7 ms·

I'm so glad. I trust running whatsapp.com, messenger.com, slack.com, discord.com, bluejeans.com, zoom.com etc.. I do not trust installing the Whatsapp app, slac

I'm so glad. I trust running whatsapp.com, messenger.com, slack.com, discord.com, bluejeans.com, zoom.com etc.. I do not trust installing the Whatsapp app, slack app, discord app, zoom app, or bluejeans app. In the browser I have control, native (at least on Windows) I don't. Those native apps, at least on windows, can basically do anything. Read my entire hard drive, scan my network, install a key logger, turn on my camera and mic, etc.... In the browser they can't

chronogram 6y ago
Indeed. They're sandboxed and you can alter the webapps in the browser. I mildly edit the CSS of most of the websites I frequently use over time with Stylus.
VWWHFSfQ 6y ago
As long as those apps will run in my web browser, I'll run them there. I don't install any of their "native" apps.. Although Google Meet is getting very difficult to run in Firefox. Crashes all the time.
- sneak 6y ago
  I ran into the issue recently where Zoom's web client wouldn't display my camera's correct aspect ratio. Their full client (on a burner laptop, don't trust them) had a setting to fix it.
- lrem 6y ago
  Works fine in my Firefox... And does Google even offer native PC apps any more? I work there and haven't heard of such a thing.
  - rplnt 6y ago
    Drive and Photos have native apps, for obvious reasons (sync).
- padenot 6y ago
  Can you give us a couple of these crashes, that you can find in about:crashes (with the date sometimes its easy to find the right one) ? If you send a link to padenot@mozilla.com I can have a look, I'm on the media team at Mozilla (that includes WebRTC). Thanks!
  - VWWHFSfQ 6y ago
    I'm going to try to capture a crash report and send it to you. I should note that it's not a "crash" -- it's just that I get immediately disconnected from the meeting when I have my video + audio on and then someone else joins. I'll try to get some repro steps and send to you!
- skrtskrt 6y ago
  Doesn't google meet not have a native app? We use Google Meet at work and using a browser to screen share a browser or IDE window seems to absolutely peg my CPU no matter which browser I use. I have no love for Zoom but at least they have a desktop app so I can screen share without bogging down my whole machine
- Teknoman117 6y ago
  Google meet crashing is interesting. I use it literally every day for meetings and I run Firefox as my primary browser (on Linux though, if that matters). I can't recall ever having a crash from it.
4gotunameagain 6y ago
It's so frustrating that they deliberately make shitty web apps in order to force you to install an app on your phone (e.g. reddit, instagram) It should be illegal imo
- CyberRabbi 6y ago
  Yeah I agree with the spirit of that. There should be a name for that practice, something that makes it sound as bad as it is but catchy. Maybe, something like webhostaging. Reddit’s webapp on mobile is notorious for webhostaging you into downloading their native app. It’s literally unusable. There should also be a name for ostensibly public social media sites that webhostage you into signing up. Instagram comes to mind. It’s a reprehensible dark pattern.
  - egeozcan 6y ago
    Maybe webhijacking? Maybe I should purchase a domain and document it... Who knows, maybe it catches on and people start linking to it.
    - CyberRabbi 6y ago
      Yes there needs to be a single use site for this. Everyone is familiar with this , it just needs a catchy name so people on Twitter spread this and easily shame websites en masse for doing it. Webhijacking is too similar to webjacking IMO https://www.geeksforgeeks.org/web-jacking/ https://www.geeksforgeeks.org/web-jacking/
      - egeozcan 6y ago
        I knew it sounded familiar from somewhere, thanks! :)
  - Y_Y 6y ago
    "webhostaging" is a much catchier name than the other suggestions in sibling comments, I think, and more memorable because it sounds weird (a bit like "webhosting"?). It's so clever I think I'll start using it, and also telling people I came up with it by myself.
tjoff 6y ago
Yeah, lucky you for running six(!) different messaging apps that you do do not trust. The future is just tragic.
mavhc 6y ago
whatsapp, messenger, slack and discord are all just electron, so almost identical anyway. Zoom has extra desktop features. Teams is has slightly more stuff on desktop, and it's electron.
- lokedhs 6y ago
  Unless you're on Linux. Teams web application allows you to share individual windows, but this feature is now available in the application.
gingerlime 6y ago
I wonder if it’s possible to install an ad blocker, at least on the electron-based apps? and regain that control?
- input_sh 6y ago
  CSS-based, no. But you can put your computer behind Pi-hole or add some of Pi-hole's lists to your hosts file, which would prevent them from communicating with tracking domains completely... unless they also bundle some sort of a proxy or a VPN.
  - gingerlime 6y ago
    Yeah, I'm already using nextdns, but not sure it's enough in some cases...
vplaunch 6y ago
They can't? There's a setting in Firefox "Block new requests asking to access your camera" that you have to enable explicitly. I'd rather have a browser that cannot access these things at all. Now I've to hope that the permissions work and the implementation is bug-free (my trust in that is quite low, browsers are too large).
- randallsquared 6y ago
  If you don't select that setting, is the default to always allow, or ask every time? If the latter, then the setting is just a convenience for those who always expect to select "deny", rather than any broadening of permissions.
pabs3 6y ago
I'd much rather open source native apps than open source or proprietary web apps (or proprietary native apps).
toastal 6y ago
It's a shame Firefox just ditched the SSB project instead of fixing the bugs and making it visible for PWA use. They say it's because people weren't using it, but it was another thing that was hidden behind about:config and had some glaring bugs which two strong reasons why people probably weren't using or even know about it.
dreamer7 6y ago
I completely agree. MacOS, atleast since Catalina, has been seeking more specific permissions for apps which is good. One particular video conferencing software asked for permission to read key strokes from any process! A very weird request. The only non-nefarious use case I can think of is that they want to allow keyboard shortcuts to work even when their app isn't in the foreground.
- jefftk 6y ago
  Another potential non-nefarious use case would be to make push to talk work when it's not in the foreground?
  - dreamer7 6y ago
    That seems really problematic though. I could be on a text editor, or the terminal or anywhere else requiring text input and might not be expecting this behaviour.
    - jefftk 6y ago
      Sorry, I edited my comment not to say spacebar, since space clearly wouldn't work. On the other hand, you might be able to do it with some key or combination that is less commonly used?
      - aleclarsoniv 6y ago
        I don't get why Apple doesn't provide an API for registering global key bindings. All it needs is user permission for a binding to be registered, and some kind of preference pane that shows you an overview of registered bindings.
        CamJN 6y ago
        They do.
danenania 6y ago
It’s true that installing a native app requires a lot of trust, but on the other side of the coin, it’s not currently possible to do end-to-end encryption securely in a web app, and content in web apps is vulnerable to browser extensions with blanket permissions (there are many ubiquitous ones). Web apps also don’t have access to the OS keychain or any ability to set file permissions, meaning they can’t store local data securely without help from a server. So if you want real data privacy, you need a native app, despite the drawbacks you point out.
- dillondoyle 6y ago
  You probably could with WASM? Totally create your own stack 100%. And there are already encrypted media streams but I don't know if that counts as E2E? A lot of these 'native' apps are just web browsers anyways...
  - danenania 6y ago
    The key difference is running a signed, static bundle of code (or binary), rather than a bunch of code that is loaded dynamically from a server on every request, which can be modified without leaving any trace. So running WASM wouldn't make any difference if you're relying on a server to deliver you that WASM on every request. A compromised (or subpoenaed) server could simply ship you a compromised WASM payload for a single request and you'd be extremely unlikely to ever find out. If Signal wanted to add a backdoor, otoh, they'd need to ship it as a signed update to all their users, with all the reputation risk that entails. Whether a native app is simply a browser underneath doesn't matter, just how the code gets delivered to the user. Even a browser extension or chrome app could work, since they are run from a signed, static bundle rather than from a server. Encrypted media streams seem like a DRM feature? I don't think they have any relevance to end-to-end encryption.

