Hacker News Reader

Comment by smcleod | Hacker News Reader

Why was this flagged? It's interesting and a serious security risk.

Because it's not a serious security risk, and the article is deceptively making it sound like it is to get more clicks. Consider this: while you're at home asleep, do you keep your car keys locked in a safe, or do you leave them sitting on a table/dresser/nightstand? Most people do the latter, and it's not a serious security risk since the door into your house is locked.

I could be wrong but disagreeing with an article isn't really a reason to flag the submission.

That analogy doesn't hold up, getting access to a network is usually something done remotely - not by forced entry, with the amount of things running on a network it's only a matter of time until something gets owned, phones home and next thing you know you have someone with a shell on your network.

Electron has _serious_ security problems and as it's footprint grows so does the risk profile.

A shell that's just on your network isn't good enough to exploit this. The attacker would need a shell on your computer, either running as you or as an administrative user. And given that, your data isn't safe anyway even if it weren't in cleartext.

What I think you're missing is the possibility of using these tokens as an attack vector in this case - social engineering. Impersonating a senior manager or a C level entity. So while on the surface you can say that the risk is minimal this can be damaging to a business provided you impersonate the "right" person.

I'm not saying it's not a big deal if those tokens get stolen. I'm saying that if your tokens could get stolen this way, they could get stolen a different way even if they weren't stored in cleartext like this.

Reply on news.ycombinator.com