81–90 of 327 posts
Earlier quoted context omitted.
The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.
Privilege escalation is a typical class soft security issues. The device owner (parent, school, etc.) set restrictions, which some other user bypasses.
Earlier quoted context omitted.
> Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children
> sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. There are two cases where this is true: a user intentionally sharing internal access with external malicious actors, or a user unintentionally sharing internal access with external malicious actors (e.g. social engineering / general incompetence). Neither apply to kiosk breakouts.
Reminds me of the trick in windows 98, where you could by pass the password input screen by opening help and open file dialog.
You can do that (Win95) https://www.youtube.com/watch?v=1UfNlRe-goY Or you can hit cancel (Win98) https://www.youtube.com/watch?v=LHgjN_RwH6g Or can you simply close the password dialog and wait (Win98) https://www.youtube.com/watch?v=Uk_SKw9hOpQ
It is feature because the login window is there primarily as an single sign on mechanism for remote network services (which obviously would not work when you just dismiss it) and there is no security boundary between local user profiles.
Earlier quoted context omitted.
> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Doesn't sound concerning, especially the latter.
As a parent, it’s concerning to me. It’s funny how I never thought it would be an issue but kids have real impulse control issues and devices are super easy to spend too much time on and contribute to negative mental health. Screen time controls don’t solve this, but they help a little bit as part of many other things to help people learn about how to self regulate.
Good times.
Earlier quoted context omitted.
There are lot of much easier ways to compromise security both for careless or malicious users. This is the fundamental difference between ios and android. If you want you could ruin the security of android, however it is harder to do it in ios. Definitely not impossible, you could sideload dangerous apps easily in ios as well.
> There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.
So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).
Earlier quoted context omitted.
As someone who remembers being a child, I'm glad there are still ways around parental controls. Kids are going to break rules, and that's fine. Making arbitrary rules unbreakable has always seemed iffy to me...
> Making arbitrary rules unbreakable has always seemed iffy to me... It creates better hackers.
This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.
Earlier quoted context omitted.
The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.
Privilege escalation is a typical class soft security issues. The device owner (parent, school, etc.) set restrictions, which some other user bypasses.
Earlier quoted context omitted.
> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.
The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.
First, this isn't correct, for instance, DRM and TPM.
Second, "the user" does not have direct access to the computer internals, which means all such access is mediated by programs that are supposed to act on the user's behalf. But because software is not formally verified, we have no guarantee that they do so, and so we must assume that any program purporting to run on the user's behalf is intentionally or unintentionally malicious. This is where the principle of least privilege comes from.