5 ms·

Google does actively prevent "embedded browser" apps - especially shady ones - from stealing Google passwords or other credentials https://security.googleblog.c

Google does actively prevent "embedded browser" apps - especially shady ones - from stealing Google passwords or other credentials https://security.googleblog.com/2019/04/better-protection-against-man-in-middle.html https://security.googleblog.com/2019/04/better-protection-ag... Electron is known to be affected: https://github.com/electron/electron/issues/22346#issuecomment-590413621 https://github.com/electron/electron/issues/22346#issuecomme... The author of Google Drive Desktop seems to be aware but I do not think anyone can win this race against Google: https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9fb5f16c49b34f05eec919edfbb001ad46bccd/src/javascripts/mainwindow.js#L59-L64 https://github.com/alexkim205/Google-Drive-Desktop/blob/bd9f...

CMay 6y ago
That only applies to the password, but the password wasn't really the concern. If you're signed in (no matter how you signed in), a modified browser has the same access to your account that you do with creative possibilities for abusing that. You can argue that if an app isn't trusted then there are other concerns with running it on your machine and that is true too, but some apps want to avoid being too suspect in order to maintain their installation as long as possible. Extra scrutiny in any scenario like this is good. :)