201–210 of 327 posts
Earlier quoted context omitted.
This is baseless fud.
[flagged]
> Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.
Earlier quoted context omitted.
> Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.
No, you said they are 'unrelated to security.' Just admit you made a mischaracterization. It happens.
it's true they could be a part of the things security needs to care about, but so is a phone catching on fire because of its battery. which in of itself is not directly a security risk.
This is a bit like accessing the internet from chm (help) files when the browser was blocked. Damn. I revealed my age!
Earlier quoted context omitted.
[flagged]
https://news.ycombinator.com/newsguidelines.html > Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.
Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…
Maybe folks here have had good luck with other android roms
Earlier quoted context omitted.
[flagged]
> It’s documented fact Can you link any sources that document this?
Earlier quoted context omitted.
This is literally a privilege-escalation attack: i.e. the user escapes from controls that are imposed on them by the device manager (which may well not be the user, but a corporate MDM platform). Are you suggesting that privilege-escalation attacks are not security risks?
> Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.
OK, so we agree that, your original statement (which follows) is wrong, because it makes broad, tacit assumptions about the threat model that are not justified?
Security is a field related to protecting device-users from malicious actors.
Whereas a more conventional definition of information security would also involve protecting systems from unauthorized access, including privilege escalations (that's the E in STRIDE, right?) that bypass controls that were intended to apply to the user.
Honestly, it's baffling to me why you're arguing this point.
mmm my kids *will* use this if they find out about this. What would be a way to find out if they did? Does this leave any trace?