6 ms·

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting

> Google's increasingly cavalier attitude towards security is concerning: > [3 bullet points unrelated to security] Security is a field related to protecting device-users from malicious actors. Your 3 examples all fall broadly under parental-controls, which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors. That may be an important or necessary measure in some contexts but classifying it as "security" is misleading.

Angostura 3y ago
> Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children
- YetAnotherNick 3y ago
  There are lot of much easier ways to compromise security both for careless or malicious users. This is the fundamental difference between ios and android. If you want you could ruin the security of android, however it is harder to do it in ios. Definitely not impossible, you could sideload dangerous apps easily in ios as well.
  - prepend 3y ago
    > There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.
    - YetAnotherNick 3y ago
      I think you misunderstood me. Android deliberately allows users to hack into their own phone and remove its security. It allows users to install malicious apps if they want to or even root the phone entirely. So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).
      - II2II 3y ago
        I would hardly call disabling a security feature in the settings or getting an authorization key from the vendor hacking into your own phone. These are features that allow users who (think they) know what they are doing do what they want to do. It is intentional and people can figure out the consequences by doing some research. That is in start contrast to finding an undocumented hole in security.
- lucideer 3y ago
  > sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. There are two cases where this is true: a user intentionally sharing internal access with external malicious actors, or a user unintentionally sharing internal access with external malicious actors (e.g. social engineering / general incompetence). Neither apply to kiosk breakouts.
  - Angostura 3y ago
    You seem very sure that those are the only two security risks to an expected browser being available on an otherwise managed device. I'm pretty certain there may be other risks.
    - lucideer 3y ago
      One can absolutely make an argument for a great many risks to be classified under security concern: there are certainly more than just these two. Doing so is simply reductio ad absurdum. To expand on this, we can if we choose classify all parental controls under general access control, and within a principle of least privilege further classify the following as legitimate security risks: - access to the internet - access to a keyboard - read access to a disk There are absolutely scenarios one can contoct where these are real concerns. The settings panel of a general-purpose consumer device doesn't fit that venn diagram for me. Is it a bug: yes. Is it a security bug: no.
      - deleted 3y ago
        [deleted]
      - blagie 3y ago
        Please take this as critical feedback, and not as a personal attack: The comments which you are making here suggest that you shouldn't develop any software which in any way touches personal data without significant upskilling on IT security. You're making false comments with complete confidence. Most security scenarios came about as a result of attackers being able to bring systems into absurd situations, and moving systems through unintended pathways. "Reductio ad absurdum" could apply to most digital exploits before they've happened. "Why would the system get into that state?" That's a key difference between physical security and digital security: - In a physical situation, I need to worry about what a typical criminal trying to break into my home or business might do. That requires reasonable measures. - In digital security, I need to worry about what the most absurdly creative attacker on the internet might do (and potentially bundle up as a script / worm / virus / etc.). I do need to worry about scenarios which might seem absurd for physical security. If you engineer classifying only "reasonable" scenarios as security risks, your system WILL eventually be compromised, and there WILL be a data leak. That shift in mind set happened around two decades ago, when the internet went from a friendly neighborhood of academics to the wild, wild west, with increasingly creative criminals attacking systems from countries many people in America have never heard of, and certainly where cross-border law enforcement is impractical. I've seen people like you design systems, and that HAS led to user harm and severe damages to the companies where they worked. At this point, this should be security 101 for anyone building software.
- RobotToaster 3y ago
  >it is also to do with protecting organisations from careless or malicious users. What about protecting users from careless or malicious organisations?
- Mystery-Machine 3y ago
  If you (in this case parent) block something (in this case browsing porn sites) on some software (in this case Android device), it most definitely _is_ a security issue if the user (in this case a child) can bypass the restriction you imposed. I don't understand what's not clear there? If your phone is locked with a pin and you pass it to your friend (Stifler) because his mom just called you, he should not in any circumstance, be able to unlock your phone without knowing the pin code. That's the first issue. The second security issue is the possibility of any website calling private internal Android functions for (potentially) setting encryption keys of your device (!!!) You don't consider this a security issue?
  - nomel 3y ago
    Related, I used to root my old android phones by going to rooting websites that would do it all in browser.
jasmer 3y ago
[dead]
naasking 3y ago
> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.
- saagarjha 3y ago
  The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.
  - johannes1234321 3y ago
    Privilege escalation is a typical class soft security issues. The device owner (parent, school, etc.) set restrictions, which some other user bypasses.
    - saagarjha 3y ago
      Right, that’s a parental control scenario.
      - sroussey 3y ago
        A Linux box with a root user and an end user and the end user can run things as root without root authentication—is that also parental controls?
    - detourdog 3y ago
      Could be an organizational need like medical files and HIPA.
  - naasking 3y ago
    > The user is generally never the adversary in any legitimate security situation. First, this isn't correct, for instance, DRM and TPM. Second, "the user" does not have direct access to the computer internals, which means all such access is mediated by programs that are supposed to act on the user's behalf. But because software is not formally verified, we have no guarantee that they do so, and so we must assume that any program purporting to run on the user's behalf is intentionally or unintentionally malicious. This is where the principle of least privilege comes from.
taeric 3y ago
Defining your way out of giving secure, as in safe, devices to kids is frustrating. And sadly reflective of exactly why the original comment is correct.
