Earlier quoted context omitted.
> gaiaId (Google Accounts and ID Administration ID) Wow, someone at Google is undoubtedly proud of coming up with that for what I assume is essentially a Google world wide unique ID, and for good reason.
Reminds me of the "Agents of S.H.I.E.L.D." scene where someone quips "Sounds like someone just really wanted it to spell 'shield'."
Google has a secret browser hidden inside the settings
321–327 of 327 posts
Re: Google has a secret browser hidden inside the settings
#322Earlier quoted context omitted.
> Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). I have to agree. Google has O(200k) employees, and included among those, are some of the best security people…
> I wanted to collect records, go to the police, and have the criminal arrested. That's not really how it works. The police can subpoena Google for the records, they won't trust audit logs you provide. Just file a police report if this is a real issue.
That's not how real-world police departments work, at least where I live. The police are lazy. They receive many complaints, and ignore most of them. Coming to the police with allegations and no evidence simply doesn't go anywhere.
Audit logs I provide won't be enough for criminal prosecution. They would be enough evidence to cause my local police to investigate, as well as adequate cause for a warrant to Google.
Re: Google has a secret browser hidden inside the settings
#323Earlier quoted context omitted.
It depends on context. There are many pieces here: 1) Cost of compromise. - For example, medical data, military secrets, and highly-personal data need a high level of security. - Something like Sudoku high scores, perhaps not so much. 2) Benefit of compromise. Some compromises net $0, and some $1M. - Something used by 4B users (like Google) has much higher potential upside than something used by 1 user. If someone ca…
If I’m reading you right, if a business had a non-critical internal system (internal network behind a strong VPN) with the potential for a CSRF attack, you wouldn’t call that a risk?
It's a risk.
Having is having glass windows (at least at street level).
Whether it's a risk worth addressing depends on a lot of specifics.
For example, a CSRF attack on something like sharepoint.business.com could be externally exploited with automated exploits. That brings you to the 7B attacker scenario, and if the business has 100,000 employees, likely one of them will hit on an attack.
A CSRF attack on a custom application only five employees know about has decent security-by-obscurity. An attacker would need to know URLs and similar business-internal information, which only five people have access to. Those five people can just as easily walk into the CEOs office and physically compromise the machine.
Re: Google has a secret browser hidden inside the settings
#324Earlier quoted context omitted.
Well said. Spoken like a true Google engineer! However, I think you understand both security as a field, at least one of my three points, as well as children and parenting. =================== Security as a field =================== You wrote: "Security is a field related to protecting device-users from malicious actors." This is a very narrow and incorrect definition. Security as a field relates to many things, incl…
That's a nice long reply - I'll try and keep my response a bit shorter. You (and many many of the replies in thread) have taken the initial topic (kiosk escape -vs- parental controls) and are defending their definition as a serious security threat by likening them to social engineering attacks on medical staff. These are separate scenarios with separate threat models. If your child is sending confidential corporate d…
I'll keep it short too: You don't understand what (many) people are trying to explain to you, and are coming to dangerously incorrect conclusions. If many people are giving you the same feedback, it should trigger something in your head, but somehow, it doesn't. You don't even seem to be trying to understand or considering the fact you might be missing something, so I'm giving up.
Please do not ever build systems which ever touch any sort of critical data or which work on consumer devices outside of a sandbox until you've picked up basic clue about security.
Re: Google has a secret browser hidden inside the settings
#325Earlier quoted context omitted.
Last time I fiddled with it, was when we moved domains and our webviews stopped working. They i) did not follow the redirects we had in place, and ii) did not allow loading the new URL without whiltelisting that domain/url somewhere in the source-code. IIRC whitelisting was the default in webviews; not sure if it still is, or if our expert Android dev configured it this way, but even getting a build that allowed to l…
Please use "allowlist" instead of "wh_telist".
huh? why? is there a bot checking for this word? will it get someone in trouble?
Re: Google has a secret browser hidden inside the settings
#326Earlier quoted context omitted.
Are you pretending to be a moderator? Referencing widely documented news isn’t an insinuation. If you want to see the links yourself you can just ask - not every post here has citations linked even when already widely available/known (I see several people have provided several references already)
> You’re apparently an employee shareholder with a bias.
Don’t care
Re: Google has a secret browser hidden inside the settings
#327This guy's experience reporting a bug to Google reminds me of mine: Me: Here's a bug in Google Sheets that exposes deleted content to third parties. Google: Not a bug. Working as expected, closing issue. Me: Really? I was personally harmed by this bug while using the application. Google: Actually, it is a bug but it's a longtime known issue, therefore you are not eligible for bug bounty. Closing issue.
I have an addition to this story:
Me: here's a bug in Google Play Services.
Google: Not a bug, working as expected, closing issue.
Me: posted the bug on my blog, and it's get extensive media coverage.
Google: It seems we were wrong! It is indeed a bug. We will return to you in a few weeks.