Electron, we have a problem

Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine. I’ve compiled a list of notable Electron apps, installed them in a lab, and test which still trust the eMudhra certs, compared to whether they verify update signatures. You can find the full table of apps on my post. submitted by /u/pascalschaerli [link] [comments]Technical Information Security Content & DiscussionRead More