Hacker News Reader

Comment by zeveb | Hacker News Reader

This is part of why Google's move to forbid users from installing SSL certificates is so anti-security and anti-privacy: it disables the ability to MITM one's own device in order to observe traffic.

I'd support regulation forcing Google to permit users to install our own root CA certs.

View on HN

You can definitely install your own CA certs on Android. https://support.google.com/nexus/answer/2844832?hl=en

Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say.

Is there no other way to get at this traffic? Possibly something at the application level, like throwing a debugger at the calls that are originating the telemetry traffic?

> Only problem is that you have to explicitly enable the use of custom CA certs in your app, so it won't work with Google apps as you say.

Or any other app doing nefarious things.

Enabling apps to ignore user-installed certs is flat-out evil an inexcusable.

Evil, herp derp. It was done by malware, to steal user data, hence the change.

If you want to log Google data traffic, you have to put a CA cert into the system cert store (needs root access).

If a user installs malware from the Play Store, that's his fault, and it's Google's fault for allowing that malware on the store. If he sideloads malware, that's his fault entirely.

Preventing me from controlling my phone is evil. Preventing me from seeing what the apps on my phone are doing is evil. If I wanted a padded room or a walled garden, I'd be using iOS.

Defense in depth.

Google can't catch everything from the Play store, hence the CA cert store change.

Reply on news.ycombinator.com