3 ms·
The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all -
by pimterry 3y ago
The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools.
Now, you can't do that.
Of course, with full source code access anything is _possible_. You can absolutely build your own Android system images from scratch disabling all these modules to work around this, and it's certainly possible for GrapheneOS/LineageOS to handle that too - but it will create a bunch of new work, and diverging from Android's implementations of core components may mean more work in future. And for most affected users "first, build your own system image" is significantly beyond their comfort zone and level of time commitment.
There will be other solutions eventually - it may be possible by digging through the namespacing and modifying the mounts of target processes individually to disable this, or there might be a way to somehow build & install your own APEX modules in a way that Android will trust, to replace the system module and thereby modify this directory, or who knows what else. There will certainly be per-process fixes possible with Frida, with hooks targeted to individual applications. More ideas welcome too :-D
Despite all that though, it's still going to be a major problem that makes it harder for users to fully control their own devices.
- izacus 3y ago> The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools. Yes, and that was used for some horrifying security/privacy breaches that made this whole site preach about buying iPhones.
- unethical_ban 3y agoModifying system certificates is uncommon for the average user, but for techies and enterprise apps I imagine it's a lot more common. It's one thing for the OS to put dangerous things behind warnings, flags and prompts. It is another to cripple the OS.
- jeroenhd 3y agoYou can install root certificates, though, and they'll work on almost any app you could need in the enterprise.
- omniglottal 3y agoBut can you uninstall the root certificates of an adversarial government (i.e., your own)? Is it now necessary that the chain of trust includes entities you don't trust?
- jeroenhd 3y agoYou can disable certificate authorities in the security settings, yes.
- WeylandYutani 3y agoThis site preaches iPhone because they make money from the Apple ecosystem. Developers hate piracy, ad blocking and most of all users.
- dang 3y agoCould you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- j5155 3y agoIf I understand correctly, system certificates can be modified without jailbreak or any root access on iPhones.
- threeseed 3y agoYou can add new root certificates which is common for phones used in the enterprise. But not aware that you can modify the core root certificates.
- franga2000 3y ago> The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools. "Just by writing to disk" omits the part where you needed to unlock the bootloader (wiping data), flash a custom recovery, install a superuser implementation and remount /system as writable (or used an overlay do fake it). The only thing that seems to be changing is where and how these certs are stored, so the procedure will be exactly the same apart from the last step, which was never the hard part. By the time you set up a phone for root access, needing one extra app or overlay to add CAs is barely an inconvenience.
- pimterry 3y agoNo - the system cert installation works out of the box on Google's own official emulators, for both AOSP & 'Play Services' editions (but not Play Store). Ditto for Genymotion, Bluestacks, etc. Zero root setup required in those cases, until now. Create the emulator, adb shell, su, mount tmpfs, write your CA certificates. You can script it and do the whole process in <1 second on a fresh device.
- franga2000 3y agoEmulators are a whole different story, I didn't realise that's what you were talking about. But emulators are a very niche use-case and they're already running modified images, so they could easily include a way to write certs. The most important (at least from my perspective) uses of custom CAs are done on real devices though, which have always needed a lot of work to modify, so little changes there.