Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

101–110 of 327 posts

Re: Google has a secret browser hidden inside the settings

#101

Post by II2II »

YetAnotherNick wrote: post #85
prepend wrote: post #67

Earlier quoted context omitted.

> There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.

I think you misunderstood me. Android deliberately allows users to hack into their own phone and remove its security. It allows users to install malicious apps if they want to or even root the phone entirely. So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).

I would hardly call disabling a security feature in the settings or getting an authorization key from the vendor hacking into your own phone. These are features that allow users who (think they) know what they are doing do what they want to do. It is intentional and people can figure out the consequences by doing some research. That is in start contrast to finding an undocumented hole in security.

Re: Google has a secret browser hidden inside the settings

#102

Post by TX81Z »

londons_explore wrote: post #3

Is this different than any other embedded webview? Doesn't nearly every app somewhere have an embedded webview somewhere for things like "view privacy policy", where it is often much easier to display html than sending the whole privacy policy to your app developer?

I used to be able to do the same thing in iTunes years ago as a laugh. I don’t see how this is a huge deal.

Re: Google has a secret browser hidden inside the settings

#103

Post by jabradoodle »

josephcsible wrote: post #99
jabradoodle wrote: post #40

Earlier quoted context omitted.

How would network restrictions help, there is WiFi at friends houses / everywhere. > There's nothing in that statement that relates specifically to kids. Most adults probably don't have parental controls on their phone...

> How would network restrictions help, there is WiFi at friends houses / everywhere. Aren't there other Internet-connected devices at friends' houses too?

Yes, however, locking your children in a Faraday cage is likely to be frowned upon.

Re: Google has a secret browser hidden inside the settings

#105

Post by rocqua »

saagarjha wrote: post #62
naasking wrote: post #53

Earlier quoted context omitted.

> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.

Excluding parental controlls from 'security' feels like more of an idealogical stance than a practical one.

I can see the argument based on Free Software principles. But I don't see anything else. There are so many cases of devices that are facing a user but not owned by the user which very much do fall under 'security'. Public terminals are a big one, devices handed out to employees in certain cases are another, and esoterica cases like prisoners also exist. Those should very much count as security, if only because 'when something breaks dangerous things can happen'. Then excluding parental controls because 'censorship bad' doesn't make much sense, since parental controls and other device lockdowns are often implemented with the exact same methods.

There are plenty of eviler things like a locked-down secure-boot and TPM grounded DRM that definitely fall under security, that I don't think it makes sense to gatekeep the term.

Heck, security as a term is so often used oppresively, that it makes little sense to gatekeep it anyway.

Re: Google has a secret browser hidden inside the settings

#107

Post by rationalist »

surgical_fire wrote: post #84
prepend wrote: post #71

Earlier quoted context omitted.

As a parent, it’s concerning to me. It’s funny how I never thought it would be an issue but kids have real impulse control issues and devices are super easy to spend too much time on and contribute to negative mental health. Screen time controls don’t solve this, but they help a little bit as part of many other things to help people learn about how to self regulate.

When I was a kid we managed to hack into my school's lab's computers to install Doom and Warcraft II. Good times.

> Doom and Warcraft II

If that's all today's kids had access to, I wouldn't be worried about it either.

I work with "average" kids today that have access to far more developmentally-damaging media, and I want the few kids that have parents that care enough to set up controls, to have a fighting chance.

Re: Google has a secret browser hidden inside the settings

#108

Post by msephton »

saagarjha wrote: post #68
msephton wrote: post #57

My brother uses a similar trick to get to a browser to bypass login on locked Android devices. It blows my mind that they can't see the security implications of this.

Getting to a browser isn’t really a security vulnerability; many devices will even have a “guest” mode that provides direct access to the internet.

Getting to a browser is an open gate. Why leave the gate open?

Re: Google has a secret browser hidden inside the settings

#109

Post by rationalist »

borski wrote: post #79
ilyt wrote: post #65

Earlier quoted context omitted.

Sure but they might've not discovered it just read it off internet or from other kids.

Both of which are forms of discovery

I can very easily "discover" how to make an illegal in under a minute using the internet, does that mean I should be allowed to have it?

I'm pretty sure your response is not what the GP meant.

Re: Google has a secret browser hidden inside the settings

#110

Post by naasking »

josephcsible wrote: post #97
naasking wrote: post #90

Earlier quoted context omitted.

> The user is generally never the adversary in any legitimate security situation. First, this isn't correct, for instance, DRM and TPM. Second, "the user" does not have direct access to the computer internals, which means all such access is mediated by programs that are supposed to act on the user's behalf. But because software is not formally verified, we have no guarantee that they do so, and so we must assume that…

> > The user is generally never the adversary in any legitimate security situation. > First, this isn't correct, for instance, DRM and TPM. You must have missed the word "legitimate". DRM and TPM are two of the best examples of illegitimate "security".

First, that's a matter of opinion. Second, it's still wrong per my second point.
Post reply on HN