11 ms·

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about

by blagie 3y ago

Google's increasingly cavalier attitude towards security is concerning: 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations At Google scale, if 0.001% accounts are impacted by a security vulnerability, that's still tens of thousands of people (you can do the math too). I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives. What's astounding is just how good Google's security team was, especially in comparison, maybe 15 years ago. Now, it increasingly reminds me of the path Yahoo took. Critically, issues build on each other and escalate. Most remote root exploits require overcoming multiple layers of security. Defense-in-depth is important. Google used to address issues when a single layer was breached, before they could combine into someone remotely rooting your phone. Now, Google only fixes security bugs only after they've combined into a severe remote exploit (which often means many devices are compromised before an update goes out).

px43 3y ago
This is a pretty standard kiosk breakout technique, which have been super common since the 90s. They have always existed, and will continue to exist. The impact and use cases for issues like this are pretty negligible, so they don't get addressed as quickly as bugs that can actually be used for real crime. Also, you say the embedded browser is "not secure", yet the going rate for browser bugs on Android are in the multi-million dollar range, especially if it leads to root.
- gjsman-1000 3y ago
  There are plenty of ways to invade someone’s privacy without being root. Stealing a Google Account would still be a prize.
henriquez 3y ago
At least Mozilla is still around to find all their bugs for them.
inetknght 3y ago
> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Good. Parental/school controls don't belong on the device. They belong on whatever the device connects to. That would be parental/school networks. If you don't want your kids to connect to things then don't let your kids have devices that connect to things. > 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk The direct security risk is using Google in the first place. > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations There's nothing in that statement that relates specifically to kids.
- jabradoodle 3y ago
  How would network restrictions help, there is WiFi at friends houses / everywhere. > There's nothing in that statement that relates specifically to kids. Most adults probably don't have parental controls on their phone...
  - heavyset_go 3y ago
    > How would network restrictions help, there is WiFi at friends houses / everywhere. > > If you don't want your kids to connect to things then don't let your kids have devices that connect to things.
    - jabradoodle 3y ago
      Comment said the restrictions belong on the network being connected to, which is useless when you can connect else where. Yes not giving your kids access to a device is one option; parental controls are another. I'm not sure either will work entirely, but that's another point.
      - JoshTriplett 3y ago
        And locking down the primary device a kid has access to creates the lure of the forbidden; that won't last any longer than their access to another device without those restrictions. That also creates an environment where if they do find something they really ought to be able to talk an adult about, they can't talk to a parent about it because they'll be in trouble (and get their friends in trouble). One of the widely studied aspects of child psychology is how to instill guidelines that last even when they're elsewhere without any enforcement other than self-enforcement.
lucideer 3y ago
> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an important or necessary measure in some contexts but classifying it as "security" is misleading.
- Angostura 3y ago
  > Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children
  - YetAnotherNick 3y ago
    There are lot of much easier ways to compromise security both for careless or malicious users. This is the fundamental difference between ios and android. If you want you could ruin the security of android, however it is harder to do it in ios. Definitely not impossible, you could sideload dangerous apps easily in ios as well.
    - prepend 3y ago
      > There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.
      - YetAnotherNick 3y ago
        I think you misunderstood me. Android deliberately allows users to hack into their own phone and remove its security. It allows users to install malicious apps if they want to or even root the phone entirely. So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).
elric 3y ago
As someone who remembers being a child, I'm glad there are still ways around parental controls. Kids are going to break rules, and that's fine. Making arbitrary rules unbreakable has always seemed iffy to me...
- mavhc 3y ago
  How else will your kids learn to be l33t hackers without motivation?
- ethbr0 3y ago
  > Making arbitrary rules unbreakable has always seemed iffy to me... It creates better hackers.
  - elric 3y ago
    I'm not so sure about that, though I guess you are probably joking. Kids are given "smart" devices which make it easy to consume stuff, but nigh impossible to break out of, let alone create stuff on (or at least nigh impossible to create code).
  - heavyset_go 3y ago
    IMO, it creates less hackers.
    - ethbr0 3y ago
      https://m.youtube.com/watch?v=bTeVgfPM0Xw&t=5m29s https://m.youtube.com/watch?v=bTeVgfPM0Xw&t=5m29s Life, uh, finds a way.
  - lucasv07 3y ago
