Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

261–270 of 327 posts

Re: Google has a secret browser hidden inside the settings

#261

Post by nomel »

Dylan16807 wrote: post #212
rileymat2 wrote: post #96

Earlier quoted context omitted.

In this case the “user” is in part the person granting controlled access. The person moving the mouse is not the user in total. Take a easier example an atm machine. If a person touching it can access accounts/remove money, there is no question about it being a security problem.

Someone on an ATM accessing accounts other than their own is a security problem. Someone on an ATM accessing youtube is not a security problem.

Being able to display whatever you want on an ATM machine is absolutely a security problem. I could put a fake PIN prompt, a prompt to enter the card number because the reader is broken, whatever. This comment sections is blowing my mind, and is a great example of why dedicated security teams are required, in the world of software.

Re: Google has a secret browser hidden inside the settings

#262

Post by adwww »

toast0 wrote: post #247
Steuard wrote: post #204

Earlier quoted context omitted.

Are we revealing our age through exploits now? How about "using gopher on a university library terminal to access a site that launched a telnet session so you can check your out-of-state college email over the summer"?

I definitely didn't use the open dialog in Notepad to run other executables at the library.

WinPopup LAN messenger!

Re: Google has a secret browser hidden inside the settings

#263

Post by bastawhiz »

This is an ancient form of exploit that was (and maybe still is) very popular with Windows: from the ctrl+alt+delete lock screen, you could open things like Help and accomplish similar actions, eventually getting access to a browser (which, in Windows' case, was also ~Windows Explorer with full file system access).

Re: Google has a secret browser hidden inside the settings

#264

Post by asdff »

hgsgm wrote: post #149
blagie wrote: post #10

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exp…

a browser is benign technology. If you want to block network access, you install a network filter.

Back in my day we would run laps around the school webmaster and their site blocking. Eventually they gave up when they realized there were more proxy sites available for us kids to find than time they had to go through the logs and block this stuff on top of their usual IT workload for the week. At some point we also realized you could proxy a website with google translate, and that basically became as good as gold in terms of an unblockable proxy, because kids needed that website for language classes.

Re: Google has a secret browser hidden inside the settings

#265

Post by nomel »

Mystery-Machine wrote: post #234
Angostura wrote: post #38

Earlier quoted context omitted.

> Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children

If you (in this case parent) block something (in this case browsing porn sites) on some software (in this case Android device), it most definitely _is_ a security issue if the user (in this case a child) can bypass the restriction you imposed. I don't understand what's not clear there? If your phone is locked with a pin and you pass it to your friend (Stifler) because his mom just called you, he should not in any cir…

Related, I used to root my old android phones by going to rooting websites that would do it all in browser.

Re: Google has a secret browser hidden inside the settings

#266

Post by drivebycomment »

tired-turtle wrote: post #148
hospitalJail wrote: post #145

Earlier quoted context omitted.

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading a…

Not disagreeing, but consider the user base of iOS vs Android. iOS users are wealthier/etc., so exploits affecting them seem more likely to be “newsworthy” and, hence, more likely to be pursued (higher upside). Similarly, consider how a sunken ferry that killed hundreds of migrants went largely unnoticed during the brouhaha surrounding the Titanic sub.

https://zerodium.com/program.html

Zerodium pays more for Android zero click FCP(full chain with persistence) than on iOS zero click FCP. Most other categories Android and iOS exploits pay the same.

Re: Google has a secret browser hidden inside the settings

#267

Post by Dwedit »

seeknotfind wrote: post #250
Dwedit wrote: post #245

Earlier quoted context omitted.

Okay, I'll bite... How did you bring up a web browser from XP Calculator? I know there's HTML Help, but I don't see a way to get on to the internet from there.

I found an article on it: https://techieinspire.com/how-to-access-the-internet-via-ms-...

Thanks, did not think to check the System Menu.

Re: Google has a secret browser hidden inside the settings

#268

Post by kinlan »

youngtaff wrote: post #159
flutas wrote: post #76

Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be…

Alex Russell talked about Android's WebView not being Chrome at State of the Browser in 2021 https://2021.stateofthebrowser.com/speakers/alex-russell/

Huh. Where did he say that? WebView is Chromium and it's updated alongside Chrome updates. There are differences because of the process model in apps and some APIs aren't available...

https://chromium.googlesource.com/chromium/src/+/HEAD/androi....

Re: Google has a secret browser hidden inside the settings

#269

Post by dgellow »

bmicraft wrote: post #200
tweakor wrote: post #66

Earlier quoted context omitted.

That's exactly what this is. It's Android System Webview, the embedded browser that apps use when they aren't a browser themselves.

Sorry, but how is this news then? The Google settings have never felt native and therefore were almost certainly a browser for a very long time now

Why does it have to be news? Someone wanted to share what they found, that’s what personal blogs are for. Nothing more.

Re: Google has a secret browser hidden inside the settings

#270

Post by blowski »

blagie wrote: post #256
blowski wrote: post #227

Earlier quoted context omitted.

Seems like an argument about system-driven and component-driven risk analyses - they both have their place, and they're not mutually exclusive. Risk-based approaches aren't about either removing all risk or paying attention to only the highest priority ones. Instead, they are about managing and tracking risk at acceptable levels based on threat models and the risk appetites of stakeholders, and implementing appropria…

It's a slightly different argument. The level of "reasonable risk" depends on the attacker in both situations. The odds of any individual crafting a special packet to crash my system are absurdly low. However, "absurdly low" is good enough. All it took was one individual to come up with the ping-of-death and one more to write a script to automate it, and systems worldwide were being taken down by random teenagers in…

Do you think there’s a standard for “incredibly hard” that all applications need to follow? Or that it varies from one application to another depending on context?
Post reply on HN