Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

21–30 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#21

Post by kb120 »

untog wrote: post #16
kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't . Pointing out Firefox and Opera is all very well, but this is the default b…

Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#22

Post by yeahforbes »

steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#23

Post by kb120 »

sitkack wrote: post #20
kb120 wrote: post #11

So the bug is only for a browser that isn't supported by Google? No surprise that it hasn't been patched. If security is such a big deal to a user they should use a browser that is supported by a strong development team. Firefox and Opera Mobile work fine on low end phones.

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?

Only 20% of mobile web traffic comes from ASOP browser.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#24

Post by untog »

kb120 wrote: post #21
untog wrote: post #16

Earlier quoted context omitted.

"a browser that isn't supported by Google" But still a browser that was created by Google and was bundled with the OS until 12 months ago, never mind how long it takes OEMs to roll it out. Android https://developer.android.com/about/dashboards/index.html?ut... Just because Google decided not to support it any more doesn't mean they shouldn't . Pointing out Firefox and Opera is all very well, but this is the default b…

Very few people explore other browsers? Alt browsers are often the first app that people download. Chrome is included in gapps.

Alt browsers are often the first app the people download.

Which people? I'll grant that Chrome is an exception, given that it's bundled, but I've never seen usage number of other alternative Android browsers hit any meaningful numbers.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#27

Post by gress »

kb120 wrote: post #23
sitkack wrote: post #20

Earlier quoted context omitted.

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?

Only 20% of mobile web traffic comes from ASOP browser.

That's because most web traffic comes from iOS. AOSP Browser represents about half of the Android traffic.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#28

Post by worklogin »

kb120 wrote: post #23
sitkack wrote: post #20

Earlier quoted context omitted.

So on 90% of phones when someone opens "the web" using the browser installed on their device, they are using an unsupported browser. How would they know this?

Only 20% of mobile web traffic comes from ASOP browser.

That's 1 in 5 mobile users! How can you argue that 20% is small?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#29

Post by gress »

jonknee wrote: post #26
lucb1e wrote: post #19

Earlier quoted context omitted.

Use Firefox. Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.

https://code.google.com/p/chromium/wiki/AndroidBuildInstruct...

That's not chrome.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#30

Post by fastest963 »

jonknee wrote: post #26
lucb1e wrote: post #19

Earlier quoted context omitted.

Use Firefox. Why? Chrome isn't open source, if you care about that kind of thing. And personal preference also.

https://code.google.com/p/chromium/wiki/AndroidBuildInstruct...

I've built it using these instructions before and it's not that difficult at all.
Post reply on HN