    as one of these young “hackers” that has always found ways for circumventing restrictions, I can definitively tell you that every kid that uses these bypasses has a different level of understanding of the “hack”. for example, some of my friends use the bypasses that I make, and they don’t have to understand the tool to use it. so while there are many (s)kids using these, it’s actually a very small percentage that learn how to make the bypass themselves, and become “better hackers”.
coldtea 3y ago
>1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Doesn't sound concerning, especially the latter.
- prepend 3y ago
  As a parent, it’s concerning to me. It’s funny how I never thought it would be an issue but kids have real impulse control issues and devices are super easy to spend too much time on and contribute to negative mental health. Screen time controls don’t solve this, but they help a little bit as part of many other things to help people learn about how to self regulate.
  - surgical_fire 3y ago
    When I was a kid we managed to hack into my school's lab's computers to install Doom and Warcraft II. Good times.
    - tjungblut 3y ago
      I vividly remember cracking the admin PWs with ophcrack or the school WEP wifi with aircrack-ng.
    - rationalist 3y ago
      > Doom and Warcraft II If that's all today's kids had access to, I wouldn't be worried about it either. I work with "average" kids today that have access to far more developmentally-damaging media, and I want the few kids that have parents that care enough to set up controls, to have a fighting chance.
      - surgical_fire 3y ago
        Oh, I am absolutely sure of that. I didn't mean my silly recollections there to be a way to handwave the concerns of people with parental controls nowadays. Those are important. I just miss those simpler times. The most risque thing we got our hands on back then were low resolution porn clips. Perhaps some odd hentai AVI with mangled translation. People used to be up in arms about something silly as Carmageddon being damaging to kid's mental health while truly awful stuff such as social media was brewing on the horizon.
rvba 3y ago
Google outsourced work to low cost bidders and now they get low quality results.
- saagarjha 3y ago
  Says the person whose last comment is upset that their engineers have a $300k salary?
  - rvba 3y ago
    Truth must have really hurt you, if you even went through my post history. My earlier comment is guy earning 300k shouldnt say that things are cheap. My current comment is that Google does not hire the best anymore, but outsources to lowest cost bidders and results are visible -> quality suffers.
    - hgsgm 3y ago
      What are they paying $300K for, if outsourcers are doing the work?
      - rvba 3y ago
        Probably designers who make new products (that are likely to get cancelled). While their popular cash cows are maintained by lowest bidders since it is boring / difficult.
        saagarjha 3y ago
        Difficult, sometimes. Boring, no.
    - saagarjha 3y ago
      I didn’t, I just spotted your comment in the other thread.
lima 3y ago
As a security researcher, I have to disagree - there's many things to criticize Google for, but "cavalier attitude to security" isn't one of them. Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). They have a fine track record keeping their users safe (...from anyone but themselves and the US government). > Given the embedded browser is not secure It's a standard web view, which uses the same engine and is sandboxed the same way the standalone Chrome browser is. There's a few extra APIs injected into it, but chances are that they require authentication or simply check the origin. What makes you think they didn't take this into account when triaging the report? There's hundreds of these web views with plenty of opportunities to "escape". > Now, Google only fixes security bugs only after they've combined into a severe remote exploit [citation needed] Things like Chrome entirely rely on multiple layers of protection and, like any sensible vendor, they will absolutely fix a bug in, say, the renderer process even if there's no full-chain exploit. > In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk In a kiosk or proctoring environment, you wouldn't be able to browse Google account settings in the first place. It's a non-issue.
- deleted 3y ago
  [deleted]
- blagie 3y ago
  > Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). I have to agree. Google has O(200k) employees, and included among those, are some of the best security people in the world. Indeed, many are left over from historic Google. However, there's a huge difference between having high-calibre employees and having those employees impact the security of the huge numbers of products Google develops. Most of those employees do fine research, but have no influence on the typical Google product. > They have a fine track record keeping their users safe ... [citation needed] Let me tell you a story. I use Google Workspace Free. My account was compromised, not through much fault of anyone involved (long story, involving being targeted by a criminal actor who gained physical access to a device). I wanted to collect records, go to the police, and have the criminal arrested. Google had clear logs of what happened. I found out that security was a value-added product. I'd need to switch from my version to a paid version, and could never switch back. The cost was going to be $6/user/month for the rest of my life, times a dozen family members, times 12 months, times another 60 years of life, which is around 50 thousand dollars. $50 grand. To get audit logs. You can guess what I decided. There was no way to prevent this retrospectively, but it'd be very easy to prevent prospectively. It just wasn't worth doing for $50k. The criminal is still out there. They might be targeting your home or business! Thanks Google! Another good story -- impacting a significant fraction of low-income individuals in the world -- is withholding security updates for Android after a few years to keep people on the upgrade treadmill. New devices have frequent updates. Older ones have slower updates, until at some point, the updates stop. Phones get compromised, and attackers do ransomware, identity theft, and other sorts of nasty things. Thanks Google! Security should not be a paid value-add. Everyone deserves security. I could tell many more stories too.
