6 ms·

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive indi

I've meant to write a blog post about this, but here goes: In-app browsers allow users to view inappropriate content, often against the wishes of sensitive individuals. People especially at risk for this include addicts and children. Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. How? Usually buried in App Settings. Almost all apps use some instance of an in-app browser to (lazily) reference thier privacy policies, EULAs, or TOCs. A buried link leads to a homepage, leads to an instagram link, leads to an unfiltered internet. Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. Even boring apps like MS Teams or adding a Gmail account to iOS mail uses a secret in-app browser. This obviously presents a problem: should developers restrict any and all app access to in-app browsers, or leave policing to individuals/parents? An easy approach is to disable the in-app browser functionality in iOs, but obviously with grave cost to developers. At the same time, at what cost is in-app browser functionality being implemented.

wepple 4y ago
Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute
- ghayes 4y ago
  This is how I get to web videos on my Peloton. Viewing the mandatory software licenses leads to web links and then you can visit anything in that Chrome browser window.
  - password4321 4y ago
    Risky share -- the statute of limitations is not up on that one!
- sirsinsalot 4y ago
  Novell Netware had a similar bug circa 1998 whereby pressing `F1` at the login screen of the terminal opened the help dialog, which opened links in IE ... from there the main Windows shell could be ran and bingo ... you're in.
  - TedDoesntTalk 4y ago
    I never saw IE or Windows running on Novell Netware. It was a server operating system. What you’re saying is akin to saying you can create a windows shell from inside linux.
    - brk 4y ago
      The Netware backend server was it's own OS, IIRC. However on the client side, you had MS-DOS and Windows Netware clients to login to the Novell server and access the associated shared resources.
      - TedDoesntTalk 4y ago
        Right, but those clients weren’t “Novell netware”.
        sirsinsalot 4y ago
        The windows client login and resource control was branded as such tho
    - yesbabyyes 4y ago
      I think what they mean is the Netware login dialogue, on Windows. My classmate hacked our high school's network, getting him thrown out of class. I'm pretty sure he used a different method, though. He got a job working for the school. This was in the mid 90s.
      - mandevil 4y ago
        Colonial? (This definitely happened at my school, wondering how common this was.)
- grishka 4y ago
  Also on Android-based kiosks, you can get into the OS through the on-screen keyboard if they're using it. Try long tapping the buttons around the spacebar, one of them would usually get you into system settings. From there you can as much as completely take over the device if you wish.
- orlp 4y ago
  As a kid I loved doing this in every museum/library/other place that always had 'locked down' interactive Windows systems back in my youth. One of my favorite ones was in a museum where I was with a friend, and there was a PC. We were bored and wanted to play some flash game, but we only had access to a mouse, and clicking links inside the locked fullscreen browser. With enough clicks we got to google and managed to copy/paste letter by letter the name of a game site in the search field and play some games.
  - dbtc 4y ago
    And I'm just excited to be able to 'visit' a museum from the internet :-)
  - pricci 4y ago
    Although using the on-screen keyboard in accessibility settings would have been easier (if that existed back then), I like your creative young mind.
    - orlp 4y ago
      We couldn't access anything but the browser window in fullscreen, only using the mouse. No start menu, tray icons, keyboard shortcuts, etc. I'm sure there's like 100 different ways to break these bad Windows kiosks so that you'd eventually end up being able to access the accessibility settings, but it wasn't directly accessible to us.
davet91 4y ago
The in-app browsers could use a domain whitelist if parental controls are turned on.
- adaktix 4y ago
  It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.
- graham1776 4y ago
  That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
- yowzadave 4y ago
  Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
- gowld 4y ago
  The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)
rahkiin 4y ago
It is interesting how this would apply for custom browser engines in the future of iOS.
- CharlesW 4y ago
  This class of security problem is also a great reason to never allow custom browser engines.
  - smoldesu 4y ago
    ...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.
    - happyopossum 4y ago
