• DoucheBagMcSwag@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    35
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Treating their users like idiots and more control. Why can’t this be editable but just under Developer Mode?

    I’m just waiting for sideloading to be blocked due to “security.”

    FFS, even iOS lets you install certificate profiles

    • pimterry@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      13
      arrow-down
      1
      ·
      1 year ago

      Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that’s widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.

      I totally agree it is possible to work around this restriction, but it’s going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn’t.

      I don’t think Android should move further in a direction where it’s impossible to directly control anything unless you install a 3rd party modification to the root daemon. That’s not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).

        • deweydecibel@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          1 year ago

          And then Google will punish them for figuring it out by letting apps block access. That’s the issue. If you could do all this without Google integrity checking, we wouldn’t have to worry.

      • Solar Bear@slrpnk.net
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        6
        ·
        1 year ago

        Wait, what tools, and why would they need you to modify existing certificates? That’s super sketchy.

        • pimterry@lemmy.worldOP
          link
          fedilink
          English
          arrow-up
          8
          ·
          1 year ago

          This is modifying system CA certs on your own device, with root access. There’s plenty of examples in the article, but most commonly you’d want to add your own CAs so that you can intercept and inspect your own network traffic. There’s a wide world of developer/researcher/reverse engineering tools that do exactly that, there’s a demo here: https://httptoolkit.com/android/

          It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there’s already far more malicious options available to them so it’s not a meaningful threat in any sense.

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    24
    ·
    1 year ago

    It’s an interesting write up. But I don’t think it’s valid for one reason, company devices often require a company certificate to be fully trusted so that the company firewall can inspect all traffic transiting it.

    So there must be a mechanism that allows corporately managed Android devices to adhere to corporate firewall policies.

    Not just corporate, there’s some countries that require you to install their certificate before you can use the internet.

    • pimterry@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      16
      arrow-down
      1
      ·
      1 year ago

      Fully managed corporate devices can do this, there’s a separate mechanism for that: https://developers.google.com/android/work/requirements/fully-managed-device

      This only works when the corporation fully manages the device though - not for normal work profiles. It’s only possible to enable that setup when the device OS is initially installed, and the resulting device is controlled 100% by an IT administrator. It’s not something you can do for your own device, and even for small companies it’s quite complicated and expensive.

      • deweydecibel@lemmy.world
        link
        fedilink
        English
        arrow-up
        17
        ·
        edit-2
        1 year ago

        This is exactly what’s happening with Windows, too. Unless you’re a business with an Enterprise version, control is being ripped away from you. We’re getting to the place now where individuals are no longer permitted to be admins of their own devices unless they’re corporations that pay for the privilege. I said it years ago when they took GroupPolicy out of Home edition: it was normalizing admin control as a premium feature, that one day average people will be priced out of.

        Combine that with a lot of the other environment integrity/hardware attestation bullshit Google and Microsoft are pushing more and more, so that even if you do manage to wrangle admin control back from them, you can be prevented from participating in the larger internet ecosystem for having the audacity to do so. Even Linux won’t be a meaningful retreat when the largest and most popular websites and apps collectively decide you have to use what is effectively a corporate approved kiosk to access them.

        This shit should be illegal.

        • Big P@feddit.uk
          link
          fedilink
          English
          arrow-up
          6
          ·
          1 year ago

          The day windows takes away my administrator power is the day I switch to Linux

            • Big P@feddit.uk
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              You can uninstall it, it just breaks some things. Internet explorer was worse

              • Darkassassin07@lemmy.ca
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                1
                ·
                edit-2
                1 year ago

                Not through any of the conventional means.

                You’ve gotta find and manually take ownership of all its files then delete them all. You also have to remove it’s updater service first (the same way) or it’ll re-install itself immediately.

                Even then, it’ll re-install with system updates.

                The only reason it breaks anything is several system services like the general help dialog and news+weather are permanently hard-coded to ignore the default browser setting and use Edge exclusively. There’s no good reason for this.

                • Big P@feddit.uk
                  link
                  fedilink
                  English
                  arrow-up
                  3
                  ·
                  1 year ago

                  Yeah, it is rediculous that they do that and I’m surprised they haven’t faced another antitrust suit for it.

        • j4k3@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          arrow-down
          1
          ·
          1 year ago

          This guide, in the third section at the bottom talks about using KeyTool to boot into UEFI and is how you get around this issue: https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki's_EFI_Install_Guide/Configuring_Secure_Boot

          Firmware bootkit vulnerabilities are one of the largest attack surfaces available right now. There are ways to deal with this, it is just added complexity. The intellectual barrier is becoming harder. Secure boot is important though.

        • slazer2au@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          1 year ago

          I don’t think it should be illegal, there are people who are not technically capable and can give permissions when they shouldn’t. I believe there should also be an an option where as a power user you are given those controls again because you have the technical understanding of what you are doing.

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        I agree it’s a pain in the butt. Using an open source MDM, EMM gives you the ability to configure your device your way.

        https://github.com/h-mdm like this

        It shouldn’t be required though. Totally agreed.

      • sirfancy@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        Correct me if I’m wrong, but I have a work profile with a cert authority installed in a work profile managed by Intune. If I update to Android 14, I’ll lose this?

        • pimterry@lemmy.worldOP
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          Unless it’s a fully managed device (different to a work profile - this has to be configured when the device first boots, it’s for phones that are fully corporately owned & managed) then I think that has to be acting as a user-level CA certificate (trusted only by apps who opt in to trust it, which notably includes Chrome) not a system-level CA certificate (trusted by all apps by default). That will keep working just fine.

    • Darkassassin07@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I’d imagine in both cases you’d have to play nicely with google for them to push your certificates to the devices for you and/or give you tools to do so.

      IE still available for those with power/money, but any regular citizen can go hump a cactus.

      • Big P@feddit.uk
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        There’s far too many corporations out there for that to be the case. It would cost them far more in managing that controlled access than they could possibly gain from whatever control they’re trying to exert here

  • WhoRoger@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    2
    ·
    1 year ago

    I kinda understand why they do this. Android has slowly been going the route to be only for dummies that shouldn’t be able to touch anything. And most device makers are completely fine with it, evidently.

    What’s needed is a really decent alternative OS, or several, with widespread support across devices.

    Yea there’s Graphene, but in terms of devices, do you want this year’s Google, last year’s Google, or an overpriced recycled phone? And in terms of firmware the situation is even more difficult.

    Even 10 years later I’m still mad at Firefox for letting go of their FF OS.

      • WhoRoger@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        Yes but not really as a competitor to Android. Its survival just shows that it always was a viable system though, which makes it even worse that FF abandoned it.

        • Willdrick@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Agreed. I’m in the same way mad as how quickly Canonical dropped support for ubuntu touch. Still lives as ubports but its not enough, as much as I appreciate the community effort, these kinds of things need a company that can liason with manufacturers for widespread support.

    • scottywh@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      13 seems fine to me so far… Just upgraded to it yesterday though so maybe I’m missing something

  • InvaderDJ@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    Besides the listed examples from the article, what would be the impact for normal to even hobbyist root users? It seems like this is a good idea to prevent modification of legit certs and allowing certs to be updated remotely.

    As touched on above: if you’re configuring your own system CA certificates on Android right now for debugging, reverse engineering, testing or research, that option is going away in Android 14, and presumably all future versions too.