Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

181–190 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#181

Post by tr3ntg »

zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs.

Security rules are meant to be taken seriously, and it's your only line of defense.

Re: Gaining access to anyones Arc browser without them even visiting a website

#182

Post by HungSu »

danpalmer wrote: post #113
rpastuszak wrote: post #99

Earlier quoted context omitted.

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

You might like Zen Browser https://zen-browser.app/

Re: Gaining access to anyones Arc browser without them even visiting a website

#184

Post by bichiliad »

tr3ntg wrote: post #181
zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

I think a system that makes it this easy to shoot yourself in the foot is probably not a great system. Documentation is important, and I'm glad it's clear and obvious, but humans make mistakes. You'd hope that the mistakes have less dire consequences.

Re: Gaining access to anyones Arc browser without them even visiting a website

#185

Post by LegitShady »

bschmidt1 wrote: post #160
Cthulhu_ wrote: post #156

Earlier quoted context omitted.

Yeah but if they super promise to not look at incoming Firebase queries they're not tracking you, right?

The super promise died with crypto, now you have to add no backsies. My site uses No Backsies Proofs (NBPs) which are encrypted to prove that all my super promises are backed by a no backsie which is stored in the no backsie vault in Antarctica.

I would feel more comfortable if your super promises were all on a blockchain, and we made No Backsie NFTs so people could clearly see these were legitimate and bid on them.

Re: Gaining access to anyones Arc browser without them even visiting a website

#186

Post by chenmike »

Sakos wrote: post #124
hollywood_court wrote: post #119

Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.

Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.

I'm in the same boat as GP. Was invited early, loved the Arc UX far more than any other browser. I've recommended it to many people.

As many other comments have pointed out, this vulnerability is such a rookie mistake that I don't think I can trust them again after this without understanding what factors in their security/engineering culture led to it. Patching this one issue isn't enough.

Re: Gaining access to anyones Arc browser without them even visiting a website

#187

Post by gspencley »

tnorthcutt wrote: post #162

https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

I've got a different take. If they're in the VC phase, that means they are not self sufficient. The amount of funding that they've raised is no indication what-so-ever of a) how much of that funding has actually been realized / received b) what their overhead is and c) what their overall financial picture looks like.

I do wish that more companies would take privacy and security seriously. And bug bounty programs are great. But they're not always within the budget of companies and the fact that they decided to award this security researcher regardless of having no such program is a massive win in my opinion and shows how much they value this particular contribution.

Re: Gaining access to anyones Arc browser without them even visiting a website

#188

Post by swatcoder »

tr3ntg wrote: post #181
zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

> bold warning text in the Firebase docs.

Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists.

Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it on to any job listing bullet points. It presumably fell off the bottom in favor of team spirit or brand enthusiasm or whatever.

How many tutorials, community answers, and gists do you think conveyed that warning?

Re: Gaining access to anyones Arc browser without them even visiting a website

#189

Post by emptysongglass »

HungSu wrote: post #182
danpalmer wrote: post #113

Earlier quoted context omitted.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

You might like Zen Browser https://zen-browser.app/

Or Floorp: https://floorp.app

Re: Gaining access to anyones Arc browser without them even visiting a website

#190

Post by trumad »

arcisbad wrote: post #64
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea... TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.

I also wrote a guide on ARC features that work better on Firefox: https://thannymack.com/#Arc%20features%20that%20work%20bette...
Post reply on HN