Comment on Android 14 blocks all modification of system certificates, even as root

ArbiterXero@lemmy.world ⁨1⁩ ⁨year⁩ ago

• mrkite@programming.dev ⁨1⁩ ⁨year⁩ ago

  Maybe read the article and not look like an idiot. All they did was move the certificates into a signed package that is updated through Google Play. They can revoke certs even faster now because it doesn’t require a system update.

  source

  • ArbiterXero@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Cool, so I can’t revoke the certs myself? Still bad.

    I can’t add my own for testing? Still bad.

    They manage it via an app that I can’t change at all? Still bad.

    source
  • Wahots@pawb.social ⁨1⁩ ⁨year⁩ ago

    What if you can’t access gplay for various reasons? (Non-stock OS, geographic lockout, etc etc)

    Are you just straight-up boned when 14 rolls around?

    source
• sudotstar@kbin.social ⁨1⁩ ⁨year⁩ ago

  IMO this isn't a real "solution" to the problem here, but this article states Android 14 also allows Google to manage device CAs remotely and push updates via Google Play, and goes into detail about how that mechanism is poorly documented publicly and is basically only an option for Google themselves, not any third party device administrators.

  Google can easily claim that all security concerns are handled by their own management while continuing to deny access to all third parties to actually handle that responsibility themselves if desired.

  source
• mathemachristian@lemm.ee ⁨1⁩ ⁨year⁩ ago

  I mean thats what its mainly for? To quickly update CAs without needing to do it as a system update that the vendor needs to vet first

  source