[rektide]

If anyone has been citing no examples, imo, it's you. I have elaborated & elaborated & elaborated, & you have said nothing to contend with other than 'it's easy'. I disagree. I've tried to talk to that at length. You've left everything but your one happy easy path to modifying a cert untouched, not commenting on a single one of the difficulties I've raised.

I think TLS was mis-designed for an in-appropriate & indecent form of security that does not give permissions to the most important actor.

Leaving the CA store on the hard drive, free to be modified by the user & sys-ops in a judicious careful manner was respectful of systems agency, giving a wide range of respect to different ways systems might need to be operated. Now, there are very few permissible ways to modify behavior. The system has closed down, locked down, become less programmable, less configurable. This advancement of the unmalleable is, imo, notable, prominent, progressing (on a wide variety of fronts), & obviously bad.

[Godel_unicode]

You provided one specific example, I explained how trivial that example was to hack around. Since then there's been nebulous pearl-clutching about how security is bad. If you had provided specific examples of how you think things are difficult, I would have explained how wrong you are. Unpinning certs is easy. Removing embedded certs is easy. Hooking verification functions is easy. If you possess the hardware, you win.

[rektide]

Most of the tool I've seen requires jailbroken/rooted devices. So only a handful of devices are even capable of these techniques. The latest iOS 14 has not yet been broken. Increasingly few Android devices can be unlocked or rooted, have been properly exploited into this mode.

I've said numerous times I thought your example was rosy. Removing embedded certs from Windows, OSX, iOS, Android programs seems like, in many cases, it could be difficult, as I don't feel like just removing the content is going to change app code that may be asking explicitly for pinning. Hooking verification functions as some of the xposed frameworks do seems viable, but again, this all is contingent on users having a level of access that most devices actively work to prevent, that requires the device to be exploited to achieve.

The security climate is in fact quite chilling. Everything you say is possible, but it requires increasingly rare access to the device, and increasing advanced levels of reverse engineering. The days when one could add their own CA to the store & intercept- those made sense- and they are long gone. The app makers, the OS makers, are securing devices against this kind of user-level control.