3 ms·

There have been reports talking about security issues in UC Browser [0] for a while [1] now [2]. It was also removed from Google Play Store [3] (although tempo

There have been reports talking about security issues in UC Browser [0] for a while [1] now [2]. It was also removed from Google Play Store [3] (although temporarily). Kinda surprises me to see it as the 'dominant' browser. Maybe people are indifferent. [0] https://citizenlab.ca/2015/05/a-chatty-squirrel-privacy-and-security-issues-with-uc-browser/ https://citizenlab.ca/2015/05/a-chatty-squirrel-privacy-and-... [1] https://citizenlab.ca/2016/08/a-tough-nut-to-crack-look-privacy-and-security-issues-with-uc-browser/ https://citizenlab.ca/2016/08/a-tough-nut-to-crack-look-priv... [2] https://tech.blorge.com/2017/11/27/uc-browser-believed-collect-private-information-users/164069 https://tech.blorge.com/2017/11/27/uc-browser-believed-colle... [3] http://www.hindustantimes.com/tech/uc-browser-app-vanishes-from-play-store-following-privacy-concerns/story-lEaTNqp9KMEEDlkqV34dnN.html http://www.hindustantimes.com/tech/uc-browser-app-vanishes-f...

seanmcdirmid 9y ago
Consider that Qihoo 360 used to do a lot of "security" work for IE. Given how shady Qihoo 360 was, Alibaba is definitely an improvement!
- yegle 9y ago
  Qihoo 360 actually does have a lot of contribution to security, for one: they upstreamed a lot of patches to AOSP: https://source.android.com/s/results/?q=%22Qihoo+360%22 https://source.android.com/s/results/?q=%22Qihoo+360%22
  - jnordwick 9y ago
    Why is this being voted down? Is there something I'm not aware of?
    - seanmcdirmid 9y ago
      I don't know (nor did I downvote). Qihoo 360 has a bad reputation, Zhong Hongyi is a Trump-like character. But if you aren't into the China tech scene, you've probably never heard of them before.
  - tfcata 9y ago
    The founder is the very first guy in China who used malware technique to prevent his own IE search enhancement plugin, 3721, circa 2004, from being uninstalled. It was a pain in the ass to uninstall this thing because it hooks so deeply in the system. Now it's sarcastic that this guy is running a security business. The most recent case is that they broadcast the footages captured on the so called security cameras on a website that it positioned to be something like Twitch but with daily life content. So you really got to see inside other people's house! Supposedly this needs to be enabled by the user as an option, but I'm not sure why so many people enabled it. They have stopped this 'service', without admitting that it's wrong. My hands shake out of anger when I'm typing this.
kurthr 9y ago
Yes, and for using "misleading and unhealthy" methods of promoting/inflating installs. That makes me wonder at the 500M total. http://indianexpress.com/article/technology/social/uc-browser-disappears-from-google-play-store-for-misleading-promotions-4938185/ http://indianexpress.com/article/technology/social/uc-browse...
baybal2 9y ago
Have you ever seen popups abusing all possible browser API(best known for use of phone vibrator) promising to get rid you of the "virus" if you go and install that UC browser? Yes, this is who they are
CydeWeys 9y ago
Very true. Amongst many other security flaws, UC Browser also does not support HSTS (headers or preload list) at all. That means that a connection made by UC Browser to any site can be man-in-the-middled and inspected or modified. As far as the Chinese government is concerned, however, this may be a feature rather than a bug. No one should be using UC Browser, full stop. It's pathologically insecure.
- stephengillie 9y ago
  Welcome to the Fishbowl, channel 44000, please do not swear.
- gatmne 9y ago
  But it correctly supports HTTPS right? If so, then a MITM attack shouldn't be possible unless your system trusts a bad CA.
  - sanxiyn 9y ago
    sslstrip exists. HTTPS support doesn't matter if you don't get HTTPS.
    - willstrafach 9y ago
      sslstrip does not stop HTTPS connections. It simply replaces https links on a page with http, and that itself requires the initially manipulated page to be served over plain HTTP. It was far more relevant when websites were mostly HTTP, but used HTTPS for login or payment pages.
      - CydeWeys 9y ago
        It doesn't stop HTTPS connections, but if I type in randomdomain.com in my browser and hit return, that sends an HTTP request by default. If someone is intercepting my connection, they can modify what's being returned by the webserver, and even if the server itself only serves via HTTPS, the man-in-the-middle program can simply terminate HTTPS and then serve a modified version of the now-unencrypted contents via HTTP. The only way to get guaranteed security is if your browser will only ever make HTTPS connections to a given domain name, and that requires HSTS preloading.
autotune 9y ago
My experience casually observing how most people in coffee shops, even developers, leave their laptops unlocked as they go use the bathroom, or ask a random stranger to watch it for them, is that security in general is not as high of a concern for many as it should be.

