Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

491–500 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#491

Post by nijave »

bmelton wrote: post #111

> i discovered that there was a arc featured called easels, easels > are a whiteboard like interface, and you can share them with people, > and they can view them on the web. when i clicked the share button > however, there was no requests in my mitmproxy instance, so whats > happening here? I first noticed this on a flight to Paris. I was building a Flutter app using Firestore, and tho I had not paid for the onboard…

Some flights have a free tier of wifi that allows messaging apps. Google Voice and Google Hangouts usually work on those so wouldn't be surprised if some other Google services make it through.

Re: Gaining access to anyones Arc browser without them even visiting a website

#492

Post by 83837jjddh »

instagraham wrote: post #77

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

[dead]

Re: Gaining access to anyones Arc browser without them even visiting a website

#493

Post by darthwalsh »

bilater wrote: post #488
ARandomerDude wrote: post #314

I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain. I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug. But these people want to build a web browser , with all the security expertise and moral duty th…

Can you explain how you could get someone else's user id? I get that this is still a big vulnerability but am trying to understand how that would happen.

It says in the article. If you share one of your snippets, or make/accept a friend request, that all uses the same id

Re: Gaining access to anyones Arc browser without them even visiting a website

#494

Post by sieabahlpark »

zamadatix wrote: post #406
ha470 wrote: post #370

Earlier quoted context omitted.

We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.

Right now You and Arc are advertising it's ideal to position posts such as "Hidden Features in Arc Search" to users but security bulletins and remediations are something that need a hidden stopgap until you've scrambled to build an alternative site to hide them away at instead. Browser security is more than finding the best PR strategy, it's a mindset that prioritizes the user's well being over the product's image. I…

[dead]

Re: Gaining access to anyones Arc browser without them even visiting a website

#495

Post by sieabahlpark »

tolmasky wrote: post #487
voidwtf wrote: post #477

Earlier quoted context omitted.

Bug bounties are always in relation to severity, number of users potentially at risk, and market cap. A browser operating at a deficit from a small company with a small market share cannot pay 100k even if they wanted to. If you and a couple friends released an app that had 50k users and you’d not even broken even, can I claim my 100k by finding a critical RCE?

No, because you probably haven’t bothered to find said CVE. There’s a strange refusal to understand the simplest market considerations here. I understand it sucks and you may not be able to afford it, but the consequence , regardless of all the reasons you can give, is that you will get less of the right kind of attention (security researchers). Now, you can hope that you will also get less of the wrong kind of atten…

[dead]

Re: Gaining access to anyones Arc browser without them even visiting a website

#496

Post by voidwtf »

tolmasky wrote: post #487
voidwtf wrote: post #477

Earlier quoted context omitted.

Bug bounties are always in relation to severity, number of users potentially at risk, and market cap. A browser operating at a deficit from a small company with a small market share cannot pay 100k even if they wanted to. If you and a couple friends released an app that had 50k users and you’d not even broken even, can I claim my 100k by finding a critical RCE?

No, because you probably haven’t bothered to find said CVE. There’s a strange refusal to understand the simplest market considerations here. I understand it sucks and you may not be able to afford it, but the consequence , regardless of all the reasons you can give, is that you will get less of the right kind of attention (security researchers). Now, you can hope that you will also get less of the wrong kind of atten…

lol, that’s not how this works, that’s not how any of this works…

you cannot demand more than someone is willing to or able to pay, either a researcher out there will spend some time on it because it’s a relatively new contender to the market and they’re hoping for low hanging fruit, or they won’t.

obviously the bounty was enough for someone to look at it and get paid out for a find, otherwise we wouldn’t be having this conversation. trying to argue that they should set a bounty high enough to make it worth your time is pointless and a funny stance to take. feel free to ignore it or be upset that they aren’t offering enough to make you feel secure, it’s not going to make 100k appear out of thin air.

Re: Gaining access to anyones Arc browser without them even visiting a website

#497

Post by Cpoll »

voiceblue wrote: post #464
DecoySalamander wrote: post #457

Earlier quoted context omitted.

Since everything is stored in their DB, they supposedly can audit logs and sources for boosts themselves to confirm if anyone was actually impacted.

Can you explain? How are they able to check whether someone did a quick “in and out” keylogger or cookie extraction? I doubt they can, because I doubt they store every request (that would go against what they claim for privacy) and I also doubt their DB backup happens on such a high frequency that they could catch this (e.g. minute-to-minute). So…how? Are you claiming they have oodles of logs and a perfect dork* to f…

I don't think you're using "dorking" correctly here, since web crawlers aren't anywhere in the picture. Server log queries aren't "dorks." Besides, if you can reproduce the issue and _if_ it's somehow logged in the database, it's usually not too hard to figure out how to query for other occurrences.

With that said, I think you're probably right. I doubt Firebase audit logs contain update contents, and based on the bug report, your "in and out" proposal is as simple as:

firebase.collection("boosts").where("creatorID", "==", "attackers_user_id").update({"creatorId": "victims_user_id" });

sleep(time);

firebase.collection("boosts").where("creatorID", "==", "victims_user_id").update({"creatorId": "attackers_user_id" });

(okay, not exactly, because this would also set the ownership of the victim's legitimate Boosts, but the actual code isn't much more difficult).

