0

There is an advice instructing to use compiled apps instead of webapps, since the former can be checked against checksums, unlike the latter which is susceptible to Javascript code injection. E.g: use Protonmail email app instead of reading mail from protonmail.com.

Many similar questions have answers discouraging the use of other apps with Tor because it might leak info. Does this advice apply to include using apps over Tor? Is it a good security practice? and what possible fingerprints can such app obtain?


Assumptions:

  • Threat model: the same as the French activist that Protonmail gave the activist's IP address to Swiss Authorities.
  • Applications used are open-source.

1 Answer 1

0

Apps can obtain a lot about a user. I'd say that it's actually unwise to run it directly on the computer. Not only does it allow the adversary to live rent-free on your computer, but the adversary can just bypass your safeguards with much more leeway than measly javascript could ever do.

Javascript is usually used to break out of the browser sandbox, and then could be potentially used for a Remote Control Execution attack or install unwanted software. The real magic happens in the malicious code that is now in your system.

This is like putting a door in your metal wall and not expecting anyone to go into it.

Whoever told you this advice is either lying to you or listening to someone that is lying to them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .