Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

291–300 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#291

Post by kevincox »

ko_pivot wrote: post #2

This is such a fantastic bug. Firebase security rules (like with other BaaS systems like Firebase) have this weird default that is hard to describe. Basically, if I write my own API, I will set the userId of the record (a 'boost' in this case) to the userId from the session, rather than passing it in the request payload. It would never even occur to a developer writing their own API past a certain level of experience…

For inserts yes, but for updates I've frequently seen cases where people just stuff the whole request into their ORM or document store. It is pretty easy to think "the owner can update the document" without realizing that there are some fields (that the official client doesn't set) that shouldn't be updated (like the owner or created timestamp).

The correct solution is likely default-deny auth for every single field. Then you at least have to explicitly make the owner field writable, and hopefully consider the impact of transfering this object to another user.

Re: Gaining access to anyones Arc browser without them even visiting a website

#292

Post by dongcarl »

oefrha wrote: post #176

> firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, i wrote a frida script to dump the relevant calls. As someone who has done some reverse engineering of macOS apps but haven't used anything beyond Charles' macOS proxy feature, this looks very painful. Is there a proxy app that maybe acts as a VPN so that basically every HTTP request is guarantee…

To add to u/ibash's comment, mitmproxy correctly implements a macOS network extension: https://mitmproxy.org/posts/local-redirect/macos/

I assume you'll have to install a root cert in order to introspect HTTPS traffic though.

Re: Gaining access to anyones Arc browser without them even visiting a website

#293

Post by Vegenoid »

throwaway984393 wrote: post #17
imglorp wrote: post #8

OP is talking about the Arc browser, not the Arc language, the Arc "Atomic React" project, or any of scores of other projects with that name.

https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does

The “what makes Arc different from other browsers” section is particularly funny.

> Arc is to your ex-browser what the iPhone was to cellphones. Or as one of our members said “like moving from a PC to a Mac.” It’s from the future — and just feels great.

Re: Gaining access to anyones Arc browser without them even visiting a website

#294

Post by soundnote »

latexr wrote: post #81
efilife wrote: post #70

Earlier quoted context omitted.

They claim so much and their browsers' code is 100% proprietary so it's impossiblen to verify their lies. This is what triggered the bullshit detector in my head

> They claim so much and their browsers' code is 100% proprietary Far from me to defend Arc (I dislike it for several reasons) but it’s based on Chromium so it’s far from 100% proprietary. Don’t Edge, Vivaldi, and even Chrome have proprietary layers on top of the open-source Chromium?

Vivaldi's inhouse UI code isn't open source, but is visible for users to verify AFAIK.

Re: Gaining access to anyones Arc browser without them even visiting a website

#295

Post by ziddoap »

timeon wrote: post #250
scblock wrote: post #164

Earlier quoted context omitted.

Truly. I was looking for a privacy respecting Chromium-based browser to use for Web MiniDisc ( https://web.minidisc.wiki/ ) and came across some enthusiastic praise for Arc. I downloaded it and it immediately wanted me to create an account to even use it. How can that possibly respect my privacy? It went right in the trash.

What is also strange that I only found out about account after download. Like it was standard thing for the browser. (Sure there are optional accounts in others but login-walled browser?)

Another strange thing about the account... They have a little section under "Security" FAQ (lol) that says:

>"Why does Arc require an account to use?"

The answer is:

>"Here's a link to our forum that explains the rationale behind requiring an account to use Arc: Why do I need an account?"

That link goes to here: https://resources.arc.net/hc/en-us/articles/19401542261911-B...

Which... Doesn't explain why you need an account!

Re: Gaining access to anyones Arc browser without them even visiting a website

#296

Post by ghodith »

JohnMakin wrote: post #258
randomdata wrote: post #246

Earlier quoted context omitted.

Coworker implies paid work, and therefore they are not amateurs. They very well may make the same mistakes, but those mistakes would be professional mistakes.

Why this level of pedantry when the meaning is absolutely clear? A professional can make an amateur mistake. This makes perfect sense. That isn't implying the professional is actually an amateur, but that he made a mistake that an amateur would make.

For some added pedantry: aren't all the mistakes that a professional might make, also ones an amateur would make?

In fact, it seems like an amateur is likely to run into all mistakes more often, thereby making all mistakes amateur mistakes; unless there some class of mistake that amateurs are better at avoiding?

Re: Gaining access to anyones Arc browser without them even visiting a website

#297

Post by squigz »

PKop wrote: post #238
squigz wrote: post #109

Earlier quoted context omitted.

Strange to label a failure to capitalize words as a "dumb social media trend", as I'm sure people have been doing that for many years prior to social media. And nobody tYpEs lIkE tHiS except when making a joke.

[flagged]

Good luck with that. I'm sure people will respond the way you want when you call them dumb.

Re: Gaining access to anyones Arc browser without them even visiting a website

#298

Post by ziddoap »

ibash wrote: post #260
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Thanks for the response. While people might nitpick on how things were handled, the fact that you checked if anyone was affected and fixed it promptly is a good thing.

It is not really nitpicking, given the severity.

Being prompt on a vulnerability of this magnitude should be considered "meeting the standard" at best.

Re: Gaining access to anyones Arc browser without them even visiting a website

#299

Post by AnimalMuppet »

bigstrat2003 wrote: post #205
Wingy wrote: post #93

Earlier quoted context omitted.

I use it to indicate tone. Proper capitalization and punctuation reads with a formal, cold tone. lowercase without caps reads with a warmer, informal tone there’s a Tom Scott Language Files video documenting it: https://www.youtube.com/watch?v=fS4X1JfX6_Q

> lowercase without caps reads with a warmer, informal tone No, it reads as "I'm uneducated and don't know how to write the English language properly". It's incredibly obnoxious for people to use as an affectation.

To me, proper capitalization is easier to parse - not massively so, but a little bit. So writing without caps is a bit of a jerk move. You're making it harder for me to read, either because you're lazy or because you want to affect a style. In either case it's a bit of a jerk move.

It's more of a jerk move when it's done on a discussion board, because what you write once is read multiple times. So the cost multiplies, but (if due to laziness) the benefit only occurs once.

Now, in something like texting, I understand, when you're trying to type on that teeny phone keyboard. It's harder to hit the shift key when you don't have a spare finger because you're only using one. But for something like here, take the time and the effort to make it better for your readers.

Re: Gaining access to anyones Arc browser without them even visiting a website

#300

Post by jonny_eh »

water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

I found it, like an actual cat, extremely distracting.
Post reply on HN