Google's increasingly cavalier attitude towards security is concerning:
1) Kids WILL use this to bypass parental / school controls as soon as they learn about it
2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk
3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations
At Google scale, if 0.001% accounts are impacted by a security vulnerability, that's still tens of thousands of people (you can do the math too). I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives.
What's astounding is just how good Google's security team was, especially in comparison, maybe 15 years ago. Now, it increasingly reminds me of the path Yahoo took.
Critically, issues build on each other and escalate. Most remote root exploits require overcoming multiple layers of security. Defense-in-depth is important. Google used to address issues when a single layer was breached, before they could combine into someone remotely rooting your phone. Now, Google only fixes security bugs only after they've combined into a severe remote exploit (which often means many devices are compromised before an update goes out).
1) Kids WILL use this to bypass parental / school controls as soon as they learn about it
2) In some contexts (especially as high-stakes test settings, but also some military/prison/finance/medical/legal/etc. settings) this IS a direct security risk
3) Given the embedded browser is not secure, if a lot of kids do this, it WILL lead to someone exploiting this, and machines being compromised and escalations
At Google scale, if 0.001% accounts are impacted by a security vulnerability, that's still tens of thousands of people (you can do the math too). I don't think engineers at Google quite have a perspective on what it means when their decisions (not just security) ruin thousands of lives.
What's astounding is just how good Google's security team was, especially in comparison, maybe 15 years ago. Now, it increasingly reminds me of the path Yahoo took.
Critically, issues build on each other and escalate. Most remote root exploits require overcoming multiple layers of security. Defense-in-depth is important. Google used to address issues when a single layer was breached, before they could combine into someone remotely rooting your phone. Now, Google only fixes security bugs only after they've combined into a severe remote exploit (which often means many devices are compromised before an update goes out).