News for hackers. Stuff that matters.

A comment on Keybase Browser Extension Insecure. Parent comment

Re:Keybase Browser Extension Insecure by wobblyasp on Sunday October 10, 2021 @12:58PM (#28819926)
Is there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page
[ Parent | on HN ]
Re:Keybase Browser Extension Insecure by akerl_ on Sunday October 10, 2021 @01:06PM (#28819992)
Per the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM
[ Parent | on HN ]
Re:Keybase Browser Extension Insecure by captn3m0 on Sunday October 10, 2021 @01:38PM (#28820312)
Other than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.
[ Parent | on HN ]