      Then the app can use DOH, or tunnel DNS requests over something else - a non-safari browser engine wouldn’t have to use system DNS by any means…
      - jamespo 4y ago
        I thought non-safari browser engines were banned
        als0 4y ago
        They are. This is a hypothetical discussion.
  - postalrat 4y ago
    How about services like luna, stadia, etc which can render any sort of interactive content (typically games)?
smoldesu 4y ago
Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy (a hard pill to swallow for HN users), so control their access to technology unless you're ready to have a serious sit-down discussion about the internet, personal privacy, and all that jazz. Put yourself in their shoes; if you're given a small black brick with an indeterminate number of capabilities, wouldn't your response be pushing it as far as it can go? I know that was my reaction when I was a kid, after buying a Pentium desktop at a garage sale.
- chinchilla2020 4y ago
  You don't have kids. Your child would be the only one at school with no phone and probably be pretty embarrassed about it.
  - munk-a 4y ago
    In school I was embarrassed about the clothes I wore... also the calculator I had and my shoes and my lunch and my trapper keeper and my pencils... Kids being embarrassed at school is unavoidable, being embarrassed is practically the job description of a teenager and younger students often have their own insecurities. There's an interesting debate as to whether these embarrassments are good or bad for us in the long run but we can side step all of that... not having access to a smartphone is important - it's important enough to warrant the slight amount of embarrassment.
- Minor49er 4y ago
  I wish this was still considered to be common sense
- ars 4y ago
  You can't live in today's world without a phone. All the mechanisms of the past that were geared for this no longer exist. For example: Drive on the road, get to a toll, don't have a Transponder to pay the bill? No problem - just call a phone number. Uh, what if I don't have a cell? This literally never even occurred to them, there is no alternative way to pay the bill. That's life today, and it applies to children as well. Want to go to some sports place that only caters to teens and above? Load this website on your phone and fill out an application. Don't have a phone? Borrow a friends phone.
Fogest 4y ago
I have a browser based game I play that makes use of many userscripts and browser extensions to further improve/enhance the game. However mobile users suffer from a problem of not having such extras. There is a very nice app someone made on Android and iOS that uses in-app browsers in order to be able to add a lot of custom things. There are many useful instances for the in-app browsers and I don't think they should be removed because of some bad actors. It's similar to how Android has had password managers making use of autofill tools via accessibility tools. Android was butchering that access, but luckily started adding some official autofill support. I don't think removing capabilities in the favour of "safety" is usually the right approach in my opinion.
- celtain 4y ago
  Most of the usecases mentioned in this thread wouldn't suffer if the in-app browser had to be invoked with a whitelist of approved domains/urls. Perhaps apps could request permission to run an unrestricted in-app browser, and that could be used to facilitate parental controls. As an aside, is giving parents the option to disable in-app browsers removing a capability or adding one?
  - Fogest 4y ago
    Yes I think in app browsers should still follow parental controls, and I don't see why that wouldn't already be a thing on devices. If I can use a VPN on my phone and have that block sites for me, it seems like it should be pretty trivial for the phone to respect parental controls across all apps, not just specifically web browsers. That would be an additional capability. But having to force a website to give specific apps permission to display them in-app seems like a removal. Some people are also suggesting removing in-app browsers which also seems silly.
- RainaRelanah 4y ago
  Mind if I ask what game? Kiwi on Android is a Chromium fork that re-enables extensions on mobile. Works well for userscripts/extensions, though often times those UIs don't scale well to mobile.
michannne 4y ago
We used to exploit these types of paths when school IT admins didn't know how to filter traffic properly but knew to block proxies.
- LegitShady 4y ago
  There was a period of time at my high school where we would compile a default browser app in Borland c++ and it would let you access whatever it wanted. They noticed because they got proper filtering after that...
polote 4y ago
A feature doesn't become a problem because 1% have an issue with it (people who use parental control). The internet is the internet if you want to restrict what people can see on the internet the only solution is to not have access to it at all