chronogram 6y ago

Indeed. They're sandboxed and you can alter the webapps in the browser. I mildly edit the CSS of most of the websites I frequently use over time with Stylus.

VWWHFSfQ 6y ago

As long as those apps will run in my web browser, I'll run them there. I don't install any of their "native" apps.. Although Google Meet is getting very difficult to run in Firefox. Crashes all the time.

sneak 6y ago
I ran into the issue recently where Zoom's web client wouldn't display my camera's correct aspect ratio. Their full client (on a burner laptop, don't trust them) had a setting to fix it.
lrem 6y ago
Works fine in my Firefox... And does Google even offer native PC apps any more? I work there and haven't heard of such a thing.
- rplnt 6y ago
  Drive and Photos have native apps, for obvious reasons (sync).
padenot 6y ago
Can you give us a couple of these crashes, that you can find in about:crashes (with the date sometimes its easy to find the right one) ? If you send a link to padenot@mozilla.com I can have a look, I'm on the media team at Mozilla (that includes WebRTC). Thanks!
- VWWHFSfQ 6y ago
  I'm going to try to capture a crash report and send it to you. I should note that it's not a "crash" -- it's just that I get immediately disconnected from the meeting when I have my video + audio on and then someone else joins. I'll try to get some repro steps and send to you!
skrtskrt 6y ago
Doesn't google meet not have a native app? We use Google Meet at work and using a browser to screen share a browser or IDE window seems to absolutely peg my CPU no matter which browser I use. I have no love for Zoom but at least they have a desktop app so I can screen share without bogging down my whole machine
Teknoman117 6y ago
Google meet crashing is interesting. I use it literally every day for meetings and I run Firefox as my primary browser (on Linux though, if that matters). I can't recall ever having a crash from it.

