Jump to content

Evernote provides backdoor internet access on iOS devices


Recommended Posts

As I find there is no sure method of internet content filtering on iOS, I use the iOS system restrictions setting to deny access to Safari, YouTube, and Installing Apps for our students. This effectively prevents them from accessing undesirable internet content on their iOS devices. However, I find that Evernote allows students to circumvent this restriction. By typing the URL of a website into a note, letting it format into a hyperlink, holding on the hyperlink, and then selecting "open", students can gain unrestricted internet access through Evernote's built-in web browser. (In fact, I registered for this forum and made this post using the same method on one of our locked iOS devices.) Could the Evernote developers please close this basckdoor functionality? All of us here really love using Evernote, and we'd hate to stop using it because of as small flaw. Many thanks.

Link to post
  • Level 5*

As I find there is no sure method of internet content filtering on iOS, I use the iOS system restrictions setting to deny access to Safari, YouTube, and Installing Apps for our students. This effectively prevents them from accessing undesirable internet content on their iOS devices. However, I find that Evernote allows students to circumvent this restriction. By typing the URL of a website into a note, letting it format into a hyperlink, holding on the hyperlink, and then selecting "open", students can gain unrestricted internet access through Evernote's built-in web browser. (In fact, I registered for this forum and made this post using the same method on one of our locked iOS devices.) Could the Evernote developers please close this basckdoor functionality? All of us here really love using Evernote, and we'd hate to stop using it because of as small flaw. Many thanks.

Hi. Welcome to the forums.

I can confirm that clicking on a link will cause Evernote to open the native browser, where you can (by the way) do cool things like clip web pages. As you've no doubt noticed, there is an "export" icon on the bottom right, which brings up a button there asking if you want to open up the web page in the Safari browser. In other words, Evernote is NOT enabling backdoor functionality. Like any app that uses Apple's native browser function, it connects to the Internet.

If I understand what you are saying, and the iOS environment correctly, I can see your problem (not wanting students to gain access to the Internet), but I don't think the solution is for Evernote to close a backdoor (because there isn't one), but for Evernote to provide a new function that blocks access to browser functionality without blocking access to the Internet (syncing). This is a considerably more difficult issue. In part, of course, it arises from the lack of cusomizability within the iOS environment, but there isn't much Evernote can do about that :)

I don't know how the developers will deal with it, because I certainly wouldn't want (for example) to lose the ability to surf the Internet from within the app (not that you are asking for everyone to lose the ability, but one relatively easy solution might be for Evernote to go directly to Safari, which would be blocked under your system). Clipping from within the app is quite convenient, even if it is a relatively unknown functionality.

Link to post

Dear GrumpyMonkey,

Thank you for your reply. It's a shame that there's not a way to add clipping functionality to the Safari browser's export menu. Otherwise, I bet this problem wouldn't exist. Nonetheless, I still think there's a few ways to solve this problem.

1. Instead of blocking internet access outright, would it be possible to check if the Safari restriction is enabled before opening any links? That way, Evernote could limit internet access only if it had already been limited in the iOS settings.

2. Besides clipping webpages from within the Evernote app, are there other advantages of using the in-app web browser? Otherwise, it might be possible to pull off a similar functionality from within the Safari browser by using an iFrame of sorts coupled with some javascript.

Let me know if you think either of these might work. I'm eager to know.

Link to post
  • Level 5*

I'm guessing that for the vast (overwhelming?) majority of users, being able to click a link in Evernote that is then opened automatically in Safari is extremely useful.

I very much doubt that Evernote will change this functionality.

Link to post
  • Level 5*

I think the iOS web view used by applications is Safari - does it matter? I'm very sure they aren't going to change it.

The difference between Webkit and Safari? It matters because there is (in at least one way) more functionality within the Evernote app than you get using Safari (web clipping). For the OP, it matters because they are trying to block access to broswers, but iOS doesn't make this easy, and Evernote's access from within the app to browsing (many other apps do this as well) provices access. I sure hope they don't change it in a manner that would take away my access to web clipping.

In answer to the OP, I don't know if Evernote developers could/would do #1. As for #2, it is notoriously difficult to mess around with Safari, and I find this method (from within the app) to be easy and dependable. Perhaps iOS 6 will change things?

