Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

411–420 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#411

Post by xelamonster »

tolmasky wrote: post #403
poincaredisk wrote: post #397

Earlier quoted context omitted.

Selling vulnerability on the black market is immoral and may be illegal. The goal of bug bounty programs was initially to signal "we won't sue white hat researchers who disclose their findings to us", when did it evolve into "pay me more than criminals would, or else"?

Let's set aside morality for a second. There is a reason low payouts are bad without even having to consider the black market: it pushes people to search for bugs in a competitor's app that pays more instead of in your app! If your app is paying out $2K and a competing app pays out $100K, why would anyone bother searching for bugs in your app? Every minute spent researching your app pay 1/50th of what you'd get searc…

Right, part of the idea is to close the gap in incentives for white hats looking for vulnerabilities to report and black hats looking for the same to exploit. You don't have to beat the black market price of a vuln because that route is much riskier, but somewhere at least in the same order of magnitude sounds decent.

It's not about viewing security researchers as sociopaths who will always sell to the highest bidder, the fact is there will always be criminals going for exploits and bug bounties can help not just by paying off someone that would have otherwise abused a bug but also by attracting an equally motivated team who would otherwise be entirely uninvolved to play defense.

Re: Gaining access to anyones Arc browser without them even visiting a website

#412

Post by strunz »

avarun wrote: post #254
tyho wrote: post #219

Earlier quoted context omitted.

There isn't really anything you can do to convince me that your team has the expertise to maintain a browser after this. It doesn't matter that you have fixed it, your team is clearly not capable of writing a secure browser, now or ever. I think this should be a resigning matter for the CTO.

And what, you’re going to find them a new CTO? What kind of magical world do you live in where problems are solved by leaders resigning, instead of stepping up and taking accountability?

What kind of accountability is it when there's no personal consequences?

Re: Gaining access to anyones Arc browser without them even visiting a website

#413

Post by xelamonster »

ljm wrote: post #391
tomjakubowski wrote: post #376

Earlier quoted context omitted.

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

You have no idea but you suspect someone could have made more?

After thinking about it for a good long ten seconds, yeah. It would be very easy to steal users' banking information with this. If you crack into one single bank account you have a decent shot at making over $2k right there, a skilled hacker could do a lot more.

Re: Gaining access to anyones Arc browser without them even visiting a website

#414

Post by rattray »

bloopernova wrote: post #221
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Will you be increasing the bug bounty payout? $2,000 is a tiny fraction of what this bug is worth, I hope you will pay the discoverer a proper bounty. You've been handed a golden opportunity to set the right course.

Hursh responded elsewhere on the thread:

https://news.ycombinator.com/item?id=41606219

Re: Gaining access to anyones Arc browser without them even visiting a website

#415

Post by tengbretson »

tomjakubowski wrote: post #376
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Hi Hursh, I'm Tom. A couple friends use Arc and they like it, so I had considered switching to it myself. Now, I won't, not really because of this vulnerability itself (startups make mistakes), but because you paid a measly $2k bounty for a bug that owns, in a dangerous way, all of your users. I won't use a browser made by a vendor who takes the security of their users this unseriously. By the way, I don't know for s…

So you're not going to use Arc. How much do you pay for the browser you do use?

Re: Gaining access to anyones Arc browser without them even visiting a website

#416

Post by xelamonster »

ha470 wrote: post #370
sushid wrote: post #302

Earlier quoted context omitted.

Hursh, can you please respond to the above commenter? As an early adopter, I find it fairly troubling to see a company that touts transparency hide the blog post and only publicly "own up to it" within the confines of a single HN thread.

We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.

Security bulletin is posted up top on the blog page now, but I have to say it doesn't exactly give me a warm and fuzzy feeling.

It falls a bit flat for me where you address the tracking of domains visited by users, I don't think this accurately addresses or identifies the core issues. When you say "this is against our privacy policy and should have never been in the product to begin with"--okay, so how did get there? This wasn't a data leak due to a bug it was an intentionally designed feature that made its way through any review process which might be in place to production without being challenged. What processes will you put in place to prevent future hidden violations of your stated policies?

Edit just to say, dubious as I am I sincerely hope Arc can overcome these issues and succeed. We desparately need more browsers, badly enough that I'll even settle for a Chromium-based one as long as it isn't made by Microsoft.

Re: Gaining access to anyones Arc browser without them even visiting a website

#417

Post by Hexigonz »

I really enjoy Arc's approach to the browser interface, but I am kind of shocked that it requires firebase at all. It touts privacy, but we have to log in, and our data is being stored in a BAAS owned by Google. It would have been SO much simpler to make it so that data is owned by the user and stored on disk. At MOST, maybe a paid syncing feature would require an external database. A takeover path like this is a big deal, but as the author pointed out, you stored URL browsing data for boosts. "Privacy first" browser's are marketing jargon today, and that sucks.

Re: Gaining access to anyones Arc browser without them even visiting a website

#418

Post by JumpCrisscross »

Hexigonz wrote: post #417

I really enjoy Arc's approach to the browser interface, but I am kind of shocked that it requires firebase at all. It touts privacy, but we have to log in, and our data is being stored in a BAAS owned by Google. It would have been SO much simpler to make it so that data is owned by the user and stored on disk. At MOST, maybe a paid syncing feature would require an external database. A takeover path like this is a big…

> "Privacy first" browser's are marketing jargon today

A glance at Arc's privacy policy makes it clear they aren't privacy anything [1]. (Contrast their device and product usage data sections with Kagi's [2].)

[1] https://arc.net/privacy#what-personal-data-do-we-collect-and...

[2] https://help.kagi.com/orion/privacy-and-security/respecting-...

Re: Gaining access to anyones Arc browser without them even visiting a website

#419

Post by wraptile »

Hexigonz wrote: post #417

I really enjoy Arc's approach to the browser interface, but I am kind of shocked that it requires firebase at all. It touts privacy, but we have to log in, and our data is being stored in a BAAS owned by Google. It would have been SO much simpler to make it so that data is owned by the user and stored on disk. At MOST, maybe a paid syncing feature would require an external database. A takeover path like this is a big…

That has been the reason I've never given Arc a shot. It's unacceptable.

Re: Gaining access to anyones Arc browser without them even visiting a website

#420

Post by steve_adams_86 »

I know Firebase is awesome for plenty of reasons. And I’m not disparaging anyone who works hard on it. There’s a ton of great software behind the product.

Unfortunately it’s at the root of almost all of my career’s worst bugs and mistakes (not necessarily caused by me), and it seems like a bit of train wreck in the wrong hands. I’ve had to rescue several clients from it, and have migrated three pretty huge applications off of it now.

I’m not sure what it is exactly. People really abuse the hell out of it.

Post reply on HN