Android 14 blocks all modification of system certificates, even as root
Android 14 blocks all modification of system certificates, even as root
httptoolkit.com
Android 14 blocks all modification of system certificates, even as root
11 comments
-
-
-
Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that's widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.
I totally agree it is possible to work around this restriction, but it's going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn't.
I don't think Android should move further in a direction where it's impossible to directly control anything unless you install a 3rd party modification to the root daemon. That's not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).
-
-
I feel like 12 was probably the last decent one. Maybe even 11.
-
13 seems fine to me so far... Just upgraded to it yesterday though so maybe I'm missing something
-
-
rip AdGuard
-
Self host time
-
I meant https filtering
-
-
-
Besides the listed examples from the article, what would be the impact for normal to even hobbyist root users? It seems like this is a good idea to prevent modification of legit certs and allowing certs to be updated remotely.
As touched on above: if you're configuring your own system CA certificates on Android right now for debugging, reverse engineering, testing or research, that option is going away in Android 14, and presumably all future versions too.
-
11 comments
Treating their users like idiots and more control. Why can’t this be editable but just under Developer Mode?
I’m just waiting for sideloading to be blocked due to “security.”
FFS, even iOS lets you install certificate profiles