Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

191–200 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#191

Post by tnorthcutt »

gspencley wrote: post #187
tnorthcutt wrote: post #162

https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

I've got a different take. If they're in the VC phase, that means they are not self sufficient. The amount of funding that they've raised is no indication what-so-ever of a) how much of that funding has actually been realized / received b) what their overhead is and c) what their overall financial picture looks like. I do wish that more companies would take privacy and security seriously. And bug bounty programs are…

Thanks for the reply! I think I disagree with you, mostly because it seems like this particular bug could have been company-destroying because of the potential reputation hit if it was exploited on a wide scale.

But regardless, I appreciate your perspective and it gives me some stuff to consider I hadn't previously.

Re: Gaining access to anyones Arc browser without them even visiting a website

#192

Post by mdaniel »

shermantanktop wrote: post #165
tailspin2019 wrote: post #74

Earlier quoted context omitted.

The mandatory account just to try Arc was always a massive red flag to me - and led to me never trying it. Now I’m glad I didn’t!

You could have just borrowed someone else’s, it appears.

Ironically, that would help the privacy concerns since it would intermingle all traffic in their analytics system. Win-win!

Re: Gaining access to anyones Arc browser without them even visiting a website

#193

Post by ggregoire »

nicolasmontone wrote: post #167
tnorthcutt wrote: post #162

https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

This is 100% company culture, probably the ones that decide this kind of things are not technical or don't understand how important is this.

They disclosed the vulnerability directly to the co-founder CTO.

> the timeline for the vulnerability:

> aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh

> aug 25 6:02pm: vulnerability poc executed on hursh's arc account

Re: Gaining access to anyones Arc browser without them even visiting a website

#194

Post by ruined »

fouc wrote: post #179
bschmidt1 wrote: post #160

Earlier quoted context omitted.

The super promise died with crypto, now you have to add no backsies. My site uses No Backsies Proofs (NBPs) which are encrypted to prove that all my super promises are backed by a no backsie which is stored in the no backsie vault in Antarctica.

Later on moxie ends up writing a quick review of NBPs > Instead of storing the data on-chain, NBPs instead contain a URL that points to the data. What surprised me about the standards was that there’s no hash commitment for the data located at the URL. Looking at many of the NBPs on popular marketplaces being sold for tens, hundreds, or millions of dollars, that URL often just points to some VPS running Apache somewh…

this is why my startup is launching backsies rollups for the blob, with null-effect prebacksies. this way everyone can be assured that any backsies issued are technically equivalent to just not making the original agreement! if you can discover a post-agreement backsie within the availability period of 0 days, and we can confirm it, we'll pay you $2,000 no backsies. so we have a market incentive not to lie to you. it's very efficient

Re: Gaining access to anyones Arc browser without them even visiting a website

#195

Post by currymj »

fold3 wrote: post #32
bestest wrote: post #29

the developers working with firebase should enforce common-sense document crud restrictions in the rules. that's just how firebase is. everyone knows it. now, when talking about ARC BROWSER, i am seriously starting to doubt the competence of the team. I mean, if the rules are broken (no tests? no rules whatsoever?), what else is broken with ARC? are we to await a data leak from ARC? any browser recommendations with p…

Did you took a look at the zen browser? It's an arc clone based on Firefox https://zen-browser.app/

i'm rooting for them to succeed, but if the concern is security, switching your daily driver browser to a brand-new browser that's still in alpha is unfortunately not a good idea.

Re: Gaining access to anyones Arc browser without them even visiting a website

#196

Post by NewJazz »

zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

At the end of the day this is an amateur mistake

God I wish. More than one of my coworkers has made this exact mistake with our (thankfully internal) front-end apps.

Re: Gaining access to anyones Arc browser without them even visiting a website

#197

Post by mthoms »

danpalmer wrote: post #113
rpastuszak wrote: post #99

Earlier quoted context omitted.

Honestly I’ve always considered Arc to be a wolf in sheep’s clothing, especially when it comes to privacy. 50-60mm cash at 500mm (!) valuation and no business model is a big red flag when it comes to something as important, as personal as a browser. This is not a charity. Someone, somehow will have to pay for that.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

I'm torn for the same reason: The UX hits all the right notes for me and I've tried every MacOS browser under the sun. I'm an ADHD sufferer and there's something about their combination of features and UI that just lets me get stuff done. And I don't even touch their AI features.

This is all really sad news.

Re: Gaining access to anyones Arc browser without them even visiting a website

#198

Post by wredue »

tr3ntg wrote: post #181
zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

Nobody reads docs dude. They copy and paste stack overflow answers, and now, copilot answers, which is going to be based on stack overflow ultimately anyway.

Re: Gaining access to anyones Arc browser without them even visiting a website

#199

Post by ggregoire »

swatcoder wrote: post #188
tr3ntg wrote: post #181

Earlier quoted context omitted.

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…

Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.

Re: Gaining access to anyones Arc browser without them even visiting a website

#200

Post by tech_ken »

Oop and I just convinced my wife and brother to move over :o

Props to her, she asked about the security and privacy of the browser and I played it off with some fanboy propaganda. Lesson learned on that one. If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now?

Post reply on HN