12 ms·

Gaining access to anyones Arc browser without them even visiting a website

1469 points by xyzeva 2y ago

fredgrott 2y ago
hmm gee I wonder was it worth to value the bug bounty at $2500 given the severity of both the bug and sheer lack skills of the browser company staff...it might even be a reputation destroyed event...
segasaturn 2y ago
It is remarkable that Arc has taken billions of dollars in VC cash but makes these rookie mistakes in securing their own backend that all of their users are accessing. Where are those billions of dollars going? Is it all just in marketing?
- imiric 2y ago
  You seem surprised. This is the MO of many tech companies.
- radicaldreamer 2y ago
  Probably the line of thinking is that security can be a back burner issue until product market fit is achieved. Doesn't matter if you build the most secure product if nobody is using it, right? Where that breaks down is that a browser MUST be relatively secure, otherwise you've given up the whole ballgame.
heraldgeezer 2y ago
Always been weird how this requires an account. Also the forum shills are worse than Brave ones.
ko_pivot 2y ago
This is such a fantastic bug. Firebase security rules (like with other BaaS systems like Firebase) have this weird default that is hard to describe. Basically, if I write my own API, I will set the userId of the record (a 'boost' in this case) to the userId from the session, rather than passing it in the request payload. It would never even occur to a developer writing their own API past a certain level of experience to let the client pass (what is supposed to be) their own userId to a protected API route. On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is.
- nottorp 2y ago
  > On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is. Tbh you're doing it wrong if you go that way. Default deny, and then you only have to imagine the legitimate uses.
  - sorrythanks 2y ago
    And then when you imagine the legitimate uses you have to imagine how allowing those legitimate uses could be misused. You always need to think red and blue.
  - ko_pivot 2y ago
    Fair enough, but my point is more conceptual, in that you still have to write `boost.userId == auth.userId` as an allowed pattern rather than making that pattern the only technically possible result, which is the convention in a traditional API.
    - dwattttt 2y ago
      The failure modes are much clearer: when you write the API in a default-deny context & forget to add that allowed pattern, it never works, so you notice & figure out the bug. The same story with default-allow means the system looks like it works fine, and you end up with no security at all.
- kevincox 2y ago
  For inserts yes, but for updates I've frequently seen cases where people just stuff the whole request into their ORM or document store. It is pretty easy to think "the owner can update the document" without realizing that there are some fields (that the official client doesn't set) that shouldn't be updated (like the owner or created timestamp). The correct solution is likely default-deny auth for every single field. Then you at least have to explicitly make the owner field writable, and hopefully consider the impact of transfering this object to another user.
upghost 2y ago
[flagged]
- ars 2y ago
  The dog is actually a cat named Neko. https://en.wikipedia.org/wiki/Neko_(software) https://en.wikipedia.org/wiki/Neko_(software)
  - DoreenMichele 2y ago
    To be clear, it's a cat named "cat" in Japanese.
- upghost 2y ago
  I got downvoted for calling it a dog?? Now that's ruff!!
  - robbiewxyz 2y ago
    Good pun :) HN tends to be a little hard on brief comments. My current understanding is that comments with little substance are totally acceptable provided they're good natured. For example this comment by dang "There's nothing wrong with submitting a comment saying just "Thanks."" https://news.ycombinator.com/item?id=37251836 https://news.ycombinator.com/item?id=37251836. Also from the guidelines "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive": this post's topic doesn't likely qualify as divisive.
  - efilife 2y ago
    [flagged]
bhaney 2y ago
There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.
- aaomidi 2y ago
  You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.
  - nemomarx 2y ago
    Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.
    - shepherdjerred 2y ago
      Having arbitrary browser access would be pretty valuable, even for just a small number of users.
    - viraptor 2y ago
      Lots of developers and power users make a good chunk of Arc's use base. If you're after some interesting credentials then "every Arc user" is a perfect group with little noise.
      - nicce 2y ago
        > power users Not that many. Most power users don't like to be forced for logging in, before they are able to use the browser.
        sulandor 2y ago
imglorp 2y ago
OP is talking about the Arc browser, not the Arc language, the Arc "Atomic React" project, or any of scores of other projects with that name.
- throwaway984393 2y ago
  https://arc.net/faq https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does
  - efilife 2y ago
    I don't understand what you do not get. In the link you sent they claim to be a privacy oriented web browser based on chromium
    - throwaway984393 2y ago
      [dead]
  - __jonas 2y ago
    It's a browser (chromium based) with a really nice UI that people love, I am intrigued but haven't used it because I find the requirement to create an account off-putting.
  - Vegenoid 2y ago
    The “what makes Arc different from other browsers” section is particularly funny. > Arc is to your ex-browser what the iPhone was to cellphones. Or as one of our members said “like moving from a PC to a Mac.” It’s from the future — and just feels great.
  - PufPufPuf 2y ago
    As a person that recently started using it: it has something like "tree style tabs", and sort of a hybrid merge of the concepts of tabs and bookmarks. In other words, the tabs work more like files on disk -- open/closed, sorted into folders. I'm probably not explaining it well either, but I encourage you to try it if you ever wanted to experiment with alternative tab management (tree style tab, tab groups etc). It's a concept that clicked for me quickly once I started using it, and now I'm angry since I want to use Firefox for philosophical reasons but don't want to go back to regular tabs.
water-data-dude 2y ago
I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)
- mceachen 2y ago
  It's doing great for being a 35-year-old cat! https://en.wikipedia.org/wiki/Neko_(software) https://en.wikipedia.org/wiki/Neko_(software)
- TiredOfLife 2y ago
  On desktop it follows the mouse no need to click.
- Semaphor 2y ago
  As I didn’t get that, it seems like the dev honors prefers-reduced-motion, and doesn’t display it in that case. Excellent of them, give joy to those who want it, prevent annoyances for those who hate them.
  - mzs 2y ago
    Same for me, on FF you can override it with: about:config ui.prefersReducedMotion = 0 https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...
  - jeroenhd 2y ago
    It does: https://github.com/adryd325/oneko.js/blob/main/oneko.js https://github.com/adryd325/oneko.js/blob/main/oneko.js const isReducedMotion = window.matchMedia(`(prefers-reduced-motion: reduce)`) === true || window.matchMedia(`(prefers-reduced-motion: reduce)`).matches === true; if (isReducedMotion) return; Simple but effective. More websites should include this check. Well done, adryd325!
- johndough 2y ago
userbinator 2y ago
while researching, i saw some data being sent over to the server, like this query everytime you visit a site I'm not surprised in the least --- basically the vast majority of software these days is spyware. Looking at Arc's privacy page, it appears to be mainly marketing fluff similar to what I've seen from other companies. I have yet to find a privacy policy that says frankly "we only know your IP and time you downloaded the software, for the few weeks before the server logs are overwritten."
- nickisnoble 2y ago
  Yeah, and no mention of if they addressed this.
  - SushiHippie 2y ago
    According to their blog post https://arc.net/blog/CVE-2024-45489-incident-response https://arc.net/blog/CVE-2024-45489-incident-response they fixed it: > We’ve fixed the issues with leaking your current website on navigation while you had the Boost editor open. We don’t log these requests anywhere, and if you didn’t have the Boosts editor open these requests were not made. Regardless this is against our privacy policy and should have never been in the product to begin with.
- latexr 2y ago
  > I have yet to find a privacy policy that says frankly "we only know your IP and time you downloaded the software, for the few weeks before the server logs are overwritten." Not with those exact words, but that’s Alfred. Server connections are done only to validate the license and check for updates, and you can even disable that. https://www.alfredapp.com/terms/ https://www.alfredapp.com/terms/ > Alfred only contacts our server when activating your Powerpack license in order to validate it, as well as periodically checking for new software updates. You can disable the software update check in the Update preferences, but we recommend keeping this enabled to ensure that you always have the latest version for security reasons and to make the most of the awesome new features!
- hypeatei 2y ago
supriyo-biswas 2y ago
Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase. Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.
- Aaron2222 2y ago
  > Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker. Only if you hate cats, pixel art, or are easily distracted.
  - hunter2_ 2y ago
    I suspect it's that they hate are easily distracted (if "hate" falls outside of the series, such that it applies beyond just "cats")!
  - nottorp 2y ago
    Looks like someone already added it to uBlock Origin since I see no cat. Or maybe the cat doesn't support Firefox...
    - doix 2y ago
      Did you enable the ui.prefersReducedMotion setting? That hides the cat from what I can tell
      - nottorp 2y ago
        Hmm not that I remember. But I have reduced motion enabled on my phone system wide and maybe that synced to my desktop on its own. Which is scary come to think of it.
        nottorp 2y ago
        Too late to edit... i just got around to checking and I do have system wide reduced motion and reduced transparency on this laptop. I'm sure I didn't set it up on there, just on the phone. I think Apple is starting to sync too much...
shepherdjerred 2y ago
$2000 is an insulting amount for such a huge vuln
- isoprophlex 2y ago