Link to post

@Mike Wood - There are many other apps that provide in-app internet access. But they usually don't provide unrestricted internet access like Evernote does. Instead, they just connect to a single site. You usually can't navigate to another site, say google.com, from the first site the app connects to. The "Settings"-->"Technical Support" option in the Evernote app is one such example.

Link to post

As for #2, it is notoriously difficult to mess around with Safari

@GrumpyMonkey - Actually, the method #2 that I suggested wouldn't require modifying Safari or accessing the iOS filesystem at all. It's a pure HTML/JavaScript method. Here's one way (though not a very good way, I'm afraid) that I can explain it: Do a Google image search on a desktop or laptop computer and then click on an image. Google will open the webpage that the image is from, and it will add a menu bar on the right of the screen, show the picture in the middle of the screen, and add a grey transparency over the webpage. Un-imagine the transparency and the picture in the middle of the screen, move the menu bar to the top of the screen, make the menubar much smaller, add a cute Evernote clip button, and voila! That's what I have in mind. Most importantly, it keeps all the code in the webpage and out of the iOS / Safari.

If you can imagine the menu bar at the top of the screen instead (and alot smaller) with no annoying picture and grey transparency, you'll get sort of an idea of what I'm talking about.

Link to post
  • 8 months later...

@wooden shoes

I found that even the apps that take you only to a website, can also get you to places like google.com, many sites have sharing options like twitter and Facebook, and google+, if its google+ than you have a direct link to google.com via the site, other options can be, depending on the original website, a site wide search that may contain a link to google.

I found that once an app takes you to a site, the game is up, and full unrestricted Internet is able to be accessed.

I am coming form the mind of a teenager who is trying to circumvent parental controls, it's not a difficult workaround, it takes but a few seconds longer, each app is different, so the workaround will be slightly different, but they basically work the same way

I wish that Evernote would take note of this issue, as Evernote is a great tool for all ages, and it is a shame, that a large group of people cannot enjoy the uses of Evernote.

I currently only use the desktop version, which can be filtered through K9, but as for iOS, I just email notes to my account and check it later,

I hope you can convince Evernote to take on your ideas, I don't know the tech side of things that well, but it sounds like you do,

I also hope that grumpymonkey is listening

Link to post
  • Level 5*

@wooden shoes

I found that even the apps that take you only to a website, can also get you to places like google.com, many sites have sharing options like twitter and Facebook, and google+, if its google+ than you have a direct link to google.com via the site, other options can be, depending on the original website, a site wide search that may contain a link to google.

I found that once an app takes you to a site, the game is up, and full unrestricted Internet is able to be accessed.

I am coming form the mind of a teenager who is trying to circumvent parental controls, it's not a difficult workaround, it takes but a few seconds longer, each app is different, so the workaround will be slightly different, but they basically work the same way

I wish that Evernote would take note of this issue, as Evernote is a great tool for all ages, and it is a shame, that a large group of people cannot enjoy the uses of Evernote.

I currently only use the desktop version, which can be filtered through K9, but as for iOS, I just email notes to my account and check it later,

I hope you can convince Evernote to take on your ideas, I don't know the tech side of things that well, but it sounds like you do,

I also hope that grumpymonkey is listening

Thanks for posting, and welcome to the forums! I don't know the tech side of things, I am afraid, though I am listening :)

If Evernote can provide such a feature without restricting my Internet access through the app, then it sounds great to me. I just don't know if it is possible / feasible.

Link to post

Developpers are releasing apps quicker than you can find "bugs" in each of them. In that case, the only thing you can control is the internet connection.

 

Therefore, I would like to suggest to use a proxy or a content filtering system to block effectively all unwanted traffic (pretty much everything) from any applications. Authorized websites can be allowed using specific rules.

 

It's more efficient, more secure and gives you more time for other valuable task. It's also more rewarding to help kids than to police them...