blagie 3y ago
Well said. Spoken like a true Google engineer! However, I think you understand both security as a field, at least one of my three points, as well as children and parenting. =================== Security as a field =================== You wrote: "Security is a field related to protecting device-users from malicious actors." This is a very narrow and incorrect definition. Security as a field relates to many things, including for example protecting confidential information. If my medical information is handled by a hospital, I would like to know that information does not land on the dark web. In order to do this, the hospital needs to implement processes which protect my information from nurses being socially-engineered, doctors installing spyware, and countless other threats. This is handled in-depth: - Personnel handling my sensitive data should be screened. - There should be technological restrictions on the devices preventing both malicious actors and errors - There should be training in place - There should be appropriate legal safeguards (NDAs, employment agreements, etc.) - And so on. Managing confidential information involves having managed devices. In many cases, these are also in physically-secure facilities and intentionally kept off-line. They don't belong to the person using them. ========= Bullet #3 ========= One of the points in the original article is that the embedded browser has "a weird JavaScript object named mm" which appears to be used to handle things like security keys. This is a security issue in the narrow sense you've defined. If my child (and many other kids) uses this to bypass parental controls, their device is likely to be compromise by a malicious actor if they browse to a malicious web site. ======== Children ======== You described kids as "a scenario within which the user is the adversary" I don't know if you've ever interacted with young kids before, but they're not so much the adversary as oblivious and clueless. Before they're teenagers, most are sweet, charming, and WANT to do the right thing. However: - They have no idea what a "buffer overflow attack" is, let along phishing and other standard scams - They're very easy to socially engineer. If you're a Random Adult, and ask them for a password, and give a stern look, they'll probably give it to you. - They have no idea of the kinds of malicious actors on the internet. If someone tells them "To enable Angry Birds, go to this special dialogue," they might very well do it. There are online videos of malicious actors tricking little kids into e.g. washing their devices in a sink, or sticking them into a microwave purely for the LOLs. Mean people do these things to kids. ... and so on. The reason to control and monitor what little kids do (not just digitally; the same applies to kitchen knives, fireplaces, and swimming pools) has very little to do with treating them as an adversary, and a lot to treating them as little kids who need an adult to help them learn.
jonhohle 3y ago
This could also be considered a sandbox bypass. A device/application is given a limited set of capabilities to ensure that if something does go wrong, the affected area is small and well known. This effectively eliminates those safeguards and provides a gaping hole that most systems designers would think had been closed vis other configuration. As others have pointed out: kiosks, schools, prisons, POS, the check-in device at a Dr. office, and any other managed device have a reasonable expectation yo behave as their admins have configured them for the sake of not necessarily the person who has the device, but also the person sitting next to them that they could possibly effect by misuse of the device. Systems have firewalls, ulimits, pledge, acls, permissions, sometimes physical lock and keys to prevent users of the system from doing things that owners or operators of the system have decided should not be permitted. As others have mentioned, this might be for security, compliance, CYA, or just reducing the number of variables to consider in a system.
- lucideer 3y ago
  > This could also be considered ... I agree but you've very appropriately used the word "could" here. The gp bemoaned Google not prioritising this issue as a serious security concern. Whether it could theoretically be classified under security if X, Y & Z were true, due to the to-the-letter definition of access control threat models, doesn't mean that in this specific case of a consumer device, that using a browser from settings is a high severity risk. Even if it were a bypass of something like Nessus/Crowdstrike/et al (and not just consumer parental controls), it still wouldn't represent a significant threat as a simple kiosk escape in isolation. Any definition that classifies this as the gp is proposing is a theoretical nitpick, not an actual considered threat model.
NovemberWhiskey 3y ago
This is literally a privilege-escalation attack: i.e. the user escapes from controls that are imposed on them by the device manager (which may well not be the user, but a corporate MDM platform). Are you suggesting that privilege-escalation attacks are not security risks?
- lucideer 3y ago
  > Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.
  - gfodor 3y ago
    No, you said they are 'unrelated to security.' Just admit you made a mischaracterization. It happens.
    - grayhatter 3y ago
      I agree with lucideer here. While I think the language chosen needlessly leaves space for pedantic arguments. They're correct that, from the context of google's software, none of these are relevant to the security that Google needs to care about. it's true they could be a part of the things security needs to care about, but so is a phone catching on fire because of its battery. which in of itself is not directly a security risk.
  - NovemberWhiskey 3y ago
    >Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. OK, so we agree that, your original statement (which follows) is wrong, because it makes broad, tacit assumptions about the threat model that are not justified? Security is a field related to protecting device-users from malicious actors. Whereas a more conventional definition of information security would also involve protecting systems from unauthorized access, including privilege escalations (that's the E in STRIDE, right?) that bypass controls that were intended to apply to the user. Honestly, it's baffling to me why you're arguing this point.
mlyle 3y ago
> Security is a field related to protecting device-users from malicious actors. This is one of many aspects of security-- perhaps what Google considers most important on Android, but surely you can imagine some scenarios which we care about which aren't about an end-user getting attacked. (Indeed, sometimes security is all about protecting infrastructure, assets, or information from device users). Besides, the third point that you cavalierly dismiss above: > > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations directly relates to even your limited notion of security.
l33t233372 3y ago
The third bullet point explicitly mentions the device being compromised, so I think it’s unfair to paint that as unrelated to security or just a parental-control issue.

