News for hackers. Stuff that matters.
Re:Standing on our own two feet by w3ll_w3ll_w3ll on Friday November 06, 2020 @02:59PM (#25010598)
I don't think Microsft Edge embeds its own root store on Android.
Re:Standing on our own two feet by tacon on Friday November 06, 2020 @05:12PM (#25011658)
Is there enough incentive for Microsoft to add a root store to Edge by next September? How hard is it to make that addition?
Re:Standing on our own two feet by jsjohnst on Friday November 06, 2020 @08:03PM (#25012519)
I may be wrong, but the effort to switch to your own root store is more doing it securely, than the difficulty of switching from system frameworks to your own SSL/HTTP transport layers. So to put another way, straight forward to do mediocre job, not as trivial to do a good or great job.
Re:Standing on our own two feet by toast0 on Sunday November 08, 2020 @02:03AM (#25023730)
Root store and TLS/HTTP library are separate concerns. You can use the system root store with your own libraries, or you can use your own root store with the system libraries.

On an Android 4.4 device, you should probably skip the system root store and the system libraries, and if you're already doing it for those phones, you might as well do it for all the phones.

Re:Standing on our own two feet by jsjohnst on Sunday November 08, 2020 @07:56AM (#25025496)
> Root store and TLS/HTTP library are separate concerns.

In the context of this thread (aka older Android devices), they aren’t truly separate concerns. You really need to do both. My point is that doing both is relatively straightforward, but doing the root store part is fairly easy to do it in a mediocre way and be brittle / insecure.