Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I won't download your app. The web version is a-ok

0xsid.com

Post reply on HN
Print view View original

541–550 of 599 posts

Re: I won't download your app. The web version is a-ok

#541

Post by palata »

tennysont wrote: post #519
palata wrote: post #324

Earlier quoted context omitted.

> Web browser is a sandbox by default. So I take this is a security concern. How do you feel about the fact that when you open a webapp in your browser, you re-download that app code every time? That the server can send you a backdoor every single time, made just for you, and nobody else will ever know? And that you can't check the "hash" of the webapp, like you can with an app? On the other hand, an app is sandboxed…

I think the question is: where should the information barrier exist? A web browser puts a barrier between your OS and the company, while an app (potentially) puts a barrier between the client and the server. For security minded and source-available apps like Signal, the latter is the right choice. For low trust companies with no expectation of app/server separation, the former seems right.

One thing is that on mobile OSes (iOS and Android), the apps are sandboxed. It is wrong to say that they are not, I don't know what people believe. Programs are typically not sandboxed on desktop OSes (though they can be, but the user has to do something about it), but on mobile they most definitely are. That's part of the reason why the security models of iOS and Android are better than desktop OSes.

Just like you don't have to give access to your filesystem to a webapp (but you can), you don't have to give this access to an app.

The reason to like webapps better than mobile apps is, IMO, not security (again, IMO it's worse in terms of security). The reason could be that they want to rely on an open source tech stack (which iOS does not provide, but Android does!). But really my feeling is that it's often either uninformed or political (i.e. it feels like a strong statement against Google to refuse Android apps?). Which again is weird to me because Google controls the browsers development (via Chromium) just as much as they control the Android core (AOSP). People who are happy with chromium should be happy with GrapheneOS, I would say.

Re: I won't download your app. The web version is a-ok

#542

Post by palata »

leptons wrote: post #524
palata wrote: post #512

Earlier quoted context omitted.

> It would take about 15 minutes to create a browser extension that could make a hash of all the files loaded, to compare with other users with the extension installed You completely underestimate it. I am absolutely certain that you cannot create a browser extension that meaningfully solves this problem in 15 minutes. > Web applications are sandboxed in the web browser. Very little issue with that Except that when w…

>You completely underestimate it. I am absolutely certain that you cannot create a browser extension that meaningfully solves this problem in 15 minutes. You are absolutely wrong. I write browser extensions, I can spin up a new one in a minute, and the code to monitor and hash all resources loaded by a webpage is trivially easy to do. It would be simple to set up a server to allow comparing the hashes, in a POC. I'm…

> I'm not talking about making this a robust service that everyone can use

Right. So you cannot do it. Thank you.

> I'm also tired of this pointless internet interaction. Goodbye.

Seems to me that you don't enjoy discussing with people who behave like jerks, which I admittedly did, just for you). You may not have realised it, but you started it. I am happy to disagree in a respectful tone, but you broke it first. Maybe that's something to think about in your next totally meaningful internet interaction, though it sounds like you like telling others that you know better because you are older.

Re: I won't download your app. The web version is a-ok

#543

Post by graftak »

akshatjiwan wrote: post #21

That's my stance as well. Unless the website is completely broken or the devs force me to download the app by blocking features on the website I prefer the web. With responsive design becoming mainstream I'm fine with using my browser for 90% of my internet work. In some cases like Google docs it's painful to use the web version so I just use the app. EDIT: I wish they'd add a console to mobile web browsers though.

For iOS Safari there's a few extensions that do the trick, search the app store for “dev tools” and theres quite a few relevant results. Personally I use web inspector and it works as advertised.

Re: I won't download your app. The web version is a-ok

#544

Post by palata »

leptons wrote: post #525
palata wrote: post #513

Earlier quoted context omitted.

That is a problem with you not understanding how security works. > If you really wanted to be secure There is no such thing as "being really secure". There are threat models, and implementations that defend you against them. Because you can't prevent a bulldozer from destroying your front door does not mean that it is useless to ever lock it. Even your air-gapped example is wrong, because it means that you have to tr…

>That is a problem with you not understanding how security works. That's hilariously wrong. >There is no such thing as "being really secure". Sure there is. "Being really secure" isn't what I said at all, and it's a vague statement to make. You're reaching to create an internet argument, and I'm frankly bored of this, you're out of your depth. >Even your air-gapped example is wrong, because it means that you have to…

> I'm really tired of this pointless internet interaction. Goodbye.

Good, that was my goal. Next time maybe don't start it.

