[Q] network may be monitored - Nexus 5 Q&A, Help & Troubleshooting

Hi, I just got my Nexus 5 yesterday and everyone is fine until I install a certificate that is required to connect to my University's wireless network.
The installation is fine, but after that I got a warning saying network may be monitored. I know I can get rid of it temporarily by swipe it away, but is there any way to disable this warning permanently? (see the attachment if my wording is confusing)

I am seeing this same thing in relation to the use of my own personal certificates. The issue stems from the use of private CA cert which I use for my local lan and vpn. Google has decided to enable CA certificate pinning as a security measure I guess hopefully there is a way to disable this.

Related

School wifi problem

Just got my Samsung Captivate about a month and I got my wifi connected to the school network, but when i open the broswer or any apps need internet i didnt get any connections? at the first week it works.. and when connecting to the school wifi it should be come out with the school login page,, then the internet will work.. however the wifi is connected doesnt matter how strong the wifi singal is.. it just cant load and cant bring me to the login page..
I really need help..
and the wifi works everywhere.. except my school...
btw my friends iphone 3gs works..
I am also at college and have had the same problem. the best reason I have found is the phone itself. half of our wifi is an older standard that does not work on the phone. it shows up as wep and i can not get it to recognize it as 802.1x . in my tinkering I have also messed up the wifi that was working.
long story short it probably won't work. I have spent a long time trying to get it to work with no luck
Sent from my SAMSUNG-SGH-I897 using XDA App
Hello to both of you,
I also attend a college with an 802.1x connection and the captivate supports most of these networks; however you will probably need to configure the network settings manually (usually retrievable on your schools IT site). If you dont mind digging up your settings I would love to check to see if I can configure your phone.
FYI, you might be having a problem similar to what's seen in this post.
http://androidforums.com/captivate-support-troubleshooting/142397-odd-netmask-issues-wifi.html
I definitely had this problem today. It appeared connected but no web pages would load. Going to have to investigate further. Why can't things just work
I know my school recently implemented some new security certificates that you must agree to before logging in, has anything like that changed for you? My wife's Aria is running 2.2 and can log into the school network, but my captivate cannot. It is frustrating I know.
Seems some colleges and universities are noticing issues with android devices letting the DHCP leases to expire but keeps using the IP address assigned instead of requesting a new one.
See the following links.
h t t p ://www . natecarlson . com/2010/08/27/android-att-captivates-wifi-networking-is-broken/
h t t p ://www . net . princeton . edu/android/android-stops-renewing-lease-keeps-using-IP-address-11236.html
I actually have similar issues with my Belkin wireless router at home. My laptops and other wireless devices have no problems connecting or re-connecting but the Captivate just refuses to re-connect after the connection was terminated. Even after resetting the router, the phone just keeps trying to use the same IP address for some reason.
The only way I could get it to reconnect is to either reboot the phone or to remove the AP entry which is a pain especially if you have wireless passwords.
Hopefully someone with better insight into how Eclair and Froyo handles WiFi can come up with some fix.
more solutions?
I believe the new 2.2 firmware solves this issue. I too am at College and my captivate FAILS to actually access the internet through wifi unless I statically assigned the IP.
I just updated to Froyo and it connected instantly. I'll have to do more testing to make sure, but I think Samsung finally fixed it.
captivate wifi issue at school
i just got Galaxy S (Captivate) and wi-fi is giving trouble.
when i tried at a university campus, it gives error and says can't open and try again later. it is like, i get connected to the network, IP and DNS and everything is generated. But when i open browser to open a website, instead of taking me to login page it gives the above error.
here is what i get when i try to open a website.
'web page not available'. the page might be temporarily down or it may have been moved permanently to new address.
here are some suggestions:
- check to make sure device has signal and data connection. (I made sure it is connected to wifi)
- reload page later. (i tried after 5 mins, same result)
- view cached copy from google. (doesn't work either)
i am not able to understand why is this happening. i tried restarting the phone after connecting to wifi but no luck. any pointers?
Sounds like they use a portal system which requires logon and doesn't play nice with the Captivate's browser. Unfortunately many such portal systems are written poorly and I've even seen some that only work with Internet Explorer.
You could try a different browser on the Captivate. Dolphin allows spoofing assorted User Agents, which might help.
Hey guys, I have the same problem connecting to m school's network login page. It would say connected but the website always says cant be found. But the good news is that I found a way to connect to it manually! What you need is your captivate and friends iphone 4 or 3gs. First have use your friends iphone to connect to the wifi and then go into wifi settings. You should see 2 DNS address, Ip address, netmask (subnet mask) and router address. Now jot those addresses down except the ip address. Go to settings->wireless and network->Wi-Fi settings->now tap the bottom left button under the samsung logo and click advanced. Now check use static ip. Do not enter anything for your ip address just yet (we will do this last). Now enter router address into gateway, subnet mask into netmask, DNS1 to DNS1 and DNS2 to DNS2. ok when you are done click back and tap the network you want to connect to. Once you are connected jot down your ip address by taping the network once more. now go back to where the static ip was and input the ip address you just jot down into the ip address underneath use static ip. Disconnect and reconnect to the desired network. You may have to do this a few times or reboot your phone. This has been working for me so far around different buildings but with the same school network connection. I hope this helps cheers!
sremick said:
Sounds like they use a portal system which requires logon and doesn't play nice with the Captivate's browser. Unfortunately many such portal systems are written poorly and I've even seen some that only work with Internet Explorer.
You could try a different browser on the Captivate. Dolphin allows spoofing assorted User Agents, which might help.
Click to expand...
Click to collapse
Yeah, my school uses the Bradford dissovable agent. Funny thing is, some connections work perfectly, others not at all. Technically none should work, and sometimes I feel that maybe I should tell them that sometimes somehow it is possible to bypass the whole agent thing- but why rock the boat just yet
Does it need a proxy to work? If so, this app is amazing.
http://forum.xda-developers.com/showthread.php?t=766569
I figured it out a month ago, and it is actually petty easy. But you really have to change ip address manually, usually just the last number.
Sent from my SAMSUNG-SGH-I897 using XDA App

