4 ms·
I could be wrong but disagreeing with an article isn't really a reason to flag the submission. That analogy doesn't hold up, getting access to a network is usu
by smcleod 4y ago
I could be wrong but disagreeing with an article isn't really a reason to flag the submission.
That analogy doesn't hold up, getting access to a network is usually something done remotely - not by forced entry, with the amount of things running on a network it's only a matter of time until something gets owned, phones home and next thing you know you have someone with a shell on your network.
Electron has _serious_ security problems and as it's footprint grows so does the risk profile.
- josephcsible 4y agoA shell that's just on your network isn't good enough to exploit this. The attacker would need a shell on your computer, either running as you or as an administrative user. And given that, your data isn't safe anyway even if it weren't in cleartext.
- DemiGuru 4y agoWhat I think you're missing is the possibility of using these tokens as an attack vector in this case - social engineering. Impersonating a senior manager or a C level entity. So while on the surface you can say that the risk is minimal this can be damaging to a business provided you impersonate the "right" person.
- josephcsible 4y agoI'm not saying it's not a big deal if those tokens get stolen. I'm saying that if your tokens could get stolen this way, they could get stolen a different way even if they weren't stored in cleartext like this.