Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Plus – Self-updating screenshots

plusdocs.com

Post reply on HN
Print view View original

51–60 of 126 posts

Re: Show HN: Plus – Self-updating screenshots

#51

Post by DandyDev »

This looks really cool and clever. I do have a question about security though. The FAQ states:

> Today, we encrypt all sensitive data on your computer before it is sent to our servers, your data is encrypted in transit and at rest. Our employees do not have access to the private key to decrypt sensitive data.

I wonder how this works. I assume Plus works by storing the cookies present in the user's browser so that it can inject those cookies in a headless browser to take a Snapshot. In order to do that, it would need to decrypt the cookie (if it was encrypted in the first place, which the FAQ seems to suggest). For that, the headless process needs the encryption key. That would mean that employees can also access that encryption key.

What am I missing here?

Re: Show HN: Plus – Self-updating screenshots

#52

Post by remixz »

chairhairair wrote: post #42
remixz wrote: post #14

Earlier quoted context omitted.

(I'm an EM at Plus) It's a bit complex, and not quite perfect, but I'm pretty happy with what we've done so far. The first method is by looking at the HTTP status codes. Since we're running a full browser on our side, we can tell if the status codes that returned are different than the initial capture. We also have been training an image classification model on pictures of log-in screens — this has worked surprisingl…

Why would running a full browser be relevant to knowing HTTP statuses of requests?

Our product works by taking a screenshot using a headless Chrome instance. In this case, it's helpful because we can look at not just the status code of the HTTP request to the page itself, but also any resources the page may fetch. This is particularly useful for SPAs, since they may return a 200 for the page itself, but an API call they make might return a non-200 when logged out.

Re: Show HN: Plus – Self-updating screenshots

#53

Post by andrewmunsell »

breck wrote: post #3

This is so clever. Love it. Would love a version that just runs locally without sending things to the cloud.

The Arc browser has something like this with their Capture + Easels feature (example of this post: https://arc.net/e/A6D1FE0C-063A-4500-8D19-46581D16181E), and it supposedly does update.

Truth be told, I have no clue how the live-updating feature works when I share an Easel but it does capture the page as I see it

Edit: It does change on my local "Easel" almost instantly with my reply, but we'll see if that screenshot updates for others. A little experiment, I guess.

Re: Show HN: Plus – Self-updating screenshots

#56

Post by artur_makly »

jacooper wrote: post #16

I want to use something like this to automatically detect visual breakage after auto updates for WordPress, discourse etc. Is there such a product? Preferably Open source

Lots of our customers use https://VisualSitemaps.com just for that. It's great for also keeping track of Competitors/Markets, besides internal QA.

Re: Show HN: Plus – Self-updating screenshots

#57

Post by blowski »

olalonde wrote: post #25
jszymborski wrote: post #12

Earlier quoted context omitted.

Is it all that much more a risk than taking a screenshot, putting it on cloud storage like OneDrive/GDrive, and sharing with a "anyone who has the link" permission? B/c I feel like that is super common and kind of impossible to stop with a permissions approach.

My guess is this works by uploading your browser's data (cookies, local storage, etc.) to Plus so that it can retake the screenshot with a headless browser even if the web page requires authentication. So if someone hacks Plus or if some employee goes rogue, they can potentially access any web app you are taking screenshots of. In other words, if Plus becomes popular, its database will become a prime target for hacke…

All tech companies, if succesful, will one day be a target for hackers and security agencies.

Re: Show HN: Plus – Self-updating screenshots

#58

Post by nmjohn »

DandyDev wrote: post #51

This looks really cool and clever. I do have a question about security though. The FAQ states: > Today, we encrypt all sensitive data on your computer before it is sent to our servers, your data is encrypted in transit and at rest. Our employees do not have access to the private key to decrypt sensitive data. I wonder how this works. I assume Plus works by storing the cookies present in the user's browser so that it…

I assume they mean by default, employees do not have access to the KMS key necessary to decrypt the sensitive data. (They mention using an individual KMS key per customer)

I suspect there must be a handful of SREs who, who could access it if they really wanted to - though that access would still be logged in cloudtrail.

Re: Show HN: Plus – Self-updating screenshots

#59

Post by wizofaus »

remixz wrote: post #14
babelfish wrote: post #5

Very cool. How does Plus handle updating screenshots taken on authenticated pages once that authentication has expired?

(I'm an EM at Plus) It's a bit complex, and not quite perfect, but I'm pretty happy with what we've done so far. The first method is by looking at the HTTP status codes. Since we're running a full browser on our side, we can tell if the status codes that returned are different than the initial capture. We also have been training an image classification model on pictures of log-in screens — this has worked surprisingl…

Ok but once it's recognised a login screen, what does it do? And presumably you can't use this for sites that require frequent MFA...
Post reply on HN