4 ms·
It’s not really a vulnerability in the sense that it leads to any sort of system compromise. It’s definitely a design flaw in whatever features they added to th
by extheat 3y ago
It’s not really a vulnerability in the sense that it leads to any sort of system compromise. It’s definitely a design flaw in whatever features they added to the OS, but not necessarily something that warrants a huge investigation.
- andybak 3y agoI think anyone expecting these security-related features to work as expected would regard it as a vulnerability.
- dcow 3y agoThere are also just normal bugs and known limitations and acceptable risks.
- kllrnohj 3y agoIs parental lock really "security-related" ? Like it's a frustrating response to this valid bug report, but it's not really a security risk here, either. You don't actually bypass the lock screen or anything.
- andybak 3y agoI think it really is and could have serious safeguarding issues. Also other features are effected like kiosk mode etc. The implications are unclear but could conceivably be quite serious in some scenarios.
- kllrnohj 3y ago> Also other features are effected like kiosk mode etc Is it? That's not demonstrated nor claimed in the linked article. > I think it really is and could have serious safeguarding issues. Elaborate. What's the security risk from your child using a browser after the parental control timeout expired? It's annoying that the automatic limits didn't fully happen, but data isn't compromised as a result, either.
- ramses0 3y agoBrowse the open internet (or internal network?!) from a McDonalds ordering kiosk? No skin in the game, but this is very similar to the old Win95 "About... Help... $BROWSER" style bypasses.
- semireg 3y agoWe are worried about children being compromised. This is as much about data getting into their heads as it is about basic exfiltration.
- tigerBL00D 3y agoIf I read that correctly, in the second case someone can bypass the pinning feature to access your personal information via the default browser's active sessions. That would be a compromise if that's the case.
- JoshuaRogers 3y agoSure, it's not arbitrary code execution, but it's certainly privilege escalation.