Hacker News Reader

There absolutely is, it's called native messaging hosts. It allows webextensions in your browser to talk to executables installed on your local machine. The locally-installed application simply needs to install their appropriate extension in your browser.

View on HN

Yes, that was their first iteration. If you think that this went any better than communicating via a local web server, well… https://palant.info/2023/01/09/touchen-nxkey-the-keylogging-...

That isn't the fault of the native messaging host transport mechanism though. I'm just saying there are transport alternatives that are more secure than the Root CA installation nonsense the apps in your submission employ.

Neither are applications doing root CA installatin nonsense a fault of communication via a local web server. HTTPS isn’t required here, but they either have this hack in place for compatibility with decade old browsers – or they simply failed to revisit it.

Reply on news.ycombinator.com