Hacker News Reader

> If your device is rooted, just add your cert to the system store.

So, basically the same as before, but there’s no UI for it anymore?

Fuck this.

I might just modify the Java SSL libs on Android to even accept my cert when cert pinning is used, if I have to spend that much effort anyway.

View on HN

If you plan on doing that, it might be worth looking into a similar project that uses the XPosed framework to bypass certificate pinning at a low level:

https://github.com/iSECPartners/Android-SSL-TrustKiller

Although it only works with Android versions up to 4.2.2, due to limitations of the XPosed framework.

I share your frustration and I'm interested in your work on this, if you do proceed please consider making it easy for others to follow your lead by publishing, anonymously if necessary.

I get that the intention is to make the device more secure but Google's execution on this is disappointing and lazy, and the result is that my devices no longer trust me the owner, which I don't consider acceptable given the lack of liability.

I'm curious what Apple's response will be.

Reply on news.ycombinator.com