4 ms·

Very useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so

Very useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so you have to do a little RE on them to insert your own cert... Or do it this way.

mschuster91 2y ago
Unfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation. For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop. Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).
- kelnos 2y ago
  > and DRM and whatnot can go and screw themselves The funny thing is that they wouldn't have even needed to take this position. DRM works well enough on (e.g.) Windows to make the various studios more or less happy, and users have "root" on Windows as usual. Ditto for macOS. Hell, DRM works just fine on my Linux desktop install, as much as I despite its existence.
  - XorNot 2y ago
    My favorite benefit of DRM support has been that Firefox will prompt me "do you want to allow DRM content?" when I visit a news website. Ignoring that or clicking no auto-blocks all the autoplaying videos.
    - freedomben 2y ago
      Indeed, I love this feature of Firefox. There's something that feels so damn good about saying "No" to DRM content. If only there was a way to tell the website that the content was blocked due to DRM...
    - lmm 2y ago
      The web is finally catching up with where it was in the Flash days.
- PlutoIsAPlanet 2y ago
  > Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM .. To be fair to Google, banks don't usually allow you to download and generate EMV tokens to perform card transactions on your PC, which places a different set of security requirements (legal requirements too) on Android phones for things like Google Pay to exist.
  - mschuster91 2y ago
    Yeah then make a Secure Enclave application for that. But ffs I am sick and tired of playing cat and mouse with every random app that whines about my phone being rooted. I might be less angry about that if there were a decent FULL backup solution for Android - with iOS I can do a backup and restore and almost everything will be restored, I think the sole exception is eSIM and Apple Pay because the secrets for that are in the SE. But for Android? Forget it, and there's enough games that don't even implement Google Play cloud-save integration. No way to backup these without root.

mschuster91 2y ago

Unfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation. For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop. Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).

kelnos 2y ago
> and DRM and whatnot can go and screw themselves The funny thing is that they wouldn't have even needed to take this position. DRM works well enough on (e.g.) Windows to make the various studios more or less happy, and users have "root" on Windows as usual. Ditto for macOS. Hell, DRM works just fine on my Linux desktop install, as much as I despite its existence.
- XorNot 2y ago
  My favorite benefit of DRM support has been that Firefox will prompt me "do you want to allow DRM content?" when I visit a news website. Ignoring that or clicking no auto-blocks all the autoplaying videos.
  - freedomben 2y ago
    Indeed, I love this feature of Firefox. There's something that feels so damn good about saying "No" to DRM content. If only there was a way to tell the website that the content was blocked due to DRM...
  - lmm 2y ago
    The web is finally catching up with where it was in the Flash days.
PlutoIsAPlanet 2y ago
> Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM .. To be fair to Google, banks don't usually allow you to download and generate EMV tokens to perform card transactions on your PC, which places a different set of security requirements (legal requirements too) on Android phones for things like Google Pay to exist.
- mschuster91 2y ago
  Yeah then make a Secure Enclave application for that. But ffs I am sick and tired of playing cat and mouse with every random app that whines about my phone being rooted. I might be less angry about that if there were a decent FULL backup solution for Android - with iOS I can do a backup and restore and almost everything will be restored, I think the sole exception is eSIM and Apple Pay because the secrets for that are in the SE. But for Android? Forget it, and there's enough games that don't even implement Google Play cloud-save integration. No way to backup these without root.