151–160 of 327 posts
Earlier quoted context omitted.
Is it just me or does this completely not work? When I paste the Javascript snippet into the address bar, nothing happens. And in Nightly it just performs a Google search with that string.
Try putting it in a bookmark and then execute it.
Earlier quoted context omitted.
Says the person whose last comment is upset that their engineers have a $300k salary?
Truth must have really hurt you, if you even went through my post history. My earlier comment is guy earning 300k shouldnt say that things are cheap. My current comment is that Google does not hire the best anymore, but outsources to lowest cost bidders and results are visible -> quality suffers.
Further " Secret " is highly inaccurate; this is easily known public knowledge..
Earlier quoted context omitted.
> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Good. Parental/school controls don't belong on the device. They belong on whatever the device connects to. That would be parental/school networks. If you don't want your kids to connect to things then don't let your kids have devices that connect to things. > 2) In some contexts (especially as high-stakes test settings, but al…
Security belongs on the endpoint. How do you know there aren’t malicious or compromised devices on the school network?
Visiting malicious sites can't harm a properly working devices.
Earlier quoted context omitted.
> How would network restrictions help, there is WiFi at friends houses / everywhere. Aren't there other Internet-connected devices at friends' houses too?
Yes, however, locking your children in a Faraday cage is likely to be frowned upon.
This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.
Is it fixed now?
Earlier quoted context omitted.
> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an…
This could also be considered a sandbox bypass. A device/application is given a limited set of capabilities to ensure that if something does go wrong, the affected area is small and well known. This effectively eliminates those safeguards and provides a gaping hole that most systems designers would think had been closed vis other configuration. As others have pointed out: kiosks, schools, prisons, POS, the check-in d…
I agree but you've very appropriately used the word "could" here. The gp bemoaned Google not prioritising this issue as a serious security concern. Whether it could theoretically be classified under security if X, Y & Z were true, due to the to-the-letter definition of access control threat models, doesn't mean that in this specific case of a consumer device, that using a browser from settings is a high severity risk. Even if it were a bypass of something like Nessus/Crowdstrike/et al (and not just consumer parental controls), it still wouldn't represent a significant threat as a simple kiosk escape in isolation.
Any definition that classifies this as the gp is proposing is a theoretical nitpick, not an actual considered threat model.
Earlier quoted context omitted.
> > The user is generally never the adversary in any legitimate security situation. > First, this isn't correct, for instance, DRM and TPM. You must have missed the word "legitimate". DRM and TPM are two of the best examples of illegitimate "security".
First, that's a matter of opinion. Second, it's still wrong per my second point.
Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be…
Earlier quoted context omitted.
You can do that (Win95) https://www.youtube.com/watch?v=1UfNlRe-goY Or you can hit cancel (Win98) https://www.youtube.com/watch?v=LHgjN_RwH6g Or can you simply close the password dialog and wait (Win98) https://www.youtube.com/watch?v=Uk_SKw9hOpQ
Except on Windows for Workgroups and Windows 9x/ME the fact that you can dismiss the login dialog is intentional feature, so bypassing it through help is just a more convoluted way of doing something that should be possible. It is feature because the login window is there primarily as an single sign on mechanism for remote network services (which obviously would not work when you just dismiss it) and there is no secu…