Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

141–150 of 327 posts

Re: Google has a secret browser hidden inside the settings

#141

Post by liminalsunset »

smashah wrote: post #111

Side point: When you rent a Tesla, please do not sign into youtube. Subsequent renters can see your whole Google account (including family members, phone numbers etc). Or at least sign out before you return the car!

On the other hand, you can use a very similar kiosk escape on the Tesla YouTube app which is just a webview to get a full screen browser while in Park on the Model 3.

There is a Factory Reset and/or a Clear Browser Data function under Car menu > Software or Service iirc. The car remembers your navigation locations too, which can usually only be removed by either deleting your driver profile or resetting the car.

Re: Google has a secret browser hidden inside the settings

#142

Post by goolz »

naasking wrote: post #53
lucideer wrote: post #33

Earlier quoted context omitted.

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an…

> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

Ya, I could not upvote this more. Honestly physical security is usually one of the biggest fail points you will see in security audits. I also agree that there is nothing wrong with viewing users as potentially adversarial. I guess some of these responses surprise me, is all. I urge any sysadmins working with physical servers to reevaluate their access controls.

Re: Google has a secret browser hidden inside the settings

#143

Post by chias »

stewx wrote: post #72

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

That is, to a T, almost identical to my experience reporting a vulnerability to Google too.

Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate

Google: "Won't fix (Intended Behavior)"

Me: Really? Google intends to allow spoofed email to appear legitimate in its interface?

Google: Actually, it's a known issue

Re: Google has a secret browser hidden inside the settings

#145

Post by hospitalJail »

blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc...

However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading an APK, going to settings, clicking allow install from web, then installing the malware. (Don't @me about Samsung hardware issues, if you cared about quality/did research, you wouldn't have bought a Samsung Android. Or heck, anything from Samsung.)

Google is a crap company that I barely use(at most degoogled services and the occasional search when DDG can't do it), but we should give companies credit when they do things well. It promotes competency over relentless marketing.

Re: Google has a secret browser hidden inside the settings

#146

Post by eNV25 »

lopkeny12ko wrote: post #125
andreasha wrote: post #2

TIL mobile JavaScript console https://eruda.liriliri.io/

Is it just me or does this completely not work? When I paste the Javascript snippet into the address bar, nothing happens. And in Nightly it just performs a Google search with that string.

Try putting it in a bookmark and then execute it.

Re: Google has a secret browser hidden inside the settings

#148

Post by tired-turtle »

hospitalJail wrote: post #145
blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading a…

Not disagreeing, but consider the user base of iOS vs Android. iOS users are wealthier/etc., so exploits affecting them seem more likely to be “newsworthy” and, hence, more likely to be pursued (higher upside).

Similarly, consider how a sunken ferry that killed hundreds of migrants went largely unnoticed during the brouhaha surrounding the Titanic sub.

Re: Google has a secret browser hidden inside the settings

#149

Post by hgsgm »

blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

a browser is benign technology. If you want to block network access, you install a network filter.

Re: Google has a secret browser hidden inside the settings

#150

Post by esprehn »

kitsunesoba wrote: post #119
flutas wrote: post #76

Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be…

I wonder why they’re not using the system default webview… Does this mean it’s WebKit instead of Blink? If it is Blink, it seems likely that it’s not as up to date as the one provided by Chrome. EDIT: just noticed the docs link, yeah it’s WebKit.

It's not actually WebKit, that's just a package name that was poorly chosen a decade ago.

https://developer.android.com/develop/ui/views/layout/webapp...

It's the system WebView, it's just not using Custom Tabs.

https://developer.chrome.com/docs/android/custom-tabs/

Post reply on HN