Dear Ben,
1. Would you mind looking at https://www.gizchina.com/2022/04/12/android-12-has-only-2-6-of-users-while-android-11-is-far-ahead/ ? ANDROID 12 HAS ONLY 2.6% OF USERS WHILE ANDROID 11 IS FAR AHEAD in April of 2022 by Uptodown. There is a figure in above link from a survey conducted by Uptodown, a 130 million user strong alternative store to Google Play. In fact, the operating system ranks fifth among the most popular OSs. Unsurprisingly, Android 11 takes first place with 29.5% of users. The latter is followed by Android 10 (25.2%), then by Android 9 (11.5%), then by Oreo, version 8.1 of Android (11%). As mentioned above, these results are not unusual. It is now customary that versions prior to the most recent remain more popular than this one. This was particularly the case with Android 11 in 2021, which remained behind Android 10 for a long time even though a quarter of users had already adopted it. 2. Please see https://9to5google.com/2022/08/12/android-12-distribution-numbers/ the news in August. Android 12 is running on 13.3% of all devices ahead of Android 13 launch. Android 11 is now at 27% from 23.8% in May. It remains the most-used version of Android today, with Android 10 following at 22.3%. Android 9 Pie is still at 14.5% and four years later still beats the latest stable release. So the "Android Fragmentation" is a big problem. . 3. Please also see https://www.gizchina.com/2022/08/15/android-12-is-installed-only-on-13-of-smartphones/ " At the beginning of August, therefore, Android 12 was installed on 13.3% of compatible devices. Currently, Android 11 is available on 27% of compatible devices.” “The truth is that even earlier versions are more popular than Android 12. So, Android 10 peaks at 22.3% installs, while Android 9 is also above it with 14.5% installs. However, this is not really surprising. Indeed, the latest versions of the operating system traditionally lag behind their predecessors." “Thus, last April, Android 12 was running only on 2.6% of devices. Even though it had already been several months since its official launch had passed. These figures are due to two things. First, if the latest Android updates are available directly on Pixels, this is not necessarily the case on smartphones from other manufacturers, which sometimes have to wait several months before being able to offer them to their users with their own overlay. <https://www.gizchina.com/2022/08/07/android-13-is-here-samsung-releases-the-first-one-ui-5-0-beta/> ” “Added to this is the reluctance of many users, many of whom keep their smartphone for several years, for fear of experiencing bugs or slowdowns in their device by installing the latest version. Thus, the delay of Android 12 compared to its predecessors was predictable, and its rise in just a few months is on the contrary very encouraging for the future, especially at the dawn of the arrival of Android 13.” Note that my colleagues who have Android 12 and 10 do not receive any upgrading message from manufacturers of their mobile phones. It is because Android's CA Trust List is distributed by smart phone's manufacturers via firmware upgrading. But my colleagues don’t use Google pixel phone to get newer Android 13. Above three points are the cases of “Android Fragmentation” problem. 4. HongkongPost CA’s post <https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/a2vWmLIKZy4> said “Our several major subscribers’ of public services have recently completed research among mobile device users in Hong Kong. It revealed that usage of the old Android devices version 10 or below (not yet pre-loaded with Root CA3) could only drop to below 5% for the Hong Kong mobile users at least after 6 years, taking into account that low-income families would slowly replace their old mobile devices.” Hongkong Post CA used Root CA1 RSA2048 with SHA-1 2003 to cross-sign Root CA3 and extended the expiration date to 2029 for Android device users on July 27, 2022. Chunghwa Telecom's new Root CA HiPKI RCA-G1 will be pre-load in Android 13 announced on August 15, 2022. I am afraid we will face a more serious situation than Hongkong Post CA. We will face a substantial number of Taiwan resident using Android 12 or below version around 2022-2025. They may not upgrade their Android. To comply with Mozilla’s proposal, Chunghwa Telecom will begin transition the subscriber chained up to ePKI Root CA to HiPKI RCA-G1 (setup new subordinate CAs under HiPKI RCA-G1 first). To solve above Android’s compatibility problem, we had better suggest our PMA to allow us to use our old root CA-ePKI Root CA to cross-sign HiPKI RCA-G1. I see you extend the distrust date from April 15, 2024 to April 15, 2025. The schedule is still tight. Android’s CA trust list is the downstream of the Mozilla’s CAs’ inclusion. It means that a new Root CA will be in Android’s CA list after Mozilla’s approve of that new Root CA in Mozilla root store. What about the mechanism of removing an old Root CA by Android? Will Android remove the pre-2006 root CAs after April 15, 2025? I doubt maybe in the summer or autumn of 2025, Android will release their version to remove ePKI Root CA. But there are still lots of persons use Android 12 or below version. There will be a critical problem about the compatibility of Android. In conclusion, I suggest Mozilla could extend the distrust date of affected pre-2006 Root CA dates on April 15, 2026 to solve the “Android Fragmentation” problem. Thank you. Regards, Li-Chun Li-Chun CHEN 在 2022年9月14日 星期三晚上8:11:47 [UTC+8] 的信中寫道： > Hi, Fillppo, > > > > About the details of the Android client compatibility and your > comment "why is cross-signing not an option". You could see Hongkong Post > CA's case in mdsp as > https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/a2vWmLIKZy4 > and Hongkong Post CA's announcement in > https://www.ecert.gov.hk/news/press/95.html. Please also search > "Android Fragmentation" key word in internet. > > I quoat some information from Hongkong Post CA as below : > > “Our several major subscribers’ of public services have recently > completed research among mobile device users in Hong Kong. It revealed > that usage of the old Android devices version 10 or below (not yet > pre-loaded with Root CA3) could only drop to below 5% for the Hong Kong > mobile users at least after 6 years, taking into account that low-income > families would slowly replace their old mobile devices.” > > Note that " Root CA3 ("Hongkong Post Root CA 3" ) has been > included in Mozilla and Microsoft in May 2019, Google in September 2020, > and Apple in October 2021. Therefore, subscribers are no longer required to > install the cross-certificate to applications such as web servers for being > trusted by common web browsers, when the web browser users use any of the > following web browsers on supported platforms ("Supported Web Browser"): - > > Google Chrome and other supported web browsers on Android 11 or above > > Microsoft Edge and other supported web browsers on Windows 10 or above > > Apple Safari and other supported web browsers on iOS 15 or above, > iPadOS 15 or above, macOS 12 or above. > > Mozilla Firefox version 68 or above on all supported platforms." > > > > "Since 2019, all TLS server certificates have been rolled-over to a > new Hongkong Post Root CA3 Certificate ("Root CA3") to replace the old Root > CA1 which is due for expiry in May 2023. We have also implemented a > cross-certificate signed by the old Root CA1, valid from Aug 2017 to May > 2023 in enabling end-users of Hong Kong who are using old version of > desktop/mobile devices pre-loaded with the old Root CA1 only to access > local websites using TLS server certificates issued under Root CA3. " > > > “A substantial number of Hong Kong residents using Android version 10 > or below, not yet pre-loaded with Root CA3. Therefore, we plan to model > the previous practice of "Let's Encrypt > <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fletsencrypt.org%2F2020%2F12%2F21%2Fextending-android-compatibility.html&data=05%7C01%7Crealsky%40cht.com.tw%7C439c9225c67d469a9c6408da94fe722e%7C54eb9440cf0345fe835e61bd4ce515c8%7C0%7C0%7C637986118385180284%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pyIkbMYEF4AccV%2BpqOtFLzbV3p8MjLzwmMWAotdcpq4%3D&reserved=0>" > > in managing similar expiry of its Root Certificate in 2021 in order to > minimize the impact of accessibility of local websites governed under Root > CA3 by old Android device users arising from the expiry of Root CA1. “ > > "In order to minimize the impact of accessibility of local websites > using our TLS server certificates by Hong Kong mobile device users to a > manageable level, we consider issuing the new cross-certificate signed by > Root CA1 extended by a longer transition period of 6 years or more (instead > of 3 years to May 2026). Taking into account that during the transition > period, the security strength would not be affected along our existing > certificate chain of trust. We have re-confirmed with our auditor to ensure > our revised plan with no compliance concerns." > > > Note that Hong Kong Post CA's Root CA1 is RSA 2048 with SHA-1. Their > new cross-sign certificate RSA 4096 with SHA-256 i: > https://crt.sh/?id=7224214828. > > > > Thanks to Mr. Man Ho of Hongkong Post Certification Authority, > Certizen . > > > > Sincerely Yours, > > > > Li-Chun Chen > > > > > > Filippo Valsorda 在 2022年9月8日 星期四上午8:42:03 [UTC+8] 的信中寫道： > >> 2022-09-08 00:11 GMT+02:00 Ben Wilson <[email protected]>: >> >> Thanks. As noted in your comments, the majority of affected root CAs have >> indicated that they do not believe that they will have a problem with the >> proposed deprecation schedule, but I am still considering modifying the >> wording/timeframes for the four or so CAs who might be affected. For >> example, one CA operator has since noted that their key is 4096-bit RSA, >> that they can provide audit documentation of their key generation, and that >> the transition to another root may be difficult for users of Android and >> Apple devices. >> >> >> Thank you for the details. Key generation audits are nice, but without >> ongoing audits from that moment to the present, I believe they don't >> mitigate the security concerns around what that key might have signed over >> its lifetime. >> >> Could the details of the Android and Apple client compatibility issues be >> shared on-list, ideally by the affected CAs? It feels like an opportunity >> for the ecosystem to learn something if nothing else. >> >> So, I will take a closer look at these four Root CAs as I continue to >> look to see how the wording or schedule of the original proposal can be >> tweaked. >> >> Off-hand, here are the Root Certificates from those affected CA operators >> who I recall have previously expressed concern, one way or another: >> >> GlobalSign - https://crt.sh/?id=88 >> DigiCert - https://crt.sh/?id=76 >> Chunghwa Telecom - https://crt.sh/?id=17183 >> Sectigo - https://crt.sh/?id=331986 >> >> Others who I believe do not have concerns with the current proposal are: >> >> SECOM - https://crt.sh/?id=144 >> Hong Kong Post - https://crt.sh/?id=4854 >> Entrust - https://crt.sh/?id=55 >> GoDaddy - https://crt.sh/?id=39 and https://crt.sh/?id=27 >> SecureTrust/Viking Cloud - https://crt.sh/?id=95564 >> >> >> Ben >> >> >> -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/7e1475b4-7835-4565-a4bc-70c9dd86e054n%40mozilla.org.
