1

In light of the recent WPA2 KRACK exploit (which many device and operating system vendors have yet to address or patch), consider all Wi-Fi connections to be unencrypted for purposes of the question.

On 1 side of the question: a browser web app using enhanced (owner-identifying) HTTPS (shows up as a green lock icon in Firefox)

On the other side of the question: a designated purpose-built mobile device app for the same service using its own encryption and authentication scheme

Assume the developers and admins for both the browser app and the mobile app are competent and vigilant - flaws and exploits in both are detected and fixed quickly. The browser app developers have no control over the browser being used (except marking specific browsers as unsupported or blocking them completely).

Which one provides better safeguards against unauthorized decryption and eavesdropping? Intuitively the mobile app should have stronger safeguards than a browser app as there have been known attacks against HTTPS where the browser is tricked into using a weak encryption scheme (in the most egregious cases, dropping encryption completely for certain elements on the page). A mobile app shouldn't have this problem considering the developer can specify a strong encryption scheme on both the client and server.

  • 1
    If the developers of "both the browser app and the mobile app are competent", then both solutions protect equally well "against unauthorized decryption and eavesdropping". A correct implementation is a correct implementation and nobody will be able to tell you what provides longer lasting security. (If by "own encryption" you mean a self-invented encryption scheme, then that would obviously be less preferable.) – Arminius Nov 3 '17 at 18:29
  • 7
    As a rule of thumb, I'd always steer towards established and proven technologies. So I'd prefer HTTPS in a popular browser over a custom app solution. – Arminius Nov 3 '17 at 18:32
  • 3
    The options are not mutually exclusive. – Tobi Nary Nov 3 '17 at 18:51
  • 1
    https will be patched after your company goes bankrupt. – dandavis Nov 3 '17 at 21:01
  • there's 4 or 5 major, professional, well-funded teams with long resumes working on browser security, and that's just under the vendor's roof. In short, there likely several times as many folks working on web security as your whole development team, and you can use their work for free. Why anyone would want to yoke infosec to devs anymore than needed is puzzling; they screw things up, they don't understand sec, and it distracts from interface refinement. seperate concerns and stand on the shoulders of professional giants. if you want a newspaper ad, you don't need to buy a printing press... – dandavis Nov 4 '17 at 6:10
1

I think what you're asking for is whether Browser or Mobile App is more secure because HTTPS is used in both. Most mobile apps are similar to webpages and use JSON and Restful APIs. In that case, App is potentially more secure because you have more control on the client side, and you can use SSL Pining and the users can't be tricked with typosquating or something.

  • at the same time, other apps can read your stored data, whereas other sites can't read your cookies. apps are also more prone to escalation because they have perms webapps don't. lastly, apps are available to reverse-engineer offline, whereas on a web app you can rate-limit discovery and instantly "patch" issues. – dandavis Nov 3 '17 at 21:24
  • 1
    Actually on a non-rooted device, other apps cannot read your stored data because it's sandboxed. The client part of web apps can be reverse-engineered offline too (html,css,js). – Daniel Grover Nov 6 '17 at 15:08
0

Given the scenario that developers and admins are essentially perfect then there is nothing to choose between them. Both will more than likely use the same or equally strong methods to encrypt the data in transit and so will be equally secure.

If you are considering the green padlock as "enhanced" then that is a miniscule difference. It just means that the domain owner has paid more money to undergo a marginally more thorough check that they are who they say they are. It has no effect on the quality of the cryptography.

Perfect admins will know to configure servers not to use weak ciphers and to use HSTS. Perfect developers will know that developing their own crypto is incredibly difficult and that properly implementing HTTPS in the app is far easier and safer.

If I had to err on one side I would go for the browser as being marginally better. Browser vendors are getting more and more stringent about respecting certificate issues. In Chrome now you can no longer click through this type of warning. Whereas without some serious know-how the app could be entirely unencrypted and you could not tell. This has happened with some banking apps...you'd think they'd know better.

https://www.theregister.co.uk/2015/12/18/ios_banking_app_audit/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.