  Yeah, you have to have some solid backbone not to sell this off to some malicious party for 20-50x that amount...
  - saagarjha 2y ago
    A malicious party who wants a vulnerability in a browser effectively nobody uses?
    - shepherdjerred 2y ago
      Arc is used disproportionately by users who work in tech which tend to be paid quite well. Am I wrong in thinking that with this vuln you could drain any financial accounts that they log into Arc with? Or, if they use Arc at work, that you now have a way to exfiltrate whatever data you want? A browser vuln is about as bad as an OS vuln considering how much we use browsers for.
  - School-Cotton 2y ago
    Am I too optimistic? I feel like most regular people I know wouldn’t sell this off. Most people are not antisocial criminals by nature, and also wouldn’t know how to contact a “state actor” even if they wanted to.
    - pityJuke 2y ago
      > also wouldn’t know how to contact a “state actor” even if they wanted to. That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.
      - apitman 2y ago
monroewalker 2y ago
Can we have Arc added to the title of the post to better alert people who use or know people who use the browser?
- gcr 2y ago
  Huge agree. I didn’t realize this applied to me the first time I saw this story yesterday. It was the rename that got me to click. Honestly I strongly feel the title should be “fundamental bug in Arc browser (CVE 123-4567)” or similar.
ahoef 2y ago
Nice article, but this is hard to read without proper capitalization. My brain uses capitals to scan beginning and ending of text.
- michaelt 2y ago
  If you were using Arc you could add a Boost for "Case: toggle between different capitalization settings - they will apply to all text on the webpage" [1] /s [1] https://resources.arc.net/hc/en-us/articles/19212718608151-Boosts-Customize-Any-Website https://resources.arc.net/hc/en-us/articles/19212718608151-B...
  - ramonverse 2y ago
    this made me laugh. 10/10
  - 63stack 2y ago
    Depending on the version you are using, you might not even need to add it, someone else might just add it for you!
- Aachen 2y ago
  I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text largely lacks intonation markers) that makes it too unreadable compared to the other changes. All this is somehow at least as fascinating to me as the vulnerability being described!
  - latexr 2y ago
    It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.
orliesaurus 2y ago
I wish we didn't have to sign up to use a browser in the future
- sulandor 2y ago
  just don't use browsers that do
- soundnote 2y ago
  With Brave you don't need to, even for sync.
bestest 2y ago
the developers working with firebase should enforce common-sense document crud restrictions in the rules. that's just how firebase is. everyone knows it. now, when talking about ARC BROWSER, i am seriously starting to doubt the competence of the team. I mean, if the rules are broken (no tests? no rules whatsoever?), what else is broken with ARC? are we to await a data leak from ARC? any browser recommendations with proper vertical tabs and basically everything working like it does in ARC?
- fold3 2y ago
  Did you took a look at the zen browser? It's an arc clone based on Firefox https://zen-browser.app/ https://zen-browser.app/
  - bestest 2y ago
    nice. will probably try it in the future. but the for-some-reason-not-obvious revelation that it's just a product that some team somewhere is working on and the fact that a browser is an important piece of software brought me back to safari (not sure if joke's on me, but in this case I trust apple engineers to do a more thorough job in ensuring my data is secure).
  - tomaskafka 2y ago
    I did. It’s like 20 % an Arc clone, and 80 % of UX papercuts. Like, you can’t have ‘add tab’ button on top when the new tab gets added to the bottom. Or that one sidebar button opens a side window to the right of the sidebar, while another below it opens the favorites to the left and moves the whole sidebar from underneath your mouse. Looks like a minimal effort css restyle of Firefox.
  - currymj 2y ago
    i'm rooting for them to succeed, but if the concern is security, switching your daily driver browser to a brand-new browser that's still in alpha is unfortunately not a good idea.
    - 2y ago
jongjong 2y ago
This is a nice investigation and a great read. Sad that they don't normally do bug bounties. $2000 seems small considering the severity of this vulnerability. Though I guess the size and finances of the company is a factor. It takes some serious skills, effort and luck to discover something like that. It should be well compensated.
ainiriand 2y ago
Start -> Control Panel -> Programs and Features -> Search 'Arc' -> Uninstall.
- erdinc 2y ago
  ...said Windows user.
  - ainiriand 2y ago
    Even worse, to write the comment I had to ask ChatGPT how it works for windows...
whatevermom 2y ago
I’m ashamed I fell for Arc and even recommended it to my friends, as someone whose job is exactly this but with Android apps :(
- efilife 2y ago
  They claim so much and their browsers' code is 100% proprietary so it's impossiblen to verify their lies. This is what triggered the bullshit detector in my head
  - latexr 2y ago
    > They claim so much and their browsers' code is 100% proprietary Far from me to defend Arc (I dislike it for several reasons) but it’s based on Chromium so it’s far from 100% proprietary. Don’t Edge, Vivaldi, and even Chrome have proprietary layers on top of the open-source Chromium?
    - soundnote 2y ago
      Vivaldi's inhouse UI code isn't open source, but is visible for users to verify AFAIK.
Borgz 2y ago
According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?
- Saris 2y ago
  When I downloaded it a few months ago and it required an account to even use it, my gut feeling was that I should just stick with Firefox.
- causal 2y ago
  I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.
  - scblock 2y ago
    Truly. I was looking for a privacy respecting Chromium-based browser to use for Web MiniDisc (https://web.minidisc.wiki/ https://web.minidisc.wiki/) and came across some enthusiastic praise for Arc. I downloaded it and it immediately wanted me to create an account to even use it. How can that possibly respect my privacy? It went right in the trash.
    - timeon 2y ago
      What is also strange that I only found out about account after download. Like it was standard thing for the browser. (Sure there are optional accounts in others but login-walled browser?)
      - roywiggins 2y ago
        Windows is practically login-walled[0] at this point so I imagine people are slowly getting to expect it. [0] witness the magic incantations needed https://www.tomshardware.com/how-to/install-windows-11-without-microsoft-account https://www.tomshardware.com/how-to/install-windows-11-witho...
eru 2y ago
For context: what is this 'arc' that the blog post mentions? I presumes it's not Paul Graham's Lisp dialect in this context? EDIT: seems to be a browser or so?
- flinth_ 2y ago
  Yes it's a new browser who tries to change the UX from traditional browsers: https://arc.net/ https://arc.net/
maipen 2y ago
Very small bounty, but I honestly believe this arc thing won’t last long… Browsers are hard and my only choice has been chrome and will remain so for the long foreseeable future. When I was younger I would enjoy switching to firefox, opera, etc.. But I always came back to chrome because it just worked and always performed when I needed. Chrome/chromium is the safest browser. People tend to fall for the shiny new thing and then realize it was just hype. Please be very careful about what software you choose to perform most of your activities. The same applies to these “new ai IDEs” that keep popping up every other say.
- appendix-rock 2y ago
  …Firefox as an alternative to Chrome!? Am I really that old!? I used Chrome for years and years, right from when it first came out. Since then, I switched back to Firefox, and have used it for years. It works perfectly fine.
- lcnPylGDnU4H9OF 2y ago
  > Chrome/chromium is the safest browser. Why do you say that?
  - creata 2y ago
    1. Chrome's security team has a very good reputation. 2. I don't know how accurate it is in 2024, but there are comparisons like https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... out there.
- tomaskafka 2y ago
  Browser is an user agent. Chrome is an advertisement company agent running on your PC, collecting data for that advertising company. People often confuse these two, but they’re the polar opposites.
__jonas 2y ago
The vulnerability has been patched, but I suppose the browser still makes a firebase query for every website you visit? That's pretty bad, whether or not they track these requests, just seems wasteful.
instagraham 2y ago
>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.
- 83837jjddh 2y ago
  [dead]
- soared 2y ago
  What sort of data does Arc track? Our plain-english Privacy Policy summarizes it well: We don’t know which websites you visit
  - nfm 2y ago
    From the quoted snippet, every page load is leaking both the domain and authed user’s ID to Firebase.
    - Cthulhu_ 2y ago
      Yeah but if they super promise to not look at incoming Firebase queries they're not tracking you, right?
      - bschmidt1 2y ago
        The super promise died with crypto, now you have to add no backsies. My site uses No Backsies Proofs (NBPs) which are encrypted to prove that all my super promises are backed by a no backsie which is stored in the no backsie vault in Antarctica.
        fouc 2y ago
        Later on moxie ends up writing a quick review of NBPs > Instead of storing the data on-chain, NBPs instead contain a URL that points to the data. What surprised me about the standards was that there’s no hash commitment for the data located at the URL. Looking at many of the NBPs on popular marketplaces being sold for tens, hundreds, or millions of dollars, that URL often just points to some VPS running Apache somewhere. Anyone with access to that machine, anyone who buys that domain name in the future, or anyone who compromises that machine can change the image, title, description, etc for the NBP to whatever they’d like at any time (regardless of whether or not they “own” the token). There’s nothing in the NBP spec that tells you what the image “should” be, or even allows you to confirm whether something is the “correct” image.
trallnag 2y ago
How could one sell a vulnerability like this to let's say Mossad? Write them an email?
- who-shot-jr 2y ago
  Page them :)
- diggan 2y ago
  https://www.mossad.gov.il/contact-us/en https://www.mossad.gov.il/contact-us/en Interestingly enough, contains a field for entering your Father's name (but not your mother's).
