Google has a secret browser hidden inside the settings

https://developer.android.com/develop/ui/views/layout/webapp...

It's the system WebView, it's just not using Custom Tabs.

https://developer.chrome.com/docs/android/custom-tabs/

https://chromium.googlesource.com/chromium/src/+/HEAD/androi....

Until someone confirms that they are what the name and what the speculation is about.

I can't find any information anywhere that either confirms or denies the possibility to bypass Google's restrictions with web views. I assume it's possible, because it's possible on most platforms, but I suppose it depends on the implementation.

I've seen parental controls that employ an (on-device) MitM proxy and DNS filtering to ensure safety, and those apps will prevent almost any app from displaying unwanted content.

Blocking external domains shouldn't be that hard, but I also don't think parental controls are of any interest or priority for most app developers.

https://www.nyx.net/

Allowed free shell accounts and the college board in GA offered free local dialup access to a Gopher server (Peachnet).

I had a terminal script that navigated through the Gopher menu until I could get to Nyx.

For both you hear nothing for about 10 weeks, then it is either closed as "expired", or "won't fix".

Last time I checked, both vulnerabilities still exist.

You: We are OK to publish a blog post about it then, right?

Google: ...

https://github.com/liriliri/eruda#demo

"Well, I played a video and crashed my car. …not like that."

> There's nothing in that statement that relates specifically to kids.

Most adults probably don't have parental controls on their phone...

This is not an option as school, at least in my region, requires devices directly since 4th grade and indirectly even earlier for homework.

Devices move between networks so having controls directly on the device is helpful.

Your argument seems like arguing that there should be no local access permissions on files and just let the network handle everything.

You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children

Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

===================

Security as a field

===================

You wrote: "Security is a field related to protecting device-users from malicious actors."

This is a very narrow and incorrect definition. Security as a field relates to many things, including for example protecting confidential information. If my medical information is handled by a hospital, I would like to know that information does not land on the dark web. In order to do this, the hospital needs to implement processes which protect my information from nurses being socially-engineered, doctors installing spyware, and countless other threats.

This is handled in-depth:

- Personnel handling my sensitive data should be screened.

- There should be technological restrictions on the devices preventing both malicious actors and errors

- There should be training in place

- There should be appropriate legal safeguards (NDAs, employment agreements, etc.)

- And so on.

Managing confidential information involves having managed devices. In many cases, these are also in physically-secure facilities and intentionally kept off-line. They don't belong to the person using them.

=========

Bullet #3

=========

One of the points in the original article is that the embedded browser has "a weird JavaScript object named mm" which appears to be used to handle things like security keys. This is a security issue in the narrow sense you've defined. If my child (and many other kids) uses this to bypass parental controls, their device is likely to be compromise by a malicious actor if they browse to a malicious web site.

========

Children

========

You described kids as "a scenario within which the user is the adversary"

I don't know if you've ever interacted with young kids before, but they're not so much the adversary as oblivious and clueless. Before they're teenagers, most are sweet, charming, and WANT to do the right thing. However:

- They have no idea what a "buffer overflow attack" is, let along phishing and other standard scams

- They're very easy to socially engineer. If you're a Random Adult, and ask them for a password, and give a stern look, they'll probably give it to you.

- They have no idea of the kinds of malicious actors on the internet. If someone tells them "To enable Angry Birds, go to this special dialogue," they might very well do it. There are online videos of malicious actors tricking little kids into e.g. washing their devices in a sink, or sticking them into a microwave purely for the LOLs. Mean people do these things to kids.

... and so on.

The reason to control and monitor what little kids do (not just digitally; the same applies to kitchen knives, fireplaces, and swimming pools) has very little to do with treating them as an adversary, and a lot to treating them as little kids who need an adult to help them learn.

Systems have firewalls, ulimits, pledge, acls, permissions, sometimes physical lock and keys to prevent users of the system from doing things that owners or operators of the system have decided should not be permitted. As others have mentioned, this might be for security, compliance, CYA, or just reducing the number of variables to consider in a system.

Are you suggesting that privilege-escalation attacks are not security risks?

This is one of many aspects of security-- perhaps what Google considers most important on Android, but surely you can imagine some scenarios which we care about which aren't about an end-user getting attacked.

(Indeed, sometimes security is all about protecting infrastructure, assets, or information from device users).

Besides, the third point that you cavalierly dismiss above:

> > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations

directly relates to even your limited notion of security.

It creates better hackers.

It’s funny how I never thought it would be an issue but kids have real impulse control issues and devices are super easy to spend too much time on and contribute to negative mental health. Screen time controls don’t solve this, but they help a little bit as part of many other things to help people learn about how to self regulate.

I have to agree. Google has O(200k) employees, and included among those, are some of the best security people in the world. Indeed, many are left over from historic Google.

However, there's a huge difference between having high-calibre employees and having those employees impact the security of the huge numbers of products Google develops. Most of those employees do fine research, but have no influence on the typical Google product.

> They have a fine track record keeping their users safe ... [citation needed]

Let me tell you a story. I use Google Workspace Free. My account was compromised, not through much fault of anyone involved (long story, involving being targeted by a criminal actor who gained physical access to a device).

I wanted to collect records, go to the police, and have the criminal arrested. Google had clear logs of what happened. I found out that security was a value-added product. I'd need to switch from my version to a paid version, and could never switch back. The cost was going to be $6/user/month for the rest of my life, times a dozen family members, times 12 months, times another 60 years of life, which is around 50 thousand dollars.

$50 grand.

To get audit logs.

You can guess what I decided.

There was no way to prevent this retrospectively, but it'd be very easy to prevent prospectively. It just wasn't worth doing for $50k. The criminal is still out there. They might be targeting your home or business!

Thanks Google!

Another good story -- impacting a significant fraction of low-income individuals in the world -- is withholding security updates for Android after a few years to keep people on the upgrade treadmill. New devices have frequent updates. Older ones have slower updates, until at some point, the updates stop. Phones get compromised, and attackers do ransomware, identity theft, and other sorts of nasty things.

Thanks Google!

Security should not be a paid value-add. Everyone deserves security.

I could tell many more stories too.

Similarly, consider how a sunken ferry that killed hundreds of migrants went largely unnoticed during the brouhaha surrounding the Titanic sub.

Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number. [1]

[1] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

Google's response since mid-2022 has consistently been "deny deny deny" and downplay, much like you are doing here. Meanwhile individuals and small businesses are targeted and crushed. It's hard to know when your identity is compromised, and by the time you know it, it's usually too late to easily triage. To the extent Google introduces products and services that contain large-scale vulnerabilities, it is very much their fault. Yet, nothing happens. Individuals pay the price of using Google products, and Google continues to make billions of dollars, unscathed. Microsoft and Amazon are also guilty of this.

Where are actual consumer protections? Nowhere to be found, in the US.

It is feature because the login window is there primarily as an single sign on mechanism for remote network services (which obviously would not work when you just dismiss it) and there is no security boundary between local user profiles.

Obviously, parents using parental control will have questions what their kids are doing for hours in the Google Settings app every day, but every kid will probably get that day or week of free browsing until their parents get suspicious.

That assumes parents bother to check on the statistics made available by parental controls, of course; if nobody checks, then the kid will access the web unrestricted for years.