Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #7

Infosec researchers question certificate stores bundled in Electron apps

Original: Uh, hey # infosec Fedi: Learning that every electron app out there ships with its own internal cert store makes me wonde

A cybersecurity discussion is under way after a commenter raised concerns that every Electron-based desktop application ships with its own internal certificate store. The worry is that these stores could contain unexpected or undocumented trusted keys, and that few people routinely audit them. Observers are asking whether anyone has made a habit of inspecting app-level cert stores for surprise additions, noting the keys would not even need to be weak to pose a risk.

Why now: The observation highlights a little-examined supply-chain and trust surface in widely used Electron applications, prompting debate among security practitioners.

Electroninfosec community

Open on mastodon →

Evidence

• Uh, hey # infosec Fedi: Learning that every electron app out there ships with its own internal cert store makes me wonder if anyone has made a routine of inspecting in-electron-app cert stores specifically for other surprise bonus keys. They don’t need to be weak keys, either,… · mhoye@cosocial.ca · 28

API: https://socialmediatrends-api.osmike.com/v1/trends/3519622