I am evaluating a vendor whose technology takes the following approach:
- My website asks user to install vendor's executable (EXE) on their machine. This EXE does operations that cannot be done in-browser
- EXE also starts a local web server on client's machine
- My website connects to 'exe.vendor-website.com'. This is a public domain, but its DNS resolves to 127.0.0.1 (I'm surprised DNS providers allow this). Vendor does this because it then allows them to make HTTPS connections to the local EXE web server (via https://exe.vendor-website.com)
Note this is a public production solution, not a development-only or intranet-only solution. Vendor used to use ActiveX, but switched once ActiveX stopped being supported.
I would like to understand what security/reliability holes may exist with the vendor's design.
- "Did the vendor embed the private key for exe.vendor-website.com in their executable" - yes, they implied this