Maybe read the article and not look like an idiot. All they did was move the certificates into a signed package that is updated through Google Play. They can revoke certs even faster now because it doesn’t require a system update.
IMO this isn’t a real “solution” to the problem here, but this article states Android 14 also allows Google to manage device CAs remotely and push updates via Google Play, and goes into detail about how that mechanism is poorly documented publicly and is basically only an option for Google themselves, not any third party device administrators.
Google can easily claim that all security concerns are handled by their own management while continuing to deny access to all third parties to actually handle that responsibility themselves if desired.
Super handy for if a certificate gets out and needs to be revoked.
Idiots.
Maybe read the article and not look like an idiot. All they did was move the certificates into a signed package that is updated through Google Play. They can revoke certs even faster now because it doesn’t require a system update.
Cool, so I can’t revoke the certs myself? Still bad.
I can’t add my own for testing? Still bad.
They manage it via an app that I can’t change at all? Still bad.
What if you can’t access gplay for various reasons? (Non-stock OS, geographic lockout, etc etc)
Are you just straight-up boned when 14 rolls around? Genuinely curious
I hope that on LineageOS that you will still be able to manage your own certificates
IMO this isn’t a real “solution” to the problem here, but this article states Android 14 also allows Google to manage device CAs remotely and push updates via Google Play, and goes into detail about how that mechanism is poorly documented publicly and is basically only an option for Google themselves, not any third party device administrators.
Google can easily claim that all security concerns are handled by their own management while continuing to deny access to all third parties to actually handle that responsibility themselves if desired.
I mean thats what its mainly for? To quickly update CAs without needing to do it as a system update that the vendor needs to vet first