive Android 14 before then.
- vetinari 3y ago
  Microsoft tried, they just failed. For now. They are still trying. Windows 11 requires TPM and Secure Boot.
  - sumuyuda 3y ago
    I think they were successful in obsoleting a huge amount of functioning computers, forcing my people to buy new hardware to run Windows 11.
    - 3y ago
Brian_K_White 3y ago
And recently there were discussions about browsers disallowing self-signed certs, even for local host, and going https-only, and the supposed excuse is you can edit your local root store. Well now what?
bitsandboots 3y ago
Every android release I see things removed, and inconsequential things added. It seems like iOS has been doing the opposite, such that slowly they may meet in the middle, and then iOS exceed android in every way. Apple folk, can I get an honest opinion here: I've been using macOS lately and I hate it because it fails at really basic user experience things that've been common on windows/linux for decades. Like finder, it's just the worst. If I were to get an iphone next generation instead of an android, would I have the same negative reaction to iOS? Would you say that iOS is a more complete, useful UX than macOS, for the smartphone use case? I think I want to make the jump, but I also don't want to waste my time/money.
- mardifoufs 3y ago
  Yes and when the Appstore restriction is removed and sideloading apps becomes trivial, I literally can't think of a single thing android would have over iOS. It's such a shame since android used to be much more than just iOS but with .apk.
- atlas_hugged 3y ago
  They have a return policy. Give it a shot with a prepaid carrier like Mint.
- Given_47 3y ago
  I don’t use my iPhone for much more than for scrolling hn during breakfast, portable audio player, looking random things up if I’m on the go, and making calls. It’s fine for that. But the user is so restricted (u can look into jailbreaking), I try to use my phone the bare min and use my desktop for everything. For context this is also someone in the midst of dumping macOS for Linux as well
exabrial 3y ago
We really need a third operating system for phones.
- bitsandboots 3y ago
  We had them. Nobody bought them and here's what we got. BB10, WebOS, Windows Phone
  - exabrial 3y ago
    I _really really_ enjoyed WebOS but it gambled way too hard on "Web Only" for the time period, and didn't really learn the lesson from Apple's attempt at the same thing. I only gave my device up after the screen broke. And damn, that hardware keyboard layout was fire.
  - wiseowise 3y ago
    Firefox OS.
- Hackbraten 3y ago
  There is: https://pureos.net https://pureos.net
  - CatWChainsaw 3y ago
    Do they have any relation with Purism?
    - Hackbraten 3y ago
      It does: > PureOS is developed by paid and volunteer members of the Purism community, and benefits from the work of its extended communities and projects.
      - CatWChainsaw 3y ago
        I see. It does make me a little concerned, given the Librem drama.
CSDude 3y ago
HTTP Toolkit was very helpful for me to extract hidden APIs from crappy EV charging apps in Turkey, combined with Frida to prevent SSL pinning and root detection. Then I realized, the reason they try to hide is maybe those APIs are abomination /s
MishaalRahman 3y ago
Left a reply to the author on Twitter, but putting it here as well in case they didn't see it. Hi! I'm the guy who wrote the blog post about updatable certs in Android 14 that your article linked. Not sure if you're aware, but there's actually a system property you can set to bypass reading from the APEX cert directory. system.certs.enabled=true From: https://android-review.googlesource.com/c/platform/frameworks/base/+/2423168 https://android-review.googlesource.com/c/platform/framework...
- pimterry 3y ago
  I don't think that helps much unfortunately. That's a java.lang.System property (i.e. a config value set within one JVM/app) as opposed to an android.os.SystemProperties OS property (globally configurable on the device via adb). Reconfiguring the former requires modifying the app itself AFAICT. That's useful for automated testing (which appears to be why they've added it) or for toggling settings between debug/prod builds, but not so much if you want to globally trust a CA certificate on your device. Of course, if you know a way to externally set such a property so that it applies to every app, that would indeed work great, and I'd love to hear about it! (I'm the author btw, and I don't see any such reply on Twitter? Classic 2023 Twitter ofc)
  - MishaalRahman 3y ago
    Finally had a chance to test it, and you're right. It's not a property that can be set via "setprop", unfortunately.
t0bia_s 3y ago
