# Electron apps vs website for services using E2EE?

**URL:** https://discuss.privacyguides.net/t/electron-apps-vs-website-for-services-using-e2ee/21467
**Category:** Questions
**Created:** 2024-10-13T01:18:16Z
**Posts:** 11

## Post 1 by @anon94009837 — 2024-10-13T01:18:16Z

Which risk seems greater?

The risk from an encryption-utilising application like Bitwarden (I use it sandboxed on MacOS) being an electron app or the risk of using the Bitwarden’s website and trusting the web server not to serve you malicious code?

---

## Post 2 by @Tally — 2024-10-13T01:26:03Z

> [@anon94009837](#):
>
> I use it sandboxed on MacOS

What’s your method for sandboxing Bitwarden?

---

## Post 3 by @anon94009837 — 2024-10-13T01:27:33Z

I downloaded it from the App Store. The .dmg file on their website isn’t sandboxed though.

---

## Post 4 by @anon94009837 — 2024-11-14T18:44:28Z

Bump because I’d like to hear thoughts on this. Good [discussion](https://github.com/secureblue/secureblue/issues/193) on the matter.

---

## Post 5 by @anon94009837 — 2024-11-14T18:46:27Z

Wouldn’t the electron app be using javascript to handle the encryption too as it is not a native app? So the only concern would be the malicious web server in both cases.

---

## Post 6 by @phnx — 2024-11-14T19:11:02Z

> [@anon94009837](#):
>
> Wouldn’t the electron app be using javascript to handle the encryption too as it is not a native app?

That logic tracks with me, but honestly, I’m not qualified to answer definitively.

* * *

I would probably use the Electron app given that it is able to leverage the macOS Keychain for storing secrets. It would also be the only choice if you want offline access to your passwords.

---

## Post 7 by @anon48875053 — 2024-11-14T19:12:00Z

Electron = dumpster fire.

---

## Post 8 by @anon94009837 — 2024-11-17T00:14:51Z

True, but for something like Proton, Tuta or Bitwarden, not using their electron apps would mean trusting the web server to not serve you malicious code as well in case the server is compromised.

---

## Post 11 by @asanyan — 2024-11-17T14:11:13Z

> [@Anon47486929](#):
>
> Electron apps don’t have [certificate pinning](https://github.com/electron/electron/pull/35526) so they also trust the transport layer and server. Electron is a glorified web-app.

But, as long as the encryption happens on the client and the server cannot update code running on the client, it (the server) shouldn’t be able to compromise you even if you were to get mitm’d, though ofc it depends on the app.

> [@anon94009837](#):
>
> The risk from an encryption-utilising application like Bitwarden (I use it sandboxed on MacOS

I’d use the electron app in a sandbox. Something like a cloud-password manager is something that needs to be very trusted anyway.