Keybase Browser Extension Insecure

Re:Keybase Browser Extension Insecure by akerl_ on Sunday October 10, 2021 @12:29PM (#28819684)

So why does Keybase inject the textbox there? Injecting an input for a secure chat app into an insecure location is going to make people who trust keybase misunderstand the security profile of that input.

[ Parent | on HN ]

Re:Keybase Browser Extension Insecure by wobblyasp on Sunday October 10, 2021 @12:58PM (#28819926)

Is there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page

[ Parent | on HN ]

Re:Keybase Browser Extension Insecure by akerl_ on Sunday October 10, 2021 @01:06PM (#28819992)

Per the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM

[ Parent | on HN ]

Re:Keybase Browser Extension Insecure by captn3m0 on Sunday October 10, 2021 @01:38PM (#28820312)

Other than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.

[ Parent | on HN ]