How green and sustainable this approach from Google exactly is when it makes forks like LineageOS harder to maintain? LineageOS is only way how to keep many devices up to date by security patches. Ability to have newer version of Android is just a bonus... or... uh wait.
keyme 3y ago
People here just love their locked bootloaders for some reason. But once you free yourself of this silliness, and root all your devices after unboxing, you'll be good for yet a few more years. Of course it'll only keep being this easy temporarily. Here's a scene from 2026 for your imaginative pleasure: Door: You need to scan your COVID25 vaccine QR code to open this door. QR App: This app will only run on a HW attested device ------ Shopkeeper: We only accept WhatsApp pay at this store. Payment App: This app will only run on a HW attested device ------ Your friend: We can only talk on this one messaging app that everybody uses. Messaging app: This app will only run on a HW attested device. Oh, but we promise that this encrypted blob of executable code that you can't disable is here just to ensure the safety of your E2E encryption. ------ Your custom ROM rooted Android 18 phone: Running a secure messaging app that was banned from the Play Store and has only like 2 other active users in the world. The police: Papers please. Phone touches the scanner. Scanner beeps and turns red. The law: You have violated the Digital Safety Act. Daily driving a non-licensed general purpose computer is illegal as this may endanger "our children". The law: You have violated the Public Health and Safety Act. Daily driving a non-licensed general purpose computer is illegal as this may be used to circumvent your quarantine and vaccination control status checks. ------ I can go on and on. I think you get the gist of it. Once we have HW attestation fully figured out, these laws will come. Cash will go away. Your agency will go away. Etc. ... And the punchline of the ghost story? The guys coding this stuff up? They're here with us reading this thread. Commenting about the virtues of locked bootloaders for your security.
- hnav 3y ago
  Googlers are adding attestation to web standards so you can't use escape through the browser. To be fair, Google stands to benefit from this and they get paid in Google so the incentives line up.
  - smoldesu 3y ago
    Everyone with two motes of influence over the browser market wants to do this: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... It's bad. It's especially bad on platforms where you don't get to choose which browser you run, but we should protest it everywhere.
maven29 3y ago
Say hi to ebpf, now shipping with android kernels.
1vuio0pswjnm7 3y ago
Where are the diffs of Android 13 against 14. Isn't this an "open source" project. If Google actively prevents "rollback" to a previous version, then how does a computer owner try out the new version. Once installed, there is no going back. Even if the owner discovers the new version is unsuitable. It's Amazon with no returns. A new car without a test drive. Reading source changes might be an easier way to review the new version than running it in an emulator and trying to figure out what changed. Is it not possible.
benmmurphy 3y ago
There are much more reliable ways to intercept traffic than messing with the root certificates. I believe corellium has a more solid strategy where they modify the TLS library to accept certs signed from their proxy and then the certificate from the origin server is passed through as an extension on the proxy certificate.
sansnom 3y ago
It's a very good news for security and also for 99.99% of the Android users. But get me wrong, it would be nice to support power user, they just need to add a feature to easily add a chosen CA and it would be perfect. Currently CA management was very dangerous because it was not updated (as stated in the article). New CA were not added so if you kept your phone long enough you would see insecure warning popping up. People would take the habits of accepting without thinking: very problematic behaviour. One solution is to used Firefox which doesn't use the system CA unlike Chrome. Another more problematic one: untrusted CA were not removed (the author give the example of TrustCor but they were other examples in the past like DigiNotar). Who knows what happens to private key of old untrusted CA ? If they end up in the wrong hands people could get MITM. (Personally, I had to remove DigiNotar for my old phone.) And of course as the author said: it's also problematic for new certificate authority like Let's Encrypt which at a time needed the complex cross sign certificate to ensure the certificates work for everyone. [1][2] [1] https://letsencrypt.org/2020/11/06/own-two-feet.html https://letsencrypt.org/2020/11/06/own-two-feet.html [2] https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html https://letsencrypt.org/2020/09/17/new-root-and-intermediate...