- bigfudge 4y ago
  Do you have kids? It’s really not easy to withdraw all internet access without substantially disadvantaging them. But I don’t want them reading 4chan either. Anything which makes that less likely without fundamentally breaking things is welcome to me.
  - chadlavi 4y ago
    As a child of the 2000s: just let them look at the horrifying underbelly of the internet. One trip down grossout lane isn't going to undo all your parenting and make them some kind of perverted monster. Children aren't prisoners.
    - mschuster91 4y ago
      Back in the early 2000s we didn't have people actively recruiting young frustrated men into incel and far-right terrorist groups though. We didn't have people thinking it was cool and edgy to make jokes about gassing Jews. Hell even the pedo/grooming problem wasn't much of a thing. Yes there was porn and vile gore floating around and you had to take care to not fall victim to dialers changing your dial-up information to bleed your phone bill... but that was all in all harmless. These days, the amount of utter idiocy is just unimaginable, "eternal september" style. You join some random online game discord and whoops half the talk is about rape fantasies, n-bombs and other kind of sickening behavior. Let it slip you're a girl and you'll get flooded with wiener pics, "cum tributes", disgusting fantasies, doxxing attempts, or flat out hate for standing in the way of someone. Go on Youtube, watch a couple of videos and your suggestions have antivaxx bullshit or "shocker videos". Games for children are filled with barely disguised pedos and "moderation" doesn't do shit. Not exactly an environment many people want to expose their children to.
CodeSgt 4y ago
I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views. That said, I firmly believe that easy access porn is one of the worst things happening to the young men and women today. I (23) know many men around my age who suffer from chronic porn addictions to the point that it severely impacts their ability for form real relationships and median age of first exposure is getting lower and lower. It's an absolutely crucial issue that no one seems to be talking about or taking seriously.
- Zababa 4y ago
  > It's an absolutely crucial issue that no one seems to be talking about or taking seriously. Most men communities talk about it in one form or the other. However, most men communities on the internet are usually close in one form or another to the right politically.
  - CodeSgt 4y ago
    I suppose I should have said it's not being talked about by any mainstream authorities or outlets in the same way a lot of women's or equity issues are (not to say porn isn't also a women's issue, it very much is, but seems to disproportionately impact men). It is a shame that any group which advocates men's issues tends to get labeled as right-wing or incelish, which then attracts those types and makes those labels a reality. And of course many were admitedly that way from the start. Edit: And to add to this, being right or left leaning isn't inherently bad. And maybe this is my personal bias coming into play here, but I find that people are much quicker to associate right-leaning movements/communities as "bad" than they are left-leaning ones. Again I accept that could be personal bias and it isn't a hill I'd die on.
    - Zababa 4y ago
      I share the same view of the situation as you. A consequence of the increase in demands for justice, political correctness, and stuff like that seems to be that every community has to be focused on a oppressed group or it will be considered right-wing and thus attract people like you said. The incel label is a good example of how bad men are treated sometimes. If you treated poor people like this by saying they're involuntarly not rich and then proceeded to say that it's mostly their fault because they don't work enough, think they can just show up to work, do their job and become rich, shouldn't expect money to be given to them, most people would react by saying that you're wrong. And when some parts of the population have trouble having sex/companionship like some trans people, it's called discrimination. But the same rules don't apply to incels it semms.
j2bax 4y ago
Why don't you just make sure there are no unsavory links on whatever page you are using the in-app browser for and disable/hide the address bar so they can't just jump onto the open web? Seems like you can have your cake and eat it!
qwertox 4y ago
I think on Android they could use Chrome Custom Tabs [0] instead of WebViews. IIRC this also protects the browser content from being accessed by the hosting app, but there is still a limited communication which is possible between the app and the tab. [0] https://developer.chrome.com/docs/android/custom-tabs/ https://developer.chrome.com/docs/android/custom-tabs/
