Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

181–190 of 327 posts

Re: Google has a secret browser hidden inside the settings

#181

Post by rvba »

hgsgm wrote: post #152
rvba wrote: post #93

Earlier quoted context omitted.

Truth must have really hurt you, if you even went through my post history. My earlier comment is guy earning 300k shouldnt say that things are cheap. My current comment is that Google does not hire the best anymore, but outsources to lowest cost bidders and results are visible -> quality suffers.

What are they paying $300K for, if outsourcers are doing the work?

Probably designers who make new products (that are likely to get cancelled). While their popular cash cows are maintained by lowest bidders since it is boring / difficult.

Re: Google has a secret browser hidden inside the settings

#183

Post by ukuina »

chias wrote: post #143
stewx wrote: post #72

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue

Well, it IS a known issue after you reported it to them in the first place! :-)

Re: Google has a secret browser hidden inside the settings

#184

Post by Xeamek »

woobar wrote: post #166
hospitalJail wrote: post #145

Earlier quoted context omitted.

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading a…

Are you sure about biggest Android exploit? Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number. [1] [1] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

To be exact, those aren't exploits of android itself, just the device it's running on. Not much of a difference in the outcome, but i guess it doesn't defeat the argument of google having good platform

Re: Google has a secret browser hidden inside the settings

#185

Post by naasking »

josephcsible wrote: post #158
naasking wrote: post #110

Earlier quoted context omitted.

First, that's a matter of opinion. Second, it's still wrong per my second point.

If you don't think DRM is illegitimate security, then what do you think is?

It still falls under security, obviously, which is why I listed it. Whether you like it or not is irrelevant.

Re: Google has a secret browser hidden inside the settings

#186

Post by butterNaN »

chias wrote: post #143
stewx wrote: post #72

This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.

That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue

I mean, technically it is a known issue now that they know about it ¯\_(ツ)_/¯

Re: Google has a secret browser hidden inside the settings

#187

Post by cratermoon »

saagarjha wrote: post #62
naasking wrote: post #53

Earlier quoted context omitted.

> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.

The role of the user as adversary is complicated, but it includes things like unintentional and coerced or duped actions. The desired behavior is to protect the user from their own mistakes or victimization. Some of the concerns GP raises overlap with security. In secure programming, the threat model always includes "user error".

Re: Google has a secret browser hidden inside the settings

#188

Post by berkes »

jeroenhd wrote: post #44
berkes wrote: post #31

Earlier quoted context omitted.

Can you visit arbitrary websites using such webviews? I never managed to. And IIRC it's rather difficult to set up a webview that allows multiple domains or URLs (but I'm no android dev, and the last time I had to fiddle with this, was years ago)

The reason it works here is that this particular webview opens a Google page that links to Google.com. There is no address bar so any safe browsing enforcement will make it at least two steps harder to access most had content. Blocking external domains shouldn't be that hard, but I also don't think parental controls are of any interest or priority for most app developers.

Last time I fiddled with it, was when we moved domains and our webviews stopped working. They i) did not follow the redirects we had in place, and ii) did not allow loading the new URL without whiltelisting that domain/url somewhere in the source-code.

IIRC whitelisting was the default in webviews; not sure if it still is, or if our expert Android dev configured it this way, but even getting a build that allowed to load content from our new domain required a new build. (Let alone that someone, even if we had links or such in our about.html, would be able to navigate there).

Re: Google has a secret browser hidden inside the settings

#189

Post by sroussey »

saagarjha wrote: post #81
johannes1234321 wrote: post #75

Earlier quoted context omitted.

Privilege escalation is a typical class soft security issues. The device owner (parent, school, etc.) set restrictions, which some other user bypasses.

Right, that’s a parental control scenario.

A Linux box with a root user and an end user and the end user can run things as root without root authentication—is that also parental controls?

Re: Google has a secret browser hidden inside the settings

#190

Post by lucideer »

NovemberWhiskey wrote: post #178
lucideer wrote: post #33

Earlier quoted context omitted.

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an…

This is literally a privilege-escalation attack: i.e. the user escapes from controls that are imposed on them by the device manager (which may well not be the user, but a corporate MDM platform). Are you suggesting that privilege-escalation attacks are not security risks?

> Are you suggesting that privilege-escalation attacks are not security risks?

Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.

Post reply on HN