329 points by pimterry 3y ago

I'm not sure of the implications here, so, two questions: (1) What effect does this have on user-installed credentials, such as a certificate for OpenVPN? I used to be able to install those myself, with a few taps. They did produce the ominous message about someone monitoring my network activity, of course. (2) Will users still be able to disable CAs in preferences? I routinely go through the list of CAs and disable anything I don't trust, mainly based on country of origin, so China, Russia, Turkey get shut off, et. al. Will this functionality still be available in Android 14?

pimterry 3y ago
1. No effect, as far as I can tell. User-installed credentials for other cases are unchanged, this just affects system-managed CA certificates 2. Yes - you can still manually soft-remove CAs through the Settings UI
redleader55 3y ago
There are several ways[1] for an Android app to trust a CA: - by default, using the system installed CAs - if specified in the app manifest, it can trust the user installed CAs - included with the app, also in the manifest, it can trust any CA the author of the app decided to trust [1] https://developer.android.com/training/articles/security-config https://developer.android.com/training/articles/security-con...

dvngnt_ 3y ago

the more they move towards apple levels of control, the less reason people have to sick with android.

shortrounddev2 3y ago
I use android because I dislike the Apple ecosystem and UI design. They could disable all side-loading of apps and I would still use Android because I just don't use mobile as my primary driver. For me, phones are for texting and browsing Reddit while I shit.
- diogenes4 3y ago
  Hah, I have exactly the opposite reaction as you: I think Android is a complete mess in terms of usability. The big differentiator, though, is your social network. Having iMessages and FaceTime is about 95% of the value of the phone/tablet for me because my friends heavily, heavily use them.
  - shortrounddev2 3y ago
    I use Line (kind of like a Japanese/Korean whatsapp) to communicate with my wife's family (Wife, sisters in law, mother in law), I use Facebook to communicate with my parents, and I don't have any friends to communicate with on other platforms, so I don't miss iMessage (maybe I don't have friends because I don't have iMessage). Otherwise the apps define most of the UI. Android is basically an app launcher to me.
  - gambiting 3y ago
    I think it's the case of knowing what you know. IOS design language depends a lot on being familiar with iOS already - I think a lot of Android design is dictated to be understandable by people who really haven't used a phone before so things are a bit clearer and more obvious. I know when I use my wife's iPhone it's so frustrating because it feels like you should be able to do action X but there isn't any clear way on how to achieve it - I ask my wife and she shows me that it's hidden behind some invisible menu or gesture and I'm like "how were you supposed to know this???" And she just shrugs "it always worked like this". Ok, I guess, but that's really poor for discoverability.
- hbn 3y ago
  > I just don't use mobile as my primary driver. For me, phones are for texting and browsing Reddit while I shit. That's the reason I use an iPhone. I don't need a bunch of customization and homescreen tinkering, I just want a thing that gets the job done and is easy to troubleshoot.
toolz 3y ago
not sure how typical I am, but I don't buy android for really any other reason than I can get brand new smartphone that does everything I want for under $200 and has multiple sim slots (which makes international travel much easier) At this point apple or anyone else would have to beat the cheap android handily for me to consider switching and that seems like a tough market to beat. I'm always impressed by how well cheap androids work when compared to their 3-4x more expensive counterparts.
- jackdh 3y ago
  You can pick up second hand ( good condition ) iPhone's for not much more. I would also then argue iPhone's last longer and tend to get more updates for longer than their android counterparts. They can support multiple ESim's now which I've had fantastic experience with when travelling abroad. Apps like Ubigi make it super easy to switch to a local sim.
  - mrguyorama 3y ago
    The problem with used iPhones is that the hardware is still powerful enough to run modern iOS, the battery only has about a year left to live so unless you budget in a battery replacement, you're basically tethered. This may finally be clearing up, but Apple's iPhone batteries from the previous decade were abysmal and had no headroom for aging. That's why they were doing the stupid downclocking of older iPhones, because the battery could no longer deliver the power to run full bore without browning out.
simiones 3y ago
Lots of people choose Android entirely unrelated to control - especially as this change apparently only affects users of rooted Android devices, which are an extremely small minority of Android users. Other reasons include price, interop with other non-Apple devices, and just a preference for the usability of Android vs iOS.
deleted 3y ago
[deleted]
CatWChainsaw 3y ago
But phones are a duopoly for the average person. What would they leave android for?

varispeed 3y ago

Obviously governments can't have an operating system where users can do as they please, e.g. bypassing government mandated MITM certificates so they can spy on citizens. So the groundwork is being prepared for coming things like Online Safety Bill here in the UK, where all communication will likely be under surveillance and so you won't be able to mod your phone to "opt out". It's a shame that such resourceful company like Google bends over to some control-freak right wing governments like we have.

LocalH 3y ago
> It's a shame that such resourceful company like Google bends over to some control-freak right wing governments like we have. Why wouldn't they? They obviously see an opportunity to grab even more control over the Internet than they already have.
surajrmal 3y ago
It's strange that you jump straight to thinking the government is involved. Moving most system components to be updatable independently of the core os is a good thing. Google should be taking these steps. Not being able to update apex files makes sense as any update will quickly overwrite your changes. This change just moves the bar for modification to be controlling the remote update source. I'm sure it will still be possible to alter that and therefore gain control. This would be similar to how you handle DNS.
SpaghettiCthulu 3y ago
Do you consider the Democrats right-wing? How about the CCP? Authoritarian, sure, but there is authoritarianism on both ends of the political spectrum.
- cumshitpiss 3y ago
  American democrats would be considered right wing in other nations e.g. europe
jeroenhd 3y ago
Kazakhstan actually tried a government mandated CA certificate. It's causing constant "you are being watched" notifications on phones that loaded the certificate. Certificate security was increased in Andeoid and other opeeating systemsm exactly because of this threat. Every OS except Android receives regular CA updates, including them various Linuxes. Android devices are still trusting known bad actors like Startcom exactly because there's no way to update just the CA store (and cheap Chinese brands definitely won't release full system updates for this after dropping support a year after the phone came out). You can disable the toggle for every system CA in your phone's settings if you want. That is, unless you think the big bad UK government bugged your phone to hide the CA that's been planted there, but if that's part of your threat model, the government certificate may be hidden on your phone already

ylyn 3y ago

Isn't this just how mounts work? If you have a something mounted to /apex/whatever and each app has a separate mount namespace, then mounting over /apex/whatever in your namespace wouldn't change anything in any other mount namespace. You'd need to either just alter the filesystem directly, or enter the other apps' mount namespaces and mount your tmpfs there too. Shared mounts might be useful here. Not sure. I'd need to take a closer look at what is going on here. But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root.

