Why Android show "Network may be monitored" with Nordvpn?

Background

This is a known feature which occurs when a Installing a private CA certificate for use with vpn or private web site encryption and or authentication or using self signed certificates, figuring in bug reports:

• Issue 62076: "network may be monitored"




• Issue 82036: Self signed certificates cause "network may be monitored" warning

Common refrain of user complaints is that this warning is (amongst others)

• Of no real use




• Inconvenience to corporates




• Impractical to expect users to get Google approved CA certificates for their uses

Google engineer has clarified in the first source (post 8) :

The "User" portion of the trusted credential store is non-system CA certificates that have been installed and are trusted by the browser and other things that use the system Trusted Certificate Store. This warning is about protecting the user of the device

(Emphasis supplied)

And provides an example of how user security can be breached

Coming to your question

Why Android cannot separate Vpn traffic from real monitoring of attackers.

Android cannot. Period.

Whether it is VPN or monitoring by attackers. As explained, it is only providing a warning that your network traffic can be monitored if you continue to use VPN / apps / self signed CA.

If you want the OS capability to deal with this kind of protection, then it seems to exist in the world's costliest Android phone - Solarin