Vulnerability in Hangouts Chat: how Electron makes open redirect great again
blog.bentkowski.info
blog.bentkowski.info
But to be fair, it also offers some great security capabilities, ala Chrome, like Content Security Policies and a seriously solid sandbox that has had untold (wo)man-centuries of work put into keeping it isolated from priveleged contexts.
Yes, you need to be very careful about stepping over the holy line, but this really isn’t that different from the kind of common sense barrier we’ve all learned to maintain between a web server and a browser client. If someone accidentally throws an API key into some browser js, you’re in trouble. This kind of mistake gets made sometimes (even at high levels) but for the most part, any serious developer will know how to enforce a hard line between the server and the client—it’s table stakes.
A simple approach for Electron is to keep the bulk of your application in a browser window with nodeIntegration: false and then set a strict CSP on the root html doc. In this way, most of your code and most of your dependencies will be isolated from the os and the network, and you can carefully whitelist the exceptions. That’s actually pretty damn hard to do yourself in a purely native app.
In short, if you take some time to learn best practices, you can make a pretty damn secure app with Electron. If you can’t be bothered, then yeah, your users will be in real danger, but they’d be in just as much (or more) danger if you made similar mistakes in native code.
I have tried to do a good job building a secure Electron app with EnvKey[1], a tool for managing configuration and secrets with end-to-end encryption. All the client-side code is open source[2] and has its security choices documented[3]. Feel free to take a peek if you’re interested in seeing a live example!
Oh, and since one’s perfect, please post an issue or a PR if you spot any problems. I will owe you a beer :)
Why then are you here defending Electron despite a similar foot gun that can only be avoided by "being good", much like C?
Seems contradictory to me.
The person who wrote this article seems more concern with phishing, but I don't think the RCE was as big of a leap as they think it was.
It is stories like this that kind of make me more of a curmudgeon, though. I feel like we are just finding new ways to retread old problems.
I’m surprised that Google didn’t see this coming though.
Personally I simply prefer to open those "apps" directly in my browser (you can even "pin" them). It saves a lot of RAM, you don't have such nasty security issues and most of the features are still there.
I've been seeing it everywhere after the Trump campaign, and after the 100th time I saw it, it started making me want to vomit.