there’s 4 of them, coincidence or conspiracy?
Well now you’ve put me on a list. Thanks.
FYI, G3 is the only one listed with the issue, the others are fine AFAIK. But if you don’t trust eMudhra at all after that, then that’s fair.
Edit: Actually it’s the intermediate certs that are compromised, the roots are still fine, but many of them come from the G3 root cert (and Sectigo’s AAA Certificate Services)
They closed shop entirely, so there won’t be any new certs signed anyway
Excerpt from that page, for Android:
- eMudhra Technologies Limited: emSign ECC Root CA - G3
- Comodo CA Limited: AAA Certificate Services
Of course, people using an Android variant that still gets regular updates are unlikely to need manual disables, since an update will take care of it.
I once tried to disable all but the ones I actually need. There are close to 200 CAs trusted by my devices and I only need to trust about 15 of them. But it’s a colossal pain in the ass to figure out which CA an app needs, so I abandoned that experiment.
Shouldnt you also disable the “Comodo” ones?
Why isn’t this a change pushed by Google?
4
4
