Timeline for How to update libssl.so on very old devices?
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2023 at 11:01 | comment | added | ILikeOldStuff | The few websites I want to work also have very little javascript, so that is less of a problem, also changing browsers can help too. The biggest hurdle is lack of support for modern encryption prevents connections from happening. Thanks for the Crosswalk link, there is a lot of stuff there and will take me a while to digest it. | |
| Nov 19, 2023 at 10:59 | comment | added | ILikeOldStuff | Since I don't put any private data on these devices, there is simply nothing to steal, thus very little risk. They each have a dedicated email account (NOT from google) that is not shared with anything else, and the VoIP passwords are device specific too, so even losing these is little more than an inconvenience since I would simply use my desktop (which can use an assortment of passwords which the devices do not have) to cancel those device passwords. And no, I do not do any internet banking on these devices (or any other android no matter how new) so malware can't steal what isn't there. | |
| Nov 19, 2023 at 10:47 | comment | added | ILikeOldStuff | @Morrison - For my specific use case(s), Stagefright is actually a non-issue. Its main transmission vector is MMS, Bluetooth and possibly videos, and none of those apply to these two devices. Neither device has EVER had any phone number or cellular carrier account, so there is no path for MMS to be delivered through. A wifi-only device (one of which does not even have any cellular nor bluetooth radio hardware) simply can't receive those things, and I uninstalled YouTube, Facebook, Twitter, etc many years ago. | |
| Nov 17, 2023 at 5:56 | comment | added | Morrison Chang | @ILikeOldStuff I really wouldn't be running old (Froyo released in 2010) devices outside. While you may want to keep things around, legacy bugs like Stagefright may exist in those versions. Additionally modern sites are using modern HTML/CSS which require modern webkit engines which now run on multi core CPUs. Proxy PC is doing heavy lifting. More FYI, Project Crosswalk existed for consistent webkit on 2.x-4.x hw. You'll have to find docs on archive.org as site is gone and web standards change. | |
| Nov 17, 2023 at 5:09 | comment | added | ILikeOldStuff | @Morrison - I've been tinkering with a proxy for my old XP desktop having similar issues, in that case it is a locally run proxy (one of the ones described at msfn.org/board/topic/… ). Do you (or anyone else) know of something like that to run on old androids? I would want it to run on the old devices so it could be helpful when I am not at home. | |
| Nov 16, 2023 at 23:45 | comment | added | Morrison Chang | An alternative solution might be to proxy the modern sites on a PC/local server so that the older browsers can access them, see: Proxy (or other solution) that can allow vintage browsers (before HTTPS era - with no or weak SSL/TLS support) to connect with HTTPS websites? | |
| Nov 16, 2023 at 13:25 | comment | added | Andrew T.♦ | While the question title might be an XY-problem, I'm honestly curious if the TLS stack can be upgraded by end-users without resorting to a custom ROM/Android update. | |
| Nov 16, 2023 at 10:33 | comment | added | ILikeOldStuff | The article about the conscrypt provider seemed promising, saying it could work all the way back to FroYo... but then the app he posted on F-Droid requires at least 4.1 Jellybean, so I don't see how to use it, even assuming other apps were compiled with it in mind. | |
| Nov 16, 2023 at 10:29 | comment | added | ILikeOldStuff | @Robert - I have tried looking on apkpure.com and apkmirror.com for old versions of both Chrome and WebView. There is Chrome 42 that could work for the IceCreamSandwich tablet, but nothing suitable for the FroYo device. The only WebView versions I could find all need at least Lollipop. The other problem is that the FroYo device is so old it does not use the ARMv7a instruction set, only ARMv6, and I could not find any of these things in that variant. | |
| Nov 16, 2023 at 10:24 | comment | added | ILikeOldStuff | @Steffen - That wasn't what I wanted to hear... but then life is like that sometimes. :-( Thanks for the clarification, anyway. | |
| Nov 15, 2023 at 21:18 | comment | added | Robert | The Google recommended way handling TLS issues on older devices (I think 4.0+ is at least supported) is using a special crypto provider that comes with Google Play Services. Apps can enable this if necessary by one code line. For details see e.g. code.mendhak.com/tls-13-old-android-devices and developers.google.com/android/reference/com/google/android/gms/… | |
| Nov 15, 2023 at 11:50 | comment | added | Robert | Your main problem is most likely not libssl but Chrome respectively the WebView component which I think is no longer updated for these old Android versions. As far as I know Chrome and WebView contain their won SSL/TLS stack and don't make use of libssl from Android. Only apps that open a TLS connection by Java/Kotlin (DEX) code make use of Android libssl. | |
| Nov 15, 2023 at 11:31 | comment | added | Steffen Ullrich | Older versions of libssl are not API compatible to newer versions, which means that you cannot simply replace libssl. The actual applications must be compiled against the new lib and maybe changes are needed in the applications too. | |
| S Nov 15, 2023 at 10:37 | review | First questions | |||
| Nov 15, 2023 at 10:41 | |||||
| S Nov 15, 2023 at 10:37 | history | asked | ILikeOldStuff | CC BY-SA 4.0 |