Earlier quoted context omitted.
Applies to YouTube too.
which is also Google
Technically Alphabet.
Accidental Google Pixel Lock Screen Bypass
421–430 of 475 posts
Re: Accidental Google Pixel Lock Screen Bypass
#422That architecture is scarily coupled with UI and it doesn't inspire a lot of confidence in Android.
Ship it mentality much?
Re: Accidental Google Pixel Lock Screen Bypass
#423I have an obsession with classifying software bugs into general categories, looking for the "root cause", or more constructively, for a way to avoid entire classes of bugs altogether. I've been doing that for more than 20 years now. This bug, if you look into the fix, falls into my "state transition" category. You can (and should) model large parts of your software as a state machine, with explicit transitions and in…
I think the root issue is one of which state is the default one. In Android the logged-in state is the default one, and the logged-out state is constructed by taking the logged-in state and essentially hiding it behind a modal. The issue with this is that systems have a tendency to return to their default state. If the modal is dismissed or has a bug that makes it crash or has a memory corruption, or any number of th…
Anything related to security should fail safe.
Failure is not lack of rigour, it's from fundamentally flawed architecture.
Re: Accidental Google Pixel Lock Screen Bypass
#424> "Hopefully they treated the original reporter(s) fairly as well." Perhaps they should have reconsidered a bounty payment of some sort for the first bug reporter as well. Perhaps that's where the other $30k of the $100k went. This actually says something interesting about bug bounty programs in general: Given a high level of false positives, it's probably not uncommon AT ALL that sometimes it takes a couple of bug r…
> Given a high level of false positives, it's probably not uncommon AT ALL that sometimes it takes a couple of bug reports before something is reproducible or generates a high enough alert/credibility status, as seemed to have happened here. This case was not the case of eventually the same reports being taken seriously. None of them were, until the author met people working at Google in person at some event, and him…
Having been on the other side of a bug bounty:
This screams like not having enough resources to take care of the reports.
Probably at Google size it's impossible to have a team large enough to deal with all the reports.
Re: Accidental Google Pixel Lock Screen Bypass
#425Re: Accidental Google Pixel Lock Screen Bypass
#426Wow, this is very serious - it pretty much turns every "left my phone on the bus" incident from "oh well" into "all your data was compromised". I don't know how Google couldn't take this seriously. Even after the poster physically demonstrated it they took months to fix it. For sensitive data with legal disclosure requirements this is a game changer.
Very disappointed with Google here - even though I lost a lot of trust in them in other areas, I still rated their security stance as excellent, especially on their own phones.
Re: Accidental Google Pixel Lock Screen Bypass
#427I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…
In met a guy once that pulled my aside once and told me he was an alien.
Re: Accidental Google Pixel Lock Screen Bypass
#428Earlier quoted context omitted.
No, not exactly, but Android is old and gnarly enough that a lot of components don't have a clear Model/View separation you'd expect in modern codebases.
Android was invented before MVC?
Well it was designed around Java, so definitely before common sense was invented.
Re: Accidental Google Pixel Lock Screen Bypass
#429Earlier quoted context omitted.
If the phone is setup for automatic updates it'll restart within a month (most of the phones I've had do monthly security patches) and you'll be in a fresh boot state. You can't turn off the updates without first unlocking the phone giving you a rather limited window to attempt to exploit the device.
Will it reboot if it's not on network?
Updates need network access. If the phone isn't on a network, then it won't reboot.
Police can't really pop out e-sims, that means the police needs to keep the phone in an RF proof bag/work in an RF proof room.
Re: Accidental Google Pixel Lock Screen Bypass
#430This is where I find out my otherwise completely functioning Pixel 3a no longer gets security updates, as of May. I knew and accepted that it wouldn't get new features and major android versions, but to not even get security updates, after only three years? So my options are: live with the piece of technology in my life that is both the most vunerable to physical security issues and has the widest access to my critic…
Or install GrapheneOS? Pixel 3a support is being phased out slowly but surely but currently it's still getting all security patches.
EDIT: I stand corrected, they stopped support in September. :(