  - trallnag 2y ago
    I assume this is similar to Russia where people get their father's name assigned as middle name
pknerd 2y ago
Man I miss these kinds of detective posts on HN
- causal 2y ago
  Upvote them, definitely something that makes HN special.
bmelton 2y ago
> i discovered that there was a arc featured called easels, easels > are a whiteboard like interface, and you can share them with people, > and they can view them on the web. when i clicked the share button > however, there was no requests in my mitmproxy instance, so whats > happening here? I first noticed this on a flight to Paris. I was building a Flutter app using Firestore, and tho I had not paid for the onboard wifi (I was doing local development) I was connected and all of my Firestore calls were succeeding. I thought this was novel, and assumed it was just something to do with websockets, so I switched to another, non-firebase-but-yes-websockets project and noticed it didn't work. At the time, I debated moving calls to Firebase just so that I could work for free while I was on flights, but realized the ROI wasn't remotely there. Glad to finally have someone else acknowledge it happening, and give some insight as to why.
- nijave 2y ago
  Some flights have a free tier of wifi that allows messaging apps. Google Voice and Google Hangouts usually work on those so wouldn't be surprised if some other Google services make it through.
deleted 2y ago
[deleted]
tomaskafka 2y ago
For some time I asked why doesn't Arc let me sync my passwords. After seeing this level of incompetence, I am happy they didn't attempt that. Yet.
hollywood_court 2y ago
Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.
- Sakos 2y ago
  Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.
  - pixxel 2y ago
    [flagged]
    - sanex 2y ago
      A pleasant user experience?
    - Sakos 2y ago
      1) What's with the hostility? 2) What exactly do I deserve?
  - tomaskafka 2y ago
    They afaik never said that they ‘fixed’ the issue where they’re sending Google your every visited url.
    - deleted 2y ago
      [deleted]
  - chenmike 2y ago
    I'm in the same boat as GP. Was invited early, loved the Arc UX far more than any other browser. I've recommended it to many people. As many other comments have pointed out, this vulnerability is such a rookie mistake that I don't think I can trust them again after this without understanding what factors in their security/engineering culture led to it. Patching this one issue isn't enough.
phyllistine 2y ago
Yeah with this and the privacy zinger at the end its definitely time my monthlong experiment with arc comes to a close. Too bad that the thing theyre actually proud of, the tabbing UX, was actually really good.
exabrial 2y ago
I roasted them on HN when they announced their product: Browsing the interest should not require an account. Its an "HTML Client", absolutely absurd. Hopefully they sit down and reconsider their choices.
lemonberry 2y ago
Arc was recommended to me by a friend. I deleted upon finding out I needed an account to use it. The excuse Arc gives is in case you want to sync. I'm capable of opting into that.
- timeon 2y ago
  "in case" is good excuse if the account is optional. Which is not case here.
zachrip 2y ago
I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At the end of the day this is an amateur mistake that likely took a 1 line diff to fix. Don't believe me? Check out the docs: https://firebase.google.com/docs/rules/rules-and-auth#cloud-firestore https://firebase.google.com/docs/rules/rules-and-auth#cloud-... - `request.auth` gives you the user id you need (`request.auth.uid`).
- tr3ntg 2y ago
  As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.
  - bichiliad 2y ago
    I think a system that makes it this easy to shoot yourself in the foot is probably not a great system. Documentation is important, and I'm glad it's clear and obvious, but humans make mistakes. You'd hope that the mistakes have less dire consequences.
  - swatcoder 2y ago
    > bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it on to any job listing bullet points. It presumably fell off the bottom in favor of team spirit or brand enthusiasm or whatever. How many tutorials, community answers, and gists do you think conveyed that warning?
mcpar-land 2y ago
Every single thing I've heard about Arc browser has been a massive red flag. Turns out it was even worse than I thought!
- deleted 2y ago
  [deleted]
tnorthcutt 2y ago
https://www.crunchbase.com/organization/the-browser-company/company_financials https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.
- nicolasmontone 2y ago
  This is 100% company culture, probably the ones that decide this kind of things are not technical or don't understand how important is this.
  - ggregoire 2y ago
    They disclosed the vulnerability directly to the co-founder CTO. > the timeline for the vulnerability: > aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh > aug 25 6:02pm: vulnerability poc executed on hursh's arc account
- gspencley 2y ago
  I've got a different take. If they're in the VC phase, that means they are not self sufficient. The amount of funding that they've raised is no indication what-so-ever of a) how much of that funding has actually been realized / received b) what their overhead is and c) what their overall financial picture looks like. I do wish that more companies would take privacy and security seriously. And bug bounty programs are great. But they're not always within the budget of companies and the fact that they decided to award this security researcher regardless of having no such program is a massive win in my opinion and shows how much they value this particular contribution.
  - tnorthcutt 2y ago
    Thanks for the reply! I think I disagree with you, mostly because it seems like this particular bug could have been company-destroying because of the potential reputation hit if it was exploited on a wide scale. But regardless, I appreciate your perspective and it gives me some stuff to consider I hadn't previously.
shermantanktop 2y ago
User identity must be derived from security context, typically at the edge of the system. But it’s so much easier for developers to think of userid as just another parameter, and they forget, and oops now they trust a random user-supplied parameter.
oefrha 2y ago
> firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, i wrote a frida script to dump the relevant calls. As someone who has done some reverse engineering of macOS apps but haven't used anything beyond Charles' macOS proxy feature, this looks very painful. Is there a proxy app that maybe acts as a VPN so that basically every HTTP request is guaranteed to go through it, so that you don't need to write a hundred lines of bespoke Frida just to capture requests? Edit: On second thought Proxifier should work for this purpose.
- ibash 2y ago
  mitmproxy.org can act as a wireguard vpn iirc
- dongcarl 2y ago
  To add to u/ibash's comment, mitmproxy correctly implements a macOS network extension: https://mitmproxy.org/posts/local-redirect/macos/ https://mitmproxy.org/posts/local-redirect/macos/ I assume you'll have to install a root cert in order to introspect HTTPS traffic though.
kfarr 2y ago
Instead of knee jerk firebase is bad, can we discuss how this could be abated properly with firebase rules for firestore? Is this the rule that was missing for arcs boosts or whatever object? ``` match /objects/{object} { // Allow create new object if user is authenticated allow create: if request.auth != null; // Allow update or delete document if user is owner of document allow update, delete: if request.auth.uid == resource.data.ownerUID } ```
- deleted 2y ago
  [deleted]
seanvelasco 2y ago
eva (kibty.town) and mr. bruh never disappoint!
deleted 2y ago
[deleted]
tech_ken 2y ago
Oop and I just convinced my wife and brother to move over :o Props to her, she asked about the security and privacy of the browser and I played it off with some fanboy propaganda. Lesson learned on that one. If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now?
- diggan 2y ago
  > If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now? I use Firefox mostly because of Sideberry (which does vertical tree-style tabs) which also integrates with "containers", so you can have something similar to workspaces but more isolation. Otherwise there is also "profiles" that probably offer even more isolation between the different profiles.
- jonjojojon 2y ago
  Firefox with extensions? The current vertical tabs extensions are not nearly as nice, but Mozilla is working on native vertical tabs. Syncing and Workspaces are already better with Firefox then with Arc.
- soundnote 2y ago
  I just use Brave with a shitton of profiles. That does cause problems for mobile use since no Android browser dev has bothered with proper profiles or ability to install multiple copies of the browser, except for Google I guess.
- creata 2y ago
  I use Firefox with Sidebery for vertical (specifically, tree style) tabs, plus a userChrome.css to hide the native horizontal tabs. Firefox has mobile apps, and the Android app supports (some) browser extensions. It works, it's boring, and it doesn't try to shove gimmicky features in my face.
- timeon 2y ago
  Even in Safari, you can remove tabs from toolbar (but it is not possible to hide toolbar itself) and have them in sidebar - there are also tab groups. But experience is probably different.
treyd 2y ago
How is this "Arc boost" system not just a more limited ad-hoc version of what WebExtensions already provide?
ha470 2y ago
I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response https://arc.net/blog/CVE-2024-45489-incident-response. I'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here – everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.
- nixosbestos 2y ago
  So when there are near weekly reports of websites being compromised due to horrid Firebase configuration, did absolutely no one on your teams raise a red flag? Is there some super low-pri ticket that says "actually make sure we use ACLs on Firebase"?
- markandrewj 2y ago
  I would like to respectfully provide the suggestion of allowing for the use of Arc without being signed into an account. Although I understand browser/device sync is part of most modern browsers, and the value it provides, normally it is a choice to use this feature. Arc still provides a lot of attractive features, even without browser sync on.
- rachofsunshine 2y ago
