Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

391–400 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#391

Post by ljm »

tomjakubowski wrote: post #376
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

You have no idea but you suspect someone could have made more?

Re: Gaining access to anyones Arc browser without them even visiting a website

#392

Post by danpalmer »

rawsta wrote: post #136
danpalmer wrote: post #113

Earlier quoted context omitted.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

Have you tried Vivaldi? It's really customizable and has a lot of features.

Vivaldi feels like a cross platform port in all the ways I try to avoid. I understand the feature set is good, but it doesn't feel nice to use. Hard to state exactly why though.

Re: Gaining access to anyones Arc browser without them even visiting a website

#393

Post by 7sidedmarble »

ljm wrote: post #391
tomjakubowski wrote: post #376

Earlier quoted context omitted.

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

You have no idea but you suspect someone could have made more?

That is generally how suspicions work

Re: Gaining access to anyones Arc browser without them even visiting a website

#394

Post by danpalmer »

HungSu wrote: post #182
danpalmer wrote: post #113

Earlier quoted context omitted.

Yeah I’m so torn. It’s honestly the best browser UX I’ve seen, the right combination of vertical tabs, auto archiving, spaces/collections, sync, etc. I don’t care for Easels, but the core is good. Except… the growth hacks have started to creep in. They overlay an advert for their own AI services on top of regular Google search results pages in their mobile app. Not even a browser chrome UI element, it’s literally ove…

You might like Zen Browser https://zen-browser.app/

Thanks for the recommendation. I just had a quick try, it's nice, seems like a very polished Firefox. It seems to have a bunch of features I don't want in a browser so not sure if they'll get in the way.

Re: Gaining access to anyones Arc browser without them even visiting a website

#395

Post by homebrewer »

AnimalMuppet wrote: post #299
bigstrat2003 wrote: post #205

Earlier quoted context omitted.

> lowercase without caps reads with a warmer, informal tone No, it reads as "I'm uneducated and don't know how to write the English language properly". It's incredibly obnoxious for people to use as an affectation.

To me, proper capitalization is easier to parse - not massively so, but a little bit. So writing without caps is a bit of a jerk move. You're making it harder for me to read, either because you're lazy or because you want to affect a style. In either case it's a bit of a jerk move. It's more of a jerk move when it's done on a discussion board, because what you write once is read multiple times. So the cost multiplies…

I use lowercase in most places precisely because it forces me to use shorter sentences and split text into paragraphs. The result is easier on the reader.

It's just a habit from chat rooms and instant messengers of the beginning of this century. Most of my mates who write like that are well over 30.

This whole subthread is one projection after another.

Re: Gaining access to anyones Arc browser without them even visiting a website

#396

Post by bschmidt1 »

sergiotapia wrote: post #390
bschmidt1 wrote: post #382

Earlier quoted context omitted.

What about S3, you don't really need a file storage provider either? > are javascript devs really that afraid You might be afraid of JS devs :P Anyway has nothing to do with language, even if it was a super c0ol Ruby-on-Rails app with Active Record and SQL db on a server you manage it's still common to have some stuff in NoSQL for fast access to live data, caches, logs, etc. Most companies at scale will have both SQL…

I mentioned javascript because I mostly see that cohort jump feet first into services like firebase/supabase/clerk/vercel/etc.

Vercel too?! What are you using for SSR + serverless, Amplify?

Vercel seems pretty great for a React-centric app with a couple of one-off backend calls to cloud services, super convenient, deploy previews in GitHub etc. why not?

Re: Gaining access to anyones Arc browser without them even visiting a website

#397

Post by poincaredisk »

tomjakubowski wrote: post #376
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

Selling vulnerability on the black market is immoral and may be illegal. The goal of bug bounty programs was initially to signal "we won't sue white hat researchers who disclose their findings to us", when did it evolve into "pay me more than criminals would, or else"?

Re: Gaining access to anyones Arc browser without them even visiting a website

#398

Post by poincaredisk »

Laaas wrote: post #378
bloopernova wrote: post #221

Earlier quoted context omitted.

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty. You've been handed a golden opportunity to set the right course.

Any new vulnerability will be sold to the highest bidder and/or exploited instead of being reported for the bug bounty because of this.

Most of the vulnerabilities I've disclosed, and I've seen disclosed, were disclosed for free, with no expectation of getting anything. Why do you think every researcher is an amoral penny pincher who will just sell exploits without caring for the consequences?

Re: Gaining access to anyones Arc browser without them even visiting a website

#399

Post by JumpCrisscross »

tomjakubowski wrote: post #376
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

> because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users

The case is redeemable. It may still be an opportunity if handled deftly. But it would require an almost theatrical display of generosity to the white hat (together, likely, with a re-constituting of the engineering team).

Re: Gaining access to anyones Arc browser without them even visiting a website

#400

Post by JumpCrisscross »

knowitnone wrote: post #387
NewJazz wrote: post #196

Earlier quoted context omitted.

At the end of the day this is an amateur mistake God I wish. More than one of my coworkers has made this exact mistake with our (thankfully internal) front-end apps.

If it's internal, did they really need to have auth?

> If it's internal, did they really need to have auth?

Nothing on a network is truly internal. The moment you break the physical link between metal and man you're in an unintuitive, and thus insecure, state.

Post reply on HN