Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

461–470 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#461

Post by dwattttt »

ko_pivot wrote: post #145
nottorp wrote: post #28

Earlier quoted context omitted.

> On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is. Tbh you're doing it wrong if you go that way. Default deny, and then you only have to imagine the legitimate uses.

Fair enough, but my point is more conceptual, in that you still have to write `boost.userId == auth.userId` as an allowed pattern rather than making that pattern the only technically possible result, which is the convention in a traditional API.

The failure modes are much clearer: when you write the API in a default-deny context & forget to add that allowed pattern, it never works, so you notice & figure out the bug.

The same story with default-allow means the system looks like it works fine, and you end up with no security at all.

Re: Gaining access to anyones Arc browser without them even visiting a website

#462

Post by footy »

titaniumtown wrote: post #288
ayhanfuat wrote: post #245

Earlier quoted context omitted.

Was the post written for HN users only? I cannot see it on your blog page ( https://arc.net/blog ). It’s not posted on your twitter either. Your whole handling seems to be responding only if there is enough noise about it.

Not a good look it not being on the main page! I personally use [zen browser]( https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.

I used Arc for a while because despite my misgivings about using a browser that requires an account etc the workflow was very good for me

I started moving to Zen about a week ago, hearing about this vulnerability yesterday and especially seeing their reaction to it I know I made the right choice in leaving Arc.

Re: Gaining access to anyones Arc browser without them even visiting a website

#463

Post by nosioptar »

duskwuff wrote: post #233
shermantanktop wrote: post #166

Earlier quoted context omitted.

> a “tinder but for cats” startup idea Needs a name. Meowr? Hissr?

Yowlr. (Which is apparently a dubstep musician.)

(Dubstep isn't music.)

My cats would use Yowlr.

Re: Gaining access to anyones Arc browser without them even visiting a website

#464

Post by voiceblue »

DecoySalamander wrote: post #457
voiceblue wrote: post #434

Earlier quoted context omitted.

It is very strange to me that their attitude is "no one was impacted" and this is "hypothetical". Any serious company would immediately consider this to be a case where everyone was impacted ! This is like coming home to the worst neighborhood on the planet to find your door wide open, and immediately putting on a blindfold so you can continue to pretend nothing's changed.

Since everything is stored in their DB, they supposedly can audit logs and sources for boosts themselves to confirm if anyone was actually impacted.

Can you explain? How are they able to check whether someone did a quick “in and out” keylogger or cookie extraction? I doubt they can, because I doubt they store every request (that would go against what they claim for privacy) and I also doubt their DB backup happens on such a high frequency that they could catch this (e.g. minute-to-minute).

So…how? Are you claiming they have oodles of logs and a perfect dork* to find suspicious JavaScript? If they had the latter wouldn’t they already be using it for security?

If you have some method that works do tell.

* https://www.alibabacloud.com/blog/what-is-dork_600025

Re: Gaining access to anyones Arc browser without them even visiting a website

#465

Post by __turbobrew__ »

instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

Yea if everything else is not enough of a red flag here, the fact that they are sending every single website you visit to Firebase — against stated privacy policies — is the mother of all red flags.

People say they like arc for the UI and there are all alternatives, but do you really want to risk someone stealing your bank creds and stealing all your money for some fancy UI?

Re: Gaining access to anyones Arc browser without them even visiting a website

#466

Post by __turbobrew__ »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

Are you going to address the part where you send visited websites to Firebase which goes against your privacy policy of not tracking visited URLs?

Re: Gaining access to anyones Arc browser without them even visiting a website

#468

Post by antifa »

timeon wrote: post #250
scblock wrote: post #164

Earlier quoted context omitted.

Truly. I was looking for a privacy respecting Chromium-based browser to use for Web MiniDisc ( https://web.minidisc.wiki/ ) and came across some enthusiastic praise for Arc. I downloaded it and it immediately wanted me to create an account to even use it. How can that possibly respect my privacy? It went right in the trash.

What is also strange that I only found out about account after download. Like it was standard thing for the browser. (Sure there are optional accounts in others but login-walled browser?)

A while back they required login before download. That's when I noped out.

Re: Gaining access to anyones Arc browser without them even visiting a website

#469

Post by moosedev »

gwd wrote: post #451
moosedev wrote: post #431

Earlier quoted context omitted.

You’re technically correct, given a literal reading of the post you quoted, but the use of “could” there was idiomatic - let me explain: There’s a (fairly dated) idiom, “it’s the least I can do”, used when you are offering to do something to make up for a mistake or offense, but the person you hurt says your offer of compensation is unnecessary. For example: Situation: Person A bumps into Person B in the cafe, causin…

Thank you for the explanation -- when I'm speaking foreign languages I appreciate this sort of explanation. But in this case, as a native English speaker, I was well aware of the idiom, and was trying to subvert it. :-) The original idiom is said in the first person, and as you say means essentially, "Justice and equity compel me to do this; I don't find myself able to do less". GGP was actually using a derivative of…

Agreed!

Re: Gaining access to anyones Arc browser without them even visiting a website

#470

Post by timeon »

tech_ken wrote: post #200

Oop and I just convinced my wife and brother to move over :o Props to her, she asked about the security and privacy of the browser and I played it off with some fanboy propaganda. Lesson learned on that one. If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now?

Even in Safari, you can remove tabs from toolbar (but it is not possible to hide toolbar itself) and have them in sidebar - there are also tab groups.

But experience is probably different.

Post reply on HN