5

In 2020, there are a lot of applications which have a web interface as well as "desktop apps." Such applications are either the same in functionality or very close. Three examples of this situation are the Slack, Discord, and Keeper Security applications. As a user, I am often left with a choice: Do I use the webapp in the browser, or do I download and install the desktop app?

In order to not be too vague, I'm not going to ask the question "which is more secure?" As this may not be possible to answer without a specific reference. However, there is truth to the fact that many of these applications are running on top of runtimes like Chrome, V8, Electron, Mono, etc.... For the purposes of this question, please assume that the app is of this style and not a "fully native" compiled app written directly in C or C++.

Ignoring any functionality differences (such as, I need the desktop app in order to do livestreaming), please list the general security implications of using the browser app vs desktop app.

For security reasons, why might I prefer to run the web in-browser version of the app rather than the desktop app and vice versa? One such implication could be, "exploitation in a browser-run web app would be limited to the tab's process, whereas in a desktop app, it could potentially access a greater scope" for example.

Improve this question
2
  • I am wondering if it is better to target a specific browser vs runtime/application with this question. It seems like the answer to this question could lead to discussion about which runtime is more/less vulnerable vs which browser is more/less vulnerable. I think in general browsers are more sandboxed then some of the runtimes you mentioned that have node integration, but that may not be a helpful answer.
    – iraleigh
    May 6, 2020 at 19:33
  • 1
    From my p.o.v, you've pretty much answered your own question in the last paragraph :) Browsers are such a huge attack surface in general, that a lot of work has gone / is going into making them secure. Container tabs in Firefox for instance, and private browsing mode are one facet. Another one is that Mozilla has apparently released a flatpak of Firefox 76, which reduces the browser's visibility to just ~/Downloads and almost nothing else. These kinds of mitigations will keep happening, and you can benefit from them simply by using a browser instead of an app.
    – user88917
    May 8, 2020 at 12:06

1 Answer 1

Reset to default
6

Installing a desktop application implies 100% trust in the service provider. It is the hypothetical security equivalent of them gaining privileged remote code execution on your web browser--a vanishingly rare security event. Proof of security concept: the provider can do significantly more to your device with the desktop app.

Trust has many facets; Discord and Slack are well known public companies, so it is unlikely that they will do something directly malicious, but you are also placing absolute faith in their security engineering practices. For example, they are chat apps handling user-generated content, and therefore vulnerable to attack. Do you trust Slack or Discord to provide equivalent security investment as Google does with Chrome? If they use a framework like Electron, do you trust them always to use best practices?

As a point of reference; on the desktop, I always use the browser-based clients for Discord and Slack, because I do not feel that the native applications provide enough added value. On mobile devices, I use the apps because they are worth it, and the app security model is more nuanced/sandboxed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .