X-Git-Url: https://gitweb.stoutner.com/?a=blobdiff_plain;f=app%2Fsrc%2Fmain%2Fres%2Fxml%2Fnetwork_security_config.xml;h=ab43d0d2de254dbb95553c0a7c2c622e2ec82edc;hb=aba828cabddd0a277271c90816b50292bb64baf1;hp=e7ed677fd2823c699e6e99b406fdacb880c51a3e;hpb=06f516f2f5c745981e292451d01b9df7d1fd57eb;p=PrivacyBrowserAndroid.git

diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index e7ed677f..ab43d0d2 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -1,24 +1,36 @@
 <?xml version="1.0" encoding="utf-8"?>
 
 <!--
-  Copyright © 2018 Soren Stoutner <soren@stoutner.com>.
+  Copyright © 2018,2020,2022 Soren Stoutner <soren@stoutner.com>.
 
-  This file is part of Privacy Browser <https://www.stoutner.com/privacy-browser>.
+  This file is part of Privacy Browser Android <https://www.stoutner.com/privacy-browser-android>.
 
-  Privacy Browser is free software: you can redistribute it and/or modify
+  Privacy Browser Android is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.
 
-  Privacy Browser is distributed in the hope that it will be useful,
+  Privacy Browser Android is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
 
   You should have received a copy of the GNU General Public License
-  along with Privacy Browser.  If not, see <http://www.gnu.org/licenses/>. -->
+  along with Privacy Browser Android.  If not, see <http://www.gnu.org/licenses/>. -->
 
-<!-- Allow HTTP traffic. -->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="true" />
+<network-security-config xmlns:tools="http://schemas.android.com/tools">
+    <!-- Allow HTTP traffic and disable HSTS, which has no benefit for Privacy Browser (because unspecified links default to HTTPS) but has negative fingerprinting implications. -->
+    <base-config
+        cleartextTrafficPermitted="true"
+        hstsEnforced="false"
+        tools:ignore="InsecureBaseConfiguration" >
+
+        <trust-anchors>
+            <!-- Trust system certificate authorities. -->
+            <certificates src="system" />
+
+            <!-- Trust user certificate authorities. -->
+            <certificates src="user" tools:ignore="AcceptsUserCertificates" />
+        </trust-anchors>
+    </base-config>
 </network-security-config>
\ No newline at end of file