58
PSA: update your apps and devices (lemmy.zip)
submitted 4 days ago* (last edited 1 day ago) by possiblylinux127@lemmy.zip to c/android@lemdro.id
25 comments fedilink hide all child comments

The emudhra certificate problem means that people can potentially man in the middle https. Make sure you update everything including apps like termux

To test if impacted visit or curl this site: https://emudhra.we-have-a-problem.com/

top 25 comments
sorted by: hot top new old
[-] lka1988@lemmy.dbzer0.com 5 points 3 days ago* (last edited 3 days ago)

Apple was notified of the eMudhra incident on 17th October. As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates.

Lmao

Meanwhile on Debian, famous for using older packages:

$ git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
fatal: unable to access 'https://git-emudhra.we-have-a-problem.com/check.git/': server verification failed: certificate signer not trusted. (CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none)
[-] possiblylinux127@lemmy.zip 8 points 2 days ago

Debian pushes out security updates within hours when it is severe. Older packages doesnt mean unsupported

[-] lka1988@lemmy.dbzer0.com 1 points 1 day ago

I know, but there are plenty of people who don't realize that and have avoided Debian because of it.

[-] db2@lemmy.world 15 points 3 days ago

I turned those off in the cert storage in settings. No need to wait or get caught by an edge case.

[-] 4TBHMeCCL@suppo.fi 3 points 3 days ago

If you use GrapheneOS, updating to 2026102100 (or higher) will take care of this for you.

remove the active eMudhra ECDSA root certificate due to compromised intermediate certificates (Vanadium received the removal of this root certificate as an out-of-band component update via our servers when it was released for Chrome)

remove both legacy eMudhra root certificates (this leaves the heavily used active RSA root certificate as the only remaining one and we're considering either removing it or disabling it by default despite other platforms not removing it at this time)

[-] cupcakezealot@piefed.blahaj.zone 3 points 3 days ago

check with this one and it will give you a proper checklist, fyi: https://emudhra.we-have-a-problem.com/

[-] limerod@reddthat.com 9 points 4 days ago

All major browsers have already updated to not trust their SSL certificate. It should show an error on all major browsers.

[-] possiblylinux127@lemmy.zip 5 points 3 days ago

That only covers mainstream web browsers

Any apps that rely on https will be vulnerable

[-] limerod@reddthat.com 2 points 3 days ago

Apps using system webview are already mitigated. Apps using system HTTPS connection protocols and SSL libraries are also mitigated. Now, for some apps which ship and use their own SSL library and do not use google safe browsing or update the cert list online they could be vulnerable.

[-] VibeSurgeon@piefed.social 4 points 3 days ago

The vast majority of app network requests would be secured by getting the TrustStore patch via Play Services, with only exceptions shipping their own crypto stack needing to update to be secured.

Still, updating your apps regularly is good practice that you should follow anyway

[-] possiblylinux127@lemmy.zip 2 points 3 days ago

Don't forget custom roms

[-] VibeSurgeon@piefed.social 3 points 3 days ago

That'd hopefully be solved with an update to that ROM in that case.

[-] paperboy@lemmy.zip 1 points 3 days ago

I wonder if that would be with Googles now twice-yearly released security updates. That's a long time between security updates.

[-] Stormy@thelemmy.club 2 points 3 days ago

Updated my apps and now r/All doesn't work on reddit. Thanks a lot.

[-] Bluegrass_Addict@lemmy.ca 6 points 3 days ago

that sounds amazing

[-] CorrectAlias@piefed.blahaj.zone 3 points 3 days ago

like termux

Am I missing something or has termux not released an APK update since 2025? Or are you referring to pkg upgrade?

[-] hexagonwin@lemmy.today 3 points 3 days ago

pkg upgrade probably

[-] CorrectAlias@piefed.blahaj.zone 1 points 3 days ago

Got it, always good to keep that up to date.

[-] deadbeef79000 2 points 3 days ago

Bold of you assume manufacturers are going to bother.

Some app devs probably will.

[-] moldy_rice@piefed.keyboardvagabond.com 0 points 2 days ago

Better: never trust https. It's highly likely that at any point in time, at least one of your adversaries has control of a CA in your root store.

Use Tor Onion Services. It solves this issue by using pinned certs.

[-] guycls@lemmy.world 0 points 2 days ago

What’s the tor address for google?

[-] moldy_rice@piefed.keyboardvagabond.com 1 points 2 days ago

There is no technology that exists that would keep the data you send to an evil US company safely private

[-] guycls@lemmy.world 2 points 2 days ago

What I’m saying is your suggestion is moot for most people, seeing most commonly used services aren’t available on tor net.

[-] moldy_rice@piefed.keyboardvagabond.com 1 points 2 days ago

Yeah, we have to write the admins to let them know this.

We have the technology. We can make the internet a safer place.

this post was submitted on 27 Oct 2026
58 points (96.8% liked)

Android

22284 readers
443 users here now

The new home of /r/Android on Lemmy and the Fediverse!

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

🔗Universal Link: !android@lemdro.id

💡Content Philosophy:

Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.

Support, technical, or app related questions belong in: !askandroid@lemdro.id

For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id

💬Matrix Chat

💬Telegram channels / chats

📰Our communities below

Rules

  1. Stay on topic: All posts should be related to the Android OS or ecosystem.

  2. No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.

  3. Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.

  4. No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.

  5. No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.

  6. No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.

  7. No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.

  8. No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.

  9. No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!

  10. No affiliate links: Posting affiliate links is not allowed.

Quick Links

Our Communities

Lemmy App List

Chat and More

founded 3 years ago
MODERATORS
ijeff@lemdro.id
ladfrombrad@lemdro.id
Paradox@lemdro.id
multimoon@lemdro.id
mikestevens@lemdro.id
Devgard@lemmy.world
limerod@reddthat.com
Netrunner@lemdro.id