Android 14 blocks all modification of system certificates, even as root

If root can't do anything it wants, is it truly root?

If I don't have the ability to control which CAs I trust, things become useless fast. This is why I fully ditched chomeOS.

I learned that Android was not open under my personal definition of "open" right from the outset, because there was no programmatic access to telephony. My first project was to build an on-board answering machine with call screening capabilities.

I used an answering machine on my landline to avoid paying for caller id and voicemail and wanted to do the same with my cellphone. I was very disappointed to learn that this was not possible, at least with my skillset.

I knew that things were going the wrong way when my Tasker script to manage airplane mode stopped working when Android required locked it away. My use case there was that lack of connectivity at the gym and at home meant that connection attempts were draining my battery and heating up the phone. Now, of course, Android does a much better job of that particular task on its own, but it still makes me cranky. :)

Everything that has happened since has only cemented my opinion that Android is not actually an open platform. I do see many of the changes as potentially valuable security measures for the masses, but I wish that it wasn't quite so difficult for a power user to use the power of the little computer we carry in our pockets.

If root can’t manage these, then who can and how?

I already hated Android 12 for overhauling the aesthetic for the worse: making volume sliders obscenely wide, making the notification shade just an over-enlarged mess, and the half-assed implementation of Material You. On my Pixel 3 that I used at the time, this change alone made me root a phone for the first time just to fix all of it.

Two updates later and once again Google fucks up something that was perfectly fine before and turns me off from their operating system yet again. While I'm nowhere close to using an iPhone, I may just use GrapheneOS if I have to switch to a phone that comes with Android 14+ out of the box.

From an IT perspective with little context on this change other than what's in the article, if there's no way to import your own certs using an MDM, this change is terrible for businesses.

You need custom certs for all kinds of things. A company's test servers often don't use public CA certs because it's expensive (or the devs are too lazy to set up Let's Encrypt). So you import a central private CA cert to IT-managed devices so browsers and endpoints don't have a fit.

For increased network security, private CAs are used for SSL decryption to determine what sites devices are going to and to check for malware embedded in pages. In order to conduct SSL decryption, you need your own private CA cert for decrypting and re-encrypting web content. While this is on the decline because of pinned certs being adopted by big websites, it's still in use for any sites you can get away with. You basically kill any network-level security tools that are almost certainly enabled on the VPN/SASE used to access private test sites.

This article isn't clear on one question: Are users still able to add new trusted authorities? I have a custom CA installed so as to be able to access self-hosted https services inside my home network. Given that Android now prevents you from accessing sites with an untrusted/self-signed cert, I need this feature.

Super handy for if a certificate gets out and needs to be revoked.

Idiots.