pseg134 3y ago
[flagged]
pimterry 3y ago
> But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root. Yes, I think in practice that's true. The end result is still a big problem though! > Isn't this just how mounts work? If you have a something mounted to /apex/whatever and each app has a separate mount namespace, then mounting over /apex/whatever in your namespace wouldn't change anything in any other mount namespace. The latter 'separate mount namespace' here is the surprising bit. Previously, you could open a shell, mount things into the filesystem (or just modify it directly) and apps would happily read files from those mounts. Now, for these cacert files, that's not the case, and additionally with the new approach direct modification is impossible. Before this change, I wasn't even aware that Android apps were using their own mount namespaces! There's very little documentation on exactly how that works and I'm not sure if there's been a case where its been clearly visible until now.
auveair 3y ago
> But I would say this result is probably a byproduct of whatever namespacing/containerisation Google is doing, rather than an intentional effort to prevent users from changing the root CAs even as root. Technology is very convenient when it's complex enough to find an excuse to fit your business objective (see manifest v3).

curiousgal 3y ago

I mean if they were willing to mess with something that was completely unbroken like the quick access tiles for WiFi/data back in Android 11 (or was it 12?) I wouldn't put it past them to mess with anything else.

kevincox 3y ago

Android isn't really open. In order to have a "certified" device you need to remove user control. For example users by default aren't even allowed to access app's "private" data. That was enough to get me to move to something where I am in control. But if you move away from a "certified" ROM then you start to fail SafetyNet (or its successors) and many apps will refuse to work. Those apps want to make sure that the user isn't in control of their devices, they want to make sure Google or a "trusted party" is. They say this is to ensure the security of your device that logs into your bank or whatever, but I guarantee that my LineageOS updated this week is more secure than my stock Google ROM that got its last update 3 years ago. If Google really wanted to prove security with SafetyNet they would stop attesting devices that haven't been updated. But it isn't about device security, it is about ensuring that the device is controlled by a big corporation, not the user.

varispeed 3y ago
This banking apps requirement is laughable if you can manage you bank accounts through the internet browser. I mean there are some banks that only work with an app, but majority of banks in my country work through the browser just fine. That being said, I have a separate phone just for bank apps and turn it on only when I need to use it for banking.
- zb3 3y ago
  > This banking apps requirement is laughable if you can manage you bank accounts through the internet browser. I mean there are some banks that only work with an app, but majority of banks in my country work through the browser just fine. Well, that's exacly why Google has proposed WEI - to make sure they no longer do, and the user is practically forced to have a device that has bundled Google spyware.
  - Izkata 3y ago
    > WEI Link so people don't need to go looking: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940

bonyt 3y ago

I think android is - and has been - more heavy-handed than Apple here. Even when you could install and trust a new root CA, some apps can and would ignore this. Apps can use certificate pinning on both iOS and Android, but apps by default on Android just ignore user-added CAs by default on Android 7+, since 2016[1]. On iOS, the process of trusting a root CA is (rightfully) tricky, requiring you to install a profile and jump through some hoops with some scary warnings, but in my experience most apps will trust it unless they're using pinning. [1]: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...

moelf 3y ago
huh, but on iOS you have apps that can ignore your VPN connection... https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-connection-for-some-services/ https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-co...
- jeroenhd 3y ago
  The same is true on Android for processes with system capabilities/root, I believe, because they can bind sockets to a specific interface and bypass the VPN you use.
jeroenhd 3y ago
I can honestly see why Google did this in Android 7. Android, being much closer to a normal computer than iOS, has a huge stalkerware problem. Stalkerware isn't stopped by prompts, weaponises backwards compatibility, and includes all manner of abuse. On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes. I would love the option to actually trust CA certificates I install (especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings), but I don't think this feature is important enough for the dozens of techies using them day to day considering the risk to every other Android user on the planet. In this case there's no evil Google conspiracy to thwart the plans of your local IT department, this is just a side effect of Google's excellent sandboxing improvement and long overdue CA store update mechanism. I'm sure Magisk modules will appear to work around this problem. The existing Magisk modules will be broken for a while but that's par for the course after major Android updates. I'll write a module myself if I have to.

nottorp 3y ago

This sounds nice for security, hell for some developers but: What happens in 2-3 years when this version of Android is abandoned? You pray the hardcoded certificates will last you a couple more years?