  Comments further down are concerned that on each page load, you're sending both the URL and a(n identifiable?) user ID to TBC. You may want to comment on that, since I think it's reasonable to say that those of us using not-Chrome (I don't use Arc personally, but I'm definitely in the 1% of browser users) are likely to also be the sort of person concerned with privacy. Vulnerabilities happen, but sending browsing data seems like a deliberate design choice.
  - mthoms 2y ago
cmsj 2y ago
I read this from another source and I was a substantial way into it before it became obvious what Arc is. Blog authors: stop assuming I know about the existence of every piece of software. (also maybe occasionally consider using the Shift key on your keyboard so you can capitalise things :)
- deleted 2y ago
  [deleted]
rockostrich 2y ago
It would be nice if I could download a version of the Arc browser with the cloud bits removed. I use it because of the UI/UX and pretty much ignore everything else. Really if there was a browser that let me keep organized spaces in a left panel plus create split screen views then it would immediately convince me to switch from Arc.
- 4dm1r4lg3n3r4l 2y ago
  https://zen-browser.app/ https://zen-browser.app/
  - rockostrich 2y ago
    I know about Zen and Floorp. For my day to day browsing Arc has: # Split screen tabs Zen and Floorp both have this but the UX for both is really clunky. Surely they'll improve but Arc felt like second nature. # Little Arcs As far as I know, neither Zen or Floorp have this feature and if they do then the UX is not as obvious as Arc. The UX around Little Arcs is almost perfect. If I click on a link, it opens as a modal that I can expand to its own tab if I need or dismiss by just clicking away. The same things happens in other apps so I don't lose context just because I wanted to look at a link quick. If I do want to bring that tab into a space then it's 1-2 clicks away. My only gripe with this is that the Little Arcs that are created from clicking links in other apps don't auto dismiss if you change focus but this might just be a setting I don't have configured. # Inset meetings/videos AFAIK neither has this feature either. Having videos that are playing just seamlessly pop-up picture-in-picture when navigating away from the video tab is useful enough but the meeting feature is key for me because my company uses Google Meet. I can navigate away from meetings to look-up info/check Slack/etc without losing focus on the meeting itself and getting back to the meeting tab or unmuting myself is 1 click away. Sure all of these things could probably be accomplished by browser extensions but I think the UI/UX within Arc is pretty tough to compete with.
Insanity 2y ago
Damn, that is bad. While I enjoyed reading through the write-up, I think a "summary section" at the top would have benefited me lol. Someone recently recommended Arc to me, I installed it on my macbook and then never actually used it when I realized there's no Linux version available, and I like a consistent browser experience across all my devices.
- radicaldreamer 2y ago
  You can use some Arc AI features to summarize it for you :)
deleted 2y ago
[deleted]
gsanderson 2y ago
Yikes. I tried Arc a while ago but switched back to Chrome. Quite glad I did now.
omertoast 2y ago
$2000 is an insult, good luck getting tips for your future vulns.
merco 2y ago
Great catch ! Also very cool to know a bit more about the tech they are using.
ARandomerDude 2y ago
I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain. I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug. But these people want to build a web browser, with all the security expertise and moral duty that implies?! Wow.
- deleted 2y ago
  [deleted]
- bilater 2y ago
  Can you explain how you could get someone else's user id? I get that this is still a big vulnerability but am trying to understand how that would happen.
  - darthwalsh 2y ago
    It says in the article. If you share one of your snippets, or make/accept a friend request, that all uses the same id
    - bilater 2y ago
      ah gotcha thanks
aanet 2y ago
Fascinating vulnerability, and a fascinating way to catch it. Kudos. BTW, on Arc's website on "Security" there still is no mention of this vulnerability (as of 20th Sep 2024, 2:32 pm PT) Check it out - https://arc.net/security https://arc.net/security Apparently the company had contracted with one Latacora for "regular outside security reviews and trainings across a wide range of different systems". Elsewhere on the page, it says "Arc uses GCP Firebase for user authentication, storage for Notes & Easels, and Cloud Functions for certain application features like referral code generation. All data stored in Firebase is encrypted-at-rest by default."
- radicaldreamer 2y ago
  The security page explicitly claims that Arc doesn't log what you're doing, giving URLs as an example, but this vulnerability claims every URL is being sent up to Firebase.
nusl 2y ago
I’ve been using Arc since it was private, and I really like the browser. The company’s posture on this topic has pretty much made me drop it entirely. It’s beyond abysmal.
aucisson_masque 2y ago
That's how you ruin a company reputation. Not saying it is or not deserved, but how could anyone trust a browser that had such a big security fail. And what about all the other that have not been reported or may be exploited ? From now on, every time someone is going to suggest arc browser, there will be another one to remind everyone of that. That's going to be very difficult to overcome when your software already doesn't have that big of a market share.
- voiceblue 2y ago
  It's a little worse than that. From now on, blackhats will have a favorite #1 browser to pentest, at least for the next few weeks. And who's going to take the bet that they'll find nothing? Not me.
sergiotapia 2y ago
The firebases and the supabases of the world are crazy to me to build your company on. You are asking for trouble and anchoring your entire company on the health of one saas that is hooked into the foundational aspects of your application! also it's so incredibly easy to really fuck up and build something exploitable. are javascript devs really that afraid of doing things themselves to this extreme level?
- bschmidt1 2y ago
  What about S3, you don't really need a file storage provider either? > are javascript devs really that afraid You might be afraid of JS devs :P Anyway has nothing to do with language, even if it was a super c0ol Ruby-on-Rails app with Active Record and SQL db on a server you manage it's still common to have some stuff in NoSQL for fast access to live data, caches, logs, etc. Most companies at scale will have both SQL and NoSQL dbs in areas. So if you're already using S3 for files, code on GitHub, storing keys in 1Pass, why not use a Firebase or MongoDB for high traffic live data? Especially if they offer built-in scaling and geo deploy options. This scenario I laid out is kinda to your point of "don't anchor your entire company on it" - the only point I'm trying to add is that you can also use these tools without the company being "anchored" on it, and they could have still ran into the same issue as Arc.
  - sergiotapia 2y ago
    I mentioned javascript because I mostly see that cohort jump feet first into services like firebase/supabase/clerk/vercel/etc.
    - bschmidt1 2y ago
      Vercel too?! What are you using for SSR + serverless, Amplify? Vercel seems pretty great for a React-centric app with a couple of one-off backend calls to cloud services, super convenient, deploy previews in GitHub etc. why not?
jrflowers 2y ago
It is troubling that the browser that cannot be used anonymously displayed questionable behavior adjacent to the mechanism that tells The Browser Company every time you are watching porn
anigbrowl 2y ago
Breakthrough technology, indeed.
Hexigonz 2y ago
I really enjoy Arc's approach to the browser interface, but I am kind of shocked that it requires firebase at all. It touts privacy, but we have to log in, and our data is being stored in a BAAS owned by Google. It would have been SO much simpler to make it so that data is owned by the user and stored on disk. At MOST, maybe a paid syncing feature would require an external database. A takeover path like this is a big deal, but as the author pointed out, you stored URL browsing data for boosts. "Privacy first" browser's are marketing jargon today, and that sucks.
- JumpCrisscross 2y ago
  > "Privacy first" browser's are marketing jargon today A glance at Arc's privacy policy makes it clear they aren't privacy anything [1]. (Contrast their device and product usage data sections with Kagi's [2].) [1] https://arc.net/privacy#what-personal-data-do-we-collect-and-how-do-we-collect-it https://arc.net/privacy#what-personal-data-do-we-collect-and... [2] https://help.kagi.com/orion/privacy-and-security/respecting-privacy.html https://help.kagi.com/orion/privacy-and-security/respecting-...
- wraptile 2y ago
  That has been the reason I've never given Arc a shot. It's unacceptable.
steve_adams_86 2y ago
I know Firebase is awesome for plenty of reasons. And I’m not disparaging anyone who works hard on it. There’s a ton of great software behind the product. Unfortunately it’s at the root of almost all of my career’s worst bugs and mistakes (not necessarily caused by me), and it seems like a bit of train wreck in the wrong hands. I’ve had to rescue several clients from it, and have migrated three pretty huge applications off of it now. I’m not sure what it is exactly. People really abuse the hell out of it.
- deleted 2y ago
  [deleted]
habosa 2y ago
I just want to say that Firebase security rules deny every operation by default. An empty rules file allows nothing. The devs that wrote these rules had to intentionally allow overly broad reads/writes to this part of their database in order to create this vulnerability. And this had to pass code review and automated testing. That’s not good, and it has nothing to do with their choice of tools.
isatty 2y ago
$2000 for remote exec on all their users even if it’s all 17 of them? Insultingly low.
soygem 2y ago
>proprietary chromium fork with aislop on top No thanks
hoothoot 2y ago
We looked into supporting Arc at work, unfortunately Arc is missing lots of basic security controls which are available in many other Chromium and non-Chromium browsers, these include: + The ability to enforce automatic updates + Ability to control which sites extensions/boots are installed on On top of this there seems to be no way to remove the requirement to have an account to use the browser, selectively choose what data is sent/sync'd from Arc, or disable basic features like Easel through which staff accidentally leak data. The UI for the browser is great, but Arc really needs to lay the groundwork for strong security controls or it'll struggle to gain (or even maintain) a foothold in the enterprise space.

