Hacker News Reader

This, BTW, is IMHO why recent Android versions refuse to use self-installed certificates for all traffic: to prevent you from knowing what apps are sending back home. It's not in Google's interest for you to control your phone and know what it's doing.

View on HN

Or it could be the reason they've said they did it - this was a primary vector for malware authors to compromise user's information and devices. Not everything is a conspiracy.

Then why not offer a confirmation box to add certificates, and let the user decide?

Probably because users will just follow instructions they found on some sketchy website without actually reading the text in the confirmation box.

Then a confirmation box saying, "only do this if you know what you're doing - it can have dire security consequences".

Just because some people are idiots who don't read what's in front of them, doesn't mean others should be impacted.

We all know the real reason it's not an option.

Reply on news.ycombinator.com