4 ms·

I hear this a lot and hence have the same feeling about node/electron but is there actually anything of substance when it comes to the lack security of Node/Ele

by mimsee 6y ago

I hear this a lot and hence have the same feeling about node/electron but is there actually anything of substance when it comes to the lack security of Node/Electron apps? Honestly curious.

chippy 6y ago
Node implies npm spaghetti / dependency vulnerabilities (e.g. left-pad) Electron I guess implies backdoors via binary blobs upstream?
jpangs88 6y ago
I feel like node/Electron are about as safe as chromium and it's npm packages that have lost everyone's confidence.
- _where 6y ago
  Is Chromium’s sandbox insecure? Electron has local file access, etc. in fact, it states: “Under no circumstances should you load and execute remote code with Node.js integration enabled.” So, Stealth should consider forking Electron if better sandboxing is needed. https://www.electronjs.org/docs/tutorial/security https://www.electronjs.org/docs/tutorial/security That doesn’t prevent it from being secure, though.
- dogma1138 6y ago
  Not exactly, the chromium/chrome sandbox isn’t dependent on how and what code you execute the electron/node one is and that is because the latter were designed to execute code across many more privilege levels than what “dedicated” browser needs. If I download and build chromium (as long as I don’t disable the sandbox altogether) I don’t actually need to think about those issues while I do need to do that with Electron.
deleted 6y ago
[deleted]
dogma1138 6y ago
Other posters have already pointed at some examples, it boils down to that you are taking in a relatively very large attack surface and one that is rather difficult to validate effectively and exhaustively.
rrdharan 6y ago
Electron lags chromium HEAD and mode+electron is a complicated architecture to secure correctly: https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni... https://github.com/minbrowser/min/issues/440 https://github.com/minbrowser/min/issues/440

by mimsee 6y ago

I hear this a lot and hence have the same feeling about node/electron but is there actually anything of substance when it comes to the lack security of Node/Electron apps? Honestly curious.

chippy 6y ago

Node implies npm spaghetti / dependency vulnerabilities (e.g. left-pad) Electron I guess implies backdoors via binary blobs upstream?

jpangs88 6y ago

I feel like node/Electron are about as safe as chromium and it's npm packages that have lost everyone's confidence.

_where 6y ago
Is Chromium’s sandbox insecure? Electron has local file access, etc. in fact, it states: “Under no circumstances should you load and execute remote code with Node.js integration enabled.” So, Stealth should consider forking Electron if better sandboxing is needed. https://www.electronjs.org/docs/tutorial/security https://www.electronjs.org/docs/tutorial/security That doesn’t prevent it from being secure, though.
dogma1138 6y ago
Not exactly, the chromium/chrome sandbox isn’t dependent on how and what code you execute the electron/node one is and that is because the latter were designed to execute code across many more privilege levels than what “dedicated” browser needs. If I download and build chromium (as long as I don’t disable the sandbox altogether) I don’t actually need to think about those issues while I do need to do that with Electron.

deleted 6y ago

[deleted]

dogma1138 6y ago

Other posters have already pointed at some examples, it boils down to that you are taking in a relatively very large attack surface and one that is rather difficult to validate effectively and exhaustively.

rrdharan 6y ago

Electron lags chromium HEAD and mode+electron is a complicated architecture to secure correctly: https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf https://www.blackhat.com/docs/us-17/thursday/us-17-Carettoni... https://github.com/minbrowser/min/issues/440 https://github.com/minbrowser/min/issues/440