1469 points by xyzeva 2y ago

hmm gee I wonder was it worth to value the bug bounty at $2500 given the severity of both the bug and sheer lack skills of the browser company staff...it might even be a reputation destroyed event...

segasaturn 2y ago

It is remarkable that Arc has taken billions of dollars in VC cash but makes these rookie mistakes in securing their own backend that all of their users are accessing. Where are those billions of dollars going? Is it all just in marketing?

imiric 2y ago
You seem surprised. This is the MO of many tech companies.
radicaldreamer 2y ago
Probably the line of thinking is that security can be a back burner issue until product market fit is achieved. Doesn't matter if you build the most secure product if nobody is using it, right? Where that breaks down is that a browser MUST be relatively secure, otherwise you've given up the whole ballgame.

heraldgeezer 2y ago

Always been weird how this requires an account. Also the forum shills are worse than Brave ones.

ko_pivot 2y ago

This is such a fantastic bug. Firebase security rules (like with other BaaS systems like Firebase) have this weird default that is hard to describe. Basically, if I write my own API, I will set the userId of the record (a 'boost' in this case) to the userId from the session, rather than passing it in the request payload. It would never even occur to a developer writing their own API past a certain level of experience to let the client pass (what is supposed to be) their own userId to a protected API route. On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is.

nottorp 2y ago
> On the other hand, with security rules you are trying to imagine every possible misuse of the system regardless of what its programmed use actually is. Tbh you're doing it wrong if you go that way. Default deny, and then you only have to imagine the legitimate uses.
- sorrythanks 2y ago
  And then when you imagine the legitimate uses you have to imagine how allowing those legitimate uses could be misused. You always need to think red and blue.
- ko_pivot 2y ago
  Fair enough, but my point is more conceptual, in that you still have to write `boost.userId == auth.userId` as an allowed pattern rather than making that pattern the only technically possible result, which is the convention in a traditional API.
  - dwattttt 2y ago
    The failure modes are much clearer: when you write the API in a default-deny context & forget to add that allowed pattern, it never works, so you notice & figure out the bug. The same story with default-allow means the system looks like it works fine, and you end up with no security at all.
kevincox 2y ago
For inserts yes, but for updates I've frequently seen cases where people just stuff the whole request into their ORM or document store. It is pretty easy to think "the owner can update the document" without realizing that there are some fields (that the official client doesn't set) that shouldn't be updated (like the owner or created timestamp). The correct solution is likely default-deny auth for every single field. Then you at least have to explicitly make the owner field writable, and hopefully consider the impact of transfering this object to another user.

upghost 2y ago

[flagged]

ars 2y ago
The dog is actually a cat named Neko. https://en.wikipedia.org/wiki/Neko_(software) https://en.wikipedia.org/wiki/Neko_(software)
- DoreenMichele 2y ago
  To be clear, it's a cat named "cat" in Japanese.
upghost 2y ago
I got downvoted for calling it a dog?? Now that's ruff!!
- robbiewxyz 2y ago
  Good pun :) HN tends to be a little hard on brief comments. My current understanding is that comments with little substance are totally acceptable provided they're good natured. For example this comment by dang "There's nothing wrong with submitting a comment saying just "Thanks."" https://news.ycombinator.com/item?id=37251836 https://news.ycombinator.com/item?id=37251836. Also from the guidelines "Comments should get more thoughtful and substantive, not less, as a topic gets more divisive": this post's topic doesn't likely qualify as divisive.
- efilife 2y ago
  [flagged]

bhaney 2y ago

There are a lot of major security vulnerabilities in the world that were made understandably, and can be forgiven if they're handled responsibly and fixed. This is not one of them. In my opinion, this shows a kind of reputation-ruining incompetency that would convince me to never use Arc ever again.

aaomidi 2y ago
You’d think that a company shipping a browser would pay a little more attention to security rules. Also, shame on firebase for not making this a bit more idiot proof. And really? $2500? That’s it? You could’ve owned literally every user of Arc… The NSA would’ve paid a couple more zeros on that.
- nemomarx 2y ago
  Are there a lot of Arc users? It seems like a pretty niche browser even compared to other niches.
  - shepherdjerred 2y ago
    Having arbitrary browser access would be pretty valuable, even for just a small number of users.
  - viraptor 2y ago
    Lots of developers and power users make a good chunk of Arc's use base. If you're after some interesting credentials then "every Arc user" is a perfect group with little noise.
    - nicce 2y ago
      > power users Not that many. Most power users don't like to be forced for logging in, before they are able to use the browser.
      - sulandor 2y ago

imglorp 2y ago

OP is talking about the Arc browser, not the Arc language, the Arc "Atomic React" project, or any of scores of other projects with that name.

throwaway984393 2y ago
https://arc.net/faq https://arc.net/faq I'm definitely not the target audience... Even after reading the faq I have no idea what it does
- efilife 2y ago
  I don't understand what you do not get. In the link you sent they claim to be a privacy oriented web browser based on chromium
  - throwaway984393 2y ago
    [dead]
- __jonas 2y ago
  It's a browser (chromium based) with a really nice UI that people love, I am intrigued but haven't used it because I find the requirement to create an account off-putting.
- Vegenoid 2y ago
  The “what makes Arc different from other browsers” section is particularly funny. > Arc is to your ex-browser what the iPhone was to cellphones. Or as one of our members said “like moving from a PC to a Mac.” It’s from the future — and just feels great.
- PufPufPuf 2y ago
  As a person that recently started using it: it has something like "tree style tabs", and sort of a hybrid merge of the concepts of tabs and bookmarks. In other words, the tabs work more like files on disk -- open/closed, sorted into folders. I'm probably not explaining it well either, but I encourage you to try it if you ever wanted to experiment with alternative tab management (tree style tab, tab groups etc). It's a concept that clicked for me quickly once I started using it, and now I'm angry since I want to use Firefox for philosophical reasons but don't want to go back to regular tabs.

water-data-dude 2y ago

I just wanted to say, I enjoyed the little pixel art cat that runs towards wherever you click immensely. It’s one of those fun, whimsical little touches that I don’t see all that often. A reminder that the internet can be a fun, whimsical place if we want it to be :)

mceachen 2y ago
It's doing great for being a 35-year-old cat! https://en.wikipedia.org/wiki/Neko_(software) https://en.wikipedia.org/wiki/Neko_(software)
TiredOfLife 2y ago
On desktop it follows the mouse no need to click.
Semaphor 2y ago
As I didn’t get that, it seems like the dev honors prefers-reduced-motion, and doesn’t display it in that case. Excellent of them, give joy to those who want it, prevent annoyances for those who hate them.
- mzs 2y ago
  Same for me, on FF you can override it with: about:config ui.prefersReducedMotion = 0 https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...
- jeroenhd 2y ago
  It does: https://github.com/adryd325/oneko.js/blob/main/oneko.js https://github.com/adryd325/oneko.js/blob/main/oneko.js const isReducedMotion = window.matchMedia(`(prefers-reduced-motion: reduce)`) === true || window.matchMedia(`(prefers-reduced-motion: reduce)`).matches === true; if (isReducedMotion) return; Simple but effective. More websites should include this check. Well done, adryd325!
johndough 2y ago

userbinator 2y ago

while researching, i saw some data being sent over to the server, like this query everytime you visit a site I'm not surprised in the least --- basically the vast majority of software these days is spyware. Looking at Arc's privacy page, it appears to be mainly marketing fluff similar to what I've seen from other companies. I have yet to find a privacy policy that says frankly "we only know your IP and time you downloaded the software, for the few weeks before the server logs are overwritten."

nickisnoble 2y ago
Yeah, and no mention of if they addressed this.
- SushiHippie 2y ago
  According to their blog post https://arc.net/blog/CVE-2024-45489-incident-response https://arc.net/blog/CVE-2024-45489-incident-response they fixed it: > We’ve fixed the issues with leaking your current website on navigation while you had the Boost editor open. We don’t log these requests anywhere, and if you didn’t have the Boosts editor open these requests were not made. Regardless this is against our privacy policy and should have never been in the product to begin with.
latexr 2y ago
> I have yet to find a privacy policy that says frankly "we only know your IP and time you downloaded the software, for the few weeks before the server logs are overwritten." Not with those exact words, but that’s Alfred. Server connections are done only to validate the license and check for updates, and you can even disable that. https://www.alfredapp.com/terms/ https://www.alfredapp.com/terms/ > Alfred only contacts our server when activating your Powerpack license in order to validate it, as well as periodically checking for new software updates. You can disable the software update check in the Update preferences, but we recommend keeping this enabled to ensure that you always have the latest version for security reasons and to make the most of the awesome new features!
hypeatei 2y ago

supriyo-biswas 2y ago

Great research. As I've said elsewhere, Firebase's authentication model is inherently broken and causes loads of issues, and people would be better off writing a small microservice or serverless function that fronts Firebase. Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker.

Aaron2222 2y ago
> Also, for anyone trying to read the article, they should put `/oneko.js` in their adblocker. Only if you hate cats, pixel art, or are easily distracted.
- hunter2_ 2y ago
  I suspect it's that they hate are easily distracted (if "hate" falls outside of the series, such that it applies beyond just "cats")!
- nottorp 2y ago
  Looks like someone already added it to uBlock Origin since I see no cat. Or maybe the cat doesn't support Firefox...
  - doix 2y ago
    Did you enable the ui.prefersReducedMotion setting? That hides the cat from what I can tell
    - nottorp 2y ago
      Hmm not that I remember. But I have reduced motion enabled on my phone system wide and maybe that synced to my desktop on its own. Which is scary come to think of it.
      - nottorp 2y ago
        Too late to edit... i just got around to checking and I do have system wide reduced motion and reduced transparency on this laptop. I'm sure I didn't set it up on there, just on the phone. I think Apple is starting to sync too much...

shepherdjerred 2y ago

$2000 is an insulting amount for such a huge vuln

isoprophlex 2y ago
Yeah, you have to have some solid backbone not to sell this off to some malicious party for 20-50x that amount...
- saagarjha 2y ago
  A malicious party who wants a vulnerability in a browser effectively nobody uses?
  - shepherdjerred 2y ago
    Arc is used disproportionately by users who work in tech which tend to be paid quite well. Am I wrong in thinking that with this vuln you could drain any financial accounts that they log into Arc with? Or, if they use Arc at work, that you now have a way to exfiltrate whatever data you want? A browser vuln is about as bad as an OS vuln considering how much we use browsers for.
- School-Cotton 2y ago
  Am I too optimistic? I feel like most regular people I know wouldn’t sell this off. Most people are not antisocial criminals by nature, and also wouldn’t know how to contact a “state actor” even if they wanted to.
  - pityJuke 2y ago
    > also wouldn’t know how to contact a “state actor” even if they wanted to. That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.
    - apitman 2y ago

monroewalker 2y ago

Can we have Arc added to the title of the post to better alert people who use or know people who use the browser?

gcr 2y ago
Huge agree. I didn’t realize this applied to me the first time I saw this story yesterday. It was the rename that got me to click. Honestly I strongly feel the title should be “fundamental bug in Arc browser (CVE 123-4567)” or similar.

ahoef 2y ago

Nice article, but this is hard to read without proper capitalization. My brain uses capitals to scan beginning and ending of text.

