Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

221–230 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#221

Post by bloopernova »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty.

You've been handed a golden opportunity to set the right course.

Re: Gaining access to anyones Arc browser without them even visiting a website

#222

Post by cmsj »

gspencley wrote: post #187
tnorthcutt wrote: post #162

https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

I've got a different take. If they're in the VC phase, that means they are not self sufficient. The amount of funding that they've raised is no indication what-so-ever of a) how much of that funding has actually been realized / received b) what their overhead is and c) what their overall financial picture looks like. I do wish that more companies would take privacy and security seriously. And bug bounty programs are…

I think we all know that tech debt often lives forever, so if you're going to start a browser company, you simply must be thinking about security/privacy from day one. If the VC model doesn't make that possible, then the only reasonable conclusion is that browsers shouldn't be a thing that VC funded startups work on.

Re: Gaining access to anyones Arc browser without them even visiting a website

#223

Post by [deleted] »

tnorthcutt wrote: post #162

https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#224

Post by [deleted] »

instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#225

Post by bobmcnamara »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

[flagged]

Re: Gaining access to anyones Arc browser without them even visiting a website

#226

Post by [deleted] »

bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

[deleted]

Re: Gaining access to anyones Arc browser without them even visiting a website

#227

Post by bschmidt1 »

JumpCrisscross wrote: post #43
endigma wrote: post #10

Earlier quoted context omitted.

Also, firebase? seriously? this is a company with like, low level software engineers on payroll, and they are using a CRUD backend in a box. cost effective I guess? I wouldn't even have firebase on the long list for a backend if I were architecting something like this. Especially when feature-parity competitors like Supabase just wrap a normal DBMS and auth model.

> low level software engineers on payroll How does The Browser Company make money? They're giving their product away for free. Browsers are complicated. It doesn't inspire confidence that the folks in charge of that complexity can't get their heads around a business model. (Aside: none of their stated company values have anything to do with the product or engineering [1]. They're all about how people feel.) [1] https…

Well, it's an app that users access all their online info through - bank, email, search, work, social - everything. Even an open-source, decentralized, blockchain, grass-fed, organic, extra virgin, written in nothing but HTML, released by W3C itself browser could monetize just ~5% of market share if users are downloading their build (or if its baked into the source), considering how much a browser reveals about its user and to the extent the user can be retargeted for: Ads, marketing, surveillance, analytics.

The biggest opportunity has to be driving search traffic to the major search providers all these browsers partner with.

Could also get acquired by a major browser vendor if you have a better product and people are downloading it more than the major ones, especially if both are based on the same underlying engine. Even Firefox still sucks to this day. I'm using it right now (Waterfox) the product still sucks! I know of some browser vendors acquiring others, especially as mobile took off and it was hard to get it right.

Seems like the opportunity is similar to that of social media but slightly more modern because nobody uses new social media anymore but people are trying out new browsers (and you get richer user/usage data).

Re: Gaining access to anyones Arc browser without them even visiting a website

#229

Post by timeon »

wredue wrote: post #203
instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

Maybe I am just stupid, but this *super* smells of arc being able to inject whatever they want in to literally any of your websites and this dude just figured out that he could also do that. This does not seem like a browser capability I want.

seems like it is the case: https://news.ycombinator.com/item?id=41601332

Re: Gaining access to anyones Arc browser without them even visiting a website

#230

Post by [deleted] »

cmsj wrote: post #220

I read this from another source and I was a substantial way into it before it became obvious what Arc is. Blog authors: stop assuming I know about the existence of every piece of software. (also maybe occasionally consider using the Shift key on your keyboard so you can capitalise things :)

[deleted]
Post reply on HN