Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

351–360 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#351

Post by shuckles »

JumpCrisscross wrote: post #342
mirzap wrote: post #273

Earlier quoted context omitted.

Pay the guy properly. $2000 is an insult. It should be $50k. This kind of bug could be sold for 100-200k easily.

> This kind of bug could be sold for 100-200k easily Maybe not. If the browser is that buggy, there may be plenty of these lying around. The company itself is pricing the vulnerability at $2k. That should speak volumes to their internal view of their product.

I think OP mean to say "this bug could let an attacker gain $200k of value easily", though you are right the market clearing price for such a vulnerability is probably low due to huge supply.

Re: Gaining access to anyones Arc browser without them even visiting a website

#352

Post by radicaldreamer »

currymj wrote: post #195
fold3 wrote: post #32

Earlier quoted context omitted.

Did you took a look at the zen browser? It's an arc clone based on Firefox https://zen-browser.app/

i'm rooting for them to succeed, but if the concern is security, switching your daily driver browser to a brand-new browser that's still in alpha is unfortunately not a good idea.

It's not in Alpha though, they've been around for years and have launched formally.

Re: Gaining access to anyones Arc browser without them even visiting a website

#353

Post by radicaldreamer »

Insanity wrote: post #256

Damn, that is bad. While I enjoyed reading through the write-up, I think a "summary section" at the top would have benefited me lol. Someone recently recommended Arc to me, I installed it on my macbook and then never actually used it when I realized there's no Linux version available, and I like a consistent browser experience across all my devices.

You can use some Arc AI features to summarize it for you :)

Re: Gaining access to anyones Arc browser without them even visiting a website

#354

Post by radicaldreamer »

JumpCrisscross wrote: post #342
mirzap wrote: post #273

Earlier quoted context omitted.

Pay the guy properly. $2000 is an insult. It should be $50k. This kind of bug could be sold for 100-200k easily.

> This kind of bug could be sold for 100-200k easily Maybe not. If the browser is that buggy, there may be plenty of these lying around. The company itself is pricing the vulnerability at $2k. That should speak volumes to their internal view of their product.

Many engineers at SV startups use Arc on a daily basis. This bug could've resulted in the compromise of multiple companies, probably including crypto exchanges. A browser bug of this severity is extremely valuable, even for a niche browser like Arc.

Re: Gaining access to anyones Arc browser without them even visiting a website

#355

Post by radicaldreamer »

segasaturn wrote: post #281

It is remarkable that Arc has taken billions of dollars in VC cash but makes these rookie mistakes in securing their own backend that all of their users are accessing. Where are those billions of dollars going? Is it all just in marketing?

Probably the line of thinking is that security can be a back burner issue until product market fit is achieved.

Doesn't matter if you build the most secure product if nobody is using it, right? Where that breaks down is that a browser MUST be relatively secure, otherwise you've given up the whole ballgame.

Re: Gaining access to anyones Arc browser without them even visiting a website

#356

Post by rakoo »

tr3ntg wrote: post #181
zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

> it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs.

I'm sorry but if the whole design is "one big database shared with everyone and we must manually configure the database for auth" there is a problem that's deeper than just having to read the doc. It means the basic understanding of what it means to keep data as private as possible is not understood. A shared database only works when the server accesses it, not when client has direct access.

What Arc needs is to segregate each user's data in a different place, in the design of the database, not as part of configuration of custom code. Make it impossible to list all user's data, or even users. When, not if, an id is guessed, related data becomes accessible by someone else; make it so that someone else still can't read it, or can't replace it.

Re: Gaining access to anyones Arc browser without them even visiting a website

#357

Post by PKop »

qubitcoder wrote: post #324
PKop wrote: post #241

Earlier quoted context omitted.

[flagged]

That seems dubious. Consider the "stylistic choices" of the former president in social media posts.

I'm not sure what you dispute or your point is here. If people slightly or strongly start aping Trump's writing style in various forms I'd say there's a good chance those people are right wing or simply "not the same people writing in all lowercase" you know?

You highlight stylistic choices. I'd say we can observe the differences in different styles and see how uses them. Is Trump writing in all lowercase? No. Is this poster writing like Trump? No. Do a lot of left-wing people use the all-lowercase style? I see it all the time, yes.

Re: Gaining access to anyones Arc browser without them even visiting a website

#358

Post by wahnfrieden »

sushid wrote: post #302
ayhanfuat wrote: post #245

Earlier quoted context omitted.

Was the post written for HN users only? I cannot see it on your blog page ( https://arc.net/blog ). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.

Hursh, can you please respond to the above commenter? As an early adopter, I find it fairly troubling to see a company that touts transparency hide the blog post and only publicly "own up to it" within the confines of a single HN thread.

Pretty obvious now that Arc will only share security alerts with the people who "catch" them at it - as few as possible

Leaves no choice but for this community to make the rest of the Arc community aware of it as they refuse the transparency

Re: Gaining access to anyones Arc browser without them even visiting a website

#359

Post by hollywood_court »

Sakos wrote: post #124
hollywood_court wrote: post #119

Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.

Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.

Where did they acknowledge the issue? There’s nothing about this issue on their website or their Twitter feed.

Re: Gaining access to anyones Arc browser without them even visiting a website

#360

Post by apitman »

pityJuke wrote: post #58
School-Cotton wrote: post #49

Earlier quoted context omitted.

Am I too optimistic? I feel like most regular people I know wouldn’t sell this off. Most people are not antisocial criminals by nature, and also wouldn’t know how to contact a “state actor” even if they wanted to.

> also wouldn’t know how to contact a “state actor” even if they wanted to. That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.

How does this work in practice? What systems are in place to prevent someone selling an exploit and then turning around and disclosing it properly as soon as they have the money, potentially getting even more money through legal channels? Is there some sort of escrow?
Post reply on HN