michaelt 2y ago
If you were using Arc you could add a Boost for "Case: toggle between different capitalization settings - they will apply to all text on the webpage" [1] /s [1] https://resources.arc.net/hc/en-us/articles/19212718608151-Boosts-Customize-Any-Website https://resources.arc.net/hc/en-us/articles/19212718608151-B...
- ramonverse 2y ago
  this made me laugh. 10/10
- 63stack 2y ago
  Depending on the version you are using, you might not even need to add it, someone else might just add it for you!
Aachen 2y ago
I was similarly fascinated by the stylistic choices made here. No capitalisation of even any names, no hyphen in a compound adjective, but dots and commas and spaces are deemed necessary, also before "and" where the word clearly acts as separator already. If you look at the waveform of speech, we have no spaces between regular words so, if they want to eliminate unnecessary flourishes... though perhaps (since text largely lacks intonation markers) that makes it too unreadable compared to the other changes. All this is somehow at least as fascinating to me as the vulnerability being described!
- latexr 2y ago
  It’s just another dumb social media trend, like tYpiNg LiKe tHiS. Hopefully it too will phase out. Search for “lowercase trend” and you’ll find reports of it going years back, there’s nothing worth being fascinated about. It has seeped into HN as well. Look closely and you’ll notice several commenters type like that.

orliesaurus 2y ago

I wish we didn't have to sign up to use a browser in the future

sulandor 2y ago
just don't use browsers that do
soundnote 2y ago
With Brave you don't need to, even for sync.

bestest 2y ago

the developers working with firebase should enforce common-sense document crud restrictions in the rules. that's just how firebase is. everyone knows it. now, when talking about ARC BROWSER, i am seriously starting to doubt the competence of the team. I mean, if the rules are broken (no tests? no rules whatsoever?), what else is broken with ARC? are we to await a data leak from ARC? any browser recommendations with proper vertical tabs and basically everything working like it does in ARC?

fold3 2y ago
Did you took a look at the zen browser? It's an arc clone based on Firefox https://zen-browser.app/ https://zen-browser.app/
- bestest 2y ago
  nice. will probably try it in the future. but the for-some-reason-not-obvious revelation that it's just a product that some team somewhere is working on and the fact that a browser is an important piece of software brought me back to safari (not sure if joke's on me, but in this case I trust apple engineers to do a more thorough job in ensuring my data is secure).
- tomaskafka 2y ago
  I did. It’s like 20 % an Arc clone, and 80 % of UX papercuts. Like, you can’t have ‘add tab’ button on top when the new tab gets added to the bottom. Or that one sidebar button opens a side window to the right of the sidebar, while another below it opens the favorites to the left and moves the whole sidebar from underneath your mouse. Looks like a minimal effort css restyle of Firefox.
- currymj 2y ago
  i'm rooting for them to succeed, but if the concern is security, switching your daily driver browser to a brand-new browser that's still in alpha is unfortunately not a good idea.
  - 2y ago

jongjong 2y ago

This is a nice investigation and a great read. Sad that they don't normally do bug bounties. $2000 seems small considering the severity of this vulnerability. Though I guess the size and finances of the company is a factor. It takes some serious skills, effort and luck to discover something like that. It should be well compensated.

ainiriand 2y ago

Start -> Control Panel -> Programs and Features -> Search 'Arc' -> Uninstall.

erdinc 2y ago
...said Windows user.
- ainiriand 2y ago
  Even worse, to write the comment I had to ask ChatGPT how it works for windows...

whatevermom 2y ago

I’m ashamed I fell for Arc and even recommended it to my friends, as someone whose job is exactly this but with Android apps :(

efilife 2y ago
They claim so much and their browsers' code is 100% proprietary so it's impossiblen to verify their lies. This is what triggered the bullshit detector in my head
- latexr 2y ago
  > They claim so much and their browsers' code is 100% proprietary Far from me to defend Arc (I dislike it for several reasons) but it’s based on Chromium so it’s far from 100% proprietary. Don’t Edge, Vivaldi, and even Chrome have proprietary layers on top of the open-source Chromium?
  - soundnote 2y ago
    Vivaldi's inhouse UI code isn't open source, but is visible for users to verify AFAIK.

Borgz 2y ago

According to this article, Arc requires an account and sends Google's Firebase the hostname of every page you visit along with your user ID. Does this make Arc the least private web browser currently being used?

Saris 2y ago
When I downloaded it a few months ago and it required an account to even use it, my gut feeling was that I should just stick with Firefox.
causal 2y ago
I trashed Arc immediately after install when I found out having an account was mandatory. That seemed so silly, like toothbrushes-requiring-wifi absurd. How much moreso now.
- scblock 2y ago
  Truly. I was looking for a privacy respecting Chromium-based browser to use for Web MiniDisc (https://web.minidisc.wiki/ https://web.minidisc.wiki/) and came across some enthusiastic praise for Arc. I downloaded it and it immediately wanted me to create an account to even use it. How can that possibly respect my privacy? It went right in the trash.
  - timeon 2y ago
    What is also strange that I only found out about account after download. Like it was standard thing for the browser. (Sure there are optional accounts in others but login-walled browser?)
    - roywiggins 2y ago
      Windows is practically login-walled[0] at this point so I imagine people are slowly getting to expect it. [0] witness the magic incantations needed https://www.tomshardware.com/how-to/install-windows-11-without-microsoft-account https://www.tomshardware.com/how-to/install-windows-11-witho...

eru 2y ago

For context: what is this 'arc' that the blog post mentions? I presumes it's not Paul Graham's Lisp dialect in this context? EDIT: seems to be a browser or so?

flinth_ 2y ago
Yes it's a new browser who tries to change the UX from traditional browsers: https://arc.net/ https://arc.net/

maipen 2y ago

Very small bounty, but I honestly believe this arc thing won’t last long… Browsers are hard and my only choice has been chrome and will remain so for the long foreseeable future. When I was younger I would enjoy switching to firefox, opera, etc.. But I always came back to chrome because it just worked and always performed when I needed. Chrome/chromium is the safest browser. People tend to fall for the shiny new thing and then realize it was just hype. Please be very careful about what software you choose to perform most of your activities. The same applies to these “new ai IDEs” that keep popping up every other say.

appendix-rock 2y ago
…Firefox as an alternative to Chrome!? Am I really that old!? I used Chrome for years and years, right from when it first came out. Since then, I switched back to Firefox, and have used it for years. It works perfectly fine.
lcnPylGDnU4H9OF 2y ago
> Chrome/chromium is the safest browser. Why do you say that?
- creata 2y ago
  1. Chrome's security team has a very good reputation. 2. I don't know how accurate it is in 2024, but there are comparisons like https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... out there.
tomaskafka 2y ago
Browser is an user agent. Chrome is an advertisement company agent running on your PC, collecting data for that advertising company. People often confuse these two, but they’re the polar opposites.

__jonas 2y ago

The vulnerability has been patched, but I suppose the browser still makes a firebase query for every website you visit? That's pretty bad, whether or not they track these requests, just seems wasteful.

instagraham 2y ago

>privacy concerns >while researching, i saw some data being sent over to the server, like this query everytime you visit a site: > firebase .collection("boosts") .where("creatorID", "==", "UvMIUnuxJ2h0E47fmZPpHLisHn12") .where("hostPattern", "==", "www.google.com"); > the hostPattern being the site you visit, this is against arc's privacy policy which clearly states arc does not know which sites you visit.

83837jjddh 2y ago
[dead]
soared 2y ago
What sort of data does Arc track? Our plain-english Privacy Policy summarizes it well: We don’t know which websites you visit
- nfm 2y ago
  From the quoted snippet, every page load is leaking both the domain and authed user’s ID to Firebase.
  - Cthulhu_ 2y ago
    Yeah but if they super promise to not look at incoming Firebase queries they're not tracking you, right?
    - bschmidt1 2y ago
      The super promise died with crypto, now you have to add no backsies. My site uses No Backsies Proofs (NBPs) which are encrypted to prove that all my super promises are backed by a no backsie which is stored in the no backsie vault in Antarctica.
      - fouc 2y ago
        Later on moxie ends up writing a quick review of NBPs > Instead of storing the data on-chain, NBPs instead contain a URL that points to the data. What surprised me about the standards was that there’s no hash commitment for the data located at the URL. Looking at many of the NBPs on popular marketplaces being sold for tens, hundreds, or millions of dollars, that URL often just points to some VPS running Apache somewhere. Anyone with access to that machine, anyone who buys that domain name in the future, or anyone who compromises that machine can change the image, title, description, etc for the NBP to whatever they’d like at any time (regardless of whether or not they “own” the token). There’s nothing in the NBP spec that tells you what the image “should” be, or even allows you to confirm whether something is the “correct” image.

trallnag 2y ago

How could one sell a vulnerability like this to let's say Mossad? Write them an email?

who-shot-jr 2y ago
Page them :)
diggan 2y ago
https://www.mossad.gov.il/contact-us/en https://www.mossad.gov.il/contact-us/en Interestingly enough, contains a field for entering your Father's name (but not your mother's).
- trallnag 2y ago
  I assume this is similar to Russia where people get their father's name assigned as middle name

pknerd 2y ago

Man I miss these kinds of detective posts on HN

causal 2y ago
Upvote them, definitely something that makes HN special.

bmelton 2y ago

> i discovered that there was a arc featured called easels, easels > are a whiteboard like interface, and you can share them with people, > and they can view them on the web. when i clicked the share button > however, there was no requests in my mitmproxy instance, so whats > happening here? I first noticed this on a flight to Paris. I was building a Flutter app using Firestore, and tho I had not paid for the onboard wifi (I was doing local development) I was connected and all of my Firestore calls were succeeding. I thought this was novel, and assumed it was just something to do with websockets, so I switched to another, non-firebase-but-yes-websockets project and noticed it didn't work. At the time, I debated moving calls to Firebase just so that I could work for free while I was on flights, but realized the ROI wasn't remotely there. Glad to finally have someone else acknowledge it happening, and give some insight as to why.

nijave 2y ago
Some flights have a free tier of wifi that allows messaging apps. Google Voice and Google Hangouts usually work on those so wouldn't be surprised if some other Google services make it through.

deleted 2y ago

[deleted]

tomaskafka 2y ago

For some time I asked why doesn't Arc let me sync my passwords. After seeing this level of incompetence, I am happy they didn't attempt that. Yet.

hollywood_court 2y ago

Thank you for sharing this. I have been using Arc since the first week of beta. The fact that they don't even mentioned this bug/fix on any of their social media is quite alarming. I enjoyed my time with Arc, but I can't possibly see myself continuing to use it after the way they handled this.