Angostura 3y ago

> Security is a field related to protecting device-users from malicious actors. You know - sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. The three points are related to security, even it couched in terms of parents/children

YetAnotherNick 3y ago
There are lot of much easier ways to compromise security both for careless or malicious users. This is the fundamental difference between ios and android. If you want you could ruin the security of android, however it is harder to do it in ios. Definitely not impossible, you could sideload dangerous apps easily in ios as well.
- prepend 3y ago
  > There are lot of much easier ways to compromise security both for careless or malicious users. So what? There can be multiple ways to compromise security and it’s not like we only solve the easiest ways and leave the rest. While there are easier ways today, when those get patched this will one day be the easiest.
  - YetAnotherNick 3y ago
    I think you misunderstood me. Android deliberately allows users to hack into their own phone and remove its security. It allows users to install malicious apps if they want to or even root the phone entirely. So there is nothing to solve or patch here. You could get ios if you want user to not have that power(even there it isn't very hard to install malicious accessibility app through sideloading).
    - II2II 3y ago
      I would hardly call disabling a security feature in the settings or getting an authorization key from the vendor hacking into your own phone. These are features that allow users who (think they) know what they are doing do what they want to do. It is intentional and people can figure out the consequences by doing some research. That is in start contrast to finding an undocumented hole in security.
lucideer 3y ago
> sometimes, just sometimes - it is also to do with protecting organisations from careless or malicious users. There are two cases where this is true: a user intentionally sharing internal access with external malicious actors, or a user unintentionally sharing internal access with external malicious actors (e.g. social engineering / general incompetence). Neither apply to kiosk breakouts.
- Angostura 3y ago
  You seem very sure that those are the only two security risks to an expected browser being available on an otherwise managed device. I'm pretty certain there may be other risks.
  - lucideer 3y ago
    One can absolutely make an argument for a great many risks to be classified under security concern: there are certainly more than just these two. Doing so is simply reductio ad absurdum. To expand on this, we can if we choose classify all parental controls under general access control, and within a principle of least privilege further classify the following as legitimate security risks: - access to the internet - access to a keyboard - read access to a disk There are absolutely scenarios one can contoct where these are real concerns. The settings panel of a general-purpose consumer device doesn't fit that venn diagram for me. Is it a bug: yes. Is it a security bug: no.
    - deleted 3y ago
      [deleted]
    - blagie 3y ago
      Please take this as critical feedback, and not as a personal attack: The comments which you are making here suggest that you shouldn't develop any software which in any way touches personal data without significant upskilling on IT security. You're making false comments with complete confidence. Most security scenarios came about as a result of attackers being able to bring systems into absurd situations, and moving systems through unintended pathways. "Reductio ad absurdum" could apply to most digital exploits before they've happened. "Why would the system get into that state?" That's a key difference between physical security and digital security: - In a physical situation, I need to worry about what a typical criminal trying to break into my home or business might do. That requires reasonable measures. - In digital security, I need to worry about what the most absurdly creative attacker on the internet might do (and potentially bundle up as a script / worm / virus / etc.). I do need to worry about scenarios which might seem absurd for physical security. If you engineer classifying only "reasonable" scenarios as security risks, your system WILL eventually be compromised, and there WILL be a data leak. That shift in mind set happened around two decades ago, when the internet went from a friendly neighborhood of academics to the wild, wild west, with increasingly creative criminals attacking systems from countries many people in America have never heard of, and certainly where cross-border law enforcement is impractical. I've seen people like you design systems, and that HAS led to user harm and severe damages to the companies where they worked. At this point, this should be security 101 for anyone building software.
RobotToaster 3y ago
>it is also to do with protecting organisations from careless or malicious users. What about protecting users from careless or malicious organisations?
Mystery-Machine 3y ago
If you (in this case parent) block something (in this case browsing porn sites) on some software (in this case Android device), it most definitely _is_ a security issue if the user (in this case a child) can bypass the restriction you imposed. I don't understand what's not clear there? If your phone is locked with a pin and you pass it to your friend (Stifler) because his mom just called you, he should not in any circumstance, be able to unlock your phone without knowing the pin code. That's the first issue. The second security issue is the possibility of any website calling private internal Android functions for (potentially) setting encryption keys of your device (!!!) You don't consider this a security issue?
- nomel 3y ago
  Related, I used to root my old android phones by going to rooting websites that would do it all in browser.