[Q] How do I connect LG Vortex to my Corporate Wifi and use apps while connected?

I have recently purchased an LG Vortex that comes with the Android 2.2 operating system installed. I have looked into rooting my phone with z4root and have successfully temporarily rooted my phone. I would rather keep my phone unrooted, but if it is absolutely necessary I will root it permanently with z4root.
My question is this: How can I connect to my company wifi and use apps that require wifi?
I can successfully connect to my corporate wifi through the 802.1x EAP protocol. The problem comes when trying to access any of the apps that require internet (I am forcing Verizon's data plan not to be used--using wifi only due to 150MB limit on my data to save $$ per month). None of my apps seem to work--internet browser, Market, Gmail, Google Calendar, etc...
On my company pc I know that within internet explorer the box is checked that says "Use automatic configuration script" and gives an "Address" that is in the format of "..../proxy.pac" It looks like my work uses a proxy for things to connect to the internet. I have no such place to put this information in my LG Vortex. I downloaded an app that seemed promising called "Proxy Settings" which will allow me to enter in the following Hostname and Port. When I tried to enter the "..../proxy.pac" as the hostname it gave me an error stating "The hostname you typed is not valid."
Is there an app or something that will allow me to use my apps when connecting to my corporate wifi? Is it a proxy setting thing or a VPN thing? I am not sure. I am open to any and every idea so that I can use my phone's online features while connected to my company's wifi.
FYI - I have friends that have iPod touches and they are able to connect to the internet with some apps internet browsing and downloading apps, but they have a similar issue of not being able to use all of their apps as well. I believe they were able to put the "..../proxy.pac" address in their devices somewhere.
Thanks!
Any ideas? HELP!!!
Your compay could have blocked its use on WIFI?
i think the Corp have blocked the connection. Basically blacklist everything but certain site. Try to access facebook through the browser, if it goes through then i dont know. Of not then the Corp have things blocked.

