Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

221–230 of 327 posts

Re: Google has a secret browser hidden inside the settings

#221

Post by matan-h »

Aerbil313 wrote: post #203

Haha, I spent an embarrassing amount of time hunting down browsers hidden in apps in the past. The same thing exists in iOS and bypasses for example a time restriction on Safari or Chrome, but can't bypass domain ban or domain time limit restrictions (also included in parental controls). You can access google.com from many apps, I'd say probably half of them. Especially Apple Support app and Microsoft and Google Apps…

Me too, I have a folder in my android called "breakthrough" and it has 20 applications, including Zoom, waze, Spotify, and so on... apparently, now, it should also include Google and maybe even the Settings :)

Re: Google has a secret browser hidden inside the settings

#222

Post by Dylan16807 »

thunderbong wrote: post #167
rationalist wrote: post #109

Earlier quoted context omitted.

I can very easily "discover" how to make an illegal in under a minute using the internet, does that mean I should be allowed to have it? I'm pretty sure your response is not what the GP meant.

Sure. And if there are consequences, face them.

"if there are consequences" is begging the question.

Re: Google has a secret browser hidden inside the settings

#223

Post by mlyle »

lucideer wrote: post #33
blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an…

> Security is a field related to protecting device-users from malicious actors.

This is one of many aspects of security-- perhaps what Google considers most important on Android, but surely you can imagine some scenarios which we care about which aren't about an end-user getting attacked.

(Indeed, sometimes security is all about protecting infrastructure, assets, or information from device users).

Besides, the third point that you cavalierly dismiss above:

> > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations

directly relates to even your limited notion of security.

Re: Google has a secret browser hidden inside the settings

#224

Post by KingMachiavelli »

jeroenhd wrote: post #44
berkes wrote: post #31

Earlier quoted context omitted.

Can you visit arbitrary websites using such webviews? I never managed to. And IIRC it's rather difficult to set up a webview that allows multiple domains or URLs (but I'm no android dev, and the last time I had to fiddle with this, was years ago)

The reason it works here is that this particular webview opens a Google page that links to Google.com. There is no address bar so any safe browsing enforcement will make it at least two steps harder to access most had content. Blocking external domains shouldn't be that hard, but I also don't think parental controls are of any interest or priority for most app developers.

It'd be pretty simple to enforce sandbox/parental controls for the integrated webview browser.

1. Just limit the webview browser location to the same list as allowed by the parental control.

2. By default limit the webview browser location to the domain first opened by the app i.e locked to a single domain by default.

3. Allow webview browser to be expanded via a regex/pattern list of domains.

4. Limit the number of webview browser location changes so even if you can access a search engine with a global domain allowlist, it would just return to the first page after N window.location changes.

There's plenty of introspection you can do via JS (which is already being used to set/inject that `mm` object), it could even check for certain DOM elements, HTTPS fingerprint, etc. to determine if the page is an "intended" destination for the particular integrated webview browser.

Re: Google has a secret browser hidden inside the settings

#225

Post by kernal »

blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

>Google's increasingly cavalier attitude towards security is concerning:

>1) Kids WILL use this to bypass parental / school controls as soon as they learn about it

What an utterly ridiculous take. It's 2023 and there are a myriad of options available for kids accessing content they want to see without using some convoluted and hamstrung procedure.

Re: Google has a secret browser hidden inside the settings

#226

Post by mlyle »

Ajedi32 wrote: post #174
rileymat2 wrote: post #96

Earlier quoted context omitted.

In this case the “user” is in part the person granting controlled access. The person moving the mouse is not the user in total. Take a easier example an atm machine. If a person touching it can access accounts/remove money, there is no question about it being a security problem.

Yeah, it's important to make a distinction between the "user" and the device owner. Often those are the same person but not always. Treating the user as an adversary can be okay in some circumstances, but treating the device owner as an adversary is never acceptable in my opinion.

The whole problem with security is that it's often difficult to tell whether all steps of what are happening now align with the device owner's true intent--

* Is it the device owner providing the direction to do this?

* Will the input being consumed as a result of this direction result in actions that the device owner approves of?

etc.

A kind of blanket assumption that everyone and everything is the adversary is a good starting point. The system needs to protect itself, in order to be able to faithfully follow the owner's instructions in the future.

Re: Google has a secret browser hidden inside the settings

#227

Post by blowski »

blagie wrote: post #177
lucideer wrote: post #91

Earlier quoted context omitted.

One can absolutely make an argument for a great many risks to be classified under security concern: there are certainly more than just these two. Doing so is simply reductio ad absurdum. To expand on this, we can if we choose classify all parental controls under general access control, and within a principle of least privilege further classify the following as legitimate security risks: - access to the internet - acc…

Please take this as critical feedback, and not as a personal attack: The comments which you are making here suggest that you shouldn't develop any software which in any way touches personal data without significant upskilling on IT security. You're making false comments with complete confidence. Most security scenarios came about as a result of attackers being able to bring systems into absurd situations, and moving…

Seems like an argument about system-driven and component-driven risk analyses - they both have their place, and they're not mutually exclusive. Risk-based approaches aren't about either removing all risk or paying attention to only the highest priority ones. Instead, they are about managing and tracking risk at acceptable levels based on threat models and the risk appetites of stakeholders, and implementing appropriate mitigations.

https://www.ncsc.gov.uk/collection/risk-management/introduci...

Re: Google has a secret browser hidden inside the settings

#228

Post by kurthr »

LeonM wrote: post #161
chias wrote: post #143

Earlier quoted context omitted.

That is, to a T, almost identical to my experience reporting a vulnerability to Google too. Me: Here's a bug in Gmail that allows spoofed email to scrub DKIM failures and appear legitimate Google: "Won't fix (Intended Behavior)" Me: Really? Google intends to allow spoofed email to appear legitimate in its interface? Google: Actually, it's a known issue

That is our experience with Microsoft as well. We have submitted two separate email related vulnerabilities with O365, one if which we would consider rather serious. We took our time to create a detailed report, with steps to reproduce, etc. For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix". Last time I checked, both vulnerabilities still exist.

Provide a 90 day timeline for the release of exploit.

Re: Google has a secret browser hidden inside the settings

#229

Post by rationalist »

rationalist wrote: post #199
thunderbong wrote: post #167

Earlier quoted context omitted.

Sure. And if there are consequences, face them.

Generally kids are not able to comprehend or foresee all of the consequences of their actions which is why parents and their communities set rules/restrictions for kids.

I'm curious as to the reasoning behind why someone apparently disagrees with that.

Re: Google has a secret browser hidden inside the settings

#230

Post by russellbeattie »

Honestly, this is pretty sloppy and Google should know better.

I've done a lot of work with WebView on Android and it's a straightforward process to intercept requests to whitelist domains. It's well trodden ground [1], especially for apps that use the WebView for their entire UI. This is an oversight by everyone from the dev team to the product manager to the QA working on it.

1. https://blog.oversecured.com/Android-security-checklist-webv...

Post reply on HN