jasmer 3y ago

[dead]

naasking 3y ago

> which are about controlling & monitoring a user's use & access of their device - a scenario within whichc the user is the adversary, not external actors Access control falls squarely under security. Also, the user should be considered the adversary, because they or programs that run on their behalf might be malicious, either knowingly or unknowingly. Not accounting for this is one of UNIX's biggest blunders.

saagarjha 3y ago
The user is generally never the adversary in any legitimate security situation. Ignorance might be but that’s not something inherent to the user and an area for improvement.
- johannes1234321 3y ago
  Privilege escalation is a typical class soft security issues. The device owner (parent, school, etc.) set restrictions, which some other user bypasses.
  - saagarjha 3y ago
    Right, that’s a parental control scenario.
    - sroussey 3y ago
      A Linux box with a root user and an end user and the end user can run things as root without root authentication—is that also parental controls?
  - detourdog 3y ago
    Could be an organizational need like medical files and HIPA.
- naasking 3y ago
  > The user is generally never the adversary in any legitimate security situation. First, this isn't correct, for instance, DRM and TPM. Second, "the user" does not have direct access to the computer internals, which means all such access is mediated by programs that are supposed to act on the user's behalf. But because software is not formally verified, we have no guarantee that they do so, and so we must assume that any program purporting to run on the user's behalf is intentionally or unintentionally malicious. This is where the principle of least privilege comes from.

taeric 3y ago

Defining your way out of giving secure, as in safe, devices to kids is frustrating. And sadly reflective of exactly why the original comment is correct.

blagie 3y ago

Well said. Spoken like a true Google engineer! However, I think you understand both security as a field, at least one of my three points, as well as children and parenting. =================== Security as a field =================== You wrote: "Security is a field related to protecting device-users from malicious actors." This is a very narrow and incorrect definition. Security as a field relates to many things, including for example protecting confidential information. If my medical information is handled by a hospital, I would like to know that information does not land on the dark web. In order to do this, the hospital needs to implement processes which protect my information from nurses being socially-engineered, doctors installing spyware, and countless other threats. This is handled in-depth: - Personnel handling my sensitive data should be screened. - There should be technological restrictions on the devices preventing both malicious actors and errors - There should be training in place - There should be appropriate legal safeguards (NDAs, employment agreements, etc.) - And so on. Managing confidential information involves having managed devices. In many cases, these are also in physically-secure facilities and intentionally kept off-line. They don't belong to the person using them. ========= Bullet #3 ========= One of the points in the original article is that the embedded browser has "a weird JavaScript object named mm" which appears to be used to handle things like security keys. This is a security issue in the narrow sense you've defined. If my child (and many other kids) uses this to bypass parental controls, their device is likely to be compromise by a malicious actor if they browse to a malicious web site. ======== Children ======== You described kids as "a scenario within which the user is the adversary" I don't know if you've ever interacted with young kids before, but they're not so much the adversary as oblivious and clueless. Before they're teenagers, most are sweet, charming, and WANT to do the right thing. However: - They have no idea what a "buffer overflow attack" is, let along phishing and other standard scams - They're very easy to socially engineer. If you're a Random Adult, and ask them for a password, and give a stern look, they'll probably give it to you. - They have no idea of the kinds of malicious actors on the internet. If someone tells them "To enable Angry Birds, go to this special dialogue," they might very well do it. There are online videos of malicious actors tricking little kids into e.g. washing their devices in a sink, or sticking them into a microwave purely for the LOLs. Mean people do these things to kids. ... and so on. The reason to control and monitor what little kids do (not just digitally; the same applies to kitchen knives, fireplaces, and swimming pools) has very little to do with treating them as an adversary, and a lot to treating them as little kids who need an adult to help them learn.

