4 ms·

While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main

While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post. The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch. It is also strange that the author seems to feel the need to reinforce the sensationalism of this post by linking something completely unrelated to Keybase. Also, where are the quotes on this post coming from? Where is the rest of the communication? There is really nothing to see here. [0] - "Initially, I planned to take a closer look at the crypto in Keybase, to see whether I can find weaknesses in their implementation. But that’s off the table now." [1] - "But as experience shows (https://palant.de/2018/07/11/ftapi-secutransfer-the-secure-alternative-to-emails-not-quite https://palant.de/2018/07/11/ftapi-secutransfer-the-secure-a...), the claim “end-to-end encryption” doesn’t automatically translate into a secure implementation."

michaelt 8y ago
The author is completely dismissing [0] the entire product If he's looking for bug bounties (be it for cash, kudos, principles, or to see it fixed), and he finds a security bug and doesn't get a bounty, why would he keep looking? Fool me once, shame on you; fool me twice...
- DuckyC 8y ago
  Keybase is clearly stating that it is infact not a bug, but an intentionally not implemented feature.
  - michaelt 8y ago
    You think the guy who wrote the article should swallow that line of BS and be motivated to do more free pentesting for them?
- pedroaraujo 8y ago
  There are rules for bug bounty programs: - https://hackerone.com/keybase https://hackerone.com/keybase
  - hjek 8y ago
    Which one of those "outside the scope" categories would you say this one falls into then? To me it reads like there's nothing preventing this bug report from deserving a bounty.
    - jsjohnst 8y ago
      None of these bullets are “open and shut cases”, but all are related without needing a major leap, especially the first one. * Content spoofing / text injection * Issues related to software or protocols not under Keybase control * Reports of spam * Vulnerabilities affecting users of outdated or unpatched browsers and platforms Do I agree with their (alleged) actions? NO! But as I know several folks at Keybase personally, I’m sure there’s another side to this story and I’m willing to give them some benefit to the doubt until I hear otherwise.
      - daveFNbuck 8y ago
        If this vulnerability can fit those 4 categories, what kind of vulnerability would you be confident would qualify for the bounty?
        jsjohnst 8y ago
        That’s the problem, I feel their exclusions from bounty are too wide. This vulnerability if confirmed should be eligible for some bounty imho. That said, they published the exclusions publicly, so getting butt hurt over not getting paid when they said you wouldn’t feels a bit petty to me.
        daveFNbuck 8y ago
        Why do you say he's butt hurt? He doesn't even mention not getting paid. The post is about Keybase not taking a security vulnerability seriously. Is it petty to warn people about an insecure product?
AgentME 8y ago
The Keybase browser extension seems to be a first-party product from them on their site. If the guarantees they make about it are this misleading, then it feels harder to trust other things they say about their product.
mosselman 8y ago
It all comes down to trustworthyness with products such as Keybase. If I were them, I'd make sure that Keybase comes across as trustworthy in all of their endeavours.
palant 8y ago
The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public. The extension is very much an official Keybase product and recommended heavily on their end. Why should I waste more time on a product where valid security issues are being dismissed? It isn't even so much about not being paid, as: if they don't care about such edge cases subverting their end-to-end encryption, what do they care about?
mirimir 8y ago
The Chrome/Firefox extension is flagged "NEW" on the download page. If these allegations are correct, it ought to be clearly labeled as insecure. I'm quite disappointed. And BTW, I also don't like the option to upload private keys. I mean, no sane person would ever do that. It's not that hard to copy keys to multiple devices, if that's really necessary for your work flow. Me, if I used mobile devices, I'd use dedicated keys, because those things are so readily pwned.

michaelt 8y ago

The author is completely dismissing [0] the entire product If he's looking for bug bounties (be it for cash, kudos, principles, or to see it fixed), and he finds a security bug and doesn't get a bounty, why would he keep looking? Fool me once, shame on you; fool me twice...

DuckyC 8y ago
Keybase is clearly stating that it is infact not a bug, but an intentionally not implemented feature.
- michaelt 8y ago
  You think the guy who wrote the article should swallow that line of BS and be motivated to do more free pentesting for them?
pedroaraujo 8y ago
There are rules for bug bounty programs: - https://hackerone.com/keybase https://hackerone.com/keybase
- hjek 8y ago
  Which one of those "outside the scope" categories would you say this one falls into then? To me it reads like there's nothing preventing this bug report from deserving a bounty.
  - jsjohnst 8y ago
    None of these bullets are “open and shut cases”, but all are related without needing a major leap, especially the first one. * Content spoofing / text injection * Issues related to software or protocols not under Keybase control * Reports of spam * Vulnerabilities affecting users of outdated or unpatched browsers and platforms Do I agree with their (alleged) actions? NO! But as I know several folks at Keybase personally, I’m sure there’s another side to this story and I’m willing to give them some benefit to the doubt until I hear otherwise.
    - daveFNbuck 8y ago
      If this vulnerability can fit those 4 categories, what kind of vulnerability would you be confident would qualify for the bounty?
      - jsjohnst 8y ago
        That’s the problem, I feel their exclusions from bounty are too wide. This vulnerability if confirmed should be eligible for some bounty imho. That said, they published the exclusions publicly, so getting butt hurt over not getting paid when they said you wouldn’t feels a bit petty to me.
        daveFNbuck 8y ago
        Why do you say he's butt hurt? He doesn't even mention not getting paid. The post is about Keybase not taking a security vulnerability seriously. Is it petty to warn people about an insecure product?

AgentME 8y ago

The Keybase browser extension seems to be a first-party product from them on their site. If the guarantees they make about it are this misleading, then it feels harder to trust other things they say about their product.

mosselman 8y ago

It all comes down to trustworthyness with products such as Keybase. If I were them, I'd make sure that Keybase comes across as trustworthy in all of their endeavours.

palant 8y ago

The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public. The extension is very much an official Keybase product and recommended heavily on their end. Why should I waste more time on a product where valid security issues are being dismissed? It isn't even so much about not being paid, as: if they don't care about such edge cases subverting their end-to-end encryption, what do they care about?

mirimir 8y ago

The Chrome/Firefox extension is flagged "NEW" on the download page. If these allegations are correct, it ought to be clearly labeled as insecure. I'm quite disappointed. And BTW, I also don't like the option to upload private keys. I mean, no sane person would ever do that. It's not that hard to copy keys to multiple devices, if that's really necessary for your work flow. Me, if I used mobile devices, I'd use dedicated keys, because those things are so readily pwned.