Keybase’s browser extension subverts its encryption
1–10 of 79 posts
Re: Keybase’s browser extension subverts its encryption
#2I have to say I am surprised and disappointed. Keybase has up until now been a shining example of doing crypto right but still accessible and easy to use. This decision falls strictly on the wrong side of the line of acceptable compromises.
> there were technical reasons why iframes didn’t work, though I forget the details
It could be that there is one or a couple of engineers at Keybase who made this decision and are also the same entity that replied to the bug bounty. It feels like they haven't thought it through properly or brought it up for proper discussion inside the organization. Let's hope that they remedy this and adjust their general approach to this if this gets enough attention.
On the other hand, even if this is addresses, unfortunately it's an indicator that other compromises in this category are done in other parts of Keybase.
Re: Keybase’s browser extension subverts its encryption
#3The keybase.io website offers a "Please send us feedback & bug reports" link[0]. As a keybase user, I intend to do so.
Re: Keybase’s browser extension subverts its encryption
#4Where do those quotes from Keybase come from? Private email?
Re: Keybase’s browser extension subverts its encryption
#5While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post.
The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch.
It is also strange that the author seems to feel the need to reinforce the sensationalism of this post by linking something completely unrelated to Keybase.
Also, where are the quotes on this post coming from? Where is the rest of the communication?
There is really nothing to see here.
[0] - "Initially, I planned to take a closer look at the crypto in Keybase, to see whether I can find weaknesses in their implementation. But that’s off the table now."
[1] - "But as experience shows (https://palant.de/2018/07/11/ftapi-secutransfer-the-secure-a...), the claim “end-to-end encryption” doesn’t automatically translate into a secure implementation."
Re: Keybase’s browser extension subverts its encryption
#6Re: Keybase’s browser extension subverts its encryption
#7While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to f…
The author is completely dismissing [0] the
entire product
Fool me once, shame on you; fool me twice...
Re: Keybase’s browser extension subverts its encryption
#8> Avoiding it is fairly easy, by isolating all of the extension’s user interface in an element.
Right, but if the social network website can modify the HTML that the Keybase extension is injecting, then surely it can also modify the iframe's URL to an attacker-controlled one? Or, for that matter, replace the event handler on the "Keybase Chat" button itself before it even gets clicked?
I'm not an extension developer, so there might be APIs available to extensions or restrictions on webpage JS that I'm not aware of, but I suspect the only secure way to do this (if you don't trust the page you're embedding in) might be to have the extension communicate with the native Keybase app, which then opens a chat window with the appropriate user, similar to how the 1Password browser extension works.
Re: Keybase’s browser extension subverts its encryption
#9While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to f…
The Keybase browser extension seems to be a first-party product from them on their site. If the guarantees they make about it are this misleading, then it feels harder to trust other things they say about their product.
Re: Keybase’s browser extension subverts its encryption
#10While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to f…
The author is completely dismissing [0] the entire product If he's looking for bug bounties (be it for cash, kudos, principles, or to see it fixed), and he finds a security bug and doesn't get a bounty, why would he keep looking? Fool me once, shame on you; fool me twice...
Keybase is clearly stating that it is infact not a bug, but an intentionally not implemented feature.