Android Chrome 99 expands Certificate Transparency, breaking all MitM dev tools
Enforcing CT is good, but that doesn't excuse the treatment of user-added CAs. On all platforms but Android, user-added CAs are considered <i>particularly trustworthy</i>. For example, Chrome Desktop, Firefox, and IE did not enforce HPKP if they encountered a cert from a user-added CA. Why does Android do the opposite? I don't see the threat model they are addressing.<p>We (mitmproxy) have repeatedly tried to get an answer to this from the Android folks (e.g. here: <a href="https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomment-282585162" rel="nofollow">https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm...</a>). It very much feels like they just want to kill uncomfortable privacy research.