Sakos 2y ago
Them acknowledging the issue, then fixing it within 28 hours isn't good enough for you? That kind of response makes me happy to continue using Arc.
- pixxel 2y ago
  [flagged]
  - sanex 2y ago
    A pleasant user experience?
  - Sakos 2y ago
    1) What's with the hostility? 2) What exactly do I deserve?
- tomaskafka 2y ago
  They afaik never said that they ‘fixed’ the issue where they’re sending Google your every visited url.
  - deleted 2y ago
    [deleted]
- chenmike 2y ago
  I'm in the same boat as GP. Was invited early, loved the Arc UX far more than any other browser. I've recommended it to many people. As many other comments have pointed out, this vulnerability is such a rookie mistake that I don't think I can trust them again after this without understanding what factors in their security/engineering culture led to it. Patching this one issue isn't enough.

phyllistine 2y ago

Yeah with this and the privacy zinger at the end its definitely time my monthlong experiment with arc comes to a close. Too bad that the thing theyre actually proud of, the tabbing UX, was actually really good.

exabrial 2y ago

I roasted them on HN when they announced their product: Browsing the interest should not require an account. Its an "HTML Client", absolutely absurd. Hopefully they sit down and reconsider their choices.

lemonberry 2y ago

Arc was recommended to me by a friend. I deleted upon finding out I needed an account to use it. The excuse Arc gives is in case you want to sync. I'm capable of opting into that.

timeon 2y ago
"in case" is good excuse if the account is optional. Which is not case here.

zachrip 2y ago

I just want to call out that there is a lot of blame put on firebase here in the comments but I think that's just people parroting stuff they don't actually know about (I don't use firebase, I have tried it out in the past though). This isn't some edge case or hard to solve thing in firebase, this is the easy stuff. The real issue here is that someone wrote an api that trusted the client to tell it who they were. At the end of the day this is an amateur mistake that likely took a 1 line diff to fix. Don't believe me? Check out the docs: https://firebase.google.com/docs/rules/rules-and-auth#cloud-firestore https://firebase.google.com/docs/rules/rules-and-auth#cloud-... - `request.auth` gives you the user id you need (`request.auth.uid`).

tr3ntg 2y ago
As someone with an app built on firebase, yes. As the author rightly points out, it's very easy to misconfigure, but basic security practices like these are highlighted in bright, bold warning text in the Firebase docs. Security rules are meant to be taken seriously, and it's your only line of defense.
- bichiliad 2y ago
  I think a system that makes it this easy to shoot yourself in the foot is probably not a great system. Documentation is important, and I'm glad it's clear and obvious, but humans make mistakes. You'd hope that the mistakes have less dire consequences.
- swatcoder 2y ago
  > bold warning text in the Firebase docs. Unfortunately, we currently have an industry where highly paid "engineers" unironically believe that their job can be done by reading/watching random tutorials, googling for StackOverflow answers, and pasting code from gists. Attentively reading documentation or developing a mental model of how your tools work so that you know how they are built to be handled does not make it on to any job listing bullet points. It presumably fell off the bottom in favor of team spirit or brand enthusiasm or whatever. How many tutorials, community answers, and gists do you think conveyed that warning?

mcpar-land 2y ago

Every single thing I've heard about Arc browser has been a massive red flag. Turns out it was even worse than I thought!

deleted 2y ago
[deleted]

tnorthcutt 2y ago

https://www.crunchbase.com/organization/the-browser-company/company_financials https://www.crunchbase.com/organization/the-browser-company/... > Total Funding Amount $68M the browser company normally does not do bug bounties, but for this catastrophic of a vuln, they decided to award me with $2,000 USD I'm struggling to put into words how disappointing I find this.

nicolasmontone 2y ago
This is 100% company culture, probably the ones that decide this kind of things are not technical or don't understand how important is this.
- ggregoire 2y ago
  They disclosed the vulnerability directly to the co-founder CTO. > the timeline for the vulnerability: > aug 25 5:48pm: got initial contact over signal (encrypted) with arc co-founder hursh > aug 25 6:02pm: vulnerability poc executed on hursh's arc account
gspencley 2y ago
I've got a different take. If they're in the VC phase, that means they are not self sufficient. The amount of funding that they've raised is no indication what-so-ever of a) how much of that funding has actually been realized / received b) what their overhead is and c) what their overall financial picture looks like. I do wish that more companies would take privacy and security seriously. And bug bounty programs are great. But they're not always within the budget of companies and the fact that they decided to award this security researcher regardless of having no such program is a massive win in my opinion and shows how much they value this particular contribution.
- tnorthcutt 2y ago
  Thanks for the reply! I think I disagree with you, mostly because it seems like this particular bug could have been company-destroying because of the potential reputation hit if it was exploited on a wide scale. But regardless, I appreciate your perspective and it gives me some stuff to consider I hadn't previously.

shermantanktop 2y ago

User identity must be derived from security context, typically at the edge of the system. But it’s so much easier for developers to think of userid as just another parameter, and they forget, and oops now they trust a random user-supplied parameter.

oefrha 2y ago

> firestore has a tendency to not abide by the system proxy settings in the Swift SDK for firebase, so going off my hunch, i wrote a frida script to dump the relevant calls. As someone who has done some reverse engineering of macOS apps but haven't used anything beyond Charles' macOS proxy feature, this looks very painful. Is there a proxy app that maybe acts as a VPN so that basically every HTTP request is guaranteed to go through it, so that you don't need to write a hundred lines of bespoke Frida just to capture requests? Edit: On second thought Proxifier should work for this purpose.

ibash 2y ago
mitmproxy.org can act as a wireguard vpn iirc
dongcarl 2y ago
To add to u/ibash's comment, mitmproxy correctly implements a macOS network extension: https://mitmproxy.org/posts/local-redirect/macos/ https://mitmproxy.org/posts/local-redirect/macos/ I assume you'll have to install a root cert in order to introspect HTTPS traffic though.

kfarr 2y ago

Instead of knee jerk firebase is bad, can we discuss how this could be abated properly with firebase rules for firestore? Is this the rule that was missing for arcs boosts or whatever object? ``` match /objects/{object} { // Allow create new object if user is authenticated allow create: if request.auth != null; // Allow update or delete document if user is owner of document allow update, delete: if request.auth.uid == resource.data.ownerUID } ```

deleted 2y ago
[deleted]

seanvelasco 2y ago

eva (kibty.town) and mr. bruh never disappoint!

deleted 2y ago

[deleted]

tech_ken 2y ago

Oop and I just convinced my wife and brother to move over :o Props to her, she asked about the security and privacy of the browser and I played it off with some fanboy propaganda. Lesson learned on that one. If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now?

diggan 2y ago
> If I only care about the vertical tabs, workspaces, and a (decent) mobile app are there any good equivalents right now? I use Firefox mostly because of Sideberry (which does vertical tree-style tabs) which also integrates with "containers", so you can have something similar to workspaces but more isolation. Otherwise there is also "profiles" that probably offer even more isolation between the different profiles.
jonjojojon 2y ago
Firefox with extensions? The current vertical tabs extensions are not nearly as nice, but Mozilla is working on native vertical tabs. Syncing and Workspaces are already better with Firefox then with Arc.
soundnote 2y ago
I just use Brave with a shitton of profiles. That does cause problems for mobile use since no Android browser dev has bothered with proper profiles or ability to install multiple copies of the browser, except for Google I guess.
creata 2y ago
I use Firefox with Sidebery for vertical (specifically, tree style) tabs, plus a userChrome.css to hide the native horizontal tabs. Firefox has mobile apps, and the Android app supports (some) browser extensions. It works, it's boring, and it doesn't try to shove gimmicky features in my face.
timeon 2y ago
Even in Safari, you can remove tabs from toolbar (but it is not possible to hide toolbar itself) and have them in sidebar - there are also tab groups. But experience is probably different.

treyd 2y ago

How is this "Arc boost" system not just a more limited ad-hoc version of what WebExtensions already provide?

ha470 2y ago

I’m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We’ve written up some technical details and how we’ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response https://arc.net/blog/CVE-2024-45489-incident-response. I'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here – everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.

nixosbestos 2y ago
So when there are near weekly reports of websites being compromised due to horrid Firebase configuration, did absolutely no one on your teams raise a red flag? Is there some super low-pri ticket that says "actually make sure we use ACLs on Firebase"?
markandrewj 2y ago
I would like to respectfully provide the suggestion of allowing for the use of Arc without being signed into an account. Although I understand browser/device sync is part of most modern browsers, and the value it provides, normally it is a choice to use this feature. Arc still provides a lot of attractive features, even without browser sync on.
rachofsunshine 2y ago
Comments further down are concerned that on each page load, you're sending both the URL and a(n identifiable?) user ID to TBC. You may want to comment on that, since I think it's reasonable to say that those of us using not-Chrome (I don't use Arc personally, but I'm definitely in the 1% of browser users) are likely to also be the sort of person concerned with privacy. Vulnerabilities happen, but sending browsing data seems like a deliberate design choice.
- mthoms 2y ago

cmsj 2y ago

I read this from another source and I was a substantial way into it before it became obvious what Arc is. Blog authors: stop assuming I know about the existence of every piece of software. (also maybe occasionally consider using the Shift key on your keyboard so you can capitalise things :)

deleted 2y ago
[deleted]

rockostrich 2y ago

It would be nice if I could download a version of the Arc browser with the cloud bits removed. I use it because of the UI/UX and pretty much ignore everything else. Really if there was a browser that let me keep organized spaces in a left panel plus create split screen views then it would immediately convince me to switch from Arc.

