0

In a talk from Moxie Marlinspike he mentioned that Signal does not intend to release a web application because they are impossible to audit. The javascript code is retrieved on each page load, so it would be trivial to send malicious code that gathers the users keys once in a while without the users noticing.

Why is this not an issue for Password Managers that have a web application, like LastPass or bitwarden? It seems like they should have the same issue, but I guess the customers need to trust them to not take their data?

3
  • 2
    "Why is this not an issue for Password Managers that have a web application" - who claims that this is not an issue there? But it might be considered an acceptable risk. Commented Jun 11, 2021 at 13:25
  • If he really said "impossible to audit" then he was speaking colloquially. Obviously, you can audit a web application. I think he just means that it is tough to do a good job since there can be a lot of code coming from various locations. How tough depends on the web app.
    – hft
    Commented Jun 11, 2021 at 17:00
  • @Gamer2015, can you please provide a link to the talk by Moxie that you referenced?
    – mti2935
    Commented Sep 18, 2023 at 23:28

1 Answer 1

3

Security is multi-dimensional. Delivering software as a web application has benefits and drawbacks.

Using software deployed as a web application requires total trust in the server, since the server can replace the code at any time. While browsers have some means to ensure the integrity of a webapp, these cannot protect against changes on the server itself. So anyone who controls the server could inject code that subverts the E2EE when the user accesses the page.

However, this ability to easily update the software can also be a benefit. For example, webapps allow security issues to be fixed very quickly – it's not necessary to download and install patches. Webapps can also be very convenient to use. If a security measure like password managers becomes more user-friendly, this could increase overall security. For example, I couldn't get myself to use a password manager until I opted for a convenient cloud-based solution, despite the additional risks of this.

So this depends a lot on the specific risk model of the user. I think that for a personal user, web-app based E2EE can be a good security tradeoff. And ultimately, a web app is not very different from auto-updating apps in practice. However, for an organization that does want to review the security-critical software they rely on, avoiding browser-based solutions and other auto-update strategies could be very important. I disagree with Signal here, and think that it should be the user's choice how they want to interact with the service. But Moxie's criticism is legitimate, and it's laudable that a security-sensitive service would discourage blind trust in that service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .