Discussion about security implications for offline-only apps or apps that only load secure content

@reZach

as per my original post, and you were nice enough to offer insights, I would love to get clarification and your thoughts on the following.

Since Electron currently does NOT implement any security mechanism to protect the src code, it would be helpful for devs to get an explanation what security implications they are facing when changing certain recommended Electron settings.

Types of apps would include: (1) online only app (e.g. Slack) (2) app that connects to remote sources, but NOT to 3rd party sources, hence the app ONLY loads verified/validated content (3) offline only app (only loads local content)

Specifically, why is the contextIsolation setting “helpful” and/or “needed” for apps (2) and (3) ?

Thanks !

[reZach]

@reZach How about the case where you are writing a front end for a nodejs script that is normally run from the command line? In this case, it seems pointless to add any security measures as the whole point of the script was to directly access nodejs functionality, and the whole point of using Electron would be to create a nicer interface to the existing functionality. It seems like having to create a whole API would be a lot of extra unnecessary work as opposed to just dropping the existing code in. Am I missing something here?

@michael-ts I would still recommend executing the script on the backend of the Electron app, if nothing else as it allows for extensibility if you decide to distribute it to others in the future, besides adhering to the frameworks current best-practices. However if what I’m reading between the lines here is that it’s a tool for yourself as a QoL improvement, you would probably be fine dropping your script in an Electron app.

[petef19]

With contextIsolation:true, you can still “require” things your renderer process can use

the require fn is not available in renderer process w/ ctxIso enabled, i.e. u can NOT use require in index.html, at least as far as I’ve tested (please report if you find otherwise), but I believe that is one of the main points of ctxIso, to remove that…

In my opinion, I feel malicious users would choose to exploit the fact that contextIsolation is off before trying to decompile your app. But due to the fact that you say your content is encrypted and then evaluated, I think its more secure that your use of bytenode to encrypt the renderer/main process code instead of turning contextIsolation on.

this is the same conclusion we came to (for our specific use case). But in the other thread, and another dedicated one before that, it was all dismissed and it was hammered over and over that you need ctxIso and sandbox which completely exposes the dev’s code - zero protection. I was not debating the viability of these options, but rather was looking for elaboration/input for other use cases (such as ours), but all of this was dismissed w/ bogus, non-sense arguments.

ok, thanks for taking the time and chiming in, much appreciated. Always good to have another mind think through a specific use case.

And if anybody else wants to chime in, please do ! Def open to hear anybody else solution to how you protect your code in Electron !

Thanks !