Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase’s browser extension subverts its encryption

palant.de

Post reply on HN
Print view View original

31–40 of 79 posts

Re: Keybase’s browser extension subverts its encryption

#31

Post by gjm11 »

MagnificentSpam wrote: post #28
lrvick wrote: post #13

Keybase also silently subverts smartcards for in-memory keys per my findings here: https://github.com/keybase/keybase-issues/issues/1946 In general I find Keybase to be a step forward in user experience and two steps backwards in terms of actual security. They just don't seem to care about the latter at all and have not demonstrated any cooperation with standards bodies like the OpenPGP working group where members ha…

What is up with this issue? https://github.com/keybase/client/issues/13560 Is that a normal thing to do on github?

Looks to me like someone posted spam and it got removed. And yes, unfortunately, that's a thing on github these days.

Re: Keybase’s browser extension subverts its encryption

#32

Post by eganist »

gjm11 wrote: post #31
MagnificentSpam wrote: post #28

Earlier quoted context omitted.

What is up with this issue? https://github.com/keybase/client/issues/13560 Is that a normal thing to do on github?

Looks to me like someone posted spam and it got removed. And yes, unfortunately, that's a thing on github these days.

Unless the title was lifted from another issue for the purpose of spam...

...this actually looks like a potential security weakness that was purged from the public space. (CWE-921)

Re: Keybase’s browser extension subverts its encryption

#33

Post by benatkin »

It seems like some analytics software like FullStory and possibly MixPanel would automatically log the messages.

I just signed up for keybase and was definitely steered towards installing the browser extension. I quickly uninstalled it because I found it annoying, though.

Re: Keybase’s browser extension subverts its encryption

#34

Post by palant »

pedroaraujo wrote: post #5

While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to f…

The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public.

The extension is very much an official Keybase product and recommended heavily on their end. Why should I waste more time on a product where valid security issues are being dismissed? It isn't even so much about not being paid, as: if they don't care about such edge cases subverting their end-to-end encryption, what do they care about?

Re: Keybase’s browser extension subverts its encryption

#35

Post by mirimir »

pedroaraujo wrote: post #5

While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to f…

The Chrome/Firefox extension is flagged "NEW" on the download page. If these allegations are correct, it ought to be clearly labeled as insecure. I'm quite disappointed.

And BTW, I also don't like the option to upload private keys. I mean, no sane person would ever do that. It's not that hard to copy keys to multiple devices, if that's really necessary for your work flow. Me, if I used mobile devices, I'd use dedicated keys, because those things are so readily pwned.

Re: Keybase’s browser extension subverts its encryption

#36

Post by ReverseCold »

giancarlostoro wrote: post #25
lrvick wrote: post #13

Keybase also silently subverts smartcards for in-memory keys per my findings here: https://github.com/keybase/keybase-issues/issues/1946 In general I find Keybase to be a step forward in user experience and two steps backwards in terms of actual security. They just don't seem to care about the latter at all and have not demonstrated any cooperation with standards bodies like the OpenPGP working group where members ha…

Have you tried / compared Wire[0] by chance? I love Wire cause it's simple, my only recommendation is to register from a browser on your desktop, it asks for your number on the phone app, but you don't need to register like that. I also like that you can delete your account and nuke everything. The back-end is open source as well. Though KeyBase gets the UI / UX factor perfect, I wish some hardcore crypto devs would…

Wire's apps feel slow and bloated on both desktop and mobile. Compared to Telegram, Wire is almost unusable.

Re: Keybase’s browser extension subverts its encryption

#37

Post by palant »

adambrenecki wrote: post #8

> Avoiding it is fairly easy, by isolating all of the extension’s user interface in an element. Right, but if the social network website can modify the HTML that the Keybase extension is injecting, then surely it can also modify the iframe's URL to an attacker-controlled one? Or, for that matter, replace the event handler on the "Keybase Chat" button itself before it even gets clicked? I'm not an extension developer,…

Yes, I didn't bother expanding this further. Spoofing Keybase UI would still be possible, but users would notice that their message doesn't get sent. Still, the only complete solution would be to delegate even the initial message to the app rather than asking uses to enter it on the webpage. Unfortunately, browsers don't let extensions open trusted UI at will...

Re: Keybase’s browser extension subverts its encryption

#39

Post by l_t »

MagnificentSpam wrote: post #28
lrvick wrote: post #13

Keybase also silently subverts smartcards for in-memory keys per my findings here: https://github.com/keybase/keybase-issues/issues/1946 In general I find Keybase to be a step forward in user experience and two steps backwards in terms of actual security. They just don't seem to care about the latter at all and have not demonstrated any cooperation with standards bodies like the OpenPGP working group where members ha…

What is up with this issue? https://github.com/keybase/client/issues/13560 Is that a normal thing to do on github?

Changing the title of an issue, presumably so it doesn't show up in search results? Deleting the body of the issue? Not leaving any explanation? Yeah, that doesn't seem normal to me. Can't say I approve.

Re: Keybase’s browser extension subverts its encryption

#40

Post by Shank »

lrvick wrote: post #15
Legogris wrote: post #2

I have to say I am surprised and disappointed. Keybase has up until now been a shining example of doing crypto right but still accessible and easy to use. This decision falls strictly on the wrong side of the line of acceptable compromises. > there were technical reasons why iframes didn’t work, though I forget the details It could be that there is one or a couple of engineers at Keybase who made this decision and ar…

Honest question: what makes you think they have -ever- done crypto right? As best I can tell they have rolled their own mostly closed source crypto solution from day 1.

TripleSec is open source and they’re basically doing a reference implementation from Applied Cryptography. You can see the details here: https://keybase.io/triplesec
Post reply on HN