11 ms·

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive indi

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. How? Usually buried in App Settings. Almost all apps use some instance of an in-app browser to (lazily) reference thier privacy policies, EULAs, or TOCs. A buried link leads to a homepage, leads to an instagram link, leads to an unfiltered internet. Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. Even boring apps like MS Teams or adding a Gmail account to iOS mail uses a secret in-app browser. This obviously presents a problem: should developers restrict any and all app access to in-app browsers, or leave policing to individuals/parents? An easy approach is to disable the in-app browser functionality in iOs, but obviously with grave cost to developers. At the same time, at what cost is in-app browser functionality being implemented.

davet91 4y ago
The in-app browsers could use a domain whitelist if parental controls are turned on.
- graham1776 4y ago
  That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
- yowzadave 4y ago
  Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
- adaktix 4y ago
  It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.
- gowld 4y ago
  The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)
wepple 4y ago
Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute
- sirsinsalot 4y ago
  Novell Netware had a similar bug circa 1998 whereby pressing `F1` at the login screen of the terminal opened the help dialog, which opened links in IE ... from there the main Windows shell could be ran and bingo ... you're in.
  - TedDoesntTalk 4y ago
    I never saw IE or Windows running on Novell Netware. It was a server operating system. What you’re saying is akin to saying you can create a windows shell from inside linux.
    - brk 4y ago
      The Netware backend server was it's own OS, IIRC. However on the client side, you had MS-DOS and Windows Netware clients to login to the Novell server and access the associated shared resources.
      - TedDoesntTalk 4y ago
        Right, but those clients weren’t “Novell netware”.
        sirsinsalot 4y ago
        The windows client login and resource control was branded as such tho
    - yesbabyyes 4y ago
rahkiin 4y ago
It is interesting how this would apply for custom browser engines in the future of iOS.
- CharlesW 4y ago
  This class of security problem is also a great reason to never allow custom browser engines.
  - smoldesu 4y ago
    ...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.
    - happyopossum 4y ago
      Then the app can use DOH, or tunnel DNS requests over something else - a non-safari browser engine wouldn’t have to use system DNS by any means…
      - jamespo 4y ago
        I thought non-safari browser engines were banned
        als0 4y ago
        They are. This is a hypothetical discussion.
  - postalrat 4y ago
    How about services like luna, stadia, etc which can render any sort of interactive content (typically games)?
smoldesu 4y ago
Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy (a hard pill to swallow for HN users), so control their access to technology unless you're ready to have a serious sit-down discussion about the internet, personal privacy, and all that jazz. Put yourself in their shoes; if you're given a small black brick with an indeterminate number of capabilities, wouldn't your response be pushing it as far as it can go? I know that was my reaction when I was a kid, after buying a Pentium desktop at a garage sale.
- ars 4y ago
  You can't live in today's world without a phone. All the mechanisms of the past that were geared for this no longer exist. For example: Drive on the road, get to a toll, don't have a Transponder to pay the bill? No problem - just call a phone number. Uh, what if I don't have a cell? This literally never even occurred to them, there is no alternative way to pay the bill. That's life today, and it applies to children as well. Want to go to some sports place that only caters to teens and above? Load this website on your phone and fill out an application. Don't have a phone? Borrow a friends phone.
  - Minor49er 4y ago
    The toll roads I've seen on the east coast will just scan your license plate and mail you a bill if you don't have a transponder
    - Broken_Hippo 4y ago
      This is the common way in Norway. Have the toll thingy or get a bill.
    - vanilla_nut 4y ago
      Frequently at an increased rate. The garden isn’t fully walled yet, but they are closing in. I’ve already had to refuse to participate in social and work events that required me to download an app to my smartphone.
Fogest 4y ago
I have a browser based game I play that makes use of many userscripts and browser extensions to further improve/enhance the game. However mobile users suffer from a problem of not having such extras. There is a very nice app someone made on Android and iOS that uses in-app browsers in order to be able to add a lot of custom things. There are many useful instances for the in-app browsers and I don't think they should be removed because of some bad actors. It's similar to how Android has had password managers making use of autofill tools via accessibility tools. Android was butchering that access, but luckily started adding some official autofill support. I don't think removing capabilities in the favour of "safety" is usually the right approach in my opinion.
