Allow user-supplied root certificates (weaken security)

Banana8994 · April 28, 2024, 4:29pm

@WhiteNoise many android apps trust user added CAs. To give a few examples: bitwarden, home-assistant, nextcloud already have it enable. If someone have physical access to device to install CA they have access to all the data alraedy

github.com

bitwarden/mobile/blob/f80ec1b221c39f993bfbb8141723c9c4bf07a17c/src/App/Platforms/Android/Resources/xml/network_security_config.xml#L6


      
          <network-security-config>
            <base-config cleartextTrafficPermitted="true">
              <trust-anchors>
                <!-- Trust pre-installed CAs -->
                <certificates src="system" />
                <!-- Additionally trust user added CAs -->
                <certificates src="user" />
              </trust-anchors>
            </base-config>
            <domain-config cleartextTrafficPermitted="false">
              <domain includeSubdomains="true">bitwarden.com</domain>
              <trust-anchors>
                <!-- Only trust pre-installed CAs for Bitwarden.com and all subdomains -->
                <certificates src="system" />
              </trust-anchors>
            </domain-config>

github.com

home-assistant/android/blob/d733b405cc00bdec5e0e092d1f3badb6f409f0c3/wear/src/main/res/xml/network_security_config.xml#L9


      
          <?xml version="1.0" encoding="utf-8"?>
          
          <network-security-config>
              <!-- We need to allow clear traffic for those who don't have SSL setup. -->
              <base-config cleartextTrafficPermitted="true">
                  <trust-anchors>
                      <!-- Trust preinstalled CAs -->
                      <certificates src="system"/>
                      <!-- Additionally trust user added CAs -->
                      <certificates src="user"/>
                  </trust-anchors>
              </base-config>
          </network-security-config>

github.com

nextcloud/android/blob/619ae12f143e5a95dbbfbb96283b943062cc1fc5/app/src/main/res/xml/network_security_config.xml#L14


      
            ~
            ~ SPDX-FileCopyrightText: 2017-2024 Nextcloud GmbH and Nextcloud contributors
            ~ SPDX-FileCopyrightText: 2017 Andy Scherzinger <[email protected]>
            ~ SPDX-License-Identifier: AGPL-3.0-or-later
          -->
          <network-security-config>
              <base-config cleartextTrafficPermitted="true">
                  <trust-anchors>
                      <!-- Trust preinstalled CAs -->
                      <certificates src="system"/>
                      <!-- Additionally trust user added CAs -->
                      <certificates src="user"/>
                  </trust-anchors>
              </base-config>
          </network-security-config>