Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

161–170 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#161

Post by pmontra »

fencepost wrote: post #141
AjithAntony wrote: post #86

Earlier quoted context omitted.

Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again. I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep. When I s…

I'm reinstalling right now to test, it shows as a ~28MB download. I feel pretty confident it's not cached data in my case, as I don't use the Chrome browser on my phone (I prefer Dolphin with gestures & LastPass integration), and on a tablet I only use it for logging into wifi hotspots. .... And after the reinstall it shows up as 65MB of app.

Dolphin is affected too.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#162

Post by scintill76 »

azernik wrote: post #53
gress wrote: post #29

Earlier quoted context omitted.

That's not chrome.

It is very very close: https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... tl;dr: Chromium is Chrome minus: 1. Crash/usage reporting to Google. 2. Proprietary video format support 3. Embedded Flash implementation (which doesn't exist on mobile anyway). 4. Google API keys. If what you care about is security auditability, that's pretty good. If you care about running only open source software, that's going…

I believe only Chrome has built-in PDF viewing too, which can be nice. The page you linked has people saying there are Chromium plugins for it, or you can install a dedicated PDF viewer and it will probably embed itself in the browser when downloading PDFs.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#163

Post by tuxracer »

bad_user wrote: post #147
robocat wrote: post #144

Earlier quoted context omitted.

You can only know if it is a "terrible" phone until long after you have bought it. Most people don't have the ability to make an informed decision about a phones purchase (or they want to buy an iPhone or Nexus but they simply can't afford it). I bought a Google Nexus at USD650 retail - a perfect counterexample to your advice. I recommend iPhones to those who can afford it (purchase price, insurance, screen replaceme…

My one year old Nexus 4 is on KitKat. I guess you're talking about the Galaxy Nexus. While I agree with you that they dropped the support a way too soon, being the reference phone you'll have no problems in updating it with CyanogenMod, which is a really good distribution btw. But as a slight counterpoint, given the fast release cycle, you can't expect them to support a phone forever. You mentioned iPhones. Well I ha…

http://www.androidheadlines.com/2014/09/galaxy-nexus-will-li...

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#164

Post by ivanstojic »

lugg wrote: post #107
AjithAntony wrote: post #86

Earlier quoted context omitted.

Yeah. I was using a Nexus One for a long time until I had to prune so many apps due to space that it wasn't worth using. I got a new phone, HTC One S (I needed a t-mobile branded phone for wifi calling) with several gigs of system partition space, and now I have to play that game again. I recognize that there are a bunch of features now that I get to enjoy, but now I have to choose which ones I want to keep. When I s…

For what its worth, the chrome Mac OS X version of google chrome is 331.9 MB on disk. Doesn't seem bogus to me.

The OSX "show info" dialog block shows the file size in disk blocks, as opposed to the actual bytes of file content. There might be a misunderstanding between people because the "real" file size is different than the "actually occupied" disk size. This is of course aggravated by lots of small files.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#166

Post by hamburglar »

scintill76 wrote: post #159
hamburglar wrote: post #143

Earlier quoted context omitted.

I guess I'm going to be forced to switch to Chrome now for safety's sake, but I've been avoiding it because it has some major usability problems that Android Browser doesn't. In particular, not reflowing a web page when you zoom in is infuriating because I invariably end up zooming in order to be able to read an article, then I have to pan side to side for every line of text. Font sizing is bizarre too. Web pages sud…

> Font sizing is bizarre too. Web pages suddenly have font sizes increasing and decreasing seemingly at random, and to the point of illegibility I haven't tried Chrome, but I see this in CyanogenMod's stock browser (probably close to AOSP) and Firefox. In Firefox's case at least, my research pointed to "font boosting" being the cause of increasing/decreasing, but I haven't found a good fix.

Amazing! Now that I know the term to search for, I'm certain that this is the misfeature that aggravates me so. My AOSP browser (which is 4.0.3) doesn't have this problem. I like the comment in the webkit bug discussing it: "In terms of status, this is shipping in stable Chrome for Android with acceptable quality." Ugh.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#167

Post by lloeki »

ivanstojic wrote: post #164
lugg wrote: post #107

Earlier quoted context omitted.

For what its worth, the chrome Mac OS X version of google chrome is 331.9 MB on disk. Doesn't seem bogus to me.

The OSX "show info" dialog block shows the file size in disk blocks, as opposed to the actual bytes of file content. There might be a misunderstanding between people because the "real" file size is different than the "actually occupied" disk size. This is of course aggravated by lots of small files.

Just to be sure:

    $ du -h -d 0 /Applications/Google\ Chrome.app               
    317M	/Applications/Google Chrome.app

    $ tar -c -f - /Applications/Google\ Chrome.app | wc -c      
    tar: Removing leading '/' from member names
    331683840

    $ find /Applications/Google\ Chrome.app -type f -print0 | xargs -0 cat | wc -c
    331010107

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#168

Post by jarek »

pmontra wrote: post #165

This leaves us with little alternatives. Tint is affected. Dolphin is affected. Firefox is just horrible on mobile, come see this page and you'll understand why (they can't get font inflation right). Chrome and Opera are what's left. Anything else?

I'm using Firefox on Android 4.4 as my full-time browser, it is rather good most of the time. TBH HN is the only site I can think of that gives me trouble... and knowing the authors' attitude to HTML I'm prepared to accept the fault is not Firefox's.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#169

Post by bad_user »

tuxracer wrote: post #163
bad_user wrote: post #147

Earlier quoted context omitted.

My one year old Nexus 4 is on KitKat. I guess you're talking about the Galaxy Nexus. While I agree with you that they dropped the support a way too soon, being the reference phone you'll have no problems in updating it with CyanogenMod, which is a really good distribution btw. But as a slight counterpoint, given the fast release cycle, you can't expect them to support a phone forever. You mentioned iPhones. Well I ha…

http://www.androidheadlines.com/2014/09/galaxy-nexus-will-li...

Ouch. The issue seems to be with "the OMAP processor from Texas Instruments" that makes support difficult. Haven't seen that coming.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#170

Post by tompod »

yeahforbes wrote: post #22
steakejjs wrote: post #15

If you aren't familiar with SOP, this is about the worst "stupid web vuln" that can happen. SOP is the glue that kind of almost makes the web secure. The attack DOES work if X-Frame-Options is enabled (thanks joev. The msfmodule says so clearly). ALL sites with or without XFrameOptions can be loaded in an iframe, and sent to a bad guy. If you would like to test on your device/browser, you can on ejj.io/SOP.php . If y…

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)

Hi YeahForbes,

TomPod, the creators of InBrowser, here.

We're unable to reproduce this error on a oneplus and a HTC M8 running the latest version of InBrowser. But rest assured, we'll check this with our suite of devices and Android version during the day.

Since version 2.11 (43), 2014-03-09 we limit the usage of JavaScript: due to another bug in Android. Hopefully it'll fix this issue as well. So please make sure that you're on latest version from Google Play.

If we can fix this on our side we'll push a fix asap. If not, we unfortunately need to wait for Google to address this. We'll post any updates on this issue at @tompodapps.

Thanks for reporting it!

Post reply on HN