Link to post

@SimonF:

(1) There is no way to use a proxy filter inside Evernote.  Evernote uses Apple's built in Web UI view (not "Webkit", as GrumpyMonkey stated on Sept. 10. (Webkit is the rendering engine that Safari and Web UI view use to display internet content.) )  You could set a system-wide proxy setting in the network settings if you wanted.  That would affect everything on the iPhone, not just the Evernote app.

 

(2) The rapid release of apps and resulting bugs has nothing to do with the issue.  The backdoor issue is not a bug.  The Evernote developers purposely designed the app to allow this backdoor functionality, though perhaps not with this intention.

Link to post

Since there's been a lot of discussion, I'm summarizing the relevant discussion here:

1. Users WoodenShoes and Laz noted that the Evernote app for iPhone allows users unrestricted backdoor internet access.  The backdoor feature is not a bug, but an intentional feature of the app.  By typing a link into an Evernote document and clicking on it, users can gain access to any website through the app's integrated web browser.  They can gain access both by by directly linking to a webpage, or by indirectly linking to one, as through Google+, Bing Search, or Twitter.

2. User GrumpyMonkey notes that the feature is useful because it allows him to use the Evernote clipper embedded in the integrated web browser.  If Evernote were to open links in Safari instead of the integrated web browser, he would lose this functionality.

 

Since I seem to be the tech nerd, I'm also making a developer suggestion here:

>>Design Evernote to check is Safari is disabled by parental controls.  If Safari is disabled, do not open the link in the integrated web viewer, and possibly display an alert message.  (I have seen a similar function in other apps.)  If Safari is not disabled by parental controls (which is the system default), then open the link in the integrated web-viewer as usual.  The change is a simple change.  It preserves the functionality of the web-clipper for advanced users like GrumpyMonkey, and it disables the backdoor functionality for users like WoodenShoes and Laz.

 

@GrumpyMonkey - could you please pass this suggestion along to a developer?  From what I can tell, no developers have seen this forum.  They are the only ones who could determine if a solution is possible and/or feasible.

Link to post
  • Level 5*

Since there's been a lot of discussion, I'm summarizing the relevant discussion here:

1. Users WoodenShoes and Laz noted that the Evernote app for iPhone allows users unrestricted backdoor internet access.  The backdoor feature is not a bug, but an intentional feature of the app.  By typing a link into an Evernote document and clicking on it, users can gain access to any website through the app's integrated web browser.  They can gain access both by by directly linking to a webpage, or by indirectly linking to one, as through Google+, Bing Search, or Twitter.

2. User GrumpyMonkey notes that the feature is useful because it allows him to use the Evernote clipper embedded in the integrated web browser.  If Evernote were to open links in Safari instead of the integrated web browser, he would lose this functionality.

 

Since I seem to be the tech nerd, I'm also making a developer suggestion here:

>>Design Evernote to check is Safari is disabled by parental controls.  If Safari is disabled, do not open the link in the integrated web viewer, and possibly display an alert message.  (I have seen a similar function in other apps.)  If Safari is not disabled by parental controls (which is the system default), then open the link in the integrated web-viewer as usual.  The change is a simple change.  It preserves the functionality of the web-clipper for advanced users like GrumpyMonkey, and it disables the backdoor functionality for users like WoodenShoes and Laz.

 

@GrumpyMonkey - could you please pass this suggestion along to a developer?  From what I can tell, no developers have seen this forum.  They are the only ones who could determine if a solution is possible and/or feasible.

Thanks for summarizing this. Most people don't take the time to do this, but I think it really helps developers (they read all of the threads, but probably have stuff to do at their day jobs) to follow the discussion. Let's turn this into a support ticket so we make sure it gets into the hands of developers.

Link to post
  • 11 months later...

Has there been any development on this issue yet?

 

I found the same backdoor access to internet on a blocked device recently (running ios 7.1.1) and ended up having to delete the Evernote app. I'd love to be able to reinstall Evernote, but not until it deals with this issue.

Link to post

By typing a link into an Evernote document and clicking on it, users can gain access to any website through the app's integrated web browser.

 

Any kid smart enough to figure out that they can type a link into EN and then surf the web by clicking on that link deserves to get access to all the porn they want :D.  Plus they'll probably make enough money one day to buy their parents a big house, so best not to piss them off  :D.

Link to post

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...