Hacker News Reader

Comment by kijiki | Hacker News Reader

In-browser e2e encryption is vulnerable to targeted attacks on specific individuals.

The service (either intentionally or by virtue of being hacked) can serve up Javascript crypto code that either uploads plaintext, or subtly backdoors the crypto so it can be decrypted. And they can do this to just a single user, so unless you audit the Javascript every single time you load the page, you'd never know.

A signed app is more secure, because a backdoor would have to be distributed to everyone, greatly increasing the chances of it being discovered.

View on HN

I don't think I agree with you. Here's a way you could make it work: by downloading a signed index.html, and opening it locally in your favorite browser. If it loads anything from the outside, use subresource integrity[1] to make sure it's sane.

Furthermore, we're using their website to download the Desktop app, the binaries are neither signed by them nor by Apple (or macOS). So the threat model is "almost" the same here as a web app here except for:

* CSRF would not work on an Electron-based app.

* Trusting an Electron-based app is a one-time thing (close to a Trust-On-First-Use trust model). (thx Nik Kinkel for pointing that to me.)

[1]: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

A signed app is only more secure if they load absolutely no code remotely, otherwise they open up the same channels of attack.

That said, at least they have the option of closing that hole with the electron app.

> A signed app is only more secure if they load absolutely no code remotely

Which they don't. That's why it's not a web app.

Actually, an electron app is very close to the security model of a browser. The fact that they do not load code intentionally, does not solve the problem that electron is able to execute injected javascript.

you get rid of any CSRF from the get go.

That doesn't fit my personal threat model (dragnet surveillance), so I'd be happy to accept slightly lower security and use a web app. imo they should offer the option of both, but notify users on web that the Electron app is preferred because it's more secure.

Reply on news.ycombinator.com