- celtain 4y ago
  Most of the usecases mentioned in this thread wouldn't suffer if the in-app browser had to be invoked with a whitelist of approved domains/urls. Perhaps apps could request permission to run an unrestricted in-app browser, and that could be used to facilitate parental controls. As an aside, is giving parents the option to disable in-app browsers removing a capability or adding one?
  - Fogest 4y ago
    Yes I think in app browsers should still follow parental controls, and I don't see why that wouldn't already be a thing on devices. If I can use a VPN on my phone and have that block sites for me, it seems like it should be pretty trivial for the phone to respect parental controls across all apps, not just specifically web browsers. That would be an additional capability. But having to force a website to give specific apps permission to display them in-app seems like a removal. Some people are also suggesting removing in-app browsers which also seems silly.
- RainaRelanah 4y ago
  Mind if I ask what game? Kiwi on Android is a Chromium fork that re-enables extensions on mobile. Works well for userscripts/extensions, though often times those UIs don't scale well to mobile.
michannne 4y ago
We used to exploit these types of paths when school IT admins didn't know how to filter traffic properly but knew to block proxies.
- LegitShady 4y ago
  There was a period of time at my high school where we would compile a default browser app in Borland c++ and it would let you access whatever it wanted. They noticed because they got proper filtering after that...
polote 4y ago
A feature doesn't become a problem because 1% have an issue with it (people who use parental control). The internet is the internet if you want to restrict what people can see on the internet the only solution is to not have access to it at all
- bigfudge 4y ago
  Do you have kids? It’s really not easy to withdraw all internet access without substantially disadvantaging them. But I don’t want them reading 4chan either. Anything which makes that less likely without fundamentally breaking things is welcome to me.
  - chadlavi 4y ago
    As a child of the 2000s: just let them look at the horrifying underbelly of the internet. One trip down grossout lane isn't going to undo all your parenting and make them some kind of perverted monster. Children aren't prisoners.
    - mschuster91 4y ago
      Back in the early 2000s we didn't have people actively recruiting young frustrated men into incel and far-right terrorist groups though. We didn't have people thinking it was cool and edgy to make jokes about gassing Jews. Hell even the pedo/grooming problem wasn't much of a thing. Yes there was porn and vile gore floating around and you had to take care to not fall victim to dialers changing your dial-up information to bleed your phone bill... but that was all in all harmless. These days, the amount of utter idiocy is just unimaginable, "eternal september" style. You join some random online game discord and whoops half the talk is about rape fantasies, n-bombs and other kind of sickening behavior. Let it slip you're a girl and you'll get flooded with wiener pics, "cum tributes", disgusting fantasies, doxxing attempts, or flat out hate for standing in the way of someone. Go on Youtube, watch a couple of videos and your suggestions have antivaxx bullshit or "shocker videos". Games for children are filled with barely disguised pedos and "moderation" doesn't do shit. Not exactly an environment many people want to expose their children to.
CodeSgt 4y ago
I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views. That said, I firmly believe that easy access porn is one of the worst things happening to the young men and women today. I (23) know many men around my age who suffer from chronic porn addictions to the point that it severely impacts their ability for form real relationships and median age of first exposure is getting lower and lower. It's an absolutely crucial issue that no one seems to be talking about or taking seriously.
- flappyeagle 4y ago
  What does it mean to be addicted to porn? Daily viewing? Hourly? Constant?
  - CodeSgt 4y ago
    Typically viewing to the detriment of your emotional/mental/physical health. If you consistently choose porn over real intimacy or if you overly desensitize yourself (porn-induced ED is a real, and quite common thing). The biggest concern is choosing porn over physical intimacy/attempts at physical intimacy. It's super easy for someone who maybe already isn't a social superstar to just find themselves choosing the easy option of porn rather than forcing themselves to go out and put effort into meeting people.
    - smsm42 4y ago
      You yourself recognize porn is an "easy option". Then no wonder people for whom it is hard to successfully form relationship that would lead to sex use it. It's like saying "cars are bad because it's too easy to just drive 100km instead of walking the same distance", ignoring the fact that for many people walking 100 km is either completely impossible or massively harder. That doesn't mean cars make you unable to walk (though in some very extreme cases it could happen). It means some people that previously had no options, now at least have this inferior one.
j2bax 4y ago
