Let's Encrypt Will Stop Working For Older Android Devices

Let's Encrypt was founded in 2012, going public in 2014, with the aim to improve security on the web. The goal was to be achieved by providing free, automated access to SSL and TLS certificates that would allow websites to make the switch over to HTTPS without having to spend any money.

Hundreds of millions of sites rely on Let's Encrypt for their HTTPS certificate needs. HTTPS security helps protect sites and users, and makes it harder for malicious actors to steal private information.

The project has just announced that, come September 1, 2021, some older software will stop trusting their certificates. Let's look at why this has come to pass, and what it means going forward.

When Let's Encrypt first went public in early 2016, they issued their own root certificate, by the name ISRG Root X1. However, it takes time for companies to include updated root certificates in their software, so until recently, all Let's Encrypt certificates were cross-signed by an IdenTrust certificate, DST Root X3. This certificate had been around much longer, and was already supported by the vast majority of OSes and browsers in regular use. This allowed Let's Encrypt to hit the ground running while they waited for the majority of software to support their own root certificate.

The problem looming on the horizon is the expiration of DST Root X3, on September 1, 2021. Of course, for those running up-to-date operating systems and browsers, there's no major issue. But for those on platforms that haven't been updated since 2016 or so, and don't support the ISRG Root X1 certificate, things will break. This affects any secure communication that uses their certificates, whether it be browsing websites with HTTPS enabled or making connections over SSL or SFTP.

The company notes that perhaps the biggest area of concern is the Android handset market. As most telecommunications networks customise Android software, along with the handset manufacturer themselves, it takes coordination between many organisations to put out an OS update for an Android phone. There's also little financial incentive for companies to support phones that have already been sold. Thus, many users find themselves locked out from OS updates entirely as networks or manufacturers simply neglect to do the work.

Data on the Android installed base, as of September 2020.

Android users on versions older than 7.1.1 are the ones who will face issues when DST Root X3 expires on September 1 next year. Based on recent statistics, these users make up roughly a third of the Android userbase – a significant number. With a conservative estimate pegging Android users as a whole making up approximately 80% of the total smartphone installed base, and around 3 billion smartphone users worldwide, back of the envelope calculations show us that leaves around 750 million users that could have issues in the coming year.

Of course, workarounds are possible. While the Android OS, and presumably web browser, are long out of date, there's nothing stopping users installing newer software that supports the ISRG Root X1 certificate. Firefox is available as a browser on the platform, and packs in its own list of trusted root certificates, so is a useful workaround for day to day web use. For developers, it's possible to include ISRG Root X1 as a trusted certificate within an individual app, and discussions are ongoing among those taking to this route. After all, adding an new trusted certificate is just putting a file in a directory, but you need root permissions to do so, which on locked Android phones means a jailbreak.

Let's Encrypt could also seek a cross-signature from another Certificate Authority, similar to when they started out. However, Certificate Authorities take on some responsibility for the certificates they sign, and it's unlikely that another CA would wish to shoulder that burden for Let's Encrypt. Particularly, as the entity is a non-profit, there is little money to be made. As a major pillar in the Internet's shift towards HTTPS encryption as the norm, Let's Encrypt consider it important that the project stand on its own, rather than relying on other for-profit organisations. Given that their root certificate is now widely recognised, outside these edge cases from 2016 and earlier, that seems like a sound decision.

With security on the Internet now more important than ever, this is a problem that isn't going away. In order to play nice with all the other computers on the global network, regular updates are simply the cost of doing business. The benefit of having an open certificate provider like Let's Encrypt around is that their transparency as to the issues and clear communication gives web hosts, developers, and end users more time to deal with the coming changes.

Security News This Week: Apple's Encryption Is Under Attack By A Mysterious Group

Does the public have a right to see gruesome photos of animal test subjects taken by a public university?

That question underpins an ongoing court battle between UC Davis and the Physicians Committee for Responsible Medicine, an animal welfare group, which is fighting for the release of photos of dead monkeys used in tests of Elon Musk–owned Neuralink's brain-chip implants. A WIRED investigation this week revealed the extent to which Neuralink and UC Davis have gone to keep images of the tests secret.