franga2000 4y ago
If someone is knowledgeable and committed enough to dig through all their apps, find any in-app browsers and try to break out onto the web, they will also realize that simply using another device will bypass all your silly blocks.
t8ty2evj 4y ago
This seems like a non-issue. Where's the damage? I'm tired of people using children and a miniscule population of users w/ severe content sensitivities as excuses to justify features that are really just tools for asserting norms. The children are fine. We've been talking about how bad the internet is for children so long that those children grew up, led fufilling lives, had their own children, and now those children are apparently being ruined by the internet. What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years.
- cercatrova 4y ago
  I have to agree here. "Think of the children" is an excuse as old as time.
- goda90 4y ago
  >What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years. Isn't addicting content a force that's trying to manipulate them? Porn, certain kinds of games, online gambling, etc can all get their hooks in someone. Prevention is better than having to fight the addiction in the first place, is it not?
  - lrvick 4y ago
    I would argue TikTok is proving far more toxic to children than access to adult content and no one seems to care. -Targeting- children with content for profit should be banned, regardless of content. If the content is neutral and presented to all the same way then they get to choose to put in the work to find what they want to consume. When it is not neutral then it is the job of a parent to help tip the scales back to neutral with conversation or partially supervised device use. Nudity for instance is only taboo in some countries, where others are whatever about it and will see women topless at the beach. Trying to censor things or target things is what does the most harm and creates closeted behavior IMO. News flash to parents... when your kid is old enough to be horny they -will- find an outlet to see nudity be it in person or on a screen. On a screen is probably the safer default.
amenghra 4y ago
In the early 1990s, we used to break out of Macintosh's AtEase at our middle school by writing a two line MacBasic program which launched Finder. We would then bring games on floppies. Everything old is new again!
O__________O 4y ago
Reminds me of stories I have heard about users of computer systems with “strong” access controls figuring out ways to make it to unfiltered internet; examples include: student/prisoner computer labs, public libraries, flight entertainment systems, public kiosks, operating system logins, etc.
xfitm3 4y ago
Doesn't the harm of surveillance outweigh the harm of viewing "inappropriate content"? Think of the addict is a new one, but I am automatically suspicious any time someone cites child protection.
- goda90 4y ago
  I think you're seeing this as a "take away this choice from society to protect the children" kind of deal, but to me it seems more like the argument is to give choice to parents and addicts to control their own devices more completely. All other things being equal, why would a consumer want to not be able to control both the browser and in-app browsers as much as possible?
nodamage 4y ago
> Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. Last time I checked, WKWebView will follow the parental control settings set on the device.
registeredcorn 4y ago
Interesting! This reminds me of the classic Windows 95 bypass. You abuse the help screen to gain access to the desktop without having to login.[1] I'm currently going through HTB Academy and once you mentioned unsecured in-app browsers, the first thing I thought of was either a Web Shell[2], or better yet, directing the in-app browser to a malicious website to download additional software to better exploit the phone. If the in-app browsers aren't filtering explicit content, I have to assume they aren't filter malicious content either. If this isn't already a well-known route of exploitation, I'm interested to see how that might change in the near future. It sounds surprisingly easy to exploit, provided you can get momentary physical (remote?) access to the phone for a short time. [1] https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY [2] https://en.wikipedia.org/wiki/Web_shell https://en.wikipedia.org/wiki/Web_shell
Forgeties79 4y ago
> Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. I don’t think this can be overstated. How many people tell you stories of watching signal-scrambled porn on TV when their parents are asleep? How many of us waited until our parents are asleep to play video game late at night? How many millions covertly downloaded Napster/Kazaa/etc. and downloaded 30 versions of a song before they finally got the one they wanted? Being “motivated” as a kid or a teen is a low bar.