jonhohle 3y ago

This could also be considered a sandbox bypass. A device/application is given a limited set of capabilities to ensure that if something does go wrong, the affected area is small and well known. This effectively eliminates those safeguards and provides a gaping hole that most systems designers would think had been closed vis other configuration. As others have pointed out: kiosks, schools, prisons, POS, the check-in device at a Dr. office, and any other managed device have a reasonable expectation yo behave as their admins have configured them for the sake of not necessarily the person who has the device, but also the person sitting next to them that they could possibly effect by misuse of the device. Systems have firewalls, ulimits, pledge, acls, permissions, sometimes physical lock and keys to prevent users of the system from doing things that owners or operators of the system have decided should not be permitted. As others have mentioned, this might be for security, compliance, CYA, or just reducing the number of variables to consider in a system.

lucideer 3y ago
> This could also be considered ... I agree but you've very appropriately used the word "could" here. The gp bemoaned Google not prioritising this issue as a serious security concern. Whether it could theoretically be classified under security if X, Y & Z were true, due to the to-the-letter definition of access control threat models, doesn't mean that in this specific case of a consumer device, that using a browser from settings is a high severity risk. Even if it were a bypass of something like Nessus/Crowdstrike/et al (and not just consumer parental controls), it still wouldn't represent a significant threat as a simple kiosk escape in isolation. Any definition that classifies this as the gp is proposing is a theoretical nitpick, not an actual considered threat model.

NovemberWhiskey 3y ago

This is literally a privilege-escalation attack: i.e. the user escapes from controls that are imposed on them by the device manager (which may well not be the user, but a corporate MDM platform). Are you suggesting that privilege-escalation attacks are not security risks?

lucideer 3y ago
> Are you suggesting that privilege-escalation attacks are not security risks? Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. Kiosk bypass might be vaguely categorisable alongside things like polkit exploits but they are not equivalent in any normal threat model.
- gfodor 3y ago
  No, you said they are 'unrelated to security.' Just admit you made a mischaracterization. It happens.
  - grayhatter 3y ago
    I agree with lucideer here. While I think the language chosen needlessly leaves space for pedantic arguments. They're correct that, from the context of google's software, none of these are relevant to the security that Google needs to care about. it's true they could be a part of the things security needs to care about, but so is a phone catching on fire because of its battery. which in of itself is not directly a security risk.
- NovemberWhiskey 3y ago
  >Nope. What I'm suggesting is that threat modelling is important. If attack vectors were classified equally based on technicalities we would have infinite surface area. OK, so we agree that, your original statement (which follows) is wrong, because it makes broad, tacit assumptions about the threat model that are not justified? Security is a field related to protecting device-users from malicious actors. Whereas a more conventional definition of information security would also involve protecting systems from unauthorized access, including privilege escalations (that's the E in STRIDE, right?) that bypass controls that were intended to apply to the user. Honestly, it's baffling to me why you're arguing this point.

mlyle 3y ago

> Security is a field related to protecting device-users from malicious actors. This is one of many aspects of security-- perhaps what Google considers most important on Android, but surely you can imagine some scenarios which we care about which aren't about an end-user getting attacked. (Indeed, sometimes security is all about protecting infrastructure, assets, or information from device users). Besides, the third point that you cavalierly dismiss above: > > 3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations directly relates to even your limited notion of security.

l33t233372 3y ago

The third bullet point explicitly mentions the device being compromised, so I think it’s unfair to paint that as unrelated to security or just a parental-control issue.