Re: Gaining access to anyones Arc browser without them even visiting a website

#498

Post by GreenWatermelon »

gukkey wrote: post #432
titaniumtown wrote: post #288

Earlier quoted context omitted.

Not a good look it not being on the main page! I personally use [zen browser]( https://github.com/zen-browser/desktop); I like the ideas of Arc, but it always seemed sketchy to me, especially it being Chromium-based and closed-source.

The only feature Zen browser missing is tab folders, once they implement it I really don't have a reason to have Arc browser anymore.

Hell despite missing tab groups, Zen browser is the only browser that finally had a "good enough" vertical tabs implementation, which allowed me to finally drop Edge as my main browser.

Re: Gaining access to anyones Arc browser without them even visiting a website

#499

Post by zamadatix »

zamadatix wrote: post #406
ha470 wrote: post #370

Earlier quoted context omitted.

We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.

Right now You and Arc are advertising it's ideal to position posts such as "Hidden Features in Arc Search" to users but security bulletins and remediations are something that need a hidden stopgap until you've scrambled to build an alternative site to hide them away at instead. Browser security is more than finding the best PR strategy, it's a mindset that prioritizes the user's well being over the product's image. I…

The sibling comment to this by sieabahlpark is already dead but to respond in case they get a chance to read the thread again anways:

The engineers already closed the hole, the blog post was already published, more work was (/is still?) going to be done to make a new site to hide them in. I wasn't asking for them to move engineers off patching to blog posting, I was asking for the already created blog posting to be made as visible in the blog the same as the posts were (which is now the case, so at least there is that).

In regards to whether or not they did analysis to show it wasn't exploited that was indeed nice to see but you still have to make the post visible anyways because you're not always right, even if you're one of the biggest companies in the world https://www.theregister.com/2024/09/17/microsoft_zero_day_sp... The measure to meet here is transparency, not perfection.

And no, I wasn't really sitting around waiting for a good opportunity to delete my account and uninstall my main browser. That would be... very odd? I'm free to change browser without a reason to blame haha. I didn't say what I was switching to either (it's quite irrelevant to the topic), which can certainly be more than one of 2 options you have quips for. Regardless which option, the measure to meet here is again not perfection but transparency and yes, others do meet that well and above how Arc did in this case.

More than anything, the reason for responding is less to argue about most of those points (I even debate just removing them now as they may detract from the point) and more to point out "real" transparency on security incidents (not just what a PR person would say gives the best image) is as big a factor in trusting a company with your data as their actual response to vulnerabilities. It doesn't matter that a company looks great 100% of the time they tell you about things if you know they are being intentionally stingy on showing you anything about it since you now have no way to trust they'd show you the bad anyways.

Re: Gaining access to anyones Arc browser without them even visiting a website

#500

Post by tolmasky »

voidwtf wrote: post #496
tolmasky wrote: post #487

Earlier quoted context omitted.

No, because you probably haven’t bothered to find said CVE. There’s a strange refusal to understand the simplest market considerations here. I understand it sucks and you may not be able to afford it, but the consequence , regardless of all the reasons you can give, is that you will get less of the right kind of attention (security researchers). Now, you can hope that you will also get less of the wrong kind of atten…

lol, that’s not how this works, that’s not how any of this works… you cannot demand more than someone is willing to or able to pay, either a researcher out there will spend some time on it because it’s a relatively new contender to the market and they’re hoping for low hanging fruit, or they won’t. obviously the bounty was enough for someone to look at it and get paid out for a find, otherwise we wouldn’t be having t…

I’m not a security researcher, so it’s really not about me. You seem to be confused about what we’re even arguing about, this discussion started because someone said they wouldn’t use this browser because the low bug bounty amount represents that the company isn’t taking security seriously. My posts simply defend why this is a perfectly reasonable stance to take. They are not me demanding an increase in bug bounties so that I will work on them. A good trick if you’re ever confused about a discussion is to simply scroll up and read the posts, I’ll make it even easier for you, this is where it starts: https://news.ycombinator.com/item?id=41606272

Secondly, in a true demonstration of confusion, if you read my posts they demand nothing. They simply state what are likely outcomes of certain choices. I’m not sure how to possibly make the stance of “if you pay smaller bug bounties in a market that has other offerings, you will get less research focused on your product” any simpler. It seems fairly straightforward… and the existence of one bug report does not somehow “disprove” this. Why not make the bug bounty $1 otherwise? Oh, is that a ridiculous suggestion? Because that might not be a worthwhile enough incentive perhaps? But who are you to dictate what is and isn’t a worthwhile incentive. “That’s not how this works. That’s not how any of this works…”

> “either a researcher out there will spend some time on it […] or they won’t.”

Yes, I agree with this truism that they either will spend time on it or they won’t. Interestingly, this is true in all scenarios. My point is how to optimize researchers spending time on your product (which in theory you are inclined to do if your are offering a bounty), and I then separately even make suggestions for how to possibly require less attention by making safer choices and being able to “ride” on another project’s bug bounties.

But again, the simplest point here is that the position of “we offer low bug bounties because that is what we can afford” is fine, it’s just also absolutely defensible to be completely turned off by it as a potential user of that product, for the likely security implications of that position.

Post reply on HN