idiotsecant 3y ago
Objective achieved : consumer buys new phone.
arusahni 3y ago
They're updatable via Google Play starting with 14, so not tied to OS updates.
- nottorp 3y ago
  But google will abandon this Android version fairly soon as we all know… what Google Play updates in 6 years?
  - arusahni 3y ago
    Google already guarantees Pixel security updates for 5 years, so I'd say that's at least the baseline. When Google removed Play Services support for the 4.x series they were 9 years old at that point.
    - nottorp 3y ago
      Google and guarantees in the same sentence? https://arstechnica.com/gadgets/2023/08/google-kills-two-year-pixel-pass-subscription-after-just-22-months/ https://arstechnica.com/gadgets/2023/08/google-kills-two-yea... Random example that even has pixel in it. Not to mention the other randomly canceled services.
      - arusahni 3y ago
        /shrug you do you.

chc4 3y ago

I mean, you still have root and APEX packages aren't doing anything tricky specifically to stymie modifications - they're just mounted file systems. You're still going to be able to modify system certificates, it's just going to be less convenient and need something more than dropping a single file to a folder. Hell, the code is even still falling back to the old file system path if the APEX mount doesn't exist, so you could just delete the entire module and go back to the old method.

pimterry 3y ago
> Hell, the code is even still falling back to the old file system path if the APEX mount doesn't exist, so you could just delete the entire module and go back to the old method. That's covered in the article - no, you can't do this. If you entirely unmount the apex module from the filesystem from a root shell, so the CA certificates aren't visible anywhere on the filesystem, apps will still read them successfully. And the OS blocks RW mounting of APEX modules so you can't delete the cacerts directory within the module either. It looks like apps have separate namespaced mounts, managed by the OS itself from boot. Effectively they're containerized, and as part of launching all applications the OS is mounting the certs directly into the process's view of the world. If you can find a way to modify the filesystem the apps see from a root shell, that would be great! I'd love to hear about it. But believe me that I've tried quite a few of the obvious things already.
- chc4 3y ago
  APEX namespace membership is managed by the ld.txt config file for the dynamic linker, iirc. You can probably just remove the com.android.conscrypt line, or remove the entire conscrypt APEX package from the system and unpack the libs into /system/lib64 instead. Or patch the linker not check APEX signatures, and repack it without the CA folder. Or unmount the conscrypt APEX mount and replace it with a FUSE mount that proxies everything else the CA folder. Or...a bunch of different other methods.

phh 3y ago

As an author of an old root for Android, and of a modern generic custom ROMs, and other Android OS stuff: The title is, and forever will be wrong. When we say you're root in Android, you're actually root. You can actually do whatever you want [1]. Magisk (the now modern "root" for Android) now includes stuff to even "edit" Java code, so even if it's hidden deep somewhere, you should still be able to access it. (Even if somehow it moves from Java to native code, we'll still find ways, don't worry) The fact that the author didn't manage to do it doesn't mean it's not possible. I could guess what's the author issue (I have two ideas in mind: 1. it requires stop;start to restart zygote, because zygote cached CAs, 2. it needs to switch to correct mount namespace before doing the commands), but I won't try it, I got tired of working on closed-source Android stuff. > More investigation is required and it's hard to know the full implications of that now, but for the many forks of Android like GrapheneOS & LineageOS, and for advanced device configuration tools like Magisk and its many modules, it probably spells trouble. I just don't understand this. GrapheneOS and LineageOS team have full source-code access. They can do whatever they please with it. (The limitation being that Google breaks stuff at an incredible rate, and following is a bit annoying) Anyway, I hope that Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to custom ROMs. (In my dreams I make a "OwnerDroid", an Android fork where the security model doesn't have the first line saying "the user is an enemy", but even though I developed some tiny bricks of it, the overall project would take a huge amount of work) [1] Except for some kernel-level protections, but GKI reduces that risk.

DistractionRect 3y ago
Armchairing here, but from a quick gloss over the article it seems like it should be quite easy to stub out: > this new approach reads certificates from /apex/com.android.conscrypt/cacerts, when it exists. Much like the how the current work arounds for safetynet, hiding root, and hiding magisk work, it should be possible to hide /apex/com.android.conscrypt/cacerts from select processes as needed to make it fail over to the old way.
pimterry 3y ago
The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools. Now, you can't do that. Of course, with full source code access anything is _possible_. You can absolutely build your own Android system images from scratch disabling all these modules to work around this, and it's certainly possible for GrapheneOS/LineageOS to handle that too - but it will create a bunch of new work, and diverging from Android's implementations of core components may mean more work in future. And for most affected users "first, build your own system image" is significantly beyond their comfort zone and level of time commitment. There will be other solutions eventually - it may be possible by digging through the namespacing and modifying the mounts of target processes individually to disable this, or there might be a way to somehow build & install your own APEX modules in a way that Android will trust, to replace the system module and thereby modify this directory, or who knows what else. There will certainly be per-process fixes possible with Frida, with hooks targeted to individual applications. More ideas welcome too :-D Despite all that though, it's still going to be a major problem that makes it harder for users to fully control their own devices.

g1a55er 3y ago

Isn’t it well known in the Android modding community how to replace and make custom APEXs? E.g. XDA has some good documentation. That seems like the right way to solve this problem. [1] https://www.xda-developers.com/android-q-apex-biggest-thing-since-project-treble/ https://www.xda-developers.com/android-q-apex-biggest-thing-... [2] https://www.xda-developers.com/android-10-custom-boot-animations/ https://www.xda-developers.com/android-10-custom-boot-animat...

