Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gaining access to anyones Arc browser without them even visiting a website

kibty.town

Post reply on HN
Print view View original

61–70 of 538 posts

Re: Gaining access to anyones Arc browser without them even visiting a website

#61

Post by Imustaskforhelp »

nemomarx wrote: post #9
aaomidi wrote: post #7

Earlier quoted context omitted.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.

my brother uses arc browser , he is a developer . I think he saw it from somebody using it (maybe theo t3 or some other creator he watches) , and he found it cool (plus there were lot of videos flooded with saying arc is really great IDK)

If someone finds something cool on the internet. They are going to try it , given that they are capable to do so.

He had a mac so he was able to do so , Even I tried to run arc on windows once when it was really beta and only available to mac (I think now it supports windows not sure)

I just kindly want to state that if the nsa could've bought this exploit , they could've simply waited and maybe even promote arc themselves (seems unlikely)

Maybe they could've tried to promote the numbers of arc users by trying to force google and microsoft search engine through some secret shady company advertising / writing blog posts for arc / giving arch funding or like how we know that there are secret courts in america

( and since these search engines basically constitutes for a high percentage of discovery of stuff by search engine by users)

People could've credited the success to arc in that case for getting more users but the real winner would've been NSA.

Re: Gaining access to anyones Arc browser without them even visiting a website

#62

Post by b112 »

johndough wrote: post #23
water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

On Debian, you can install and run the cat with sudo apt install oneko oneko & Makes a great gift for colleagues who leave their computer unattended.

Well that was a rabbit hole.

Current version is hard to even see with high-res screens. A few checks shows endless ports, code from the 90s and before, and all sorts of other fun.

Wonder if the author will reply.

Re: Gaining access to anyones Arc browser without them even visiting a website

#63

Post by lukan »

water-data-dude wrote: post #11

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

I did not. On the firefox mobile browser it was just using screen space.

Re: Gaining access to anyones Arc browser without them even visiting a website

#64

Post by arcisbad »

bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

This convinced me to never use Arc again. I created a small guide to migrate from it to an open-source alternative: https://gist.github.com/clouedoc/4acc8355782f394152d8ce19cea...

TL;DR: it's not possible to export data from Arc, but it's possible to copy-paste the folder to a Chrome profile, and Firefox and other browsers will detect&import it.

Re: Gaining access to anyones Arc browser without them even visiting a website

#65

Post by prmoustache »

Imustaskforhelp wrote: post #56
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this…

You do know that there are more than chrome and arc right?

Re: Gaining access to anyones Arc browser without them even visiting a website

#66

Post by prmoustache »

aaomidi wrote: post #7
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

> You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

only the 17 users they have.

Shouldn't a government sue you if you try to sell him out vuln unless you personally know people in charge?

Re: Gaining access to anyones Arc browser without them even visiting a website

#67

Post by Aachen »

ahoef wrote: post #25

Nice article, but this is hard to read without proper capitalization. My brain uses capitals to scan beginning and ending of text.

I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text largely lacks intonation markers) that makes it too unreadable compared to the other changes. All this is somehow at least as fascinating to me as the vulnerability being described!

Re: Gaining access to anyones Arc browser without them even visiting a website

#68

Post by efilife »

throwaway984393 wrote: post #17
imglorp wrote: post #8

OP is talking about the Arc browser, not the Arc language, the Arc "Atomic React" project, or any of scores of other projects with that name.

https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does

I don't understand what you do not get. In the link you sent they claim to be a privacy oriented web browser based on chromium

Re: Gaining access to anyones Arc browser without them even visiting a website

#69

Post by 255kb »

aaomidi wrote: post #7
bhaney wrote: post #5

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.

Firestore rules are in "lock mode" (no read or write allowed) by default since a long time. Then, everything is ultra well explained in the docs.

I was already aware of it when being a noob dev 10 years ago, and could easily write a rule to enforce auth + ownership in the rules. No way, seasoned devs can miss that.

Re: Gaining access to anyones Arc browser without them even visiting a website

#70

Post by efilife »

whatevermom wrote: post #47

I’m ashamed I fell for Arc and even recommended it to my friends, as someone whose job is exactly this but with Android apps :(

They claim so much and their browsers' code is 100% proprietary so it's impossiblen to verify their lies. This is what triggered the bullshit detector in my head
Post reply on HN