Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

191–200 of 327 posts

Re: Google has a secret browser hidden inside the settings

#191

Post by berkes »

marionauta wrote: post #52
berkes wrote: post #31

Earlier quoted context omitted.

Can you visit arbitrary websites using such webviews? I never managed to. And IIRC it's rather difficult to set up a webview that allows multiple domains or URLs (but I'm no android dev, and the last time I had to fiddle with this, was years ago)

It's possible. I remember one app that opened a webview to their terms of use page, which somewhere had a link to a Google page, which I could use to go to Google search. So, no direct URL input, but you could go to any website indexed.

IIRC webview, by default, requires a dev to whitelist domains. Maybe that has changed, IDK.

But finding an example where you can navigate elsewhere is not proof that all webviews are broken; maybe they have this "security issue" by default and allow a dev to tighten it (bad sec. practice IMO), and maybe android versions or SDK-versions differ in how they adhere, IDK. But the times that I encountered this and fiddled with it, it was a PIAS to even allow loading a page from another domain.

Re: Google has a secret browser hidden inside the settings

#192

Post by kapp_in_life »

saagarjha wrote: post #68
msephton wrote: post #57

My brother uses a similar trick to get to a browser to bypass login on locked Android devices. It blows my mind that they can't see the security implications of this.

Getting to a browser isn’t really a security vulnerability; many devices will even have a “guest” mode that provides direct access to the internet.

Letting your kid or younger relatives use up your mobile data from your locked phone might not be a vulnerability but definitely isn't the expected behavior.

Re: Google has a secret browser hidden inside the settings

#193

Post by sota4077 »

TeMPOraL wrote: post #27
huxflux wrote: post #14

This brings back memories of older Windows versions, where you could push F1 and trigger various run commands through Windows Help

My first thought too - this feels like that "F1 -> Open Help File -> Other... -> right-click on explorer.exe and select Run" method of bypassing login screen circa Windows 95/98.

I had not thought of this ins multiple decades at this point, but I used to do this too! What a trip down memory lane.

Re: Google has a secret browser hidden inside the settings

#194

Post by gfodor »

lucideer wrote: post #190
NovemberWhiskey wrote: post #178

Earlier quoted context omitted.

This is literally a privilege-escalation attack: i.e. the user escapes from controls that are imposed on them by the device manager (which may well not be the user, but a corporate MDM platform). Are you suggesting that privilege-escalation attacks are not security risks?

> Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.

No, you said they are 'unrelated to security.' Just admit you made a mischaracterization. It happens.

Re: Google has a secret browser hidden inside the settings

#195

Post by freedomben »

blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

> I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives.

Doesn't that seem a little hyperbolic? "Ruin somebody's life" seems pretty dramatic.

Re: Google has a secret browser hidden inside the settings

#197

Post by efreak »

hgsgm wrote: post #162
lopkeny12ko wrote: post #151

Earlier quoted context omitted.

How is this supposed to work? Opening the bookmarks page navigates away from the current page. Even then, selecting the bookmark does nothing.

Works in Firefox, not Chrome. Android. 1. Bookmark any page, making a dummy 2. Menu > Bookmarks > edit 3. Change URL of dummy bookmark to the js bookmarklet code. 4. Visit any site. 5. Menu > Bookmarks > tap on the bookmarklet 6. Widget appears on bottom right of page It doesn't work on HN(?) But does work on other sites.

If you're on Android and want eruda, I've got a userscript to load it on every site here: https://github.com/Efreak/UserScripts/tree/master/Eruda-Mobi...

It helps with things like removing elements because you can see the DOM and it's fewer clicks away and easier to use than ublock, which doesn't show the DOM in the little box provided for element removal and only allows removing one item say a time (you can use multiple selectors, but every time you tap an element to get the selector it overwrites the existing content)

Re: Google has a secret browser hidden inside the settings

#198

Post by doublerabbit »

alpaca128 wrote: post #196
wahnfrieden wrote: post #179

Earlier quoted context omitted.

[flagged]

> It’s documented fact Can you link any sources that document this?

https://www.vice.com/en/article/qkvaam/google-confirms-cops-...

https://heartland.org/opinion/widespread-wiretapping-is-how-...

https://www.reuters.com/article/us-alphabet-google-privacy-l...

To post a few

Re: Google has a secret browser hidden inside the settings

#199

Post by rationalist »

thunderbong wrote: post #167
rationalist wrote: post #109

Earlier quoted context omitted.

I can very easily "discover" how to make an illegal in under a minute using the internet, does that mean I should be allowed to have it? I'm pretty sure your response is not what the GP meant.

Sure. And if there are consequences, face them.

Generally kids are not able to comprehend or foresee all of the consequences of their actions which is why parents and their communities set rules/restrictions for kids.

Re: Google has a secret browser hidden inside the settings

#200

Post by bmicraft »

tweakor wrote: post #66
londons_explore wrote: post #3

Is this different than any other embedded webview? Doesn't nearly every app somewhere have an embedded webview somewhere for things like "view privacy policy", where it is often much easier to display html than sending the whole privacy policy to your app developer?

That's exactly what this is. It's Android System Webview, the embedded browser that apps use when they aren't a browser themselves.

Sorry, but how is this news then? The Google settings have never felt native and therefore were almost certainly a browser for a very long time now
Post reply on HN