Google Family Link field test

on YouTube ↗55m

" summary

Google Family Link screen limits and app blocks fail in concrete ways: a Google app camera/voice search path allows continued browsing after timeouts, and a Skype in-app WebView (React Native loadUrl) opens unrestricted pages from a group chat link, letting kids run full web content. These workarounds are found by a motivated teenager and persist because apps can prevent fixes by blocking app updates. Mitigations: avoid embedded WebViews, use Chrome Custom Tabs or force physical/OS-level restrictions.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 1:08Mobile devices & kids
3. 3:19Addiction business
4. 14:01Google Family Link
5. 28:33Digging deeper

" related talks

• 34mOvercoming Insecurities in WebViewsBalázs Gerlei · droidcon London 2024
• 42mOvercoming Unsecurities in WebViewsBalázs Gerlei · Android Worldwide July 2024
• 28mHey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a FeatureErez Yalon · Black Hat Asia 2020
• 33mMeasuring the Insecurity of Mobile Deep Links of AndroidChun Wang, Fang Liu, Andres Pico, Danfeng Yao, Gang Wang · 26th USENIX Security Symposium (USENIX Security '17)
• 25mHey Google, Activate Spyware! When Google Assistant Uses a Vulnerability as a FeatureErez Yalon · RSA Conference 2020 DevSecOps & Application Security
• 27mBypassing Browser Security Policies for Fun and ProfitRafay Baloch · Black Hat Asia 2016
• 26mWhy does Google think my app is harmful?Alec Guertin · droidcon NYC 2019
• 28mControlling Safe Browsing to Protect WebViewAkihiro Shiota · DroidKaigi 2019