jsnar

Electron is unsafe because it's based on outdated versions of Chromium: https://github.com/signalapp/Signal-Desktop/issues/1635

Signal desktop app is based on the insecure Electron runtime. See my report here: https://github.com/signalapp/Signal-Desktop/issues/1635

See here for the security issues published in Chrome stable releases in those versions:

https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googleblog.com/2017/09/stable-channel... https://chromereleases.googleblog.com/2017/10/stable-channel...

Electron makes things worse: it is not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

This doesn't make it safe -- consider a lower level library inside Chromium can be exploited when processing input data. Your chat app can be exploited by receiving a crafted image. This actually happened in image processing library and network library in Chromium.

submitted issue for this: https://github.com/WhisperSystems/Signal-Desktop/issues/1635

It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.

See here for the security issues published in Chrome stable releases in those versions:

https://chromereleases.googleblog.com/2017/07/stable-channel...

https://chromereleases.googleblog.com/2017/09/stable-channel...

https://chromereleases.googleblog.com/2017/10/stable-channel...

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

Electron could still be faulty: its multi process architecture makes application developer easier to write memory leaking code.

NW.js can run any Chrome Apps directly: http://nwjs.io