Is ngrok safe to use or can it be compromised?

落花浮王杯 提交于 2021-02-18 03:43:24

问题


Is ngrok a safe tool to use? I was reading a tutorial which recommended to use ngrok test API responses that I make to outside services that need to connect to my endpoints also.


回答1:


There is no source code available for Version 2.0, considering it started as an open source project in 2014. I am suspect of any code that opens a tunnel to my localhost from the cloud. Pretty scary stuff especially without source code!




回答2:


I found good rating, but vacuous information here:

http://www.scamadviser.com/is-ngrok.com-a-fake-site.html

The kicker for me is

https://developer.atlassian.com/blog/2015/05/secure-localhost-tunnels-with-ngrok/

where the Atlassian folks recommend it highly.

I think I am going to use it.




回答3:


It opens up a tunnel to your dev machine, which is partially secured by obscurity (a hard to guess subdomain), and can be further secured by requiring a password. But you're still opening yourself up to ngrok itself, and the company is completely opaque (no address, no employees, no business name, no LinkedIn presence; all I can find is that it has 1-10 employees and is private; not even sure what country its based in). On top of that the code is not open-sourced. No reason to think they're not legit, but not a lot of information available to build trust.

You may be able to use ngrok and other local tunnel services with more security by encrypting the traffic. See https://security.stackexchange.com/questions/177280/end-to-end-encryption-for-localtunnel-ngrok-setup/177357#177357 for more information.




回答4:


If anyone is concerning compromising their development environment, you can use Docker. There are many ngrok/docker projects but here is the one I chose: https://github.com/gtriggiano/ngrok-tunnel

for macOS, use "TARGET_HOST=docker.for.mac.localhost"



来源:https://stackoverflow.com/questions/36552950/is-ngrok-safe-to-use-or-can-it-be-compromised

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!