4 ms·
> The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all
by izacus 3y ago
> The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools.
Yes, and that was used for some horrifying security/privacy breaches that made this whole site preach about buying iPhones.
- unethical_ban 3y agoModifying system certificates is uncommon for the average user, but for techies and enterprise apps I imagine it's a lot more common. It's one thing for the OS to put dangerous things behind warnings, flags and prompts. It is another to cripple the OS.
- jeroenhd 3y agoYou can install root certificates, though, and they'll work on almost any app you could need in the enterprise.
- omniglottal 3y agoBut can you uninstall the root certificates of an adversarial government (i.e., your own)? Is it now necessary that the chain of trust includes entities you don't trust?
- jeroenhd 3y agoYou can disable certificate authorities in the security settings, yes.
- WeylandYutani 3y agoThis site preaches iPhone because they make money from the Apple ecosystem. Developers hate piracy, ad blocking and most of all users.
- dang 3y agoCould you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- j5155 3y agoIf I understand correctly, system certificates can be modified without jailbreak or any root access on iPhones.
- threeseed 3y agoYou can add new root certificates which is common for phones used in the enterprise. But not aware that you can modify the core root certificates.