Android
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
view the rest of the comments
Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that's widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.
I totally agree it is possible to work around this restriction, but it's going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn't.
I don't think Android should move further in a direction where it's impossible to directly control anything unless you install a 3rd party modification to the root daemon. That's not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).
And then Google will punish them for figuring it out by letting apps block access. That's the issue. If you could do all this without Google integrity checking, we wouldn't have to worry.
Wait, what tools, and why would they need you to modify existing certificates? That's super sketchy.
This is modifying system CA certs on your own device, with root access. There's plenty of examples in the article, but most commonly you'd want to add your own CAs so that you can intercept and inspect your own network traffic. There's a wide world of developer/researcher/reverse engineering tools that do exactly that, there's a demo here: https://httptoolkit.com/android/
It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there's already far more malicious options available to them so it's not a meaningful threat in any sense.