Thanks for reminding me to do that!

there's 4 of them, coincidence or conspiracy?

FYI, G3 is the only one listed with the issue, the others are fine AFAIK. But if you don't trust eMudhra at all after that, then that's fair.

Edit: Actually it's the intermediate certs that are compromised, the roots are still fine, but many of them come from the G3 root cert (and Sectigo's AAA Certificate Services)

Source: https://emudhra.we-have-a-problem.com/

Where did you find that?

Oh, thanks for that! 😊 I just heard that they quit the TLS business all together.

On Android:

Security and privacy -> more security settings -> view certificates

Or go to settings and serach of certificates in the search bar

Yeah, my understanding was they're not issuing new certificates, but the current ones are still valid until they've expired.

Settings - Security and privacy - More security settings - View security certificates

Mind you, I'm using an outdated Android 15 with a similarly outdated One UI 7. I hope that either AOSP or Samsung already have patched emudhra out of the latest releases? I'm only doing this because I'm not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader.

Well now you've put me on a list. Thanks.

They closed shop entirely, so there won't be any new certs signed anyway

Thanks, found it

Thanks! How was this not widely spread on day 1? Why wasn't it pushed as an ota update to deactivate them?

eMudhra invalidated their insecure certificates and released renewed ones as far as I know.

No problem! But as I told another person, I’m only doing this because I’m not updating my phone anymore, because One UI 8 and above have disabled unlocking of the bootloader. If you're not rooted and you are still receiving updates from the vendor and Google, then I can't imagine this being useful.

outdated Android 15 with a similarly outdated One UI 7

...outdated @ 15 w/ 7?

Good God WHAT are you running 😂😂😂

Uhhh, well on my most up to date device its at least a double digit android version.

I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it's a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.

Why isn't this a change pushed by Google?

Yeah, I too had that ambition once, but I didn't even know where to begin, since I don't know how to find out which once my apps, websites and other services actually need. Other than investigating whole chains of collaboration between the various owners and devs of those services. Arduous much? 😅

Is it not? I have no idea. My device isn't legitimate in their eyes. 😅 (Rooted.)

8.0 is double digit, right?

The new ones are 10 times more secure.

The key is now "40"

Arduous much?

Sounds like a job for a machine.

Careful! They're gonna whoop our asses:

I needed this comment. Thanks. 😂

There it is again. You're shining today. 🤣

Because these are root certs which are still fine, it's the intermediate certs that are compromised.

I still disabled eMudhra's emSign G3 anyway, but that's probably why Google hasn't disabled the ones shown.

Recently learned that root CA don't actually expire. Yes, they have an expiration date, but nothing pays attention to it for a CA.

Shouldnt you also disable the "Comodo" ones?

Pray tell 🤔

Well you can't sign new certs (with the current date) with an expired root/intermediate cert, but the root/intermediate cert expiring doesn't strictly invalidate the already signed certs.

But I was more talking about the end-user certificates in the previous comment.

they were/are a shittier-than-average CA that got famously hacked in 2011 and less famously other times; later they bizarrely tried to trademark the name "Lets Encrypt" (after the real Lets Encrypt already existed). Since 2022 they're called "Xcitium" and "Sectigo".

Yeah, no need to trust them with this.
I got a notification that comes after an update, showing new features, which was a day after looking at these memes.
And I still had the G3 enabled.

NOpe.

Just got an Android update ~ half a day ago.
Just checked the certs, all were there and enabled.

And this is stock Android.

Holy crap, that is some valuable insight! Thanks! :D

If anyone else here uses AdGuard, the latest version of their app rejects the affected certificates. 👍

Thats just how they remembered their private key

4

4

Thank is for the reminder.

Well, the post is exactly about the 4, so... yes.

44 comments as I open the thread

4 options to disable

AUGH!!!! IT'S A CONSPIRACY!!!!!!!!!

I remember thay Lets Encrypt fiasco. Certainly made it hard to figure out the right LE cert when installing onto client websites.

Somebody just knocked on my door. I'm arming myself. Right now. 🔪

Are you arming your........... forearms? FOREarms???? hahahHAHahaHAHAAAAHAHahaaaaHAHAAa!!!1!1!111eleventy

;-)

I've never looked at this list before. Quite a large number of them. Is there any way for me to know which ones I shouldn't have enabled?

Without having any specialized knowledge on the subject, I'd say, start frequenting cyber security forums, follow youtubers who cover such topics and just keep yourself up to date on matters cyber. Or start researching the CAs one by one.