wepple 4y ago

Tangential, but these same links have always been a great way to break out of poorly designed kiosk systems. I recall noodling with a huge interactive display on the side of a bus stop that had an embedded map, and surely enough the TOS link launched a browser, and from there you could use the Save As dialog to get to anything to execute

ghayes 4y ago
This is how I get to web videos on my Peloton. Viewing the mandatory software licenses leads to web links and then you can visit anything in that Chrome browser window.
- password4321 4y ago
  Risky share -- the statute of limitations is not up on that one!
sirsinsalot 4y ago
Novell Netware had a similar bug circa 1998 whereby pressing `F1` at the login screen of the terminal opened the help dialog, which opened links in IE ... from there the main Windows shell could be ran and bingo ... you're in.
- TedDoesntTalk 4y ago
  I never saw IE or Windows running on Novell Netware. It was a server operating system. What you’re saying is akin to saying you can create a windows shell from inside linux.
  - brk 4y ago
    The Netware backend server was it's own OS, IIRC. However on the client side, you had MS-DOS and Windows Netware clients to login to the Novell server and access the associated shared resources.
    - TedDoesntTalk 4y ago
      Right, but those clients weren’t “Novell netware”.
      - sirsinsalot 4y ago
        The windows client login and resource control was branded as such tho
  - yesbabyyes 4y ago
    I think what they mean is the Netware login dialogue, on Windows. My classmate hacked our high school's network, getting him thrown out of class. I'm pretty sure he used a different method, though. He got a job working for the school. This was in the mid 90s.
    - mandevil 4y ago
      Colonial? (This definitely happened at my school, wondering how common this was.)
grishka 4y ago
Also on Android-based kiosks, you can get into the OS through the on-screen keyboard if they're using it. Try long tapping the buttons around the spacebar, one of them would usually get you into system settings. From there you can as much as completely take over the device if you wish.
orlp 4y ago
As a kid I loved doing this in every museum/library/other place that always had 'locked down' interactive Windows systems back in my youth. One of my favorite ones was in a museum where I was with a friend, and there was a PC. We were bored and wanted to play some flash game, but we only had access to a mouse, and clicking links inside the locked fullscreen browser. With enough clicks we got to google and managed to copy/paste letter by letter the name of a game site in the search field and play some games.
- dbtc 4y ago
  And I'm just excited to be able to 'visit' a museum from the internet :-)
- pricci 4y ago
  Although using the on-screen keyboard in accessibility settings would have been easier (if that existed back then), I like your creative young mind.
  - orlp 4y ago
    We couldn't access anything but the browser window in fullscreen, only using the mouse. No start menu, tray icons, keyboard shortcuts, etc. I'm sure there's like 100 different ways to break these bad Windows kiosks so that you'd eventually end up being able to access the accessibility settings, but it wasn't directly accessible to us.

davet91 4y ago

The in-app browsers could use a domain whitelist if parental controls are turned on.

adaktix 4y ago
It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.
graham1776 4y ago
That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.
yowzadave 4y ago
Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?
gowld 4y ago
The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)

rahkiin 4y ago

It is interesting how this would apply for custom browser engines in the future of iOS.

CharlesW 4y ago
This class of security problem is also a great reason to never allow custom browser engines.
- smoldesu 4y ago
  ...why wouldn't it be possible? iOS has application sandboxing, just drop all DNS requests for the webview that's outside a developer-defined namespace. I'm sure someone at Apple could find a better way to implement it, but we shouldn't accept lame excuses like this. Apple has 200 billion dollars in cash, this is not an advanced problem space.
  - happyopossum 4y ago
    Then the app can use DOH, or tunnel DNS requests over something else - a non-safari browser engine wouldn’t have to use system DNS by any means…
    - jamespo 4y ago
      I thought non-safari browser engines were banned
      - als0 4y ago
        They are. This is a hypothetical discussion.
- postalrat 4y ago
  How about services like luna, stadia, etc which can render any sort of interactive content (typically games)?

smoldesu 4y ago

Or maybe... just don't give your kids an iPhone? Seriously, using the internet/computers should be treated with the same level of caution as grown-up scissors or fillet knives; powerful tools, but they need training to avoid hurting yourself with them. If this is what you're worried about, why are you even giving them a small computer in the first place? Your kids will always be more cunning than your security policy (a hard pill to swallow for HN users), so control their access to technology unless you're ready to have a serious sit-down discussion about the internet, personal privacy, and all that jazz. Put yourself in their shoes; if you're given a small black brick with an indeterminate number of capabilities, wouldn't your response be pushing it as far as it can go? I know that was my reaction when I was a kid, after buying a Pentium desktop at a garage sale.