4.3 Certificate-Wifi broken (TLS)

Hey guys, I'll try to be brief on this. Apparently some 4.3 devices have an issue with WiFi where certificate-authenticated networks won't connect. I'm at my college network and I download my certificate, install it, try to connect and it asks me to set it up. Here's my setup (exactly how my college specifies you to set it up):
EAP Method: TLS
CA certificate: (Unspecified)
User certificate: My certificate
Identity: My Identity
It worked fine pre-4.3, but now it says "invalid password", even though TLS doesn't require, or even have an option for a password. If anybody has any idea as to how I could get this working (I'm thinking perhaps taking 4.1.2 WiFi libraries and manually moving them onto my phone. I just have no idea exactly what files it would take, or if WiFi would even work afterwards) it would be much appreciated.
I'd just move back to 4.1.2, but 4.3 works so beautifully on my phone besides this one hiccup that I don't think it'd be worth it.
Fixed is more like it.
Previously, the EAP-TLS configuration would let you connect to any AP, regardless of the certificate presented by the authenticator. This meant that an attacker could set up a rogue AP broadcasting your SSID, and your client would naively connect, presenting its credentials which could be harvested by the rogue AP.
Now, you have to select/identify the signing CA for the AP's certificate for a true, mutually-authenticated exchange between your phone and the AP. Your phone will only present credentials to an identified authenticator with a certificate from a pre-defined CA (GeoTrust, GoDaddy, Bob's Upstairs Certificate Authority, etc.). Define that in the "CA Certificate" portion of your connection and you should be good to go.
Why this misconfiguration presents itself as "invalid password" is beyond me. Beats "PC LOAD LETTER", I guess...
joeinternet said:
Fixed is more like it.
Previously, the EAP-TLS configuration would let you connect to any AP, regardless of the certificate presented by the authenticator. This meant that an attacker could set up a rogue AP broadcasting your SSID, and your client would naively connect, presenting its credentials which could be harvested by the rogue AP.
Now, you have to select/identify the signing CA for the AP's certificate for a true, mutually-authenticated exchange between your phone and the AP. Your phone will only present credentials to an identified authenticator with a certificate from a pre-defined CA (GeoTrust, GoDaddy, Bob's Upstairs Certificate Authority, etc.). Define that in the "CA Certificate" portion of your connection and you should be good to go.
Why this misconfiguration presents itself as "invalid password" is beyond me. Beats "PC LOAD LETTER", I guess...
Click to expand...
Click to collapse
I get both a User and CA certificate from my college, but when using both of them at the same time, the problem persists. Any way to fix it or is it a case of my campus' internet not using an identified authenticator for their certificates?
Boardwalk30 said:
I get both a User and CA certificate from my college, but when using both of them at the same time, the problem persists. Any way to fix it or is it a case of my campus' internet not using an identified authenticator for their certificates?
Click to expand...
Click to collapse
If 4.3 on your S3 is the full version, you cannot go back to 4.1.2 without bricking your phone.
Sent from my SCH-I535 using xda app-developers app

prevent android being "smart" about wifi connectivity

when I connect to a captive wifi, I want to use the connection as is (maybe I want to login without telling google - since the builtin authenticator uses their gstatic domain, or maybe I want to probe the network as it is being redirected, or maybe I just want firefox to manage my password to the portal, etc)
but after I select "use wifi as is" on the android webview builtin auth screen, android starts to route all and every traffic to my 3g/4g data connection instead, until I disable and re-enable wifi.
it will only ever redirect traffic to wifi after it successfully got the correct 204 from gstatic.com
is there anyway to work around this?
I am on android6, but I think I has always been like that.
gcbxda said:
when I connect to a captive wifi, I want to use the connection as is (maybe I want to login without telling google - since the builtin authenticator uses their gstatic domain, or maybe I want to probe the network as it is being redirected, or maybe I just want firefox to manage my password to the portal, etc)
but after I select "use wifi as is" on the android webview builtin auth screen, android starts to route all and every traffic to my 3g/4g data connection instead, until I disable and re-enable wifi.
it will only ever redirect traffic to wifi after it successfully got the correct 204 from gstatic.com
is there anyway to work around this?
I am on android6, but I think I has always been like that.
Click to expand...
Click to collapse
Do you have any kind of Linux ide? Have you tried making a tunnel?
Or is that what your looking for. I'm not 100% sure what your looking for. If your trying to skip Hotspot authentication? Or anything like that Then a tunnel would work fine.
Sorry I can't be of much else help
If your phone is rooted or has a custom ROM (Which would obviously indicate that the phone is rooted), there is a solution that you can try using a terminal (Or ADB shell).
Issue the command: "settings put global captive_portal_detection_enabled 0" That should prevent captive portal detection and gstatic confirmation. This should work, I haven't tried it personally though.
Additionally, you can setup a captive server.
Issue the command: "settings put global captive_portal_server g.cn"
Restart your phone, and you should have access to the pages.
Basically, connecting as is, requires you to reach a site that does not require 204 confirmation and afterward other sites should be accessible. Let me know if this helps.
Josh Ross said:
If your phone is rooted or has a custom ROM (Which would obviously indicate that the phone is rooted), there is a solution that you can try using a terminal (Or ADB shell).
Issue the command: "settings put global captive_portal_detection_enabled 0" That should prevent captive portal detection and gstatic confirmation. This should work, I haven't tried it personally though.
Additionally, you can setup a captive server.
Issue the command: "settings put global captive_portal_server g.cn"
Restart your phone, and you should have access to the pages.
Basically, connecting as is, requires you to reach a site that does not require 204 confirmation and afterward other sites should be accessible. Let me know if this helps.
Click to expand...
Click to collapse
no root on the phone (damn blackberry priv) and no control of the portal.
this is so infuriating. This is trivial, banal even, on any device i control. Feel like a kid on training wheels every time i touch my phone.