4gotunameagain 6y ago

It's so frustrating that they deliberately make shitty web apps in order to force you to install an app on your phone (e.g. reddit, instagram) It should be illegal imo

CyberRabbi 6y ago
Yeah I agree with the spirit of that. There should be a name for that practice, something that makes it sound as bad as it is but catchy. Maybe, something like webhostaging. Reddit’s webapp on mobile is notorious for webhostaging you into downloading their native app. It’s literally unusable. There should also be a name for ostensibly public social media sites that webhostage you into signing up. Instagram comes to mind. It’s a reprehensible dark pattern.
- egeozcan 6y ago
  Maybe webhijacking? Maybe I should purchase a domain and document it... Who knows, maybe it catches on and people start linking to it.
  - CyberRabbi 6y ago
    Yes there needs to be a single use site for this. Everyone is familiar with this , it just needs a catchy name so people on Twitter spread this and easily shame websites en masse for doing it. Webhijacking is too similar to webjacking IMO https://www.geeksforgeeks.org/web-jacking/ https://www.geeksforgeeks.org/web-jacking/
    - egeozcan 6y ago
      I knew it sounded familiar from somewhere, thanks! :)
- Y_Y 6y ago
  "webhostaging" is a much catchier name than the other suggestions in sibling comments, I think, and more memorable because it sounds weird (a bit like "webhosting"?). It's so clever I think I'll start using it, and also telling people I came up with it by myself.

tjoff 6y ago

Yeah, lucky you for running six(!) different messaging apps that you do do not trust. The future is just tragic.

mavhc 6y ago

whatsapp, messenger, slack and discord are all just electron, so almost identical anyway. Zoom has extra desktop features. Teams is has slightly more stuff on desktop, and it's electron.

lokedhs 6y ago
Unless you're on Linux. Teams web application allows you to share individual windows, but this feature is now available in the application.

gingerlime 6y ago

I wonder if it’s possible to install an ad blocker, at least on the electron-based apps? and regain that control?

input_sh 6y ago
CSS-based, no. But you can put your computer behind Pi-hole or add some of Pi-hole's lists to your hosts file, which would prevent them from communicating with tracking domains completely... unless they also bundle some sort of a proxy or a VPN.
- gingerlime 6y ago
  Yeah, I'm already using nextdns, but not sure it's enough in some cases...

vplaunch 6y ago

They can't? There's a setting in Firefox "Block new requests asking to access your camera" that you have to enable explicitly. I'd rather have a browser that cannot access these things at all. Now I've to hope that the permissions work and the implementation is bug-free (my trust in that is quite low, browsers are too large).

randallsquared 6y ago
If you don't select that setting, is the default to always allow, or ask every time? If the latter, then the setting is just a convenience for those who always expect to select "deny", rather than any broadening of permissions.

pabs3 6y ago

I'd much rather open source native apps than open source or proprietary web apps (or proprietary native apps).

toastal 6y ago

It's a shame Firefox just ditched the SSB project instead of fixing the bugs and making it visible for PWA use. They say it's because people weren't using it, but it was another thing that was hidden behind about:config and had some glaring bugs which two strong reasons why people probably weren't using or even know about it.

dreamer7 6y ago

I completely agree. MacOS, atleast since Catalina, has been seeking more specific permissions for apps which is good. One particular video conferencing software asked for permission to read key strokes from any process! A very weird request. The only non-nefarious use case I can think of is that they want to allow keyboard shortcuts to work even when their app isn't in the foreground.

jefftk 6y ago
Another potential non-nefarious use case would be to make push to talk work when it's not in the foreground?
- dreamer7 6y ago
  That seems really problematic though. I could be on a text editor, or the terminal or anywhere else requiring text input and might not be expecting this behaviour.
  - jefftk 6y ago
    Sorry, I edited my comment not to say spacebar, since space clearly wouldn't work. On the other hand, you might be able to do it with some key or combination that is less commonly used?
    - aleclarsoniv 6y ago
      I don't get why Apple doesn't provide an API for registering global key bindings. All it needs is user permission for a binding to be registered, and some kind of preference pane that shows you an overview of registered bindings.
      - CamJN 6y ago
        They do.

danenania 6y ago

It’s true that installing a native app requires a lot of trust, but on the other side of the coin, it’s not currently possible to do end-to-end encryption securely in a web app, and content in web apps is vulnerable to browser extensions with blanket permissions (there are many ubiquitous ones). Web apps also don’t have access to the OS keychain or any ability to set file permissions, meaning they can’t store local data securely without help from a server. So if you want real data privacy, you need a native app, despite the drawbacks you point out.

dillondoyle 6y ago
You probably could with WASM? Totally create your own stack 100%. And there are already encrypted media streams but I don't know if that counts as E2E? A lot of these 'native' apps are just web browsers anyways...
- danenania 6y ago
  The key difference is running a signed, static bundle of code (or binary), rather than a bunch of code that is loaded dynamically from a server on every request, which can be modified without leaving any trace. So running WASM wouldn't make any difference if you're relying on a server to deliver you that WASM on every request. A compromised (or subpoenaed) server could simply ship you a compromised WASM payload for a single request and you'd be extremely unlikely to ever find out. If Signal wanted to add a backdoor, otoh, they'd need to ship it as a signed update to all their users, with all the reputation risk that entails. Whether a native app is simply a browser underneath doesn't matter, just how the code gets delivered to the user. Even a browser extension or chrome app could work, since they are run from a signed, static bundle rather than from a server. Encrypted media streams seem like a DRM feature? I don't think they have any relevance to end-to-end encryption.