How to use hterm from my browser, and is it just as secure as my regular terminal emulator?

Question

I just found the solution to a question that I posed in 2011: Is there a web app that provides a terminal emulator / secure interface to the bash shell? in a Chrome web store app called "secure shell". It says that it uses hterm, which is defined in the FAQ as:

"HTML Terminal", or hterm, is an xterm-compatible terminal emulator written entirely in JavaScript.

It is intended to be fast enough and correct enough to compete with native terminals such as xterm, gnome-terminal, konsole and Terminal.app.

hterm is only a terminal emulator. It does not provide SSH access (or any other text-based command) on its own.

Then is the web app just a way to access a terminal emulator through my web browser? Does it provide a secure link between my browser and my server? I gather that the answer is yes, because the FAQ says:

Secure Shell can make a direct connection to a standard sshd server on any port of the destination machine.

but the language is both sufficiently 'technical' and sufficiently vague that confirmation or explanation would be appreciated.

Answer 1

There are two pieces here, there is a terminal emulator called hterm and an ssh client.

For your question it's probably enough to think of a terminal emulator as the piece of software that displays the applications you're running. In this case, the application you're running is an SSH client using NaCl technology to run in your browser.

They are bundled together in the chrome addon because you need both pieces to have a fully functioning terminal environment.

I believe one of the ssh plugins in the chrome store is made by google. I don't know that the security of the application has been heavily vetted from a code-security standpoint, but there are no glaring problems with its approach: it's a real ssh client, running in the browser.

See this for a discussion of terminal emulators: http://en.wikipedia.org/wiki/Terminal_emulator

Answer 2

I think you are mixing up between the definition of secure and Secure Shell (SSH). The term "Secure Shell" is quite misleading, since your shell session might not necessarily be secure at all. The answer you got from the FAQ only shows that the web app can make a direct connection to the server that you intend to connect to, but nothing about how secure your session will be.

As for the web app itself, I have no guarantees regarding how it works, but reading from the FAQ, the web app "emulates" the environment of a terminal. It is not a standard terminal by itself and is only intended to create a somewhat fake environment, but have the same functions as a normal terminal.

Back to your question, if you want to use this web app, it is at your own risk regarding how secure it can be. The FAQ isn't promising anything with you on security right now. If you need further clarification, I suggest that you post your question on IT Security Q&A instead.