Hacker News Reader

Comment by GekkePrutser | Hacker News Reader

Easy. Set up your own PKI and trust it. Keep the private key safe and nobody else can use it.

Only problem is that on Android 7 and above apps can choose to ignore any added certificates in the user store and the system store is off limits. Only way you can do it is by managing the phone in COBO or COPE mode with Android Enterprise. Which requires an expensive MDM system and a factory reset to enroll it.

Also the app can do certificate pinning which is even worse to get around. You'll have to modify the actual app.

I wouldn't be surprised if this rigmarole was the result of app development companies trying to keep secret how much data they exfiltrate.

View on HN

You don't need a factory reset to enrol in MDM, you can create a managed "work" profile and leave the unmanaged user profile alone.

That is correct, you can enroll into BYOD / regular work profile mode without reset. But for COPE mode and COBO mode you must factory reset to enroll.. because they are triggered in the startup Wizard by tapping 5 times on the background and then scanning the QR code (or by entering the token at the Google setup screen). These are fully managed modes.

And those modes are the only ones that allow you to push certificates to the system store. Normal BYOD work profile mode doesn't allow you to do that anymore. They only go into the user store where apps are free to ignore them - since Android 7. This mode is only meant for user owned phones and thus Google wants to limit what you as an admin can do. And manually you can't add them anymore either.

So that's why I mentioned the factory reset there.. It really is needed if you want to add root CAs to the system store.

(I managed 60.000 phones, 40k of which Android until a couple months ago :)

That makes perfect sense though, because presumably the system store would affect all profiles. Sure the app can ignore the user CA store, but it can ignore the system one too and just bring its own CA roots.

You certainly still get the "Your organisation may monitor network traffic in your work profile" warning on Android 12 when there's a CA added to the work profile.

> managing the phone in COBO or COPE mode with Android Enterprise

Better solution IMO is flash Lineage, preferably a variant with signature spoofing, and refuse to use proprietary garbage that pins certificates. If that means no streaming services or whatever it is then fine, I'll just pirate instead thank you very much. Why should I put money towards supporting things that erode my rights?

True. I do the same. But I like to do some research on security and privacy (this is my job now) and for that it's very handy to be able to intercept SSL traffic from mainstream apps.

Reply on news.ycombinator.com