hunson_abadeer 3y ago
The prevailing take on HN and most other geeky sites is that measures meant to prevent users from fully using their devices - DRM, secure boot, etc - are harmful at worst and pointless at best. We usually don't get upset about iPhone or Playstation jailbreaks - we celebrate users regaining control of their devices. This is even though you can think of a malicious use or two. What's different about this issue? That it gives us an opportunity to bash Google? And to make broad inferences about the company's supposed demise from a single anecdotal data point? Essentially every other company that attempts these kinds of controls will sooner or later find it bypassed, usually many times over...
HeWhoLurksLate 3y ago
I can confirm that this works as a bypass for IBM's MaaS360 for at least one organization
miohtama 3y ago
Kids bypassing a default web browser is not a security issue, but a parenting issue.
hospitalJail 3y ago
I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading an APK, going to settings, clicking allow install from web, then installing the malware. (Don't @me about Samsung hardware issues, if you cared about quality/did research, you wouldn't have bought a Samsung Android. Or heck, anything from Samsung.) Google is a crap company that I barely use(at most degoogled services and the occasional search when DDG can't do it), but we should give companies credit when they do things well. It promotes competency over relentless marketing.
- tired-turtle 3y ago
  Not disagreeing, but consider the user base of iOS vs Android. iOS users are wealthier/etc., so exploits affecting them seem more likely to be “newsworthy” and, hence, more likely to be pursued (higher upside). Similarly, consider how a sunken ferry that killed hundreds of migrants went largely unnoticed during the brouhaha surrounding the Titanic sub.
  - drivebycomment 3y ago
    https://zerodium.com/program.html https://zerodium.com/program.html Zerodium pays more for Android zero click FCP(full chain with persistence) than on iOS zero click FCP. Most other categories Android and iOS exploits pay the same.
- wahnfrieden 3y ago
  Google is substantially wiretapped
  - surajrmal 3y ago
    This is baseless fud.
hgsgm 3y ago
a browser is benign technology. If you want to block network access, you install a network filter.
- asdff 3y ago
  Back in my day we would run laps around the school webmaster and their site blocking. Eventually they gave up when they realized there were more proxy sites available for us kids to find than time they had to go through the logs and block this stuff on top of their usual IT workload for the week. At some point we also realized you could proxy a website with google translate, and that basically became as good as gold in terms of an unblockable proxy, because kids needed that website for language classes.
BeFlatXIII 3y ago
Good for those children. They have figured out to return control of the device to its user instead of it unquestioningly serving the interest of its owner.
freedomben 3y ago
> I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives. Doesn't that seem a little hyperbolic? "Ruin somebody's life" seems pretty dramatic.
- scrum-treats 3y ago
  Are you familiar with identity theft? How about browser-based attacks leveraged via Google vulnerabilities that allow malicious (corporate) actors access to your keystrokes (e.g., user sign-on information across all accounts)? Google's response since mid-2022 has consistently been "deny deny deny" and downplay, much like you are doing here. Meanwhile individuals and small businesses are targeted and crushed. It's hard to know when your identity is compromised, and by the time you know it, it's usually too late to easily triage. To the extent Google introduces products and services that contain large-scale vulnerabilities, it is very much their fault. Yet, nothing happens. Individuals pay the price of using Google products, and Google continues to make billions of dollars, unscathed. Microsoft and Amazon are also guilty of this. Where are actual consumer protections? Nowhere to be found, in the US.
j45 3y ago
Increasingly it seems iOS is the way to go for kids devices and management of the screentime. Maybe folks here have had good luck with other android roms
kernal 3y ago
>Google's increasingly cavalier attitude towards security is concerning: >1) Kids WILL use this to bypass parental / school controls as soon as they learn about it What an utterly ridiculous take. It's 2023 and there are a myriad of options available for kids accessing content they want to see without using some convoluted and hamstrung procedure.
tesdinger 3y ago
> Given the embedded browser is not secure, if a lot of kids do this Sounds like a parenting issue, not a software issue.