Also this week, an investigation by the Markup, copublished with WIRED, analyzed crime predictions by Geolitica (formerly PredPol) in Plainfield, New Jersey, and found that they accurately predicted crime less than 1 percent of the time. As WIRED previously reported, Geolitica is shutting down at the end of this year and being sold for parts to SoundThinking, maker of the gunshot-detection system ShotSpotter.

Earlier this year, the data-extortion gang Clop exploited a vulnerability in the widely used file-transfer service MOVEit, racking up victims around the globe including major corporations and US government agencies. The full number of victim organizations continues to climb into the thousands, with more than 3.4 million people's data potentially stolen, making it the biggest hack of 2023.

If you own an inexpensive Android TV streaming box, you may want to toss it into the sea—or recycle it responsibly. New research found that at least eight cheap streaming boxes contained a backdoor that connects the devices with servers in China and is used to commit fraud and other cybercrime. Researchers also found dozens of Android, iOS, and TV box apps that were used for fraudulent behavior. While at least some of the apps have been removed from the app stores, more than 120,000 Android devices and 150,000 iOS devices were impacted.

Speaking of phone security, we detailed how to know when your device will stop getting security updates and how to keep Google from using your data in its generative AI tool, Bard. Finally, we profiled the team at a UK-based nonprofit that's helping women fight back against digital domestic violence.

That's not all. Each week we round up the security and privacy news that we didn't cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

When WIRED first reported that Apple had sent a letter responding to demands from an anti-child-exploitation group called Heat Initiative, we had one big question: What the hell is Heat Initiative? An investigation by the Intercept now provides some clues.

According to the Intercept, the group is funded by "dark-money donors" linked to billionaire Democrats. Sarah Gardner, who leads the group, refused to comment on Heat Initiative's funding and said she disagrees with Apple's "privacy-absolutist" approach. The group, which had virtually no online presence when Apple sent that letter, is now waging a high-profile campaign to force the company to do more to scan for child sexual abuse material (CSAM) on users' devices and iCloud storage, which would likely mean weakening encryption.

15 Best Android Apps Available Right Now

Joe Hindy / Android Authority

Here it is, ladies and gentlemen. The crème de la crème. These Android apps stand alone at the top of an ever-growing pantheon. These apps have become ubiquitous with Android, and if you're looking for the good stuff, this is where you start. There are a ton of amazing Android apps out there. However, there are a few that stand out above the rest. Without further delay, here are the best Android apps currently available.

Most people should be familiar with most of these apps. They are the best, and the best usually aren't anonymous. That is, after all, what makes them the best. You can also check out our picks for the best apps released in 2022 for a few extra ideas.

The best Android apps available right now 1Weather

Price: Free / $1.99

1Weather is arguably the best weather app out there. It features a simple, paginated design that shows you the current weather, forecast for up to 12 weeks, a radar, and other fun stats. You'll also get a fairly decent set of lightly customizable widgets and the standard stuff like severe weather notifications and a radar so you can see the storms approaching. There is also a video element with two or three-minute weather updates for your region. The UI is logical and reasonably easy to navigate as well. The radar occasionally hangs while loading, but it's usually not too big of a deal.

The free version has every feature with some mild, inoffensive advertising. The single $1.99 in-app purchase removes advertising. Most will also enjoy the range of weather fun facts when you open the app. We have a list of the best weather apps and widgets if you want more options.

Google Drive

Price: Free / $1.99-$299.99 per month

Google Drive is a cloud storage solution available on Android where all new users get 15GB for free permanently upon signing up. You can, of course, buy more if needed. What makes Google Drive so special is the suite of Android apps that are attached to it. They include Google Docs, Sheets, Slides, Photos, Gmail, Google Calendar, and Google Keep. It covers so many bases and is so cheap that it's impossible not to recommend it to just about anybody.

Some of the features of these apps include live collaboration, deep sharing features, and compatibility with Microsoft Office documents. It's easy to use, you get 15GB of free storage for your documents, and the cross-platform support is pretty good. You can find more cloud storage apps and more office apps if you want something different.

Google Maps and Waze

Price: Free

Google Maps virtually owns the navigation apps scene and remains one of the best Android apps ever. It gets frequent, almost weekly updates that only add to its incredibly generous list of existing features. Aside from the basics, Google Maps gives you access to places of interest, traffic data, directions to things like rest stops or gas stations, and you can download maps for offline use.