Why don't you just make sure there are no unsavory links on whatever page you are using the in-app browser for and disable/hide the address bar so they can't just jump onto the open web? Seems like you can have your cake and eat it!
qwertox 4y ago
I think on Android they could use Chrome Custom Tabs [0] instead of WebViews. IIRC this also protects the browser content from being accessed by the hosting app, but there is still a limited communication which is possible between the app and the tab. [0] https://developer.chrome.com/docs/android/custom-tabs/ https://developer.chrome.com/docs/android/custom-tabs/
franga2000 4y ago
If someone is knowledgeable and committed enough to dig through all their apps, find any in-app browsers and try to break out onto the web, they will also realize that simply using another device will bypass all your silly blocks.
t8ty2evj 4y ago
This seems like a non-issue. Where's the damage? I'm tired of people using children and a miniscule population of users w/ severe content sensitivities as excuses to justify features that are really just tools for asserting norms. The children are fine. We've been talking about how bad the internet is for children so long that those children grew up, led fufilling lives, had their own children, and now those children are apparently being ruined by the internet. What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years.
- cercatrova 4y ago
  I have to agree here. "Think of the children" is an excuse as old as time.
- goda90 4y ago
  >What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years. Isn't addicting content a force that's trying to manipulate them? Porn, certain kinds of games, online gambling, etc can all get their hooks in someone. Prevention is better than having to fight the addiction in the first place, is it not?
  - lrvick 4y ago
    I would argue TikTok is proving far more toxic to children than access to adult content and no one seems to care. -Targeting- children with content for profit should be banned, regardless of content. If the content is neutral and presented to all the same way then they get to choose to put in the work to find what they want to consume. When it is not neutral then it is the job of a parent to help tip the scales back to neutral with conversation or partially supervised device use. Nudity for instance is only taboo in some countries, where others are whatever about it and will see women topless at the beach. Trying to censor things or target things is what does the most harm and creates closeted behavior IMO. News flash to parents... when your kid is old enough to be horny they -will- find an outlet to see nudity be it in person or on a screen. On a screen is probably the safer default.
amenghra 4y ago
In the early 1990s, we used to break out of Macintosh's AtEase at our middle school by writing a two line MacBasic program which launched Finder. We would then bring games on floppies. Everything old is new again!
O__________O 4y ago
Reminds me of stories I have heard about users of computer systems with “strong” access controls figuring out ways to make it to unfiltered internet; examples include: student/prisoner computer labs, public libraries, flight entertainment systems, public kiosks, operating system logins, etc.
xfitm3 4y ago
Doesn't the harm of surveillance outweigh the harm of viewing "inappropriate content"? Think of the addict is a new one, but I am automatically suspicious any time someone cites child protection.
- goda90 4y ago
  I think you're seeing this as a "take away this choice from society to protect the children" kind of deal, but to me it seems more like the argument is to give choice to parents and addicts to control their own devices more completely. All other things being equal, why would a consumer want to not be able to control both the browser and in-app browsers as much as possible?
nodamage 4y ago
> Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. Last time I checked, WKWebView will follow the parental control settings set on the device.
registeredcorn 4y ago
Interesting! This reminds me of the classic Windows 95 bypass. You abuse the help screen to gain access to the desktop without having to login.[1] I'm currently going through HTB Academy and once you mentioned unsecured in-app browsers, the first thing I thought of was either a Web Shell[2], or better yet, directing the in-app browser to a malicious website to download additional software to better exploit the phone. If the in-app browsers aren't filtering explicit content, I have to assume they aren't filter malicious content either. If this isn't already a well-known route of exploitation, I'm interested to see how that might change in the near future. It sounds surprisingly easy to exploit, provided you can get momentary physical (remote?) access to the phone for a short time. [1] https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY [2] https://en.wikipedia.org/wiki/Web_shell https://en.wikipedia.org/wiki/Web_shell
Forgeties79 4y ago
> Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. I don’t think this can be overstated. How many people tell you stories of watching signal-scrambled porn on TV when their parents are asleep? How many of us waited until our parents are asleep to play video game late at night? How many millions covertly downloaded Napster/Kazaa/etc. and downloaded 30 versions of a song before they finally got the one they wanted? Being “motivated” as a kid or a teen is a low bar.

