3 ms·

What is the security model for hardening a local application? I see this in the docs >Hashing important messages with a OTP salt, you are able to encrypt mess

What is the security model for hardening a local application? I see this in the docs >Hashing important messages with a OTP salt, you are able to encrypt messages between the user interface and the Rust backend. We are currently investigating the use of additional sources of entropy such as the amazing Infinite Noise TRNG. It reminds me of .net `SecureString`, which they then don't recommend using: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D... because it doesn't really provide any extra security anyway..

nim2020 6y ago
A local tauri binary that is optimally secured: - all assets are baked into the binary, not an ASAR or some kind of sidecar - uses minimal javascript obfuscation - disables console availability in the webview - detects if it has been invoked from command line and exits - uses a minimal CSP to prevent the webview from reaching out to unknown resources - uses an API acceptlist, to treeshake out any unneeded functionality - injects the code directly into the webview from rust, circumventing the need for a localhost server - communicates with the event API, which uses randomized handles for all events to prevent static attacks from knowing in advance what a function call will be - never relies on external resources like remote servers / CDNs - removes all println! macros from consumer side rust - uses the forthcoming signed updater system - has been audited with frida-trace on delegate platforms - probably a couple more I am forgetting
- 0xcoffee 6y ago
  It feels like there are good security measures mixed with 'bad' ones in here. It may be useful to focus more on the why, then the what. I see you are familiar with frida and know a thing about reverse engineering, so I assume you know that just like most local protectors, someone will just eventually write a wrapper that automatically bypasses all the 'security' measures. If we take electron as an example, why do I care that Tauri implements all these things, while electron doesn't. How does it make it more secure? Am I supposed to be worried someone is sitting in between my GUI and backend intercepting messages? Is this a common attack vector for electron? I'm really have a lot of questions why to put effort into developing all these things.
archgoon 6y ago
They discuss some features that they are adding https://tauri.studio/docs/about/security https://tauri.studio/docs/about/security Unfortunately, they don't explicitly say what their threat model is, but you may be able to infer it from their feature list. I am surprised they list "Decompilation is Difficult" as a feature. I'd be hesitant to rely on this for long.
c-smile 6y ago
Hard to speak about security when <input type="password"> is handled in a 3-rd party process with unknown telemetry settings.

nim2020 6y ago

A local tauri binary that is optimally secured: - all assets are baked into the binary, not an ASAR or some kind of sidecar - uses minimal javascript obfuscation - disables console availability in the webview - detects if it has been invoked from command line and exits - uses a minimal CSP to prevent the webview from reaching out to unknown resources - uses an API acceptlist, to treeshake out any unneeded functionality - injects the code directly into the webview from rust, circumventing the need for a localhost server - communicates with the event API, which uses randomized handles for all events to prevent static attacks from knowing in advance what a function call will be - never relies on external resources like remote servers / CDNs - removes all println! macros from consumer side rust - uses the forthcoming signed updater system - has been audited with frida-trace on delegate platforms - probably a couple more I am forgetting

0xcoffee 6y ago
It feels like there are good security measures mixed with 'bad' ones in here. It may be useful to focus more on the why, then the what. I see you are familiar with frida and know a thing about reverse engineering, so I assume you know that just like most local protectors, someone will just eventually write a wrapper that automatically bypasses all the 'security' measures. If we take electron as an example, why do I care that Tauri implements all these things, while electron doesn't. How does it make it more secure? Am I supposed to be worried someone is sitting in between my GUI and backend intercepting messages? Is this a common attack vector for electron? I'm really have a lot of questions why to put effort into developing all these things.

archgoon 6y ago

They discuss some features that they are adding https://tauri.studio/docs/about/security https://tauri.studio/docs/about/security Unfortunately, they don't explicitly say what their threat model is, but you may be able to infer it from their feature list. I am surprised they list "Decompilation is Difficult" as a feature. I'd be hesitant to rely on this for long.

c-smile 6y ago

Hard to speak about security when <input type="password"> is handled in a 3-rd party process with unknown telemetry settings.