ZeWaren 3y ago

I have a private PKI I use to connect to my self-hosted software: email server, calendar provider, notes server, photo sync tool, etc. I NEED to be able to add my root cert to the list of certified authorities. I don't need to change anything to the system provided list. I just need to add mine. It's my device, I'd like to be able to change anything if I want to.

gh02t 3y ago
Same for me, but don't a lot of corporate IT policies deploy root certificates to devices too? You'd think there has to be a way to do it.
- jeroenhd 3y ago
  User certificates still work fine. Apps have to opt into the user CA store (many of them don't) but any app deployed by IT should be fine. Chrome works, Firefox can be made to work, and I believe the Gmail app also works with user CA certificates.
  - gh02t 3y ago
    Thanks for the clarification, I was pretty confused by the article on this detail myself. Per app opt seems like a reasonable compromise for my use as long as the browser recognizes my CA, as that's the one I care about.
    - jeroenhd 3y ago
      The biggest issue is that the developer needs to opt in, the user can't decide "my email client should trust this certificate".
severino 3y ago
I was also confused about that. I don't use an Android phone currently, but I remember you could add your own CA certificates to an Android phone -without being root, just using some option under settings- and at least applications like the web browser would trust them. And I'm not talking about long ago. So I couldn't understand if the need of rooting your device to install custom certificates was for something different.

jchw 3y ago

I'm daily driving a Pinephone Pro. Interesting note out there: Chase.com tries really, really, really hard to block you from using non-standard browsers (like Librewolf) as well as phone/tablet browsers (it will try to force you to use the mobile application.) At least until WEI becomes mandatory, this isn't really a serious problem, since these braindead measures are all easily bypassed. However, I am interested if there is any potential legal avenue to pursue given that Chase is a bank. My first guess would be ADA compliance, but I'm not sure. At this point, I'm so fed up that I am not sure if it is an empty threat anymore to say that I'm interested in filing lawsuits over this. (I realize this is a tangent, but it's relevant because it underscores yet another facet of how leaving the oligopoly of mobile phone operating systems is damn near impossible. Android will just keep getting worse, probably even if the Linux phone niche miraculously grows to a couple percentage points; we need something.)

horsawlarway 3y ago
Dark ages are a-coming. Seriously. We are going to have an age of digital serfdom. You will use a device provided to you by some "benevolent" corporation. They will own every aspect of that device and you will only be allowed to drive it if you give them money (pay your access fee today!). They will lock down most other avenues, general computing will be reserved for "corporate" use only, and while there will be a "free web", it will be fairly technical and user hostile, and the vast majority of marketplaces (ex: anything that touches money) will avoid it like the plague.
- jchw 3y ago
  None of us individually can fix the problem we're faced with, but I'll tell you what we can do: Be the biggest possible pains in the ass about it, and that's exactly what I intend to do. I'm planning on digging my heels as deep as they go and just causing as much trouble for everyone. Believe me, if my browser gets blocked based on user agent, the owners will hear about it. I will bypass it. (I am bypassing it in many cases.) If you try to push me to a mobile app, I'm either going to find a way to use your website, or I'm taking my business elsewhere at basically any cost necessary. For me, the end of the open web is scorched earth. I intend to gain approximately nothing from this, and I don't care.

GenericDev 3y ago

I'm so sick of this. I don't feel like I own my devices anymore.

deleted 3y ago
[deleted]
exabrial 3y ago
Don't worry, you don't. Just wait until they lobby and make it illegal do to do so! This will come under one of the following guises: 1. Save The Children 2. Save The Planet 3. Save the Tax revenue 4. Anti-Terrorism
jeroenhd 3y ago
Why not buy a phone with known good LineageOS support if you're afraid Google may update your phone? You can audit and compile the entire OS yourself and disable any CA certificates you may dislike.
- GenericDev 3y ago
  Or. Hear me out. Why don't these companies actually give me back the ability to control my devices? Why is the onus on me? Why don't these fuckers do the right thing. So tired of this what-aboutism bullshit.
  - jeroenhd 3y ago
    You're buying their phones, not the phones of companies that give you full control. Most customers care more about not having to wonder about security than about having the ability to flash a new kernel. Show companies that there's money to be made by buying devices to your liking or you'll be subject to design decisions made for the vast majority of customers. Why should companies care about your specific wishes over everyone else's if you're not putting your money where your mouth is? They exist to make money, they're no government or charity. Everybody has been screaming at Google about how Google can't keep Android up to date since Android 2.1 launched. The geneewl comsensus is that if you wqnt updates and security, you need to buy an iPhone. They're finally fixing this problem but every step along the way the percentage of a percentage complains that they're the victim of Google's conspiracy.