Re: I won't download your app. The web version is a-ok

#545

Post by The_President »

senordevnyc wrote: post #515
ChrisMarshallNY wrote: post #462

Earlier quoted context omitted.

Yeah, it's OK. I said that I wouldn't argue, and I'm sticking to that. Have a great day!

Just thought I'd help you understand how this works so you don't spread misinformation, but you too!

This remark is overly condescending.

Re: I won't download your app. The web version is a-ok

#546

Post by integralid »

antiframe wrote: post #488
scorpionfeet wrote: post #155

Earlier quoted context omitted.

My company corporate card requires an app because it has an Authenticator to access the website. I tried the ole “but I only have a flip phone” and they said there was no other option. The bastards forced my hand.

Why would the company only issue you a flip phone if the Authenticator the require doesn't run on it?

The company didn't issue any phone. They want GP to install authenticator on their private phone and GP tried to softly refuse by lying (I think) they only own a flip phone. It didn't work.

Re: I won't download your app. The web version is a-ok

#547

Post by integralid »

graemep wrote: post #539
scorpionfeet wrote: post #388

Earlier quoted context omitted.

Unapproved by the company.

So its their device you are using? otherwise how to they know what authenticator you are using? Most use the same standard.

Except Microsoft Authenticator. That's what my company uses and this is the only reason I ever use my work phone.

Re: I won't download your app. The web version is a-ok

#548

Post by asddubs »

chrneu wrote: post #494
AlBugdy wrote: post #413

Earlier quoted context omitted.

> I personally find the idea of doing homework on my phone horrifying but I suppose kids today are either used to it and comfortable with it, or they've simply never used a computer and don't know what they're missing. Though I'd wager they probably aren't comfortable typing on a keyboard. First hand from a couple of ~16 year olds I know. Definitely not a representative sample. Some know how to type at an acceptable…

My partner is a therapist and so I wind up in a lot of therapist groups and support groups for therapists. Many of them are youth therapists. I also coach kids and help coordinate youth athletics. My best friend is also a middle school teacher, along with his partner. So I think I have a decent grasp on where kids are at nowadays. At least in my area. Most people I know who work with kids agree that the majority of c…

It kind of sound to me like you're surrounded by a lot of people who will tell you stories about kids, but only the ones who are having problems. Either because there's a selection that happened before they even encountered the kids (being a therapist), or because there's just no reason to talk about the ones that are doing fine (teacher)

Re: I won't download your app. The web version is a-ok

#549

Post by mlrtime »

chrneu wrote: post #494
AlBugdy wrote: post #413

Earlier quoted context omitted.

> I personally find the idea of doing homework on my phone horrifying but I suppose kids today are either used to it and comfortable with it, or they've simply never used a computer and don't know what they're missing. Though I'd wager they probably aren't comfortable typing on a keyboard. First hand from a couple of ~16 year olds I know. Definitely not a representative sample. Some know how to type at an acceptable…

My partner is a therapist and so I wind up in a lot of therapist groups and support groups for therapists. Many of them are youth therapists. I also coach kids and help coordinate youth athletics. My best friend is also a middle school teacher, along with his partner. So I think I have a decent grasp on where kids are at nowadays. At least in my area. Most people I know who work with kids agree that the majority of c…

Interesting (I read this all) and wonder if it is a local issue vs a larger issue? Meaning are you seeing the influence of your local social economy class and how they parent?

I'm guessing this is a urban city area of upper middle class? I could be completely off.

Re: I won't download your app. The web version is a-ok

#550

Post by jcattle »

neutronicus wrote: post #168
dariosalvi78 wrote: post #148

Earlier quoted context omitted.

not even the older generations. My parents save files on the Whatsapp chat, and my father is one who bought the first IBM PC when it came out, so someone who has touched these things for decades (tho very superficially). I think that the software industry, especially operating systems, have completely failed to provide a balanced product between the overly bloated and messed up (Windows), the overly complicated (Linu…

> My parents save files on the Whatsapp chat That's becoming dangerously true of my wife and I as well, to be honest. The friction is just so much lower than Google Drive or whatever. As long as I handle it right away. It's just finding something from more than an hour ago that's intolerable.

Also, you usually have context for the file. Like "Hey, can you send me this blueberry crumble recipe?".

I do this quite frequently. I know which person knows, I know I've asked them before and usually a quick keyword search is enough to find whatever I'm looking for again.

So this thing has at least two more information points I can search for to pinpoint the file than a simple file on my PC. It tells me who, and more context on what.

Post reply on HN