Hacker News Reader

Comment by 0xCMP | Hacker News Reader

Wow, I didn't realize that older versions of Android (and possibly current versions?) didn't let you install root certificates without rooting it. IIUC iOS does let you install whatever root certificate you want with multiple confirmations/password prompts and it doesn't require authenticating every time it's going to use it.

View on HN

This is why having root access on devices you own is important.

In fact, I'd even argue that not having root means you don't own it.

I would also say that if you don't have full administrator access,but the company still does?

That's a rental, not a sale.

And I'd argue that under FTC rule, that's illegal.

You can install CA certs on current versions without being rooted. For Android 14 on a Pixel 6a:

Security & Privacy -> More Security & Privacy -> Encryption & credentials -> Install a certificate -> CA certificate

This works for Chrome and any app that uses the system cert store. I've used it for self-hosted services for several years. Don't know when it was first added.

Unfortunately this installs it as a user cert and only works for app that explicitly request it. To work everywhere you need to install it as a system cert which requires root

Interestingly ios (which is generally more locked down for dev stuff like this) allows users to install certs for all apps without jailbreak

OK, so this is an android problem not an overdrive or letsencrypt problem

That's clear from TFA

From memory, you definitely were able to install root certs pre-7.0ish but that functionality was removed, presumably to stop users from running man in the middle proxies and sniffing app traffic.

A huge irony in that alongside all the talk of conservatism, iOS provides much more user flexibility in this area of all things, and something that keeps me using the ecosystem.

You can still load root certs but as mentioned, it requires rooting your Android device. Some apps do have certificate pinning but the majority I would bet don't

Reply on news.ycombinator.com