The widespread popularity of insecure proprietary network encryption in the Android ecosystem
No ratings
Presented at Real World Crypto 2026 by
TLS is not as universal as we might think. Applications with hundreds of millions of active users continue to use insecure, home-rolled proprietary network encryption to protect sensitive user data. This talk demonstrates that this is a widespread and systemic issue affecting a large portion of the most popular applications in the world. We demonstrates that HTTPS is, in fact, not everywhere, and that a massive portion of mobile network communications remains poorly encrypted and accessible to systems of mass surveillance. These issues are particularly concentrated in mobile applications developed in China, which have been overlooked by the global security community despite their massive popularity and influence. We performed a large-scale measurement to evaluate the network security of 1.7k Android apps, we found that (1) 47.6% of top Mi Store applications use proprietary network cryptography without any additional encryption, compared to only 3.51% of top Google Play Store applications, and that (2) these proprietary protocols often contain basic flaws in their construction. We analyzed the 18 most popular protocols, which belonged to 9 protocol families. 7 of these protocol families allowed network eavesdroppers to passively decrypt underlying data, including browsing data and device metadata, among various other issues, such as being downgradable, not validating TLS certificates, and the use of RSA without OAEP. These vulnerabilities affected 26.9% of our Mi Store dataset with a cumulative 130 billion downloads. Through the vulnerabilities fixed as a result of this work, this research has directly improved the network security of up to one billion people. However, there were hundreds more proprietary protocols used by popular applications that we discovered. Verifying all of their security through manual reverse-engineering and vulnerability reporting is not feasible at this scale. What can we do as a community to fix this systemic issue and prevent such failures from occurring in the future?