Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

121–130 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#121

Post by soared »

instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

What sort of data does Arc track? Our plain-english Privacy Policy summarizes it well:

We don’t know which websites you visit

Re: Gaining access to anyones Arc browser without them even visiting a website

#122

Post by Sakos »

arcisbad wrote: post #64
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea... TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.

Unfortunately, Zen Browser simply isn't an alternative. If you like Arc, then Zen's UI for tabs and splitting views isn't really anywhere close to satisfying the same needs.

Re: Gaining access to anyones Arc browser without them even visiting a website

#123

Post by latexr »

squigz wrote: post #109
latexr wrote: post #78

Earlier quoted context omitted.

It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.

Strange to label a failure to capitalize words as a "dumb social media trend", as I'm sure people have been doing that for many years prior to social media. And nobody tYpEs lIkE tHiS except when making a joke.

> Strange to label a failure to capitalize words

It’s not a failure, it’s a conscious choice.

> as I'm sure people have been doing that for many years prior to social media.

But now it’s happening more frequently. That’s what “trend” means. It doesn’t mean it never happened before.

> And nobody tYpEs lIkE tHiS except when making a joke.

Just because you don’t know people like that, does not mean they don’t exist. The world is bigger than one person’s knowledge. I personally knew several teenagers who did it for all their communication, before smartphones. The speed at which they were able to do it was astounding.

Re: Gaining access to anyones Arc browser without them even visiting a website

#124

Post by Sakos »

hollywood_court wrote: post #119

Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.

Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.

Re: Gaining access to anyones Arc browser without them even visiting a website

#125

Post by Sakos »

supriyo-biswas wrote: post #14

Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase. Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.

> Firebase's authentication model is inherently broken

I'm not very familiar with Firebase. In what way is it broken and what issues does it cause?

Re: Gaining access to anyones Arc browser without them even visiting a website

#126

Post by IggleSniggle »

Imustaskforhelp wrote: post #56
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this…

> Did you know that chrome gives an unfair advantage to its user sites by giving system information (core usage etc.) and some other things which are not supposed to be seen by browsers only to the websites starting with *.google.com ?

That's pretty interesting. Where can I learn more about this?

Re: Gaining access to anyones Arc browser without them even visiting a website

#127

Post by zendaven »

water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

I guess it's removed? I don't see it. On Windows Chrome.

Re: Gaining access to anyones Arc browser without them even visiting a website

#128

Post by hypeatei »

userbinator wrote: post #12

while researching, i saw some data being sent over to the server, like this query everytime you visit a site I'm not surprised in the least --- basically the vast majority of software these days is spyware. Looking at Arc's privacy page, it appears to be mainly marketing fluff similar to what I've seen from other companies. I have yet to find a privacy policy that says frankly "we only know your IP and time you downl…

Seeing "privacy focused" in any sort of mission statement is almost becoming an indicator of the opposite (I'm sure there's a word for this)

I'd rather a company have simple goals that can be explained in a sentence or two. No hand wavey BS like "we care about your privacy"

Re: Gaining access to anyones Arc browser without them even visiting a website

#129

Post by nottorp »

latexr wrote: post #118
nottorp wrote: post #103

Earlier quoted context omitted.

> That seems like a perfectly reasonable thing to sync. Accessibility settings are exactly the type of thing you shouldn’t have to configure again and again on every device. No, because I disabled motion on my phone because the wiggling of icons on the main screen annoyed me, not because I have motion sickness. Nothing wiggles on the desktop (yet). This option doesn't even belong in accessibility IMO, it should be a…

Gotta be honest, the aggressive and unreasonable snark completely turns me off from helping you. It feels that regardless of the obviousness of the setting, you’ll find some nitpick to shout back at me about it. Since I don’t work for Apple or yourself, I don’t have to justify their choices or be the recipient of your unjustified and unprompted bad humour. I’m making a conscious choice to not soil my Friday on accoun…

Thanks for the martyrdom but last time I checked clipboard syncing it was a package with everything that gets synced, including sms forwarding etc on Apple. If there is a way to disable syncing granularly it’s not documented anywhere.

Re: Gaining access to anyones Arc browser without them even visiting a website

#130

Post by nfm »

soared wrote: post #121
instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

What sort of data does Arc track? Our plain-english Privacy Policy summarizes it well: We don’t know which websites you visit

From the quoted snippet, every page load is leaking both the domain and authed user’s ID to Firebase.
Post reply on HN