[CrackBerry Question]

I noticed my BB KeyOne trusts the WoSign certificate authority. It would appear they've not followed best practices for being a public CA.

Apple has decided to blacklist them, Mozilla seemingly decided against it. Google it? I can't seem to post links here.

I'm curious - with all the security awareness Blackberry has, do they have any input towards the phone's trusted CAs? Do they have any opinion regarding changes in web security in general that would lead them to a move like Apple and just outright blocking WoSign in an update?

For a phone that has a security check app to tell me how vulnerable I am, I was hoping BB would take a position of leadership and have an opinion about issues like this.

[Bla1ze]

AFAIK those would still be loaded up by Google as part of the Core OS, and even still, you would get warnings in your browser if any of them were reached. You can disable WoSign and StartCom in the settings if you're that concerned.

[kyle11gmailcom]

Thanks! I'd already disabled them just to see if they'd be enabled again in a subsequent update (they weren't). I'm not terribly concerned about it, I was more curious about where the line is drawn in the Android ecosystem compared to Apple. If I understand you right, you believe that Google, as the maintainer of Android overall would take on the role of vetting which root CAs are trusted. I'm not sure I agree based on what I'm able to find. Google has distrusted WoSign in Chrome, but I can't find any similar mention of them removing it from the Android sources.

Via stackoverflow i came across this little nugget on Chromium's root ca policy:

"Note that, similar to Linux, the certificates included within the Android sources may be further altered by device manufacturers or carriers, pursuant to their local programs."

I don't mean to be bothersome or belabor the point, I'm just really curious about who decides what root CAs get trusted in my Berry!

[Bla1ze]

I don't mean to be bothersome or belabor the point, I'm just really curious about who decides what root CAs get trusted in my Berry!

Yeah, if I had another non-BlackBerry device I would check for you just to see myself but unfortunately all I have are BlackBerry devices.