undefined | Better HN

0 pointsswsieber8y ago0 comments

A signed app is only more secure if they load absolutely no code remotely, otherwise they open up the same channels of attack.

That said, at least they have the option of closing that hole with the electron app.

0 comments

lambda8y ago

> A signed app is only more secure if they load absolutely no code remotely

Which they don't. That's why it's not a web app.

JepZ8y ago

Actually, an electron app is very close to the security model of a browser. The fact that they do not load code intentionally, does not solve the problem that electron is able to execute injected javascript.

baby8y ago

you get rid of any CSRF from the get go.

j / k navigate · click thread line to collapse