4 ms·

I think android is - and has been - more heavy-handed than Apple here. Even when you could install and trust a new root CA, some apps can and would ignore this.

by bonyt 3y ago

I think android is - and has been - more heavy-handed than Apple here. Even when you could install and trust a new root CA, some apps can and would ignore this. Apps can use certificate pinning on both iOS and Android, but apps by default on Android just ignore user-added CAs by default on Android 7+, since 2016[1]. On iOS, the process of trusting a root CA is (rightfully) tricky, requiring you to install a profile and jump through some hoops with some scary warnings, but in my experience most apps will trust it unless they're using pinning. [1]: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...

moelf 3y ago
huh, but on iOS you have apps that can ignore your VPN connection... https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-connection-for-some-services/ https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-co...
- jeroenhd 3y ago
  The same is true on Android for processes with system capabilities/root, I believe, because they can bind sockets to a specific interface and bypass the VPN you use.
jeroenhd 3y ago
I can honestly see why Google did this in Android 7. Android, being much closer to a normal computer than iOS, has a huge stalkerware problem. Stalkerware isn't stopped by prompts, weaponises backwards compatibility, and includes all manner of abuse. On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes. I would love the option to actually trust CA certificates I install (especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings), but I don't think this feature is important enough for the dozens of techies using them day to day considering the risk to every other Android user on the planet. In this case there's no evil Google conspiracy to thwart the plans of your local IT department, this is just a side effect of Google's excellent sandboxing improvement and long overdue CA store update mechanism. I'm sure Magisk modules will appear to work around this problem. The existing Magisk modules will be broken for a while but that's par for the course after major Android updates. I'll write a module myself if I have to.
- vetinari 3y ago
  > especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate' Installing into system store and then configuring Firefox to use system store is the hard way, on all supported systems.
  - jeroenhd 3y ago
    > Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate' Not on Firefox for Android, it just makes me download the file. You can do it of course; just go to Settings > About Firefox > Tap the Firefox logo seven times > Go back > Secret Settings > Toggle "Use third party CA certificates". about:certificate shows me a bunch of buttons to export certificates, but there's no disabling or importing from that screen.
    - vetinari 3y ago
      > Not on Firefox for Android, it just makes me download the file That's... interesting. I did import my ca cert exactly this way, so they must have changed it... bummer. In the about:certificate I can see the ca cert that was imported this way and inspect it.
      - jeroenhd 3y ago
        It definitely used to work like this, but thst functionality broke for me when the Firefox rewrite launched (Firefox 69 I believe). In my opinion, Firefox shouldn't need to keep a separate store for user imported certificates at all. The operating system already has this built in, with a dedicated API to listing and importing these certificates, and Firefox actually uses that if you use the secret setting to enable it (not in about:config, you're not allowed to touch about:config unless you run Beta or Nightly). I think Firefox tries to be simple and easy like Chrome is, but just fails to in edge cases. I still can't paste an IPv6 IP address (i.e. http://[2000::5677]/ http://[2000::5677]/) into the address bar and just visit it like I can on every other browser I've tried, and to me that's indicative of Mozilla's struggles to keep up with the mobile browser market.

by bonyt 3y ago

moelf 3y ago

huh, but on iOS you have apps that can ignore your VPN connection... https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-connection-for-some-services/ https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-co...

jeroenhd 3y ago
The same is true on Android for processes with system capabilities/root, I believe, because they can bind sockets to a specific interface and bypass the VPN you use.

jeroenhd 3y ago

I can honestly see why Google did this in Android 7. Android, being much closer to a normal computer than iOS, has a huge stalkerware problem. Stalkerware isn't stopped by prompts, weaponises backwards compatibility, and includes all manner of abuse. On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes. I would love the option to actually trust CA certificates I install (especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings), but I don't think this feature is important enough for the dozens of techies using them day to day considering the risk to every other Android user on the planet. In this case there's no evil Google conspiracy to thwart the plans of your local IT department, this is just a side effect of Google's excellent sandboxing improvement and long overdue CA store update mechanism. I'm sure Magisk modules will appear to work around this problem. The existing Magisk modules will be broken for a while but that's par for the course after major Android updates. I'll write a module myself if I have to.

vetinari 3y ago
> especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate' Installing into system store and then configuring Firefox to use system store is the hard way, on all supported systems.
- jeroenhd 3y ago
  > Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate' Not on Firefox for Android, it just makes me download the file. You can do it of course; just go to Settings > About Firefox > Tap the Firefox logo seven times > Go back > Secret Settings > Toggle "Use third party CA certificates". about:certificate shows me a bunch of buttons to export certificates, but there's no disabling or importing from that screen.
  - vetinari 3y ago
    > Not on Firefox for Android, it just makes me download the file That's... interesting. I did import my ca cert exactly this way, so they must have changed it... bummer. In the about:certificate I can see the ca cert that was imported this way and inspect it.
    - jeroenhd 3y ago
      It definitely used to work like this, but thst functionality broke for me when the Firefox rewrite launched (Firefox 69 I believe). In my opinion, Firefox shouldn't need to keep a separate store for user imported certificates at all. The operating system already has this built in, with a dedicated API to listing and importing these certificates, and Firefox actually uses that if you use the secret setting to enable it (not in about:config, you're not allowed to touch about:config unless you run Beta or Nightly). I think Firefox tries to be simple and easy like Chrome is, but just fails to in edge cases. I still can't paste an IPv6 IP address (i.e. http://[2000::5677]/ http://[2000::5677]/) into the address bar and just visit it like I can on every other browser I've tried, and to me that's indicative of Mozilla's struggles to keep up with the mobile browser market.