by blagie 3y ago

px43 3y ago

This is a pretty standard kiosk breakout technique, which have been super common since the 90s. They have always existed, and will continue to exist. The impact and use cases for issues like this are pretty negligible, so they don't get addressed as quickly as bugs that can actually be used for real crime. Also, you say the embedded browser is "not secure", yet the going rate for browser bugs on Android are in the multi-million dollar range, especially if it leads to root.

gjsman-1000 3y ago
There are plenty of ways to invade someone’s privacy without being root. Stealing a Google Account would still be a prize.

henriquez 3y ago

At least Mozilla is still around to find all their bugs for them.

inetknght 3y ago

> 1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Good. Parental/school controls don't belong on the device. They belong on whatever the device connects to. That would be parental/school networks. If you don't want your kids to connect to things then don't let your kids have devices that connect to things. > 2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk The direct security risk is using Google in the first place. > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations There's nothing in that statement that relates specifically to kids.

jabradoodle 3y ago
How would network restrictions help, there is WiFi at friends houses / everywhere. > There's nothing in that statement that relates specifically to kids. Most adults probably don't have parental controls on their phone...
- heavyset_go 3y ago
  > How would network restrictions help, there is WiFi at friends houses / everywhere. > > If you don't want your kids to connect to things then don't let your kids have devices that connect to things.
  - jabradoodle 3y ago
    Comment said the restrictions belong on the network being connected to, which is useless when you can connect else where. Yes not giving your kids access to a device is one option; parental controls are another. I'm not sure either will work entirely, but that's another point.
    - JoshTriplett 3y ago
      And locking down the primary device a kid has access to creates the lure of the forbidden; that won't last any longer than their access to another device without those restrictions. That also creates an environment where if they do find something they really ought to be able to talk an adult about, they can't talk to a parent about it because they'll be in trouble (and get their friends in trouble). One of the widely studied aspects of child psychology is how to instill guidelines that last even when they're elsewhere without any enforcement other than self-enforcement.

lucideer 3y ago

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an important or necessary measure in some contexts but classifying it as "security" is misleading.

Angostura 3y ago
> Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children
- YetAnotherNick 3y ago
  There are lot of much easier ways to compromise security both for careless or malicious users. This is the fundamental difference between ios and android. If you want you could ruin the security of android, however it is harder to do it in ios. Definitely not impossible, you could sideload dangerous apps easily in ios as well.
  - prepend 3y ago
    > There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.
    - YetAnotherNick 3y ago
      I think you misunderstood me. Android deliberately allows users to hack into their own phone and remove its security. It allows users to install malicious apps if they want to or even root the phone entirely. So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).

elric 3y ago

As someone who remembers being a child, I'm glad there are still ways around parental controls. Kids are going to break rules, and that's fine. Making arbitrary rules unbreakable has always seemed iffy to me...

mavhc 3y ago
How else will your kids learn to be l33t hackers without motivation?
ethbr0 3y ago
> Making arbitrary rules unbreakable has always seemed iffy to me... It creates better hackers.
- elric 3y ago
  I'm not so sure about that, though I guess you are probably joking. Kids are given "smart" devices which make it easy to consume stuff, but nigh impossible to break out of, let alone create stuff on (or at least nigh impossible to create code).
- heavyset_go 3y ago
  IMO, it creates less hackers.
  - ethbr0 3y ago
    https://m.youtube.com/watch?v=bTeVgfPM0Xw&t=5m29s https://m.youtube.com/watch?v=bTeVgfPM0Xw&t=5m29s Life, uh, finds a way.
- lucasv07 3y ago
  as one of these young “hackers” that has always found ways for circumventing restrictions, I can definitively tell you that every kid that uses these bypasses has a different level of understanding of the “hack”. for example, some of my friends use the bypasses that I make, and they don’t have to understand the tool to use it. so while there are many (s)kids using these, it’s actually a very small percentage that learn how to make the bypass themselves, and become “better hackers”.

coldtea 3y ago

>1) Kids WILL use this to bypass parental / school controls as soon as they learn about it Doesn't sound concerning, especially the latter.