davet91 4y ago

The in-app browsers could use a domain whitelist if parental controls are turned on.

graham1776 4y ago
That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
yowzadave 4y ago
Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
adaktix 4y ago
It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.
gowld 4y ago
The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)

wepple 4y ago

Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute

sirsinsalot 4y ago
Novell Netware had a similar bug circa 1998 whereby pressing `F1` at the login screen of the terminal opened the help dialog, which opened links in IE ... from there the main Windows shell could be ran and bingo ... you're in.
- TedDoesntTalk 4y ago
  I never saw IE or Windows running on Novell Netware. It was a server operating system. What you’re saying is akin to saying you can create a windows shell from inside linux.
  - brk 4y ago
    The Netware backend server was it's own OS, IIRC. However on the client side, you had MS-DOS and Windows Netware clients to login to the Novell server and access the associated shared resources.
    - TedDoesntTalk 4y ago
      Right, but those clients weren’t “Novell netware”.
      - sirsinsalot 4y ago
        The windows client login and resource control was branded as such tho
  - yesbabyyes 4y ago

rahkiin 4y ago

It is interesting how this would apply for custom browser engines in the future of iOS.

CharlesW 4y ago
This class of security problem is also a great reason to never allow custom browser engines.
- smoldesu 4y ago
  ...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.
  - happyopossum 4y ago
    Then the app can use DOH, or tunnel DNS requests over something else - a non-safari browser engine wouldn’t have to use system DNS by any means…
    - jamespo 4y ago
      I thought non-safari browser engines were banned
      - als0 4y ago
        They are. This is a hypothetical discussion.
- postalrat 4y ago
  How about services like luna, stadia, etc which can render any sort of interactive content (typically games)?

smoldesu 4y ago

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy (a hard pill to swallow for HN users), so control their access to technology unless you're ready to have a serious sit-down discussion about the internet, personal privacy, and all that jazz. Put yourself in their shoes; if you're given a small black brick with an indeterminate number of capabilities, wouldn't your response be pushing it as far as it can go? I know that was my reaction when I was a kid, after buying a Pentium desktop at a garage sale.

ars 4y ago
You can't live in today's world without a phone. All the mechanisms of the past that were geared for this no longer exist. For example: Drive on the road, get to a toll, don't have a Transponder to pay the bill? No problem - just call a phone number. Uh, what if I don't have a cell? This literally never even occurred to them, there is no alternative way to pay the bill. That's life today, and it applies to children as well. Want to go to some sports place that only caters to teens and above? Load this website on your phone and fill out an application. Don't have a phone? Borrow a friends phone.
- Minor49er 4y ago
  The toll roads I've seen on the east coast will just scan your license plate and mail you a bill if you don't have a transponder
  - Broken_Hippo 4y ago
    This is the common way in Norway. Have the toll thingy or get a bill.
  - vanilla_nut 4y ago
    Frequently at an increased rate. The garden isn’t fully walled yet, but they are closing in. I’ve already had to refuse to participate in social and work events that required me to download an app to my smartphone.

Fogest 4y ago

I have a browser based game I play that makes use of many userscripts and browser extensions to further improve/enhance the game. However mobile users suffer from a problem of not having such extras. There is a very nice app someone made on Android and iOS that uses in-app browsers in order to be able to add a lot of custom things. There are many useful instances for the in-app browsers and I don't think they should be removed because of some bad actors. It's similar to how Android has had password managers making use of autofill tools via accessibility tools. Android was butchering that access, but luckily started adding some official autofill support. I don't think removing capabilities in the favour of "safety" is usually the right approach in my opinion.