bitsandboots 3y ago

So many good comments here, but I keep thinking about how thankful I am that PCs don't work like smartphones, and it's sad it's regressed to this point. Android has so thoroughly defeated itself, that I feel crazy to say I'm thankful that microsoft doesn't run the PC world like google runs the smartphone world. Windows itself is a bastion of stability and sanity compared to android. Things do not need to be upgraded prior to the hardware actually breaking of old age. Beyond that, just like google, microsoft doesnt control the entire hardware-software pipeline. But just like google, microsoft is in a place of power where they could have made it incredibly inconvenient to own your PC, by dictating norms through a store, or discouraging any deviation of environment by safetynet. My memory is bad here, but did this sort of thing ever end in antitrust lawsuits for microsoft in the past? And, when can we look forward to the same for google?

jeroenhd 3y ago
Windows has had regular CA updates for about two decade now. If anything, Android works more like Windows at this point. Microsoft has also added tons of DRM to Windows (which they later broke). Remote attestation is built into the OS as well. Google has inconvenienced Android developers by altering the Android internals you weren't supposed to rely on anyway; Microsoft does this all the time as well. We may need to wait a few weeks for an updated Magisk module. Honestly, it's really notm that bad. Just don't click the update button on the five or six devices that will receive Android 14 before then.
vetinari 3y ago
Microsoft tried, they just failed. For now. They are still trying. Windows 11 requires TPM and Secure Boot.
- sumuyuda 3y ago
  I think they were successful in obsoleting a huge amount of functioning computers, forcing my people to buy new hardware to run Windows 11.
  - 3y ago

Brian_K_White 3y ago

And recently there were discussions about browsers disallowing self-signed certs, even for local host, and going https-only, and the supposed excuse is you can edit your local root store. Well now what?

bitsandboots 3y ago

Every android release I see things removed, and inconsequential things added. It seems like iOS has been doing the opposite, such that slowly they may meet in the middle, and then iOS exceed android in every way. Apple folk, can I get an honest opinion here: I've been using macOS lately and I hate it because it fails at really basic user experience things that've been common on windows/linux for decades. Like finder, it's just the worst. If I were to get an iphone next generation instead of an android, would I have the same negative reaction to iOS? Would you say that iOS is a more complete, useful UX than macOS, for the smartphone use case? I think I want to make the jump, but I also don't want to waste my time/money.

mardifoufs 3y ago
Yes and when the Appstore restriction is removed and sideloading apps becomes trivial, I literally can't think of a single thing android would have over iOS. It's such a shame since android used to be much more than just iOS but with .apk.
atlas_hugged 3y ago
They have a return policy. Give it a shot with a prepaid carrier like Mint.
Given_47 3y ago
I don’t use my iPhone for much more than for scrolling hn during breakfast, portable audio player, looking random things up if I’m on the go, and making calls. It’s fine for that. But the user is so restricted (u can look into jailbreaking), I try to use my phone the bare min and use my desktop for everything. For context this is also someone in the midst of dumping macOS for Linux as well

exabrial 3y ago

We really need a third operating system for phones.

bitsandboots 3y ago
We had them. Nobody bought them and here's what we got. BB10, WebOS, Windows Phone
- exabrial 3y ago
  I _really really_ enjoyed WebOS but it gambled way too hard on "Web Only" for the time period, and didn't really learn the lesson from Apple's attempt at the same thing. I only gave my device up after the screen broke. And damn, that hardware keyboard layout was fire.
- wiseowise 3y ago
  Firefox OS.
Hackbraten 3y ago
There is: https://pureos.net https://pureos.net
- CatWChainsaw 3y ago
  Do they have any relation with Purism?
  - Hackbraten 3y ago
    It does: > PureOS is developed by paid and volunteer members of the Purism community, and benefits from the work of its extended communities and projects.
    - CatWChainsaw 3y ago
      I see. It does make me a little concerned, given the Librem drama.