blue tooth

Someone keeps turning on blue tooth while on public WiFi were to locate and rid of certificates or intrusive coding
raymondbernard said:
Someone keeps turning on blue tooth while on public WiFi were to locate and rid of certificates or intrusive coding
Click to expand...
Click to collapse
You need to provide more info ie what version of Android & security patch date .
Anyhow, You should always use a VPN when accessing a public wifi, only use a trusted provider (many VPN companies are dodgy, they severe you their adds, harvest your data etc many even appear to be controlled by governments ef China, Iran, etc) Use a list of trusted VPN's from a trusted organisation like like the EFF ... though you may trust someone else more ...) Set up a VPN and see if Bluetooth starts, before messing with certs.
Do you have Bluetooth tethering on? Some apps may be able to create a hotspot if allowed.
See "user credentials" in settings for any EXTRA installed certificates, normally this will be empty, unless you or your work or an app have installed a certificate.
Do not mess with system certificates unless you know what you are doing. however you can probably disable most of them, I have, you just have to remember that if you get error msgs warnings from apps or websites this is likely why. Which ones you disable will depend on who you trust & which country you are in.
IronRoo said:
You need to provide more info ie what version of Android & security patch date .
Anyhow, You should always use a VPN when accessing a public wifi, only use a trusted provider (many VPN companies are dodgy, they severe you their adds, harvest your data etc many even appear to be controlled by governments ef China, Iran, etc) Use a list of trusted VPN's from a trusted organisation like like the EFF ... though you may trust someone else more ...) Set up a VPN and see if Bluetooth starts, before messing with certs.
Do you have Bluetooth tethering on? Some apps may be able to create a hotspot if allowed.
See "user credentials" in settings for any EXTRA installed certificates, normally this will be empty, unless you or your work or an app have installed a certificate.
Do not mess with system certificates unless you know what you are doing. however you can probably disable most of them, I have, you just have to remember that if you get error msgs warnings from apps or websites this is likely why. Which ones you disable will depend on who you trust & which country you are in.
Click to expand...
Click to collapse
Android patch January 1 2018
Version=asks v 1.4 released on 161228
SMR-jan 1 2018 release MS
No Bluetooth tethering is disabled
System certificates are disabled I do know what doing
When running VPN Bluetooth still sometimes turns on anyway to trace path of access
raymondbernard said:
Android patch January 1 2018
Version=asks v 1.4 released on 161228
SMR-jan 1 2018 release MS
No Bluetooth tethering is disabled
System certificates are disabled I do know what doing
When running VPN Bluetooth still sometimes turns on anyway to trace path of access
Click to expand...
Click to collapse
Sorry, just trying to cover all possibilities as I have no idea what you know about security certs, so I try not to assume anything, though I did assume you have turned off Bluetooth scanning already ? Was there a reason you suspect BT certs is your problem? Is there another device listed as connected to your phone when BT turns itself on?
OK, good you are on a relatively recent security patch it seems so many vulnerabilities should already be patched, if it is actually some sort of security issue you have. That said there have already been some Bluetooth related vulnerabilities in 2019 eg this one from March CVE-2019-2009, but it needs BT turned on already, so not your problem. (should have also asked before are you on stock with selinux enforcing?)
I believe Google Play services can sometimes turn on Bluetooth, check "recent location requests" in settings (also might show you another app that is doing it?) Then you can go to, settings> apps> advanced>permissions>location & change setting for Play Services This might of course affect other features you want ... so maybe turn off another app listed there especially if it was listed in "recent location requests" when BT has turned itself on.
No other devices listed on my account
Am useing stock selinux enforcing not google play services as it only gets turned on when on public WiFi will check locations history
raymondbernard said:
No other devices listed on my account
Am useing stock selinux enforcing not google play services as it only gets turned on when on public WiFi will check locations history
Click to expand...
Click to collapse
Good, you should be pretty secure then.
As I understand it, Play Services can be used by other apps to send location requests, it may activate location when it sees a public wifi, so it could be why some people have reported it turning on Bluetooth as this is also part of location. However I'm not 100% clear exactly how this works, so I may be wrong.
Do you know anything about setting up bitcoin wallets as it won't confirm my I'D I've tried several times
raymondbernard said:
Do you know anything about setting up bitcoin wallets as it won't confirm my I'D I've tried several times
Click to expand...
Click to collapse
sorry, no

Categories

Resources