celtain 4y ago
Most of the usecases mentioned in this thread wouldn't suffer if the in-app browser had to be invoked with a whitelist of approved domains/urls. Perhaps apps could request permission to run an unrestricted in-app browser, and that could be used to facilitate parental controls. As an aside, is giving parents the option to disable in-app browsers removing a capability or adding one?
- Fogest 4y ago
  Yes I think in app browsers should still follow parental controls, and I don't see why that wouldn't already be a thing on devices. If I can use a VPN on my phone and have that block sites for me, it seems like it should be pretty trivial for the phone to respect parental controls across all apps, not just specifically web browsers. That would be an additional capability. But having to force a website to give specific apps permission to display them in-app seems like a removal. Some people are also suggesting removing in-app browsers which also seems silly.
RainaRelanah 4y ago
Mind if I ask what game? Kiwi on Android is a Chromium fork that re-enables extensions on mobile. Works well for userscripts/extensions, though often times those UIs don't scale well to mobile.

michannne 4y ago

We used to exploit these types of paths when school IT admins didn't know how to filter traffic properly but knew to block proxies.

LegitShady 4y ago
There was a period of time at my high school where we would compile a default browser app in Borland c++ and it would let you access whatever it wanted. They noticed because they got proper filtering after that...

polote 4y ago

A feature doesn't become a problem because 1% have an issue with it (people who use parental control). The internet is the internet if you want to restrict what people can see on the internet the only solution is to not have access to it at all

bigfudge 4y ago
Do you have kids? It’s really not easy to withdraw all internet access without substantially disadvantaging them. But I don’t want them reading 4chan either. Anything which makes that less likely without fundamentally breaking things is welcome to me.
- chadlavi 4y ago
  As a child of the 2000s: just let them look at the horrifying underbelly of the internet. One trip down grossout lane isn't going to undo all your parenting and make them some kind of perverted monster. Children aren't prisoners.
  - mschuster91 4y ago
    Back in the early 2000s we didn't have people actively recruiting young frustrated men into incel and far-right terrorist groups though. We didn't have people thinking it was cool and edgy to make jokes about gassing Jews. Hell even the pedo/grooming problem wasn't much of a thing. Yes there was porn and vile gore floating around and you had to take care to not fall victim to dialers changing your dial-up information to bleed your phone bill... but that was all in all harmless. These days, the amount of utter idiocy is just unimaginable, "eternal september" style. You join some random online game discord and whoops half the talk is about rape fantasies, n-bombs and other kind of sickening behavior. Let it slip you're a girl and you'll get flooded with wiener pics, "cum tributes", disgusting fantasies, doxxing attempts, or flat out hate for standing in the way of someone. Go on Youtube, watch a couple of videos and your suggestions have antivaxx bullshit or "shocker videos". Games for children are filled with barely disguised pedos and "moderation" doesn't do shit. Not exactly an environment many people want to expose their children to.

CodeSgt 4y ago

I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views. That said, I firmly believe that easy access porn is one of the worst things happening to the young men and women today. I (23) know many men around my age who suffer from chronic porn addictions to the point that it severely impacts their ability for form real relationships and median age of first exposure is getting lower and lower. It's an absolutely crucial issue that no one seems to be talking about or taking seriously.

flappyeagle 4y ago
What does it mean to be addicted to porn? Daily viewing? Hourly? Constant?
- CodeSgt 4y ago
  Typically viewing to the detriment of your emotional/mental/physical health. If you consistently choose porn over real intimacy or if you overly desensitize yourself (porn-induced ED is a real, and quite common thing). The biggest concern is choosing porn over physical intimacy/attempts at physical intimacy. It's super easy for someone who maybe already isn't a social superstar to just find themselves choosing the easy option of porn rather than forcing themselves to go out and put effort into meeting people.
  - smsm42 4y ago
    You yourself recognize porn is an "easy option". Then no wonder people for whom it is hard to successfully form relationship that would lead to sex use it. It's like saying "cars are bad because it's too easy to just drive 100km instead of walking the same distance", ignoring the fact that for many people walking 100 km is either completely impossible or massively harder. That doesn't mean cars make you unable to walk (though in some very extreme cases it could happen). It means some people that previously had no options, now at least have this inferior one.

j2bax 4y ago

Why don't you just make sure there are no unsavory links on whatever page you are using the in-app browser for and disable/hide the address bar so they can't just jump onto the open web? Seems like you can have your cake and eat it!