chinchilla2020 4y ago
You don't have kids. Your child would be the only one at school with no phone and probably be pretty embarrassed about it.
- munk-a 4y ago
  In school I was embarrassed about the clothes I wore... also the calculator I had and my shoes and my lunch and my trapper keeper and my pencils... Kids being embarrassed at school is unavoidable, being embarrassed is practically the job description of a teenager and younger students often have their own insecurities. There's an interesting debate as to whether these embarrassments are good or bad for us in the long run but we can side step all of that... not having access to a smartphone is important - it's important enough to warrant the slight amount of embarrassment.
Minor49er 4y ago
I wish this was still considered to be common sense
ars 4y ago
You can't live in today's world without a phone. All the mechanisms of the past that were geared for this no longer exist. For example: Drive on the road, get to a toll, don't have a Transponder to pay the bill? No problem - just call a phone number. Uh, what if I don't have a cell? This literally never even occurred to them, there is no alternative way to pay the bill. That's life today, and it applies to children as well. Want to go to some sports place that only caters to teens and above? Load this website on your phone and fill out an application. Don't have a phone? Borrow a friends phone.

Fogest 4y ago

I have a browser based game I play that makes use of many userscripts and browser extensions to further improve/enhance the game. However mobile users suffer from a problem of not having such extras. There is a very nice app someone made on Android and iOS that uses in-app browsers in order to be able to add a lot of custom things. There are many useful instances for the in-app browsers and I don't think they should be removed because of some bad actors. It's similar to how Android has had password managers making use of autofill tools via accessibility tools. Android was butchering that access, but luckily started adding some official autofill support. I don't think removing capabilities in the favour of "safety" is usually the right approach in my opinion.

celtain 4y ago
Most of the usecases mentioned in this thread wouldn't suffer if the in-app browser had to be invoked with a whitelist of approved domains/urls. Perhaps apps could request permission to run an unrestricted in-app browser, and that could be used to facilitate parental controls. As an aside, is giving parents the option to disable in-app browsers removing a capability or adding one?
- Fogest 4y ago
  Yes I think in app browsers should still follow parental controls, and I don't see why that wouldn't already be a thing on devices. If I can use a VPN on my phone and have that block sites for me, it seems like it should be pretty trivial for the phone to respect parental controls across all apps, not just specifically web browsers. That would be an additional capability. But having to force a website to give specific apps permission to display them in-app seems like a removal. Some people are also suggesting removing in-app browsers which also seems silly.
RainaRelanah 4y ago
Mind if I ask what game? Kiwi on Android is a Chromium fork that re-enables extensions on mobile. Works well for userscripts/extensions, though often times those UIs don't scale well to mobile.

michannne 4y ago

We used to exploit these types of paths when school IT admins didn't know how to filter traffic properly but knew to block proxies.

LegitShady 4y ago
There was a period of time at my high school where we would compile a default browser app in Borland c++ and it would let you access whatever it wanted. They noticed because they got proper filtering after that...

polote 4y ago

A feature doesn't become a problem because 1% have an issue with it (people who use parental control). The internet is the internet if you want to restrict what people can see on the internet the only solution is to not have access to it at all

