let's take a theoretical app that has both an installable version and a web version. I use it via my web browser or I can install the app.

What are the safety considerations for the host operating system given each option? is one safer than the other, or does the browser protect you more?

I guess I have always been under the impression that running the web app of a service is safer than installing it as if there was malicious code it is limited to the browser. But I wanted to know how realistic this is?

  • 2
    This question is a bit too much theoretical and lacks important real-life details which are relevant when evaluating the security. There is nothing known about the type of app, what features it has, how the "native" app is actually implemented (maybe just similar to the web app, but ships with its own browser or uses webview components) and what operating system is involved (i.e. do all native apps run as the same user as in windows or as different users as in Android). Based on this lack of information the question is too broad to answer. – Steffen Ullrich Apr 24 '19 at 4:33
  • Are you worried about a malicious application (i.e. a malicious app vs a malicious webpage), or about exploitation of a vulnerability in the app? – forest Apr 24 '19 at 5:57

The answer is - it depends on the application, and also depends on the threats you want to address.

In most cases, if you are running application in web your attack surface may be a smaller then in case of natively installed - easily because you run a process in a sandboxed environment (for example chrome sandboxes each tab), and you run less code in your web browser. This makes you more protected through the vendor because he would need to exploit the whole browser. That said you have different new vectors attacks like XSS or CSRF.

Not the answer you're looking for? Browse other questions tagged or ask your own question.