Re:Why We Must Fight for the Right to Repair Our Electronics
by eadmund on Wednesday October 25, 2017 @12:31AM
(#15547474)
Yup — and this is the same Google who have conspired to prevent you from installing your own SSL certs, so that you can see what data that module is sending to them.
[ Parent
| on HN ]
Re:Why We Must Fight for the Right to Repair Our Electronics
by kuschku on Wednesday October 25, 2017 @09:44AM
(#15550010)
Specifically: User-installed TLS certificates are now in a separate keystore from system CAs, users can not disable system CAs, and apps can choose which keystore to trust, but the default is that user CAs are not trusted unless apps explicitly opt-in.
This is extremely user-hostile.
Re:Why We Must Fight for the Right to Repair Our Electronics
by chrisper on Wednesday October 25, 2017 @01:24AM
(#15547717)
If you have root, can you not install SSL certificates?
Re:Why We Must Fight for the Right to Repair Our Electronics
by dasil003 on Wednesday October 25, 2017 @02:48AM
(#15548032)
I am totally ignorant of Android, but they could be pinning, and do so in such a way that it fails silently without sending data. As root you could probably detect this but you'd really have to know what you were looking for.
Re:Why We Must Fight for the Right to Repair Our Electronics
by userbinator on Wednesday October 25, 2017 @06:40AM
(#15548959)
As root you could probably detect this but you'd really have to know what you were looking for.
I can think of two relatively easy and probably-not-secure (you were asking for freedom, not security...) ways to not only detect but also bypass this:
- Hook certificate verification APIs to always return true.
- Scan for certificates embedded in the binary and overwrite them dynamically. This will work if the app decides to use its own crypto but standard certificate formats.