Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has a secret browser hidden inside the settings

matan-h.com

Post reply on HN
Print view View original

311–320 of 327 posts

Re: Google has a secret browser hidden inside the settings

#311

Post by inanutshellus »

kbenson wrote: post #253
flutas wrote: post #76

Did some investigation. So when you click on "Manage my account" you actually get taken out of the settings app and into an Activity (name for the "screen" God object on Android) embedded inside of Google Play Services. Eventually, following this the browser is com.google.android.gms/.auth.folsom.ui.GenericActivity. This doesn't seem to be using the default system webview implementation, as on my phone that would be…

> gaiaId (Google Accounts and ID Administration ID) Wow, someone at Google is undoubtedly proud of coming up with that for what I assume is essentially a Google world wide unique ID, and for good reason.

Reminds me of the "Agents of S.H.I.E.L.D." scene where someone quips "Sounds like someone just really wanted it to spell 'shield'."

Re: Google has a secret browser hidden inside the settings

#312

Post by Asooka »

berkes wrote: post #188
jeroenhd wrote: post #44

Earlier quoted context omitted.

The reason it works here is that this particular webview opens a Google page that links to Google.com. There is no address bar so any safe browsing enforcement will make it at least two steps harder to access most had content. Blocking external domains shouldn't be that hard, but I also don't think parental controls are of any interest or priority for most app developers.

Last time I fiddled with it, was when we moved domains and our webviews stopped working. They i) did not follow the redirects we had in place, and ii) did not allow loading the new URL without whiltelisting that domain/url somewhere in the source-code. IIRC whitelisting was the default in webviews; not sure if it still is, or if our expert Android dev configured it this way, but even getting a build that allowed to l…

Please use "allowlist" instead of "wh_telist".

Re: Google has a secret browser hidden inside the settings

#313

Post by bsimpson »

lkois wrote: post #307
bsimpson wrote: post #63

I used to do the same thing in the lobby while my parents were banking. Those "best viewed in Netscape Navigator" tags were golden for this. Workflow was almost exactly the same: click through until you get a "best viewed in" tag and get from there to a search engine.

I've used this to get to a browser that almost does full screen videos in a borrowed Tesla, from the YouTube app. Then navigated to some dodgy adware infested streaming site and it was working okay until changing to another video, when it froze the whole Tesla computer and the car needed a hard reboot

"How's 2023 going?"

"Well, I played a video and crashed my car. …not like that."

Re: Google has a secret browser hidden inside the settings

#314

Post by scarface_74 »

dr_kiszonka wrote: post #301
scarface_74 wrote: post #280

Earlier quoted context omitted.

Been there done that. https://www.nyx.net/ Allowed free shell accounts and the college board in GA offered free local dialup access to a Gopher server (Peachnet). I had a terminal script that navigated through the Gopher menu until I could get to Nyx.

Wow - they still host user websites, some of which are from the 90's, with iframes, patterned backgrounds, etc. So cool. https://www.nyx.net/userhomes.html

I find it quite amusing that you are warned about “large websites” they host where the pages are over 25Kb

Re: Google has a secret browser hidden inside the settings

#315

Post by c22 »

8organicbits wrote: post #302
blagie wrote: post #258

Earlier quoted context omitted.

> Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). I have to agree. Google has O(200k) employees, and included among those, are some of the best security people…

> I wanted to collect records, go to the police, and have the criminal arrested. That's not really how it works. The police can subpoena Google for the records, they won't trust audit logs you provide. Just file a police report if this is a real issue.

I don't think police issue subpoenas. They may be able to acquire a warrant to force google to turn over data, but would they actually do it? They would certainly require some sort of preliminary evidence or probable cause.

Of course your attorney could file an action against google (or another party) and a court could subpoena google's records to resolve it, but that's starting to sound expensive...

Re: Google has a secret browser hidden inside the settings

#317

Post by nomel »

Dylan16807 wrote: post #292
nomel wrote: post #261

Earlier quoted context omitted.

Being able to display whatever you want on an ATM machine is absolutely a security problem. I could put a fake PIN prompt, a prompt to enter the card number because the reader is broken, whatever. This comment sections is blowing my mind, and is a great example of why dedicated security teams are required, in the world of software.

