Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

131–140 of 327 posts

Re: Google has a secret browser hidden inside the settings

#131
post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

I can confirm that this works as a bypass for IBM's MaaS360 for at least one organization

Re: Google has a secret browser hidden inside the settings

#132

Earlier quoted context omitted.

The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.

> The user is generally never the adversary in any legitimate security situation. First, this isn't correct, for instance, DRM and TPM. Second, "the user" does not have direct access to the computer internals, which means all such access is mediated by programs that are supposed to act on the user's behalf. But because software is not formally verified, we have no guarantee that they do so, and so we must assume that…

The word "user" is ambiguous.

There are two kinds of relationships between an "user" and a computer.

The computer may belong to the employer of the "user" and the "user" receives temporary local access or remote access to it, in order to perform the job's tasks. Or the computer may belong to some company that provides some paid or free services, which involve the local or remote using of a computer.

In such a context, the main purpose of security is indeed to ensure that the "user" cannot use the computer for anything else than what is intended by the computer owner.

The second kind of relationship between a "user" and a computer is when the "user" is supposed to be the owner or the co-owner of the computer. In this case the security should be directed only towards external threats and any security feature which is hidden or which cannot be overridden by the "user" is not acceptable.

Except perhaps in special cases, parental controls should no longer be necessary after a much lower age than usually claimed, as they are useless anyway.

I have grown up in a society where everybody was subjected to parental controls, regardless of age, i.e. regardless whether they were 10 years old, 40 years old or 100 years old.

Among many other things that were taboo, there was no pornography, either in printed form, or in movie theaters or on TV.

Despite this, the young children, at least the young boys, were no more innocent than they would be today given unrestricted access to Internet. At school, after the age of 10 years, whenever there were no adults or girls around, a common pass-time was the telling of various sexual jokes. I have no idea which was the source of those jokes, but there was an enormous number of them and they included pretty much everything that can be seen in a porno movie today. The only difference between the children of that time and those who would be exposed to pornography today was that due to the lack of visual information both those who were telling and those who were listening did not understand many of the words or descriptions included in the jokes.

So even Draconian measures designed to "protect the innocence of the children" fail to achieve their purpose and AFAIK none of those boys who "lost their innocence" by being exposed to pornographic jokes at a low age were influenced in any way by this.

Re: Google has a secret browser hidden inside the settings

#133
post #77

Earlier quoted context omitted.

> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Good. Parental/school controls don't belong on the device. They belong on whatever the device connects to. That would be parental/school networks. If you don't want your kids to connect to things then don't let your kids have devices that connect to things. > 2) In some contexts (especially as high-stakes test settings, but al…

> If you don't want your kids to connect to things then don't let your kids have devices that connect to things. This is not an option as school, at least in my region, requires devices directly since 4th grade and indirectly even earlier for homework. Devices move between networks so having controls directly on the device is helpful. Your argument seems like arguing that there should be no local access permissions o…

> Your argument seems like arguing that there should be no local access permissions on files and just let the network handle everything.

Quite the contrary. Your local files are given to you by your local device. It's up to your local device to ensure that those files are properly access controlled.

But things on your network are given to you by your network. It should be up to your network to ensure that those things are properly access controlled. It should be up to you to ensure that you don't connect to networks which don't have proper access control.

> school, at least in my region, requires devices directly since 4th grade

If school requires things then school should provide things.

> indirectly even earlier for homework

Homework should be done at home. Are you saying that you don't have control over which devices on your network are able to access which things online? You should fix that.

Re: Google has a secret browser hidden inside the settings

#134
This is exactly how I used to bypass the parental control application on windows when I was young. I only had 1 hour of computer time, after which the tool would close all applications on my PC except Microsoft Office Apps (for productivity). After a bit of clicking around, I somehow managed to open a browser in Outlook and play flash games on Miniclip.

Re: Google has a secret browser hidden inside the settings

#135
post #37

TIL mobile JavaScript console https://eruda.liriliri.io/

A bookmarklet would be nice. This is how the current developer tools in browsers started (Firebug).

Bookmarking included in the project README…

https://github.com/liriliri/eruda#demo

Re: Google has a secret browser hidden inside the settings

#136
post #59
post #35

Earlier quoted context omitted.

As someone who remembers being a child, I'm glad there are still ways around parental controls. Kids are going to break rules, and that's fine. Making arbitrary rules unbreakable has always seemed iffy to me...

> Making arbitrary rules unbreakable has always seemed iffy to me... It creates better hackers.

as one of these young “hackers” that has always found ways for circumventing restrictions, I can definitively tell you that every kid that uses these bypasses has a different level of understanding of the “hack”. for example, some of my friends use the bypasses that I make, and they don’t have to understand the tool to use it. so while there are many (s)kids using these, it’s actually a very small percentage that learn how to make the bypass themselves, and become “better hackers”.

Re: Google has a secret browser hidden inside the settings

#137
post #76

Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be…

I wonder why they’re not using the system default webview… Does this mean it’s WebKit instead of Blink? If it is Blink, it seems likely that it’s not as up to date as the one provided by Chrome. EDIT: just noticed the docs link, yeah it’s WebKit.

[deleted]

Re: Google has a secret browser hidden inside the settings

#138
post #39

Earlier quoted context omitted.

Do normal embedded webviews also bypass parental controls? If so, that seems like a massive issue.

Normally they are fixed to one domain.

Right, but if I've banned youtube.com in parental controls, it'll still load in, say, a Mastodon client with an in-app browser for opening links?

Re: Google has a secret browser hidden inside the settings

#140
post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Good. Parental/school controls don't belong on the device. They belong on whatever the device connects to. That would be parental/school networks. If you don't want your kids to connect to things then don't let your kids have devices that connect to things. > 2) In some contexts (especially as high-stakes test settings, but al…

Security belongs on the endpoint. How do you know there aren’t malicious or compromised devices on the school network?
Post reply on HN