bigfudge 4y ago
Do you have kids? It’s really not easy to withdraw all internet access without substantially disadvantaging them. But I don’t want them reading 4chan either. Anything which makes that less likely without fundamentally breaking things is welcome to me.
- chadlavi 4y ago
  As a child of the 2000s: just let them look at the horrifying underbelly of the internet. One trip down grossout lane isn't going to undo all your parenting and make them some kind of perverted monster. Children aren't prisoners.
  - mschuster91 4y ago
    Back in the early 2000s we didn't have people actively recruiting young frustrated men into incel and far-right terrorist groups though. We didn't have people thinking it was cool and edgy to make jokes about gassing Jews. Hell even the pedo/grooming problem wasn't much of a thing. Yes there was porn and vile gore floating around and you had to take care to not fall victim to dialers changing your dial-up information to bleed your phone bill... but that was all in all harmless. These days, the amount of utter idiocy is just unimaginable, "eternal september" style. You join some random online game discord and whoops half the talk is about rape fantasies, n-bombs and other kind of sickening behavior. Let it slip you're a girl and you'll get flooded with wiener pics, "cum tributes", disgusting fantasies, doxxing attempts, or flat out hate for standing in the way of someone. Go on Youtube, watch a couple of videos and your suggestions have antivaxx bullshit or "shocker videos". Games for children are filled with barely disguised pedos and "moderation" doesn't do shit. Not exactly an environment many people want to expose their children to.

CodeSgt 4y ago

I'm glad to see someone mention addicts. I feel as if internet addiction, and especially subsets of it such as porn addiction, aren't given enough weight by either the addiction treatment community or the technical community. Before someone accuses me of being a conservative religious zealot as tends to happen when anyone denounces porn, I'll say that I'm far from a puritan and am extremely liberal in my social views. That said, I firmly believe that easy access porn is one of the worst things happening to the young men and women today. I (23) know many men around my age who suffer from chronic porn addictions to the point that it severely impacts their ability for form real relationships and median age of first exposure is getting lower and lower. It's an absolutely crucial issue that no one seems to be talking about or taking seriously.

Zababa 4y ago
> It's an absolutely crucial issue that no one seems to be talking about or taking seriously. Most men communities talk about it in one form or the other. However, most men communities on the internet are usually close in one form or another to the right politically.
- CodeSgt 4y ago
  I suppose I should have said it's not being talked about by any mainstream authorities or outlets in the same way a lot of women's or equity issues are (not to say porn isn't also a women's issue, it very much is, but seems to disproportionately impact men). It is a shame that any group which advocates men's issues tends to get labeled as right-wing or incelish, which then attracts those types and makes those labels a reality. And of course many were admitedly that way from the start. Edit: And to add to this, being right or left leaning isn't inherently bad. And maybe this is my personal bias coming into play here, but I find that people are much quicker to associate right-leaning movements/communities as "bad" than they are left-leaning ones. Again I accept that could be personal bias and it isn't a hill I'd die on.
  - Zababa 4y ago
    I share the same view of the situation as you. A consequence of the increase in demands for justice, political correctness, and stuff like that seems to be that every community has to be focused on a oppressed group or it will be considered right-wing and thus attract people like you said. The incel label is a good example of how bad men are treated sometimes. If you treated poor people like this by saying they're involuntarly not rich and then proceeded to say that it's mostly their fault because they don't work enough, think they can just show up to work, do their job and become rich, shouldn't expect money to be given to them, most people would react by saying that you're wrong. And when some parts of the population have trouble having sex/companionship like some trans people, it's called discrimination. But the same rules don't apply to incels it semms.

j2bax 4y ago

Why don't you just make sure there are no unsavory links on whatever page you are using the in-app browser for and disable/hide the address bar so they can't just jump onto the open web? Seems like you can have your cake and eat it!

qwertox 4y ago

I think on Android they could use Chrome Custom Tabs [0] instead of WebViews. IIRC this also protects the browser content from being accessed by the hosting app, but there is still a limited communication which is possible between the app and the tab. [0] https://developer.chrome.com/docs/android/custom-tabs/ https://developer.chrome.com/docs/android/custom-tabs/

franga2000 4y ago

If someone is knowledgeable and committed enough to dig through all their apps, find any in-app browsers and try to break out onto the web, they will also realize that simply using another device will bypass all your silly blocks.

