Hacker News Reader

Comment by bonyt | Hacker News Reader

I think android is - and has been - more heavy-handed than Apple here. Even when you could install and trust a new root CA, some apps can and would ignore this. Apps can use certificate pinning on both iOS and Android, but apps by default on Android just ignore user-added CAs by default on Android 7+, since 2016[1].

On iOS, the process of trusting a root CA is (rightfully) tricky, requiring you to install a profile and jump through some hoops with some scary warnings, but in my experience most apps will trust it unless they're using pinning.

[1]: https://android-developers.googleblog.com/2016/07/changes-to...

View on HN

I can honestly see why Google did this in Android 7. Android, being much closer to a normal computer than iOS, has a huge stalkerware problem. Stalkerware isn't stopped by prompts, weaponises backwards compatibility, and includes all manner of abuse.

On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes.

I would love the option to actually trust CA certificates I install (especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings), but I don't think this feature is important enough for the dozens of techies using them day to day considering the risk to every other Android user on the planet.

In this case there's no evil Google conspiracy to thwart the plans of your local IT department, this is just a side effect of Google's excellent sandboxing improvement and long overdue CA store update mechanism.

I'm sure Magisk modules will appear to work around this problem. The existing Magisk modules will be broken for a while but that's par for the course after major Android updates. I'll write a module myself if I have to.

First, this is utterly false:

> On iOS it's shockingly easy to subvert your HTTPS privacy for years after you've let someone borrow your phone for five minutes.

You need a passcode to install certificates. And people casually handing over their phones would be a much bigger problem if that really is widespread behavior.

Second, can we stop using "techies" as some kind of magic word to make any technical concerns go away?

> especially Firefox, a fucking web browser, doesn't even opt into user certificates without a secret tap combo and hidden settings

Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate'

Installing into system store and then configuring Firefox to use system store is the hard way, on all supported systems.

> Firefox uses it's own CA store and installing your own is trivial. Ever tried to just open URL with your cert? The ui for certs isn't nice, but you can still view them in 'about:certificate'

Not on Firefox for Android, it just makes me download the file. You can do it of course; just go to Settings > About Firefox > Tap the Firefox logo seven times > Go back > Secret Settings > Toggle "Use third party CA certificates".

about:certificate shows me a bunch of buttons to export certificates, but there's no disabling or importing from that screen.

> Not on Firefox for Android, it just makes me download the file

That's... interesting. I did import my ca cert exactly this way, so they must have changed it... bummer.

In the about:certificate I can see the ca cert that was imported this way and inspect it.

It definitely used to work like this, but thst functionality broke for me when the Firefox rewrite launched (Firefox 69 I believe).

In my opinion, Firefox shouldn't need to keep a separate store for user imported certificates at all. The operating system already has this built in, with a dedicated API to listing and importing these certificates, and Firefox actually uses that if you use the secret setting to enable it (not in about:config, you're not allowed to touch about:config unless you run Beta or Nightly).

I think Firefox tries to be simple and easy like Chrome is, but just fails to in edge cases. I still can't paste an IPv6 IP address (i.e. http://[2000::5677]/) into the address bar and just visit it like I can on every other browser I've tried, and to me that's indicative of Mozilla's struggles to keep up with the mobile browser market.

huh, but on iOS you have apps that can ignore your VPN connection... https://restoreprivacy.com/latest-ios-found-to-bypass-vpn-co...

The same is true on Android for processes with system capabilities/root, I believe, because they can bind sockets to a specific interface and bypass the VPN you use.

Reply on news.ycombinator.com