Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

441–450 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#441

Post by sbotzek »

prilo wrote: post #243
ggregoire wrote: post #199

Earlier quoted context omitted.

Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.

I often wonder how much this can be attributed to the pretty awful SEO of most documentation. I write mostly Python at work and it's infuriating how often GeeksForGeeks, W3Schools, Programiz, or RealPython pop up when I'm just trying to reference like, the arg order of a builtin, or the particular behavior. Django is worse, I often feel like I can't even find the doc when I know it's there and read it before.

People have already given many ideas, but if you use DuckDuckGo they have bangs for searching various python docs. Here's a page that lets you search which ones are available: https://duckduckgo.com/bangs

Re: Gaining access to anyones Arc browser without them even visiting a website

#442

Post by habosa »

I just want to say that Firebase security rules deny every operation by default. An empty rules file allows nothing.

The devs that wrote these rules had to intentionally allow overly broad reads/writes to this part of their database in order to create this vulnerability. And this had to pass code review and automated testing.

That’s not good, and it has nothing to do with their choice of tools.

Re: Gaining access to anyones Arc browser without them even visiting a website

#443

Post by com2kid »

qwertox wrote: post #429
ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

> including moving off Firebase Firebase is not to blame here. It's a solid technology which just has to be used properly. Google highlights the fact that setting up ACLs is critical and provides examples on how to set them up correctly. If none of the developers who were integrating the product into Arc bothered about dealing with the ACLs, then they are either noobs or simply didn't care about security.

Saying Google provides examples of being rather nice about it.

Firebase ACLs are a constant source of vulnerabilities largely because they are confusing and don't have enough documentation around them.

Re: Gaining access to anyones Arc browser without them even visiting a website

#444

Post by liendolucas »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

> "...the hypothetical depth of this vulnerability is unacceptable."

What is also unacceptable is to pay 2000 dollars for something like this AND have to create user accounts to use your browser. Will definitely stay away from it.

Re: Gaining access to anyones Arc browser without them even visiting a website

#445

Post by GVRV »

kfarr wrote: post #211
zachrip wrote: post #143

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At…

Agreed, if I understand correctly the fix to this issue would be the following rules inside of a "match" statement in firestore.rules which is plainly documented as firebase firestore security 101: ``` // Allow create new object if user is authenticated allow create: if request.auth != null; // Allow update or delete document if user is owner of document allow update, delete: if request.auth.uid == resource.data.owne…

Didn't they already have these rules in place? And the vulnerability was when the owner was updating the resource to have a new owner?

Re: Gaining access to anyones Arc browser without them even visiting a website

#446

Post by yas_hmaheshwari »

avarun wrote: post #254
tyho wrote: post #219

Earlier quoted context omitted.

There isn't really anything you can do to convince me that your team has the expertise to maintain a browser after this. It doesn't matter that you have fixed it, your team is clearly not capable of writing a secure browser, now or ever. I think this should be a resigning matter for the CTO.

And what, you’re going to find them a new CTO? What kind of magical world do you live in where problems are solved by leaders resigning, instead of stepping up and taking accountability?

Yeah, I also think that asking someone to resign for this does not look like a proportionate response

They are owning up to their mistakes and making sure such things don't happen again (and increasing the amount from 2K :-)) seems like the right approach to me

Re: Gaining access to anyones Arc browser without them even visiting a website

#447

Post by johndough »

rixed wrote: post #435
johndough wrote: post #320

Earlier quoted context omitted.

I don't, but I run the same system configuration, so I can compile it on my computer, transfer it and run it. Alternatively, if a compiler such as gcc is available, you could also run # https seems to be broken on this website currently wget http://www.daidouji.com/oneko/distfiles/oneko-1.2.sakura.5.tar.gz tar -xf oneko-1.2.sakura.5.tar.gz cd oneko-1.2.sakura.5/ gcc oneko.c -lX11 -lm -o oneko ./oneko & cd .. # remove…

so, to remind your coworkers that they should securely lock their computer, you download some software from http and run it on it?

No. As mentioned before, I have a precompiled binary. But you are right about security, so here is how to verify the SHA-256 hash of this file:

    printf '2c2e05f1241e9b76f54475b5577cd4fb6670de058218d04a741a04ebd4a2b22f\t oneko-1.2.sakura.5.tar.gz' | sha256sum -c

Re: Gaining access to anyones Arc browser without them even visiting a website

#448

Post by pndy »

causal wrote: post #132
Borgz wrote: post #52

According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?

I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.

I had doubts already when submissions promoting the browser were added on hn while there was no way to see how it looks like or even test it out - for quite some time there was nothing but mail singup on their page.

https://news.ycombinator.com/item?id=35801529

Re: Gaining access to anyones Arc browser without them even visiting a website

#449

Post by larsrc »

knowitnone wrote: post #387
NewJazz wrote: post #196

Earlier quoted context omitted.

At the end of the day this is an amateur mistake God I wish. More than one of my coworkers has made this exact mistake with our (thankfully internal) front-end apps.

If it's internal, did they really need to have auth?

YES!!! You need auth to prevent employees from looking up sensitive user data without a good reason, or it'll be a stalker's haven. And to prevent possible intruders from gaining more data/access. Defense in depth. And for preventing an experiment from wiping use data. And for so many other reasons!

Re: Gaining access to anyones Arc browser without them even visiting a website

#450

Post by skykooler »

prilo wrote: post #243
ggregoire wrote: post #199

Earlier quoted context omitted.

Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.

I often wonder how much this can be attributed to the pretty awful SEO of most documentation. I write mostly Python at work and it's infuriating how often GeeksForGeeks, W3Schools, Programiz, or RealPython pop up when I'm just trying to reference like, the arg order of a builtin, or the particular behavior. Django is worse, I often feel like I can't even find the doc when I know it's there and read it before.

Also, many pieces of software whose "documentation" is just some examples of its use.
Post reply on HN