Regarding the arbitrary executable concern, there’s a huge advantage in the browser ecosystem that I think nullifies this particular concern.
The native messaging API is exclusively for web extensions/addons. Given all the security concerns with malware hijacking browsers via their extensions systems, for years all non-developer focused browsers have key signing requirements in the same manner as snap itself. E.G., for Firefox, you must upload the addon to Mozilla to review, who then give it the blessing to be distributed. Users will have guarantees from the package manager that the browser is trusted, meaning there’s keys involved the whole way.
This review process would ensure that there’s no other programs that would try to access KeepassXC’s manifest file, other than the official KeepassXC browser extensions themselves, and that extension is set up to have an explicit authentication mechanism to ensure that it’s talking to the real KeepassXC.
So in general, because we can say the files will only ever be used by KeepassXC’s own browser extension, we can ignore a theoretical attack from KeepassXC itself, that’s just the general aspect of trust in the publisher, and specifically, it’s trust in the publisher of the addon, which doesn’t relate to the snap side of the problem.
And it’s trust in the publisher then that I think merits this for autoconnection. KeepassXC is a password manager. My instance has quite literally all my passwords for every online account, bank accounts, my Snapcraft/Ubuntu One account, etc. It also has my SSH keys (since the app has functionality to manage SSH Agents).
Basically, there’s literally no need for an exploit to be required. The app could trivially send all of this decrypted to some hacker if it wanted to; the trust is that the app is built securely by trusted publishers.
As an extreme example, KeepassXC could trivially escalate itself to root on my PC by shipping an SSH client in the snap, taking my SSH key, and remotely logging in as root. I’d hope people agree that’s something they have trust wouldn’t ever be allowed to happen.
As such, given the UX improvements, and encouraging people to swap to adopting Password Managers to begin with, there’s no real practical security lost in my personal opinion in real world circumstances. The trust in this application is already immense and there’s cryptographic security & reviews on all sides to prevent that kind of tampering from being a real world concern. Meanwhile the usability improvements for the snapd ecosystem are there; including not having people Google how to work around it via running an external script (hopefully the official one, but can we be sure?).
