Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

511–520 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#511

Post by thruway516 »

pembrook wrote: post #506
thruway516 wrote: post #505

Earlier quoted context omitted.

I don't think you understood the severity or the noobiness of the error. This is a browser not a crud app or electron app. A browser is a complex system level piece of software not a hacky mvp and this kind of error shows that maybe they don't have the competence to be building something like this. It makes you wonder what other basic flaws are there just waiting to be exploited, even if its built on top of chromium.…

Agreed, I wouldn’t have hopped on the first airplane with some bicyclist named Wilbur. That would involve risk of immediate physical harm. On the other hand, we’re talking about a 2 year old browser leaking what websites you visit. Do you also think Firefox in 2006 was bulletproof? The entire internet and every single OS & browser was a leaky bucket back then. The current safety-ism, paranoia and risk-aversion around…

You're speaking in bland hand-wavy generalities and like I said before I'm not sure you understood the issue or even read the write-up since you're not really addressing it specifically (it's a whole lot more than 'leaking'). To extend the analogy, this is like having bike engineers build an mvp supersonic jet and you find out they are using bike brakes to stop the thing. Its not even just merely an error its about some very questionable architecture. This is not a mozilla innovating the browser and making the mistakes you get when you're experimenting-and-innovating-something-new type situation at all and it has nothing to do with paranoia or five-eyes lol.

Re: Gaining access to anyones Arc browser without them even visiting a website

#512

Post by mrinfinitiesx »

bschmidt1 wrote: post #209
tailspin2019 wrote: post #74

Earlier quoted context omitted.

The mandatory account just to try Arc was always a massive red flag to me - and led to me never trying it. Now I’m glad I didn’t!

No Linux version prevented me from trying it, didn't even get to the account wall, who knows if there's a pay wall. Perhaps the "moat" concept was misunderstood.

Same

Re: Gaining access to anyones Arc browser without them even visiting a website

#513

Post by ycombinatrix »

ha470 wrote: post #213

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response…

ngl this is pretty pathetic. the massive security hole is one thing but you're just gonna gloss over violating your own privacy policy?

Re: Gaining access to anyones Arc browser without them even visiting a website

#514

Post by ycombinatrix »

rixed wrote: post #435
johndough wrote: post #320

Earlier quoted context omitted.

I don't, but I run the same system configuration, so I can compile it on my computer, transfer it and run it. Alternatively, if a compiler such as gcc is available, you could also run # https seems to be broken on this website currently wget http://www.daidouji.com/oneko/distfiles/oneko-1.2.sakura.5.tar.gz tar -xf oneko-1.2.sakura.5.tar.gz cd oneko-1.2.sakura.5/ gcc oneko.c -lX11 -lm -o oneko ./oneko & cd .. # remove…

so, to remind your coworkers that they should securely lock their computer, you download some software from http and run it on it?

Not the person you're responding to but my workplace has a special internal link precisely to "remind" coworkers to not leave unlocked laptops unattended.

Don't worry, it's https ;)

Re: Gaining access to anyones Arc browser without them even visiting a website

#515

Post by ycombinatrix »

gwd wrote: post #85
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

On the other hand, this is pretty impressive: aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh aug 25 6:02pm: vulnerability poc executed on hursh's arc account aug 25 6:13pm: added to slack channel after details disclosed over encrypted format aug 26 9:41pm: vulnerability patched, bounty awarded sep 6 7:49pm: cve assigned (CVE-2024-45489) Four hours from out-of-the-blue initial con…

28 hours for a 1 line fix is impressive?

Re: Gaining access to anyones Arc browser without them even visiting a website

#516

Post by netdevnet »

swatcoder wrote: post #188
tr3ntg wrote: post #181

Earlier quoted context omitted.

As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.

> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…

I am glad to put engineers in quotes because many people here and elsewhere will use that word with a straight face while also believing that you can call yourself that while learning your job from watching youtube vids and pasting code you don't understand. We need to stop using the word "engineer" for "software developer".

I shall watch the downvotes come from these so called "engineers".

Re: Gaining access to anyones Arc browser without them even visiting a website

#517

Post by netdevnet »

zo1 wrote: post #309
ggregoire wrote: post #199

Earlier quoted context omitted.

Reading/watching random tutorials and asking basic questions on SO __instead of reading the official docs__ is a trend I've observed for the last 10 years. Even for stuff pretty well documented like Python, Postgres, React, etc.

Most official documentation is awful, and just an API reference. It's (almost) like asking someone to learn english and then pointing them to a dictionary. And that's because a lot of devs think it's perfectly dandy to just put perfunctory docstrings in their methods, point it at whatever "doc generation" tool, wire it up to a github.io domain and call it a day. There is a reason people crave, want and seek things li…

That's true but people still do it for well documented stuff like Vue, Svelte and the R that shall not be named. Two wrongs that don't make a right

Re: Gaining access to anyones Arc browser without them even visiting a website

#518

Post by netdevnet »

pphysch wrote: post #208
swatcoder wrote: post #188

Earlier quoted context omitted.

> bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it…

"don't trust the client / validate inputs" is software security 101

It points to a deeper issue in the Browser Company imo. Clearly, an inexperienced dev wrote that api, a senior approved the PR and no one in the wider team picked it up. And that's a team building the fundamental unit of your digital experience. If they failed at something this basic, I would be terrified to know what else they are missing in terms of security

Re: Gaining access to anyones Arc browser without them even visiting a website

#519

Post by netdevnet »

zamadatix wrote: post #406
ha470 wrote: post #370

Earlier quoted context omitted.

We’re working on a proper security bulletin site that will have these front and center! This was a bit of a stopgap for now.

Right now You and Arc are advertising it's ideal to position posts such as "Hidden Features in Arc Search" to users but security bulletins and remediations are something that need a hidden stopgap until you've scrambled to build an alternative site to hide them away at instead. Browser security is more than finding the best PR strategy, it's a mindset that prioritizes the user's well being over the product's image. I…

why would even use a browser that requires you to have an account to use it? It screamed security vector and was the only reason I chose not to use it

Re: Gaining access to anyones Arc browser without them even visiting a website

#520

Post by netdevnet »

voidwtf wrote: post #477
tolmasky wrote: post #403

Earlier quoted context omitted.

Let's set aside morality for a second. There is a reason low payouts are bad without even having to consider the black market: it pushes people to search for bugs in a competitor's app that pays more instead of in your app! If your app is paying out $2K and a competing app pays out $100K, why would anyone bother searching for bugs in your app? Every minute spent researching your app pay 1/50th of what you'd get searc…

Bug bounties are always in relation to severity, number of users potentially at risk, and market cap. A browser operating at a deficit from a small company with a small market share cannot pay 100k even if they wanted to. If you and a couple friends released an app that had 50k users and you’d not even broken even, can I claim my 100k by finding a critical RCE?

Put it this way. If someone got hold of the vuln and exploited all the users and they all sued you, how much would it cost to defend yourself in court (not even considering winning or losing)
Post reply on HN