There should be parental controls that disallows installing apps, so there is no hidden browsers. Google and apple has an entire walled garden infra setup that they are using for control and hoovering up all the user data, the same infra can be uses for this.
This, and more - device makers and those upstream of the parents need to make "child safe" phones .. and probably (uh, oh) make them that way by default so that tech savvy types can disengage restrictions (and have that restrictions lifted state glaringly obvious for non tech savvy parents).
The raison d'etre for my above framed question was to highlight that non tech parents can not be expected to IT-child-safe phones and then monitor risks w/out assistance from vendors.
That's basically what this law is, but it's not saying there has to be a wholly separate phone model, but it's saying every phone (or desktop or laptop or tablet or ...) must have a child safe mode.
The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.
GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.
Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.
Once upon a time, RuneScape ran a promotion where World of Warcraft players could join a special world with double XP (experience points) or something by clicking this promotion link.
RuneScape has an in-game dungeon designed to teach players about account security. One of the questions is whether you should click on a link that promises double XP...
It's also not worth posting "I tried didn't work" because nobody knows what you tried. There is zero information in it, and it's a waste of bits that just pollutes the discussion.
It seems like that, but it's not. When trying to figure out a problem, even that tiny bit of information is worthwhile. If nobody else has posted it, it's the first indication that it doesn't work.
If others have posted, it's an indication that it's a wider-spread problem than you knew.
I'd still rather have more information, and I look down on people who only post something that useless. But it does have information I've used to figure problems out.
My first thought was that they have several people who seem like they'll expect very serious compensation but no actual product, then I noticed they already seem to have a whole bunch of VC backers. I'm not gonna lie, I'm a little jealous of people who can make a flashy vaporware pitch deck and ride the VC gravy train.
Differences in parsing between two systems can allow data to sneak through. For example you might put a space before the header name. The reverse proxy might treat it as a header name starting with a space, so not matching the one it wants to remove, and not removed, while the origin server trims the space.
This is a ubiquitous security concern, like IDOR and memory safety. Every time you have a separate validation step for anything, you have the possibility of a parser differential vulnerability.
If you don't know it yet, look up "HTTP request smuggling" - pretty interesting.
This is only true if you are using apps that require no communication with a server.
Otherwise it's constant forced updates, and basing security on the version number of the installed app is a moot point since you can't guarantee the server will send the same replies to 2 different users.
I can't parse the part about e2e not making sense for webpages.
> This is only true if you are using apps that require no communication with a server
End-to-end encryption is all about going through an untrusted server. You don't need end-to-end encryption otherwise.
> Otherwise it's constant forced updates
There are apps that allow you to verify that you are running the same signed binary as others. Think key transparency but for apps. It's trivial to do.
> basing security on the version number of the installed app
Obviously you don't base your security on the version number of the installed app?!
> since you can't guarantee the server will send the same replies to 2 different users
With a website, you cannot. When you open protonmail.com in your browser, you don't know if you are running the same code as I am when I do the same.
With a mobile app, you can. You get a signed binary, it's trivial to compare. Also even if you don't check that, if you get the Signal app through the Google Play Store, it means that the app is signed by Signal but distributed by Google. They have to collude in order to have you get a different binary.
> I can't parse the part about e2e not making sense for webpages.
It's what I'm saying above:
- If you audit the Signal sources, compile them and run them, then you don't have to trust the server.
- If you use the Signal app distributed by Google, you can trust that you got the same app as everybody else who downloaded it through the Play Store, unless Signal and Google collude.
- If you open protonmail.com in your browser, you have to blindly trust that the Proton server is sending you the code you expect. But if you have to blindly trust the server, then it's not exactly end-to-end encryption anymore, is it?
Just the other day at the NATO summit he seemingly claimed Iran's nuclear program is so damaged they'll never be able to build a bomb. So, mission accomplished? Nothing the guy says is credible..
