Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

161–170 of 327 posts

Re: Google has a secret browser hidden inside the settings

#161

Post by LeonM »

chias wrote: post #143
stewx wrote: post #72

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue

That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc.

For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix".

Last time I checked, both vulnerabilities still exist.

Re: Google has a secret browser hidden inside the settings

#162

Post by hgsgm »

lopkeny12ko wrote: post #151
eNV25 wrote: post #146

Earlier quoted context omitted.

Try putting it in a bookmark and then execute it.

How is this supposed to work? Opening the bookmarks page navigates away from the current page. Even then, selecting the bookmark does nothing.

Works in Firefox, not Chrome. Android.

1. Bookmark any page, making a dummy

2. Menu > Bookmarks > edit

3. Change URL of dummy bookmark to the js bookmarklet code.

4. Visit any site.

5. Menu > Bookmarks > tap on the bookmarklet

6. Widget appears on bottom right of page

It doesn't work on HN(?) But does work on other sites.

Re: Google has a secret browser hidden inside the settings

#164

Post by wahnfrieden »

hospitalJail wrote: post #145
blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading a…

Google is substantially wiretapped

Re: Google has a secret browser hidden inside the settings

#166

Post by woobar »

hospitalJail wrote: post #145
blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading a…

Are you sure about biggest Android exploit?

Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number. [1]

[1] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

Re: Google has a secret browser hidden inside the settings

#167

Post by thunderbong »

rationalist wrote: post #109
borski wrote: post #79

Earlier quoted context omitted.

Both of which are forms of discovery

I can very easily "discover" how to make an illegal in under a minute using the internet, does that mean I should be allowed to have it? I'm pretty sure your response is not what the GP meant.

Sure. And if there are consequences, face them.

Re: Google has a secret browser hidden inside the settings

#168

Post by lucideer »

goolz wrote: post #142
naasking wrote: post #53

Earlier quoted context omitted.

> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

Ya, I could not upvote this more. Honestly physical security is usually one of the biggest fail points you will see in security audits. I also agree that there is nothing wrong with viewing users as potentially adversarial. I guess some of these responses surprise me, is all. I urge any sysadmins working with physical servers to reevaluate their access controls.

> there is nothing wrong with viewing users as potentially adversarial

There is a world of difference between considering users adversarially (social engineering is the most common threat vector bar none) and considering kiosk escape a serious threat.

Re: Google has a secret browser hidden inside the settings

#169

Post by tuukkah »

8ig8 wrote: post #135
tuukkah wrote: post #37

Earlier quoted context omitted.

A bookmarklet would be nice. This is how the current developer tools in browsers started (Firebug).

Bookmarking included in the project README… https://github.com/liriliri/eruda#demo

Thank you! I must have expected an embed code and missed the javascript: part.

Re: Google has a secret browser hidden inside the settings

#170

Post by BeFlatXIII »

blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

Good for those children. They have figured out to return control of the device to its user instead of it unquestioningly serving the interest of its owner.
Post reply on HN