CSDude 3y ago

HTTP Toolkit was very helpful for me to extract hidden APIs from crappy EV charging apps in Turkey, combined with Frida to prevent SSL pinning and root detection. Then I realized, the reason they try to hide is maybe those APIs are abomination /s

MishaalRahman 3y ago

Left a reply to the author on Twitter, but putting it here as well in case they didn't see it. Hi! I'm the guy who wrote the blog post about updatable certs in Android 14 that your article linked. Not sure if you're aware, but there's actually a system property you can set to bypass reading from the APEX cert directory. system.certs.enabled=true From: https://android-review.googlesource.com/c/platform/frameworks/base/+/2423168 https://android-review.googlesource.com/c/platform/framework...

pimterry 3y ago
I don't think that helps much unfortunately. That's a java.lang.System property (i.e. a config value set within one JVM/app) as opposed to an android.os.SystemProperties OS property (globally configurable on the device via adb). Reconfiguring the former requires modifying the app itself AFAICT. That's useful for automated testing (which appears to be why they've added it) or for toggling settings between debug/prod builds, but not so much if you want to globally trust a CA certificate on your device. Of course, if you know a way to externally set such a property so that it applies to every app, that would indeed work great, and I'd love to hear about it! (I'm the author btw, and I don't see any such reply on Twitter? Classic 2023 Twitter ofc)
- MishaalRahman 3y ago
  Finally had a chance to test it, and you're right. It's not a property that can be set via "setprop", unfortunately.

t0bia_s 3y ago

How green and sustainable this approach from Google exactly is when it makes forks like LineageOS harder to maintain? LineageOS is only way how to keep many devices up to date by security patches. Ability to have newer version of Android is just a bonus... or... uh wait.

keyme 3y ago

People here just love their locked bootloaders for some reason. But once you free yourself of this silliness, and root all your devices after unboxing, you'll be good for yet a few more years. Of course it'll only keep being this easy temporarily. Here's a scene from 2026 for your imaginative pleasure: Door: You need to scan your COVID25 vaccine QR code to open this door. QR App: This app will only run on a HW attested device ------ Shopkeeper: We only accept WhatsApp pay at this store. Payment App: This app will only run on a HW attested device ------ Your friend: We can only talk on this one messaging app that everybody uses. Messaging app: This app will only run on a HW attested device. Oh, but we promise that this encrypted blob of executable code that you can't disable is here just to ensure the safety of your E2E encryption. ------ Your custom ROM rooted Android 18 phone: Running a secure messaging app that was banned from the Play Store and has only like 2 other active users in the world. The police: Papers please. Phone touches the scanner. Scanner beeps and turns red. The law: You have violated the Digital Safety Act. Daily driving a non-licensed general purpose computer is illegal as this may endanger "our children". The law: You have violated the Public Health and Safety Act. Daily driving a non-licensed general purpose computer is illegal as this may be used to circumvent your quarantine and vaccination control status checks. ------ I can go on and on. I think you get the gist of it. Once we have HW attestation fully figured out, these laws will come. Cash will go away. Your agency will go away. Etc. ... And the punchline of the ghost story? The guys coding this stuff up? They're here with us reading this thread. Commenting about the virtues of locked bootloaders for your security.

hnav 3y ago
Googlers are adding attestation to web standards so you can't use escape through the browser. To be fair, Google stands to benefit from this and they get paid in Google so the incentives line up.
- smoldesu 3y ago
  Everyone with two motes of influence over the browser market wants to do this: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://httptoolkit.com/blog/apple-private-access-tokens-att... It's bad. It's especially bad on platforms where you don't get to choose which browser you run, but we should protest it everywhere.

maven29 3y ago

Say hi to ebpf, now shipping with android kernels.

1vuio0pswjnm7 3y ago

Where are the diffs of Android 13 against 14. Isn't this an "open source" project. If Google actively prevents "rollback" to a previous version, then how does a computer owner try out the new version. Once installed, there is no going back. Even if the owner discovers the new version is unsuitable. It's Amazon with no returns. A new car without a test drive. Reading source changes might be an easier way to review the new version than running it in an emulator and trying to figure out what changed. Is it not possible.

benmmurphy 3y ago

There are much more reliable ways to intercept traffic than messing with the root certificates. I believe corellium has a more solid strategy where they modify the TLS library to accept certs signed from their proxy and then the certificate from the origin server is passed through as an extension on the proxy certificate.

sansnom 3y ago

It's a very good news for security and also for 99.99% of the Android users. But get me wrong, it would be nice to support power user, they just need to add a feature to easily add a chosen CA and it would be perfect. Currently CA management was very dangerous because it was not updated (as stated in the article). New CA were not added so if you kept your phone long enough you would see insecure warning popping up. People would take the habits of accepting without thinking: very problematic behaviour. One solution is to used Firefox which doesn't use the system CA unlike Chrome. Another more problematic one: untrusted CA were not removed (the author give the example of TrustCor but they were other examples in the past like DigiNotar). Who knows what happens to private key of old untrusted CA ? If they end up in the wrong hands people could get MITM. (Personally, I had to remove DigiNotar for my old phone.) And of course as the author said: it's also problematic for new certificate authority like Let's Encrypt which at a time needed the complex cross sign certificate to ensure the certificates work for everyone. [1][2] [1] https://letsencrypt.org/2020/11/06/own-two-feet.html https://letsencrypt.org/2020/11/06/own-two-feet.html [2] https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html https://letsencrypt.org/2020/09/17/new-root-and-intermediate...