if you like to know about all the gory details of how we isolate apps from getting at any side channels, see this discussion which also includes a security audit by Cure53 https://delta.chat/en/2023-05-22-webxdc-security
And yes, it's maybe not perfect, but it's not just yet another web view that has arbitrary access. Also, even if an app manages to break isolation, it has no access to the social graph at all. See https://webxdc.org/docs/spec/selfAddr_and_selfName.html for what is exposed to apps from the messenger side.
Delta Chat
npub17g…ynrxn
2025-03-28 15:00:39 UTC
in reply to nevent1q…92f3
Author Public Key
npub17gpd02zrcswhzlwa7m9sz0tw76ylgncjy9xxa4ppkjzqyzhvygyqvynrxnSeen on
wss://relay.momostr.pinkPublished at
2025-03-28 15:00:39 UTCEvent JSON
{
"id": "6c6744b710c33489ba9bf429dd1ed247761e81b19f9bfe7db9ebd135401de60a",
"pubkey": "f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208",
"created_at": 1743174039,
"kind": 1,
"tags": [
[
"p",
"cfa4990670e555c3bbe1e0bbe5119e0025e9be1c369fd99951cb343d5ee52149"
],
[
"e",
"8359369d69ea65cbf4dedd87d00552b2af22b2b9ab57ed6cfa6e3acbaebeb1b0",
"",
"reply",
"4530f00100b651b3a777014201f90e79df16b9dadee4f404d6c691003ad56810"
],
[
"proxy",
"https://chaos.social/@delta/114240653860573617",
"web"
],
[
"p",
"4530f00100b651b3a777014201f90e79df16b9dadee4f404d6c691003ad56810"
],
[
"p",
"f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208"
],
[
"e",
"75b72e07f47e744a845e726698769c3ec73d9ef3d89bd782614e1a410e3facba",
"",
"root",
"f202d7a843c41d717dddf6cb013d6ef689f44f12214c6ed421b484020aec2208"
],
[
"proxy",
"https://chaos.social/users/delta/statuses/114240653860573617",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://chaos.social/users/delta/statuses/114240653860573617",
"pink.momostr"
],
[
"-"
]
],
"content": "if you like to know about all the gory details of how we isolate apps from getting at any side channels, see this discussion which also includes a security audit by Cure53 https://delta.chat/en/2023-05-22-webxdc-security\n\nAnd yes, it's maybe not perfect, but it's not just yet another web view that has arbitrary access. Also, even if an app manages to break isolation, it has no access to the social graph at all. See https://webxdc.org/docs/spec/selfAddr_and_selfName.html for what is exposed to apps from the messenger side.",
"sig": "38286a7636cea858b82e3396127853ca59bdb0270a47697a5fb726f148ed6072ceea20e57518921b14c888fd80d341c69dfc9b8eff7f2272df41bf37482486e2"
}