seanmcdirmid 9y ago

Consider that Qihoo 360 used to do a lot of "security" work for IE. Given how shady Qihoo 360 was, Alibaba is definitely an improvement!

yegle 9y ago
Qihoo 360 actually does have a lot of contribution to security, for one: they upstreamed a lot of patches to AOSP: https://source.android.com/s/results/?q=%22Qihoo+360%22 https://source.android.com/s/results/?q=%22Qihoo+360%22
- jnordwick 9y ago
  Why is this being voted down? Is there something I'm not aware of?
  - seanmcdirmid 9y ago
    I don't know (nor did I downvote). Qihoo 360 has a bad reputation, Zhong Hongyi is a Trump-like character. But if you aren't into the China tech scene, you've probably never heard of them before.
- tfcata 9y ago
  The founder is the very first guy in China who used malware technique to prevent his own IE search enhancement plugin, 3721, circa 2004, from being uninstalled. It was a pain in the ass to uninstall this thing because it hooks so deeply in the system. Now it's sarcastic that this guy is running a security business. The most recent case is that they broadcast the footages captured on the so called security cameras on a website that it positioned to be something like Twitch but with daily life content. So you really got to see inside other people's house! Supposedly this needs to be enabled by the user as an option, but I'm not sure why so many people enabled it. They have stopped this 'service', without admitting that it's wrong. My hands shake out of anger when I'm typing this.

kurthr 9y ago

Yes, and for using "misleading and unhealthy" methods of promoting/inflating installs. That makes me wonder at the 500M total. http://indianexpress.com/article/technology/social/uc-browser-disappears-from-google-play-store-for-misleading-promotions-4938185/ http://indianexpress.com/article/technology/social/uc-browse...

baybal2 9y ago

Have you ever seen popups abusing all possible browser API(best known for use of phone vibrator) promising to get rid you of the "virus" if you go and install that UC browser? Yes, this is who they are

CydeWeys 9y ago

Very true. Amongst many other security flaws, UC Browser also does not support HSTS (headers or preload list) at all. That means that a connection made by UC Browser to any site can be man-in-the-middled and inspected or modified. As far as the Chinese government is concerned, however, this may be a feature rather than a bug. No one should be using UC Browser, full stop. It's pathologically insecure.

stephengillie 9y ago
Welcome to the Fishbowl, channel 44000, please do not swear.
gatmne 9y ago
But it correctly supports HTTPS right? If so, then a MITM attack shouldn't be possible unless your system trusts a bad CA.
- sanxiyn 9y ago
  sslstrip exists. HTTPS support doesn't matter if you don't get HTTPS.
  - willstrafach 9y ago
    sslstrip does not stop HTTPS connections. It simply replaces https links on a page with http, and that itself requires the initially manipulated page to be served over plain HTTP. It was far more relevant when websites were mostly HTTP, but used HTTPS for login or payment pages.
    - CydeWeys 9y ago
      It doesn't stop HTTPS connections, but if I type in randomdomain.com in my browser and hit return, that sends an HTTP request by default. If someone is intercepting my connection, they can modify what's being returned by the webserver, and even if the server itself only serves via HTTPS, the man-in-the-middle program can simply terminate HTTPS and then serve a modified version of the now-unencrypted contents via HTTP. The only way to get guaranteed security is if your browser will only ever make HTTPS connections to a given domain name, and that requires HSTS preloading.

autotune 9y ago

My experience casually observing how most people in coffee shops, even developers, leave their laptops unlocked as they go use the bathroom, or ask a random stranger to watch it for them, is that security in general is not as high of a concern for many as it should be.