Security of simple client/server desktop app
The important thing you want to enforce is that only the same local user can see the hello world.

You're relying at least on the inability of any random user to


listen in on someone else's sockets.
read another user's files
otherwise learn the secret
execute random python code in your server
And the inability for a remote attacker to connect to your socket.


1, 2 and 4 depend how well you've secured your system (no privilege elevation or random suid files lying around). 4 also depends on the security of flask and the rest of your python stack.

Five can be broken, depending on how your firewall is configured (someone could use connection tracking to get your socket forwarded, even though it is bound to localhost). You'd be better off using unix domain sockets.

The second is broken, because you chmod the file only after you've written to it. That gives a window for the attacker to open the file. In fact the attacker could even write to the file and execute arbitrary commands, which is why you should never use os.system, and you should use urlparse to build the url.

The third is broken in two ways:


the secret appears in the process list
the server won't take the same time to compare strings that are mostly right and mostly wrong. The attacker can guess the length of the secret, and guess the secret letter by letter (timing attack).