You're assuming they have control of a lot of the screen, and that they have access to the keypad. Or even that they can get to sites other than youtube. Please don't assume the case that makes my post the weakest. Your mind is blown because you're reading way too much into my hypothetical.

> Or even that they can get to sites other than YouTube.

Playing a video directing the user to call a number would be enough to trick some people. Enabling social engineering is a security problem.

Security is minding the specifics, which requires not assuming things are ok. That's why red teams exist, and why the default assumption of "it's not ok" is the correct assumption. ;)

We'll find out if the specific case in the article is a problem or not, once people look at it very closely. We may not have this luxury with our hypothetical ATM, though.

Re: Google has a secret browser hidden inside the settings

#318

Post by Dylan16807 »

nomel wrote: post #317
Dylan16807 wrote: post #292

Earlier quoted context omitted.

You're assuming they have control of a lot of the screen, and that they have access to the keypad. Or even that they can get to sites other than youtube. Please don't assume the case that makes my post the weakest. Your mind is blown because you're reading way too much into my hypothetical.

> Or even that they can get to sites other than YouTube. Playing a video directing the user to call a number would be enough to trick some people. Enabling social engineering is a security problem. Security is minding the specifics, which requires not assuming things are ok. That's why red teams exist, and why the default assumption of "it's not ok" is the correct assumption. ;) We'll find out if the specific case in…

I'm not here to make assumptions. I'm here to point out "being able to open a web page in a context like that is not necessarily a security problem", and I'm sure you can think of an example if you don't like my example.

With an existence proof, you only have to worry about the narrowest possible interpretation. The skill of considering what an exploit could lead to is very important, but it fits oddly into such a hypothetical. Finding a possible flaw doesn't invalidate an existence proof unless you also can't think of a way to mitigate it.

Also if the video is small and says youtube and tricks a user I'm not sure I would call that a security problem. You can trick users with a post-it note, and that doesn't mean there's anything wrong on a technical level.

Re: Google has a secret browser hidden inside the settings

#319

Post by nomel »

Dylan16807 wrote: post #318
nomel wrote: post #317

Earlier quoted context omitted.

> Or even that they can get to sites other than YouTube. Playing a video directing the user to call a number would be enough to trick some people. Enabling social engineering is a security problem. Security is minding the specifics, which requires not assuming things are ok. That's why red teams exist, and why the default assumption of "it's not ok" is the correct assumption. ;) We'll find out if the specific case in…

I'm not here to make assumptions. I'm here to point out "being able to open a web page in a context like that is not necessarily a security problem", and I'm sure you can think of an example if you don't like my example. With an existence proof, you only have to worry about the narrowest possible interpretation. The skill of considering what an exploit could lead to is very important, but it fits oddly into such a hy…

> You can trick users with a post-it note, and that doesn't mean there's anything wrong on a technical level.

Sure, but something present on the screen of a trusted system is very very different than a post it note. This claim is why I'm sticking strong by my assertion that this is why red teams exist. That's a really baffling view of security, to me.

Re: Google has a secret browser hidden inside the settings

#320

Post by Dylan16807 »

nomel wrote: post #319
Dylan16807 wrote: post #318

Earlier quoted context omitted.

I'm not here to make assumptions. I'm here to point out "being able to open a web page in a context like that is not necessarily a security problem", and I'm sure you can think of an example if you don't like my example. With an existence proof, you only have to worry about the narrowest possible interpretation. The skill of considering what an exploit could lead to is very important, but it fits oddly into such a hy…

> You can trick users with a post-it note, and that doesn't mean there's anything wrong on a technical level. Sure, but something present on the screen of a trusted system is very very different than a post it note. This claim is why I'm sticking strong by my assertion that this is why red teams exist. That's a really baffling view of security, to me.

You're still not listening to my real point.

Pretend it can only play a rickroll, no other videos. Or I could come up with something more reasonable like "it only does top trending and you need to hold keys down so if you don't have skimmer-level tech to shove in you can't persist the exploit" or whatever.

I'm saying there's some scenario where it's not a security issue.

You don't need to prove that there are scenarios that are security issues. That's obvious.

Post reply on HN