prepend 3y ago
As a parent, it’s concerning to me. It’s funny how I never thought it would be an issue but kids have real impulse control issues and devices are super easy to spend too much time on and contribute to negative mental health. Screen time controls don’t solve this, but they help a little bit as part of many other things to help people learn about how to self regulate.
- surgical_fire 3y ago
  When I was a kid we managed to hack into my school's lab's computers to install Doom and Warcraft II. Good times.
  - tjungblut 3y ago
    I vividly remember cracking the admin PWs with ophcrack or the school WEP wifi with aircrack-ng.
  - rationalist 3y ago
    > Doom and Warcraft II If that's all today's kids had access to, I wouldn't be worried about it either. I work with "average" kids today that have access to far more developmentally-damaging media, and I want the few kids that have parents that care enough to set up controls, to have a fighting chance.
    - surgical_fire 3y ago
      Oh, I am absolutely sure of that. I didn't mean my silly recollections there to be a way to handwave the concerns of people with parental controls nowadays. Those are important. I just miss those simpler times. The most risque thing we got our hands on back then were low resolution porn clips. Perhaps some odd hentai AVI with mangled translation. People used to be up in arms about something silly as Carmageddon being damaging to kid's mental health while truly awful stuff such as social media was brewing on the horizon.

rvba 3y ago

Google outsourced work to low cost bidders and now they get low quality results.

saagarjha 3y ago
Says the person whose last comment is upset that their engineers have a $300k salary?
- rvba 3y ago
  Truth must have really hurt you, if you even went through my post history. My earlier comment is guy earning 300k shouldnt say that things are cheap. My current comment is that Google does not hire the best anymore, but outsources to lowest cost bidders and results are visible -> quality suffers.
  - hgsgm 3y ago
    What are they paying $300K for, if outsourcers are doing the work?
    - rvba 3y ago
      Probably designers who make new products (that are likely to get cancelled). While their popular cash cows are maintained by lowest bidders since it is boring / difficult.
      - saagarjha 3y ago
        Difficult, sometimes. Boring, no.
  - saagarjha 3y ago
    I didn’t, I just spotted your comment in the other thread.

lima 3y ago

As a security researcher, I have to disagree - there's many things to criticize Google for, but "cavalier attitude to security" isn't one of them. Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). They have a fine track record keeping their users safe (...from anyone but themselves and the US government). > Given the embedded browser is not secure It's a standard web view, which uses the same engine and is sandboxed the same way the standalone Chrome browser is. There's a few extra APIs injected into it, but chances are that they require authentication or simply check the origin. What makes you think they didn't take this into account when triaging the report? There's hundreds of these web views with plenty of opportunities to "escape". > Now, Google only fixes security bugs only after they've combined into a severe remote exploit [citation needed] Things like Chrome entirely rely on multiple layers of protection and, like any sensible vendor, they will absolutely fix a bug in, say, the renderer process even if there's no full-chain exploit. > In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk In a kiosk or proctoring environment, you wouldn't be able to browse Google account settings in the first place. It's a non-issue.

deleted 3y ago
[deleted]
blagie 3y ago
> Their security teams are industry-leading and they have done a lot of important work over the past decade (Project Zero, a very well-done bug bounty program, Advanced Protection, FIDO/hardware security keys, large-scale fuzzing and AFL, tons of behind the scenes sandboxing work, Linux kernel hardening...). I have to agree. Google has O(200k) employees, and included among those, are some of the best security people in the world. Indeed, many are left over from historic Google. However, there's a huge difference between having high-calibre employees and having those employees impact the security of the huge numbers of products Google develops. Most of those employees do fine research, but have no influence on the typical Google product. > They have a fine track record keeping their users safe ... [citation needed] Let me tell you a story. I use Google Workspace Free. My account was compromised, not through much fault of anyone involved (long story, involving being targeted by a criminal actor who gained physical access to a device). I wanted to collect records, go to the police, and have the criminal arrested. Google had clear logs of what happened. I found out that security was a value-added product. I'd need to switch from my version to a paid version, and could never switch back. The cost was going to be $6/user/month for the rest of my life, times a dozen family members, times 12 months, times another 60 years of life, which is around 50 thousand dollars. $50 grand. To get audit logs. You can guess what I decided. There was no way to prevent this retrospectively, but it'd be very easy to prevent prospectively. It just wasn't worth doing for $50k. The criminal is still out there. They might be targeting your home or business! Thanks Google! Another good story -- impacting a significant fraction of low-income individuals in the world -- is withholding security updates for Android after a few years to keep people on the upgrade treadmill. New devices have frequent updates. Older ones have slower updates, until at some point, the updates stop. Phones get compromised, and attackers do ransomware, identity theft, and other sorts of nasty things. Thanks Google! Security should not be a paid value-add. Everyone deserves security. I could tell many more stories too.