qwertox 4y ago

I think on Android they could use Chrome Custom Tabs [0] instead of WebViews. IIRC this also protects the browser content from being accessed by the hosting app, but there is still a limited communication which is possible between the app and the tab. [0] https://developer.chrome.com/docs/android/custom-tabs/ https://developer.chrome.com/docs/android/custom-tabs/

franga2000 4y ago

If someone is knowledgeable and committed enough to dig through all their apps, find any in-app browsers and try to break out onto the web, they will also realize that simply using another device will bypass all your silly blocks.

t8ty2evj 4y ago

This seems like a non-issue. Where's the damage? I'm tired of people using children and a miniscule population of users w/ severe content sensitivities as excuses to justify features that are really just tools for asserting norms. The children are fine. We've been talking about how bad the internet is for children so long that those children grew up, led fufilling lives, had their own children, and now those children are apparently being ruined by the internet. What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years.

cercatrova 4y ago
I have to agree here. "Think of the children" is an excuse as old as time.
goda90 4y ago
>What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years. Isn't addicting content a force that's trying to manipulate them? Porn, certain kinds of games, online gambling, etc can all get their hooks in someone. Prevention is better than having to fight the addiction in the first place, is it not?
- lrvick 4y ago
  I would argue TikTok is proving far more toxic to children than access to adult content and no one seems to care. -Targeting- children with content for profit should be banned, regardless of content. If the content is neutral and presented to all the same way then they get to choose to put in the work to find what they want to consume. When it is not neutral then it is the job of a parent to help tip the scales back to neutral with conversation or partially supervised device use. Nudity for instance is only taboo in some countries, where others are whatever about it and will see women topless at the beach. Trying to censor things or target things is what does the most harm and creates closeted behavior IMO. News flash to parents... when your kid is old enough to be horny they -will- find an outlet to see nudity be it in person or on a screen. On a screen is probably the safer default.

amenghra 4y ago

In the early 1990s, we used to break out of Macintosh's AtEase at our middle school by writing a two line MacBasic program which launched Finder. We would then bring games on floppies. Everything old is new again!

O__________O 4y ago

Reminds me of stories I have heard about users of computer systems with “strong” access controls figuring out ways to make it to unfiltered internet; examples include: student/prisoner computer labs, public libraries, flight entertainment systems, public kiosks, operating system logins, etc.

xfitm3 4y ago

Doesn't the harm of surveillance outweigh the harm of viewing "inappropriate content"? Think of the addict is a new one, but I am automatically suspicious any time someone cites child protection.

goda90 4y ago
I think you're seeing this as a "take away this choice from society to protect the children" kind of deal, but to me it seems more like the argument is to give choice to parents and addicts to control their own devices more completely. All other things being equal, why would a consumer want to not be able to control both the browser and in-app browsers as much as possible?

nodamage 4y ago

> Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. Last time I checked, WKWebView will follow the parental control settings set on the device.

registeredcorn 4y ago

Interesting! This reminds me of the classic Windows 95 bypass. You abuse the help screen to gain access to the desktop without having to login.[1] I'm currently going through HTB Academy and once you mentioned unsecured in-app browsers, the first thing I thought of was either a Web Shell[2], or better yet, directing the in-app browser to a malicious website to download additional software to better exploit the phone. If the in-app browsers aren't filtering explicit content, I have to assume they aren't filter malicious content either. If this isn't already a well-known route of exploitation, I'm interested to see how that might change in the near future. It sounds surprisingly easy to exploit, provided you can get momentary physical (remote?) access to the phone for a short time. [1] https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY [2] https://en.wikipedia.org/wiki/Web_shell https://en.wikipedia.org/wiki/Web_shell

Forgeties79 4y ago

> Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. I don’t think this can be overstated. How many people tell you stories of watching signal-scrambled porn on TV when their parents are asleep? How many of us waited until our parents are asleep to play video game late at night? How many millions covertly downloaded Napster/Kazaa/etc. and downloaded 30 versions of a song before they finally got the one they wanted? Being “motivated” as a kid or a teen is a low bar.