[flagged]
I got downvoted for calling it a dog?? Now that's ruff!!
[flagged]
Gaining access to anyones Arc browser without them even visiting a website
71–80 of 538 posts
Re: Gaining access to anyones Arc browser without them even visiting a website
#72There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.
I agree & disagree. Browsers are very important part of our life. If someone compromises our browsers , they basically compromise every single aspect of privacy and can lead to insane scams. And because arc browser is new , they wanted to build fast and so they used tools like firebase / firestore to be capable of moving faster (they are a startup) Now I have read the article but I am still not sure how much of this…
I very much agree with the idea that browsers are security-sensitive software, unlike, say, a picture editor, and more like an ssh server. It should be assumed to be constantly under attack.
And browser development is exactly not the area where I would like to see the "move fast, break things" attitude. While firebase may be sloppy with security and thus unfit for certain purposes, I would expect competent developers of a browser to do due diligence before considering to use it, or whatever else, for anything even remotely related to security. Or, if they want to experiment, I'd rather that be opt-in, and come with a big banner: "This is experimental software. DO NOT attempt to access your bank account, or your real email account, or your social media accounts".
With that, I don't see much exploit potential in learning stats like the number of cores on your machine. Maybe slightly more chances of fingerprinting, but nothing comparable to the leak through improper usage of firebase.
Re: Gaining access to anyones Arc browser without them even visiting a website
#73Earlier quoted context omitted.
Did you enable the ui.prefersReducedMotion setting? That hides the cat from what I can tell
Hmm not that I remember. But I have reduced motion enabled on my phone system wide and maybe that synced to my desktop on its own. Which is scary come to think of it.
Too late to edit... i just got around to checking and I do have system wide reduced motion and reduced transparency on this laptop. I'm sure I didn't set it up on there, just on the phone.
I think Apple is starting to sync too much...
Re: Gaining access to anyones Arc browser without them even visiting a website
#74There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.
The mandatory account just to try Arc was always a massive red flag to me - and led to me never trying it. Now I’m glad I didn’t!
Re: Gaining access to anyones Arc browser without them even visiting a website
#75OP is talking about the Arc browser, not the Arc language, the Arc "Atomic React" project, or any of scores of other projects with that name.
https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does
It's a browser (chromium based) with a really nice UI that people love, I am intrigued but haven't used it because I find the requirement to create an account off-putting.
Re: Gaining access to anyones Arc browser without them even visiting a website
#76The vulnerability has been patched, but I suppose the browser still makes a firebase query for every website you visit?
That's pretty bad, whether or not they track these requests, just seems wasteful.
Re: Gaining access to anyones Arc browser without them even visiting a website
#77>privacy concerns
>while researching, i saw some data being sent over to the server, like this query everytime you visit a site:
> firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com");
> the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.
Re: Gaining access to anyones Arc browser without them even visiting a website
#78Nice article, but this is hard to read without proper capitalization. My brain uses capitals to scan beginning and ending of text.
I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text la…
It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about.
It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.
Re: Gaining access to anyones Arc browser without them even visiting a website
#79Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase. Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.
It's really not hard to build this safely in firebase, this could've been authored the same way in node too. I think whoever authored this either majorly cut corners or just isn't experienced enough to understand how to write authenticated controllers like this. This should scare people away from this browser, it's such a basic thing to mess up and it shouldn't have happened.
Re: Gaining access to anyones Arc browser without them even visiting a website
#80Earlier quoted context omitted.
Hmm not that I remember. But I have reduced motion enabled on my phone system wide and maybe that synced to my desktop on its own. Which is scary come to think of it.
Too late to edit... i just got around to checking and I do have system wide reduced motion and reduced transparency on this laptop. I'm sure I didn't set it up on there, just on the phone. I think Apple is starting to sync too much...
That seems like a perfectly reasonable thing to sync. Accessibility settings are exactly the type of thing you shouldn’t have to configure again and again on every device.
Either way, you can disable syncing of system settings.