If you add to that the Waze experience, which includes tons of its own features, you won't need another navigation app. Ever. Google also owns and operates Waze, so we list them together. Both navigation apps work on Android Auto and usually work better than car navigation systems. Of course, we have more GPS apps options if you need them.

Google Search / Assistant / Feed

Price: Free

This is one seriously powerful app. It also works on most Android devices. You simply download the app and then enable it. From there, you can ask it whatever you want. It also supports a variety of commands. You can control smart home products, ask it just about any question, and it can even do simple math problems for you. It's included with a variety of products such as Google Home speakers.

There is also a second Google Assistant app for those who want a quick launch icon on the home screen. The hardware stuff costs money, but Google Assistant is free. There are other decent personal assistants like Amazon Alexa, and you can check them out here.

LastPass

Price: Free / $12 per year

LastPass is one of those must-have Android apps. It's a password manager that lets you save your login credentials safely and securely. On top of that, it can help generate nearly impossible passwords for you to use on your accounts. It's all controlled with a master password. It has cross-platform support (premium version only), so you can use it on computers, mobile devices, tablets, or whatever.

There are others, but LastPass seems to be one step ahead most of the time. Additionally, the premium version is reasonably inexpensive. You can also grab LastPass Authenticator to go along with it for added security. There are other options for great password managers if the new, more restricted free version isn't doing it for you. LastPass also has an authenticator app for additional security.

Microsoft SwiftKey

Price: Free

Microsoft SwiftKey Keyboard is among the most powerful and customizable third-party keyboards available. It hit the market several years ago with a predictive engine unlike any other keyboard, and the app has grown a lot over the years. It's a free download with free themes so you don't have to pay a dime.

Other features include a dedicated number row, SwiftKey Flow, which allows for gesture typing, multiple language support, cross-device syncing of your library, and much more. It's about as good as it gets in the keyboard space. It's true that Microsoft now owns SwiftKey, but so far they have managed not to mess it up. Gboard, Google's keyboard app, is also exceptionally good, and the only reason it's not on the list is to avoid having three consecutive Google apps here. There are some other great alternative Android keyboards as well.

Nova Launcher

Price: Free / $4.99

Initially, we weren't going to put any launchers on this list. Nova Launcher seems to be extending beyond what normal launchers are. It's been around for years and consistently updated; thus, it's always been a great launcher replacement option. It has many features, including the ability to back up and restore your home screen set-ups, icon theming for all your Android apps, tons of customization elements for the home screen and app drawer, and more. An analytics company purchased it, but no bad changes have been made so far.

You can even make it look like the Pixel Launcher if you want to. If you go premium, you can tack on gesture controls, unread count badges for apps, and icon swipe actions. Those looking for something simpler may want to try Lawnchair Launcher or Hyperion Launcher. Of course, we have a list of the best Android launchers with even more options. We also have a tutorial for Nova Launcher if you want to learn more.

Pocket Casts

Price: Free / $0.99 per month / $9.99 per year

Pocket Casts is one of the most popular podcast apps. It received some ire years ago for moving to a subscription model. However, changes since then have made the app more or less usable by anyone, even without a subscription. The app houses a ton of podcasts, good sharing options, and you can set things like auto download and playback speed. The UI is clean, easy to read, and easy to navigate. There isn't much Pocket Casts does wrong.

The subscription is mostly optional and includes cross-platform support, more themes, 10GB of cloud storage to store podcasts, and more. We used to be quite against subscriptions, but since most podcast players now do it, but I'm able to use this without the subscription without much issue. Podcast Addict and CastBox are other excellent options in this space, and we have a list of even more great podcast apps.

Poweramp

Price: Free trial / $4.99

Poweramp is one of Android's most popular and functional local music players. It has all of the features, including Hi-Res audio support, Android Auto, an equalizer, gapless smoothing, and support for virtually any audio codec you can find. The UI has a tiny bit of a learning curve, but it's also one of the better-looking music players, with optional themes in the Google Play Store.

Solid Explorer

Price: Free trial / $2.99

File browsing is something everyone inevitably has (or wants) to do, so you might as well do it with a capable, fantastic file browser. Solid Explorer is pretty much as good as it gets in the file explorer apps realm. It features Material Design, archiving support, support for the most popular cloud services, and even some more power-user stuff like FTP, SFPT, WebDav, and SMB/CIFS support.