hunson_abadeer 3y ago

The prevailing take on HN and most other geeky sites is that measures meant to prevent users from fully using their devices - DRM, secure boot, etc - are harmful at worst and pointless at best. We usually don't get upset about iPhone or Playstation jailbreaks - we celebrate users regaining control of their devices. This is even though you can think of a malicious use or two. What's different about this issue? That it gives us an opportunity to bash Google? And to make broad inferences about the company's supposed demise from a single anecdotal data point? Essentially every other company that attempts these kinds of controls will sooner or later find it bypassed, usually many times over...

HeWhoLurksLate 3y ago

I can confirm that this works as a bypass for IBM's MaaS360 for at least one organization

miohtama 3y ago

Kids bypassing a default web browser is not a security issue, but a parenting issue.

hospitalJail 3y ago

I don't trust google for multiple reasons, wont use them for anything important or start new services, I am careful to what I search, etc... However, as far as my knowledge tells me Google is the best in the biz when it comes to security. While iPhones 0 click exploits cause the death of journalists and leak nudes of billionaires; The biggest 'Android' exploit Pegasus has requires going to some website, downloading an APK, going to settings, clicking allow install from web, then installing the malware. (Don't @me about Samsung hardware issues, if you cared about quality/did research, you wouldn't have bought a Samsung Android. Or heck, anything from Samsung.) Google is a crap company that I barely use(at most degoogled services and the occasional search when DDG can't do it), but we should give companies credit when they do things well. It promotes competency over relentless marketing.

tired-turtle 3y ago
Not disagreeing, but consider the user base of iOS vs Android. iOS users are wealthier/etc., so exploits affecting them seem more likely to be “newsworthy” and, hence, more likely to be pursued (higher upside). Similarly, consider how a sunken ferry that killed hundreds of migrants went largely unnoticed during the brouhaha surrounding the Titanic sub.
- drivebycomment 3y ago
  https://zerodium.com/program.html https://zerodium.com/program.html Zerodium pays more for Android zero click FCP(full chain with persistence) than on iOS zero click FCP. Most other categories Android and iOS exploits pay the same.
wahnfrieden 3y ago
Google is substantially wiretapped
- surajrmal 3y ago
  This is baseless fud.

hgsgm 3y ago

a browser is benign technology. If you want to block network access, you install a network filter.

asdff 3y ago
Back in my day we would run laps around the school webmaster and their site blocking. Eventually they gave up when they realized there were more proxy sites available for us kids to find than time they had to go through the logs and block this stuff on top of their usual IT workload for the week. At some point we also realized you could proxy a website with google translate, and that basically became as good as gold in terms of an unblockable proxy, because kids needed that website for language classes.

BeFlatXIII 3y ago

Good for those children. They have figured out to return control of the device to its user instead of it unquestioningly serving the interest of its owner.

freedomben 3y ago

> I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives. Doesn't that seem a little hyperbolic? "Ruin somebody's life" seems pretty dramatic.

scrum-treats 3y ago
Are you familiar with identity theft? How about browser-based attacks leveraged via Google vulnerabilities that allow malicious (corporate) actors access to your keystrokes (e.g., user sign-on information across all accounts)? Google's response since mid-2022 has consistently been "deny deny deny" and downplay, much like you are doing here. Meanwhile individuals and small businesses are targeted and crushed. It's hard to know when your identity is compromised, and by the time you know it, it's usually too late to easily triage. To the extent Google introduces products and services that contain large-scale vulnerabilities, it is very much their fault. Yet, nothing happens. Individuals pay the price of using Google products, and Google continues to make billions of dollars, unscathed. Microsoft and Amazon are also guilty of this. Where are actual consumer protections? Nowhere to be found, in the US.

j45 3y ago

Increasingly it seems iOS is the way to go for kids devices and management of the screentime. Maybe folks here have had good luck with other android roms

kernal 3y ago

>Google's increasingly cavalier attitude towards security is concerning: >1) Kids WILL use this to bypass parental / school controls as soon as they learn about it What an utterly ridiculous take. It's 2023 and there are a myriad of options available for kids accessing content they want to see without using some convoluted and hamstrung procedure.

tesdinger 3y ago

> Given the embedded browser is not secure, if a lot of kids do this Sounds like a parenting issue, not a software issue.