4 ms·

Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executin

Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executing code from remote sources. Electron gives those same capabilities to apps written in JavaScript.

ori_b 6y ago
Electron: The safety of desktop applications with the user experience of web applications.
- zeepzeep 6y ago
  So, worst of both worlds?
josteink 6y ago
> Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executing code from remote sources. Capability, sure. But more often than not, it is Electron-based applications which are happy to include remote scripts... Because that's often as easy or easier than vendoring your dependencies and bundling them. In practice, Electron apps probably poses a bigger security risk, at least for that threat-vector.
- ChrisLTD 6y ago
  On MacOS they could and should be sandboxed by the OS.
- kevingadd 6y ago
  For a while you could get persistent native code execution (effectively root) in Slack, Discord and Microsoft Teams by dropping a text file in a specific spot in AppData/homedir/etc. Didn't even need to be chmodded or anything, just drop the file there and the electron apps would run it at startup with full permissions. Really dramatically lowered the difficulty of running code on an end-user's machine, especially since that directory is writable by virtually anything, including an electron app you've XSS'd. I think all 3 have been patched to prevent that particular attack, but it's astonishing to me that electron apps don't seem to use any form of code signing. my HackerOne reports were all Out Of Scope, naturally, until parts of the attack got assigned CVEs later and someone else got the bug bounty :) At least it's fixed!
kevingadd 6y ago
Yes and no. Chrome does a ton of stuff to prevent foreign processes from messing with it, so exfiltrating your gmail session tokens or emails via a native app is very difficult. In a chrome extension? Laughably easy, tons of extensions have read/write access to all your gmail tabs because Google does nothing to warn users about how dangerous that permission is. The extension APIs are poorly designed such that you need that wildcard access for all sorts of things, too. They did eventually try to shut the barn door after the horse bolted by changing the wildcard permissions system to have manual domain filtering but I never saw them actually shut it off by default (doing so would break existing extensions). Maybe they will in Manifest v3 since they're perfectly happy breaking ad blockers.

ori_b 6y ago

Electron: The safety of desktop applications with the user experience of web applications.

zeepzeep 6y ago
So, worst of both worlds?

josteink 6y ago

> Let's give engineers more credit, here. The majority of desktop applications have the same capabilities, including writing all over your filesystem and executing code from remote sources. Capability, sure. But more often than not, it is Electron-based applications which are happy to include remote scripts... Because that's often as easy or easier than vendoring your dependencies and bundling them. In practice, Electron apps probably poses a bigger security risk, at least for that threat-vector.

ChrisLTD 6y ago
On MacOS they could and should be sandboxed by the OS.
kevingadd 6y ago
For a while you could get persistent native code execution (effectively root) in Slack, Discord and Microsoft Teams by dropping a text file in a specific spot in AppData/homedir/etc. Didn't even need to be chmodded or anything, just drop the file there and the electron apps would run it at startup with full permissions. Really dramatically lowered the difficulty of running code on an end-user's machine, especially since that directory is writable by virtually anything, including an electron app you've XSS'd. I think all 3 have been patched to prevent that particular attack, but it's astonishing to me that electron apps don't seem to use any form of code signing. my HackerOne reports were all Out Of Scope, naturally, until parts of the attack got assigned CVEs later and someone else got the bug bounty :) At least it's fixed!

kevingadd 6y ago

Yes and no. Chrome does a ton of stuff to prevent foreign processes from messing with it, so exfiltrating your gmail session tokens or emails via a native app is very difficult. In a chrome extension? Laughably easy, tons of extensions have read/write access to all your gmail tabs because Google does nothing to warn users about how dangerous that permission is. The extension APIs are poorly designed such that you need that wildcard access for all sorts of things, too. They did eventually try to shut the barn door after the horse bolted by changing the wildcard permissions system to have manual domain filtering but I never saw them actually shut it off by default (doing so would break existing extensions). Maybe they will in Manifest v3 since they're perfectly happy breaking ad blockers.