4dm1r4lg3n3r4l 2y ago
https://zen-browser.app/ https://zen-browser.app/
- rockostrich 2y ago
  I know about Zen and Floorp. For my day to day browsing Arc has: # Split screen tabs Zen and Floorp both have this but the UX for both is really clunky. Surely they'll improve but Arc felt like second nature. # Little Arcs As far as I know, neither Zen or Floorp have this feature and if they do then the UX is not as obvious as Arc. The UX around Little Arcs is almost perfect. If I click on a link, it opens as a modal that I can expand to its own tab if I need or dismiss by just clicking away. The same things happens in other apps so I don't lose context just because I wanted to look at a link quick. If I do want to bring that tab into a space then it's 1-2 clicks away. My only gripe with this is that the Little Arcs that are created from clicking links in other apps don't auto dismiss if you change focus but this might just be a setting I don't have configured. # Inset meetings/videos AFAIK neither has this feature either. Having videos that are playing just seamlessly pop-up picture-in-picture when navigating away from the video tab is useful enough but the meeting feature is key for me because my company uses Google Meet. I can navigate away from meetings to look-up info/check Slack/etc without losing focus on the meeting itself and getting back to the meeting tab or unmuting myself is 1 click away. Sure all of these things could probably be accomplished by browser extensions but I think the UI/UX within Arc is pretty tough to compete with.

Insanity 2y ago

Damn, that is bad. While I enjoyed reading through the write-up, I think a "summary section" at the top would have benefited me lol. Someone recently recommended Arc to me, I installed it on my macbook and then never actually used it when I realized there's no Linux version available, and I like a consistent browser experience across all my devices.

radicaldreamer 2y ago
You can use some Arc AI features to summarize it for you :)

deleted 2y ago

[deleted]

gsanderson 2y ago

Yikes. I tried Arc a while ago but switched back to Chrome. Quite glad I did now.

omertoast 2y ago

$2000 is an insult, good luck getting tips for your future vulns.

merco 2y ago

Great catch ! Also very cool to know a bit more about the tech they are using.

ARandomerDude 2y ago

I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain. I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug. But these people want to build a web browser, with all the security expertise and moral duty that implies?! Wow.

deleted 2y ago
[deleted]
bilater 2y ago
Can you explain how you could get someone else's user id? I get that this is still a big vulnerability but am trying to understand how that would happen.
- darthwalsh 2y ago
  It says in the article. If you share one of your snippets, or make/accept a friend request, that all uses the same id
  - bilater 2y ago
    ah gotcha thanks

aanet 2y ago

Fascinating vulnerability, and a fascinating way to catch it. Kudos. BTW, on Arc's website on "Security" there still is no mention of this vulnerability (as of 20th Sep 2024, 2:32 pm PT) Check it out - https://arc.net/security https://arc.net/security Apparently the company had contracted with one Latacora for "regular outside security reviews and trainings across a wide range of different systems". Elsewhere on the page, it says "Arc uses GCP Firebase for user authentication, storage for Notes & Easels, and Cloud Functions for certain application features like referral code generation. All data stored in Firebase is encrypted-at-rest by default."

radicaldreamer 2y ago
The security page explicitly claims that Arc doesn't log what you're doing, giving URLs as an example, but this vulnerability claims every URL is being sent up to Firebase.

nusl 2y ago

I’ve been using Arc since it was private, and I really like the browser. The company’s posture on this topic has pretty much made me drop it entirely. It’s beyond abysmal.

aucisson_masque 2y ago

That's how you ruin a company reputation. Not saying it is or not deserved, but how could anyone trust a browser that had such a big security fail. And what about all the other that have not been reported or may be exploited ? From now on, every time someone is going to suggest arc browser, there will be another one to remind everyone of that. That's going to be very difficult to overcome when your software already doesn't have that big of a market share.

voiceblue 2y ago
It's a little worse than that. From now on, blackhats will have a favorite #1 browser to pentest, at least for the next few weeks. And who's going to take the bet that they'll find nothing? Not me.

sergiotapia 2y ago

The firebases and the supabases of the world are crazy to me to build your company on. You are asking for trouble and anchoring your entire company on the health of one saas that is hooked into the foundational aspects of your application! also it's so incredibly easy to really fuck up and build something exploitable. are javascript devs really that afraid of doing things themselves to this extreme level?

bschmidt1 2y ago
What about S3, you don't really need a file storage provider either? > are javascript devs really that afraid You might be afraid of JS devs :P Anyway has nothing to do with language, even if it was a super c0ol Ruby-on-Rails app with Active Record and SQL db on a server you manage it's still common to have some stuff in NoSQL for fast access to live data, caches, logs, etc. Most companies at scale will have both SQL and NoSQL dbs in areas. So if you're already using S3 for files, code on GitHub, storing keys in 1Pass, why not use a Firebase or MongoDB for high traffic live data? Especially if they offer built-in scaling and geo deploy options. This scenario I laid out is kinda to your point of "don't anchor your entire company on it" - the only point I'm trying to add is that you can also use these tools without the company being "anchored" on it, and they could have still ran into the same issue as Arc.
- sergiotapia 2y ago
  I mentioned javascript because I mostly see that cohort jump feet first into services like firebase/supabase/clerk/vercel/etc.
  - bschmidt1 2y ago
    Vercel too?! What are you using for SSR + serverless, Amplify? Vercel seems pretty great for a React-centric app with a couple of one-off backend calls to cloud services, super convenient, deploy previews in GitHub etc. why not?

jrflowers 2y ago

It is troubling that the browser that cannot be used anonymously displayed questionable behavior adjacent to the mechanism that tells The Browser Company every time you are watching porn

anigbrowl 2y ago

Breakthrough technology, indeed.

Hexigonz 2y ago

I really enjoy Arc's approach to the browser interface, but I am kind of shocked that it requires firebase at all. It touts privacy, but we have to log in, and our data is being stored in a BAAS owned by Google. It would have been SO much simpler to make it so that data is owned by the user and stored on disk. At MOST, maybe a paid syncing feature would require an external database. A takeover path like this is a big deal, but as the author pointed out, you stored URL browsing data for boosts. "Privacy first" browser's are marketing jargon today, and that sucks.

JumpCrisscross 2y ago
> "Privacy first" browser's are marketing jargon today A glance at Arc's privacy policy makes it clear they aren't privacy anything [1]. (Contrast their device and product usage data sections with Kagi's [2].) [1] https://arc.net/privacy#what-personal-data-do-we-collect-and-how-do-we-collect-it https://arc.net/privacy#what-personal-data-do-we-collect-and... [2] https://help.kagi.com/orion/privacy-and-security/respecting-privacy.html https://help.kagi.com/orion/privacy-and-security/respecting-...
wraptile 2y ago
That has been the reason I've never given Arc a shot. It's unacceptable.

steve_adams_86 2y ago

I know Firebase is awesome for plenty of reasons. And I’m not disparaging anyone who works hard on it. There’s a ton of great software behind the product. Unfortunately it’s at the root of almost all of my career’s worst bugs and mistakes (not necessarily caused by me), and it seems like a bit of train wreck in the wrong hands. I’ve had to rescue several clients from it, and have migrated three pretty huge applications off of it now. I’m not sure what it is exactly. People really abuse the hell out of it.

deleted 2y ago
[deleted]

habosa 2y ago

I just want to say that Firebase security rules deny every operation by default. An empty rules file allows nothing. The devs that wrote these rules had to intentionally allow overly broad reads/writes to this part of their database in order to create this vulnerability. And this had to pass code review and automated testing. That’s not good, and it has nothing to do with their choice of tools.

isatty 2y ago

$2000 for remote exec on all their users even if it’s all 17 of them? Insultingly low.

soygem 2y ago

>proprietary chromium fork with aislop on top No thanks

hoothoot 2y ago

We looked into supporting Arc at work, unfortunately Arc is missing lots of basic security controls which are available in many other Chromium and non-Chromium browsers, these include: + The ability to enforce automatic updates + Ability to control which sites extensions/boots are installed on On top of this there seems to be no way to remove the requirement to have an account to use the browser, selectively choose what data is sent/sync'd from Arc, or disable basic features like Easel through which staff accidentally leak data. The UI for the browser is great, but Arc really needs to lay the groundwork for strong security controls or it'll struggle to gain (or even maintain) a foothold in the enterprise space.