Tag Info

Hot answers tagged

7

On ICS or later you can check this in your settings. Go to Settings->Security->Trusted Credentials to see a list of all your trusted CAs, separated by whether they were included with the system or installed by the user. Earlier versions of Android keep their certs under /system/etc/security in an encrypted bundle named cacerts.bks which you can ...


5

If you control the network, you can use Shark for Root to check whether the apps open port 80 (default port for HTTP) or port 443 (default port for HTTPS). IIRC, WireShark can also read HTTP headers. If you don't want to root your phone, and you're on a Wifi network that you owned; you can use Wireshark/Firesheep to snoop on the traffic of the Android ...


3

Android devices are only susceptible to this bug if they connect to servers which have not updated their server-side OpenSSL components. If the server component of OpenSSL is secure, no data is leaked. Therefore the main focus of this vulnerability is to server admins, not individual users. Most probably this can be fixed with app updates as a temporary ...


3

If Joe's device is rooted and Joe has a server (with full SSH access) running somewhere on internet, Joe should use SSH Tunnel app with socks proxy option checked (for dynamic port forwarding). There's no need to install VPN server or proxy server. There's no need to do complicated configurations on server. Plus, Joe's data will be secured inside powerful ...


2

I found the following but I don't think this is a definitive answer though it looks close to what I need, secure end-to-end encryption with no chance of snooping/sniffing/MITM. http://en.wikipedia.org/wiki/Off-the-Record_Messaging#Phone_apps I wasn't fully aware of OTR though I had heard the term used elsewhere but didn't know the full implications. I ...


2

I don't think there is a way to find out directly. The only thing I can think of is Check the log files and hope there is a mention of https, however this is not likely to be very succesful. Reverse engineer the app and look at the source code but to understand what your looking for you'll want to have some Android programming experience.


1

From the article you posted: OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable OpenSSL 1.0.1g is NOT vulnerable OpenSSL 1.0.0 branch is NOT vulnerable OpenSSL 0.9.8 branch is NOT vulnerable According to the Security Enhancements in Android 4.2 article, Android started using OpenSSL 1.0.1 as of version 4.2. This means that older Android ...


1

Your best bet will be to build it from source. There are a few StackOverflow questions that you might want to reference if you haven't already. How to use openSSL Library in the ANDROID application How to build OpenSSL on Android/Linux ? Openssl Build Issue with Android NDK r8 The first SO has an answer linking to a GitHub project ...


1

We had similar issues in our office router which had expired security certificate resulting in denial of HTTPS URLs. When we updated our certificate this issue was solved. I guess your issue should be similar. I stumbled on a web page that claims the solution. But looking at the solution I very much doubt its worth.


1

I don't think there is any widely known issue with this. I am able to sign in to StackExchange automatically on my Nexus S. I looked around at the Android Issue Tracker and while there are a lot of results for "browser https", none in the first 20 or so seemed pertinent. It might just be a problem local to your phone. I'd try resetting it.



Only top voted, non community-wiki answers of a minimum length are eligible