This sounds nice for security, hell for some developers but:
What happens in 2-3 years when this version of Android is abandoned? You pray the hardcoded certificates will last you a couple more years?
What happens in 2-3 years when this version of Android is abandoned? You pray the hardcoded certificates will last you a couple more years?
> Android 14 makes root certificates updatable via Google Play
> Android's root store used to require an OTA update to add or remove root certificates. That won't be the case in Android 14.
TIL there's a workaround though [0]:
> If you use Android 7.0 or earlier, you may need to take action to ensure you can still access websites secured by Let’s Encrypt certificates. We recommend installing and using Firefox Mobile, which uses its own trust store instead of the Android OS trust store, and therefore trusts ISRG Root X1.
[0] https://letsencrypt.org/2023/07/10/cross-sign-expiration.htm...
[1] https://www.xda-developers.com/android-14-root-certificates-...
I had to install a Let's Encrypt certificate to get my self-hosted password manager working because Google's updates are missing an intermediate certificate Let's Encrypt uses. This is not a hypothetical down the road issue but an issue present right now. Why should Google be the final arbiter of who I trust? They clearly have their gaps.
And let's not even get started on the existing approved certificate providers that you shouldn't really be trusting since they've been shown to provide certificates to people and organizations that shouldn't have them.
https://arstechnica.com/gadgets/2023/08/google-kills-two-yea...
Random example that even has pixel in it. Not to mention the other randomly canceled services.
The current situation is that the CA bundle doesn't receive any updates from Google. If your manufacturer repackages their CA bundle and still updates your device, you'll receive a new CA bundle, but I don't believe this is guaranteed.
Furthermore, if you're still running Android 14 after six years, your issue is with the manufacturer of your device. The latest version of the CA bundle will still work of course, but you should really be at least four or five Android versions higher at that point.