Bitwarden Heist - How to Break Into Password Vaults Without Using Passwords
Mastodon: toot.cafe/@pimterry
Reddit: www.reddit.com/user/pimterry
- 0 Followers
- 0 Following
- 0 Posts
Working with the new Idempotency Keys RFC
Hahaha, that might be British-specific I guess? I always assumed it was universal. Just means “a long time”.
OpenAPI for Everybody
This is modifying system CA certs on your own device, with root access. There’s plenty of examples in the article, but most commonly you’d want to add your own CAs so that you can intercept and inspect your own network traffic. There’s a wide world of developer/researcher/reverse engineering tools that do exactly that, there’s a demo here: httptoolkit.com/android/
It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there’s already far more malicious options available to them so it’s not a meaningful threat in any sense.
Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that’s widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.
I totally agree it is possible to work around this restriction, but it’s going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn’t.
I don’t think Android should move further in a direction where it’s impossible to directly control anything unless you install a 3rd party modification to the root daemon. That’s not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).
Fully managed corporate devices can do this, there’s a separate mechanism for that: developers.google.com/…/fully-managed-device
This only works when the corporation fully manages the device though - not for normal work profiles. It’s only possible to enable that setup when the device OS is initially installed, and the resulting device is controlled 100% by an IT administrator. It’s not something you can do for your own device, and even for small companies it’s quite complicated and expensive.
Android 14 blocks all modification of system certificates, even as root
Android 14 blocks all modification of system certificates, even as root
To be clear - even in that world, not having WEI would make you much more suspicious than a ‘normal’ user, so you’re effectively describing every Firefox and/or Linux (etc) user seeing captchas all the damn time. If Cloudflare used this as a signal, that’d be a captcha for 20% of websites.
Try using Tor today and see how inconvenient the web becomes. Just ‘not blocked’ doesn’t mean you get a reasonable experience.
The only healthy route for the web is fair access and free competition between clients. WEI sets that on fire.