Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

171–180 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#171

Post by tomaskafka »

soundnote wrote: post #106
bestest wrote: post #29

the developers working with firebase should enforce common-sense document crud restrictions in the rules. that's just how firebase is. everyone knows it. now, when talking about ARC BROWSER, i am seriously starting to doubt the competence of the team. I mean, if the rules are broken (no tests? no rules whatsoever?), what else is broken with ARC? are we to await a data leak from ARC? any browser recommendations with p…

Brave. Vertical tabs, privacy, everything sync is e2ee (unlike eg. Edge). Vivaldi may also be worth a look. Similar setup: User-oriented team, vertical tabs, e2ee sync. If you like a thorough browser history, I think Vivaldi keeps a more detailed browsing history than most other Chromium browsers.

Brave is VC funded and needing to extract a billion of value. Just like Arc.

Re: Gaining access to anyones Arc browser without them even visiting a website

#172

Post by jwells89 »

danpalmer wrote: post #113
rpastuszak wrote: post #99

Earlier quoted context omitted.

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

It does get a lot right and feels smooth in ways that Chrome, the various Chrome-clones, and Firefox just don't. It's also ironically the only browser even trying to feel native on Windows, using WinUI/WinAppSDK for its UI there, despite originally being Mac only.

It's unfortunate that other cross platform browsers have such a strong tendency to phone in these little things, because they really do add up to make for a nicer experience.

Re: Gaining access to anyones Arc browser without them even visiting a website

#173

Post by tomaskafka »

maipen wrote: post #57

Very small bounty, but I honestly believe this arc thing won’t last long… Browsers are hard and my only choice has been chrome and will remain so for the long foreseeable future. When I was younger I would enjoy switching to firefox, opera, etc.. But I always came back to chrome because it just worked and always performed when I needed. Chrome/chromium is the safest browser. People tend to fall for the shiny new thin…

Browser is an user agent. Chrome is an advertisement company agent running on your PC, collecting data for that advertising company.

People often confuse these two, but they’re the polar opposites.

Re: Gaining access to anyones Arc browser without them even visiting a website

#174

Post by EraYaN »

Sakos wrote: post #122
arcisbad wrote: post #64

Earlier quoted context omitted.

This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea... TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.

Unfortunately, Zen Browser simply isn't an alternative. If you like Arc, then Zen's UI for tabs and splitting views isn't really anywhere close to satisfying the same needs.

Firefox seems to be borrowing some of the UI features slowly (at least the vertical tabs). And at least the Mozilla Foundation is very public with their wants and goals.

Re: Gaining access to anyones Arc browser without them even visiting a website

#175

Post by throwaway984393 »

efilife wrote: post #68
throwaway984393 wrote: post #17

Earlier quoted context omitted.

https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does

I don't understand what you do not get. In the link you sent they claim to be a privacy oriented web browser based on chromium

[dead]

Re: Gaining access to anyones Arc browser without them even visiting a website

#176

Post by oefrha »

> firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, i wrote a frida script to dump the relevant calls.

As someone who has done some reverse engineering of macOS apps but haven't used anything beyond Charles' macOS proxy feature, this looks very painful. Is there a proxy app that maybe acts as a VPN so that basically every HTTP request is guaranteed to go through it, so that you don't need to write a hundred lines of bespoke Frida just to capture requests?

Edit: On second thought Proxifier should work for this purpose.

Re: Gaining access to anyones Arc browser without them even visiting a website

#177

Post by kfarr »

Instead of knee jerk firebase is bad, can we discuss how this could be abated properly with firebase rules for firestore?

Is this the rule that was missing for arcs boosts or whatever object?

```

  match /objects/{object} {

     // Allow create new object if user is authenticated

      allow create: if request.auth != null;

      // Allow update or delete document if user is owner of document

      allow update, delete: if request.auth.uid == resource.data.ownerUID

  }
```

Re: Gaining access to anyones Arc browser without them even visiting a website

#179

Post by fouc »

bschmidt1 wrote: post #160
Cthulhu_ wrote: post #156

Earlier quoted context omitted.

Yeah but if they super promise to not look at incoming Firebase queries they're not tracking you, right?

The super promise died with crypto, now you have to add no backsies. My site uses No Backsies Proofs (NBPs) which are encrypted to prove that all my super promises are backed by a no backsie which is stored in the no backsie vault in Antarctica.

Later on moxie ends up writing a quick review of NBPs

> Instead of storing the data on-chain, NBPs instead contain a URL that points to the data. What surprised me about the standards was that there’s no hash commitment for the data located at the URL. Looking at many of the NBPs on popular marketplaces being sold for tens, hundreds, or millions of dollars, that URL often just points to some VPS running Apache somewhere. Anyone with access to that machine, anyone who buys that domain name in the future, or anyone who compromises that machine can change the image, title, description, etc for the NBP to whatever they’d like at any time (regardless of whether or not they “own” the token). There’s nothing in the NBP spec that tells you what the image “should” be, or even allows you to confirm whether something is the “correct” image.

Re: Gaining access to anyones Arc browser without them even visiting a website

#180

Post by chucksmash »

IggleSniggle wrote: post #126
Imustaskforhelp wrote: post #56

Earlier quoted context omitted.

I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this…

> Did you know that chrome gives an unfair advantage to its user sites by giving system information (core usage etc.) and some other things which are not supposed to be seen by browsers only to the websites starting with *.google.com ? That's pretty interesting. Where can I learn more about this?

I recall there being a thread with way more discussion at the time, but I can't put my finger on that thread right now. This post has some information:

https://news.ycombinator.com/item?id=35152419

Post reply on HN