t8ty2evj 4y ago

This seems like a non-issue. Where's the damage? I'm tired of people using children and a miniscule population of users w/ severe content sensitivities as excuses to justify features that are really just tools for asserting norms. The children are fine. We've been talking about how bad the internet is for children so long that those children grew up, led fufilling lives, had their own children, and now those children are apparently being ruined by the internet. What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years.

cercatrova 4y ago
I have to agree here. "Think of the children" is an excuse as old as time.
goda90 4y ago
>What children need isn't more protection it's an escape hatch from all the forces trying to manipulate them during their most vulnerable years. Isn't addicting content a force that's trying to manipulate them? Porn, certain kinds of games, online gambling, etc can all get their hooks in someone. Prevention is better than having to fight the addiction in the first place, is it not?
- lrvick 4y ago
  I would argue TikTok is proving far more toxic to children than access to adult content and no one seems to care. -Targeting- children with content for profit should be banned, regardless of content. If the content is neutral and presented to all the same way then they get to choose to put in the work to find what they want to consume. When it is not neutral then it is the job of a parent to help tip the scales back to neutral with conversation or partially supervised device use. Nudity for instance is only taboo in some countries, where others are whatever about it and will see women topless at the beach. Trying to censor things or target things is what does the most harm and creates closeted behavior IMO. News flash to parents... when your kid is old enough to be horny they -will- find an outlet to see nudity be it in person or on a screen. On a screen is probably the safer default.

amenghra 4y ago

In the early 1990s, we used to break out of Macintosh's AtEase at our middle school by writing a two line MacBasic program which launched Finder. We would then bring games on floppies. Everything old is new again!

O__________O 4y ago

Reminds me of stories I have heard about users of computer systems with “strong” access controls figuring out ways to make it to unfiltered internet; examples include: student/prisoner computer labs, public libraries, flight entertainment systems, public kiosks, operating system logins, etc.

xfitm3 4y ago

Doesn't the harm of surveillance outweigh the harm of viewing "inappropriate content"? Think of the addict is a new one, but I am automatically suspicious any time someone cites child protection.

goda90 4y ago
I think you're seeing this as a "take away this choice from society to protect the children" kind of deal, but to me it seems more like the argument is to give choice to parents and addicts to control their own devices more completely. All other things being equal, why would a consumer want to not be able to control both the browser and in-app browsers as much as possible?

nodamage 4y ago

> Nearly every app, even "safe apps" including children-rated apps, allow access to an in app browser. Even when iOs has locked down all access to Safari, a parent has removed access to all the "apparent" unsafe sites, there are still ways to access the unfiltered internet inside of these safe apps. Last time I checked, WKWebView will follow the parental control settings set on the device.

registeredcorn 4y ago

Interesting! This reminds me of the classic Windows 95 bypass. You abuse the help screen to gain access to the desktop without having to login.[1] I'm currently going through HTB Academy and once you mentioned unsecured in-app browsers, the first thing I thought of was either a Web Shell[2], or better yet, directing the in-app browser to a malicious website to download additional software to better exploit the phone. If the in-app browsers aren't filtering explicit content, I have to assume they aren't filter malicious content either. If this isn't already a well-known route of exploitation, I'm interested to see how that might change in the near future. It sounds surprisingly easy to exploit, provided you can get momentary physical (remote?) access to the phone for a short time. [1] https://www.youtube.com/watch?v=1UfNlRe-goY https://www.youtube.com/watch?v=1UfNlRe-goY [2] https://en.wikipedia.org/wiki/Web_shell https://en.wikipedia.org/wiki/Web_shell

Forgeties79 4y ago

> Yes they are long, inefficient paths to reach the internet, but curious (or motivated) individuals or children will use almost any app to reach the internet. I don’t think this can be overstated. How many people tell you stories of watching signal-scrambled porn on TV when their parents are asleep? How many of us waited until our parents are asleep to play video game late at night? How many millions covertly downloaded Napster/Kazaa/etc. and downloaded 30 versions of a song before they finally got the one they wanted? Being “motivated” as a kid or a teen is a low bar.