3

Is using Web Gmail over Gmail App is more safe, for example, see following options:

  • Android Google Chrome or Android App
  • Windows Google Chrome or Windows Universal App
  • MacOS Safari or MacOS App Store Application
  • iOS Safari or iOS App Store Application
  • Linux Google Chrome or Linux Desktop App?

Would that be true for other applications assuming that each app would store it's data in its own directory and use standard sandbox (on Linux there are more, on Windows mainly Universal Apps)?

For example, Google Maps for Linux is built using Epiphany which is using its own folder, and the sandbox can be added no problem.

This is to investigate if doing dedicated app for e.g. Windows, Linux, MacOS platform would provide more security over web browser, for example Banking Application.

  • An important consideration is whether the app will benefit from App-private storage. For example, on Windows, traditionally any app can access the data of any other app on the same user account. On Android, each app has its own private storage, which other apps cannot access by default. By bundling Windows/Mac/Linux (classical) and Android/iPad (app-private storage) together you are creating an overly broad question. – Bryan Field Oct 3 '16 at 14:30
  • It doesn't warrant its own answer, but I always perceive apps versus web interfaces more insecure by default if for no other reason than you can't easily see whether an app is even using encryption or not. There have been a few high-profile incidents where SSL was disabled in an app and nobody noticed for a while. – Ivan Oct 4 '16 at 16:11
5

It depends on what you mean by security... As soon an you use a dedicated mail application, you keep a copy of the messages on the local client. Said differently, you add an element on the chain and the global security of a chain is the one of its weakest element.

That being said, the security server side is just a username+password. So having a local copy does not really add weakeness, except for the physical security question. If you have a desktop in a correctly protected building, the question of a physical theft of mail is likely to be less important than the question of a physical intrusion. If you use a phone or a desktop that you carry with you, the risk of a physical theft is much higher, and you should considere using full disk encryption.

For the more general question, the response could vary. But anyway a multi tier application should have at least a presentation layer (web or app), a business layer and persistence layer. The business and persistence layer should be server side, and the kernel of the authorization rules should be implemented server side on the service layer. The authentication should be the same, and the protocol between client and server should use same level of protection (TLS or SSL) with server certificate and client authentication, so as for the mail, the main question will be the security of local data.

An do not forget, the weakest element on a security chain is often the user itself: the strongest password will not be able to protect your account if is is written on a postit at the bottom of the screen. The password container of most browser can be a major risk if it is not itself password protected, and the same rule applies to rich client applications.

  • Perhaps this is simply terminology but I don't think this: "the strongest password becomes ridiculously weak if is is written on a postit at the bottom of the screen" is correct. The password is not made more weak by writing it down. Leaving it written down is plain sight subjects you to a different kind of attacks/attackers but it doesn't make it any easier for someone to crack it with brute force or dictionary attacks. – JimmyJames Oct 4 '16 at 14:10
  • @JimmyJames: I agree with you but it was the best phrasing I could find. I try hard to write correct english but it is not my first language. What I meant is that as soon as the password is on the postit on the screen, the account is no longer protected. Could you suggest a better sentence, either in a comment or directly by editing my post? – Serge Ballesta Oct 4 '16 at 14:55
  • I guess the best description is that the password is 'exposed to physical access'. Actually, sticking it to the screen might be better than sticking it to the desk where it's in view of a camera. The severity of this depends on who has access to the screen. I don't think we are at the point where people are sneaking into homes to collect passwords off of stickies but I could be wrong. If you do this at home your kids, spouse, or roommate might peek at your email but they are unlikely to drain your bank account or sell your information (YMMV depending on who you hang around with.) – JimmyJames Oct 4 '16 at 15:10
  • @JimmyJames: is it better like that? – Serge Ballesta Oct 4 '16 at 15:39
  • I think it's more correct in terminology. I think the point is debatable for reasons I've already given. – JimmyJames Oct 4 '16 at 16:03
2

TL;DR There's more to think about if you go the app route vs browser only.


In either case, you'll have to consider the security of the application on the server side.

Web browsers and apps alike will still need to negotiate things like SSL / TLS. If you go the app-route, you'll need to account for the security of the application as well. Take into account issue like cert-pinning.

In general, designing the system to be accessed by web browser only, places 100% of the security on the backend; whereas, an app transfers some of the security risks to the application. Applications can also be reverse engineered to expose sensitive information so special care needs to be applied to the app development and secure coding guidelines become especially important (they are important regardless, but more so when they are provided to the user).

1

Specifically Gmail, or applications in general?

Going down the web route for an application means the app needs to be secured against the OWASP Top 10. e.g.

  • Session fixation
  • Cross site scripting
  • Cross site request forgery
  • Cookies sharing the Same Origin Policy for HTTPS and HTTP
  • Clickjacking

My point is the web is insecure by default, whereas a dedicated client application can be hardened to remove some of the insecurities that are present in adopting general web standards. That is, the client can be simpler in what it is doing, in that it will only be making API requests to the server, and is not mixing UI code with pure data. This does not mean it does not need to be written in a secure fashion, just that I believe there are fewer "gotchas" for developers to fall victim to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.