It looks great, is incredibly stable, and just works well. There is a 14-day free trial with a $2.99 price tag at the end of it. Other file browsers have more features, but few blend together looks, ease of use, and features like Solid Explorer does. If this doesn't work for you, here are some other outstanding file browsers.

Check out some excellent hardware as well:

Tasker and IFTTT

Price: $2.99 and Free, respectively

Tasker and IFTTT are two of the most powerful Android apps. They are automation apps where you can create various triggers to perform actions when specific things happen. For instance, you can use IFTTT or Tasker to turn on your Philips Hue lights automatically at night and off in the morning. Generally speaking, Tasker is the power-user option and has a much steeper learning curve than IFTTT. IFTTT is not only easier to use, but there is a boatload of fun things you can do with it. 

Tasker is free on Google Play Pass. IFTT is free for most stuff but there is a subscription if you want a few extras. There are some other great Android tools and utility apps, but none of them can step up to Tasker and IFTTT.

Textra

Price: Free / $4.49

Textra is arguably the best and most stable texting app for Android. It comes with various themes, most of which are editable by you. It does everything you need an SMS app to do without much hassle. It even has a tutorial built-in that makes it work with Android Auto better than most other texting apps. We like it for its simplicity. It's better than most OEM SMS apps, and we'd recommend it over most of them.

TickTick

Price: Free / $27.99 per year

TickTick isn't as popular as other to-do list apps. However, it may be the best one. It covers the basics like recurring tasks, reminders, push notifications, various organizational features, and categories. The app also lets you share tasks and entire categories with other people. This makes it great for family use, small teams at work, or other such groups. It's also great for grocery lists, honey-do lists, or others.

You get all of the features for free, albeit in a somewhat limited capacity, such as two reminders per task (premium makes that infinite). Our only major gripe is the lack of Wear OS support, which we hope the developers will eventually add. Some other excellent options in the space include Todoist and Microsoft To-Do. Yes, we also have a full list of the best to-do list apps.

YouTube and YouTube Music

Price: Free / $12.99+

We don't typically recommend streaming services to people. After all, everybody has their own preferences and plenty of great options exist. However, we really like the combination of YouTube Music and YouTube. For one price, you get unlimited music from YouTube Music with more than enough tracks to compete with Spotify and Apple Music. However, you also get ad-free YouTube, background video play, and offline downloads.

That one-two punch is right up there with the Hulu, Disney+, and ESPN+ bundle for $12.99 per month as one of the best deals for video and audio streaming. Other music streaming services are usually better, but ad-free YouTube without the need for sideloading is excellent. Audiophiles may want to check out Hi-Fi options like TIDAL or Deezer, even if those services come at a premium or one of these music streaming apps.

Zedge

Price: Free / $0.99 per month / $4.99 per year

Last but certainly not least on our list is Zedge. This is a wallpaper, ringtones, notification tones, and alarm tones app that gives you an unbelievable number of options to customize the most basic parts of your device. On top of having an exhaustive collection of things, Zedge also promotes various items during holiday seasons, making it easy to theme your phone up for Christmas, Halloween, and other holidays.

It's not 100% perfect. It does have the occasional bug and some of the worst advertising practices of any mobile app. Zedge Premium is a new initiative to provide premium content at a reasonable price. You watch ads or fill out surveys to earn Zedge credits as well. There are other great ringtone apps and great wallpaper apps. However, Zedge is the only one that reliably does both well, and its library is massive.

 ExpressVPN (Sponsored)

ExpressVPN is one of the most trusted, secure brands in the virtual private network industry, and that's for good reason. It's super fast and extremely safe, boasting an SSL-secured network with 256-bit encryption and, get this, unlimited bandwidth and speed. ExpressVPN has servers in 94 countries (including Hong Kong, Taiwan, Japan, and others) in over 145 locations around the world, so there will always be a location near you to give you the best experience possible. What's more, the service even has stealth servers in Hong Kong. They are to evade the GFW specifically. It doesn't even look like you're using a VPN!

If we missed any of the best Android apps, tell us about them in the comments below.

Thank you for reading. Try these out too:

Comments

---