4 ms·
Keybase Browser Extension Insecure
- tragictrash 5y agoAnything you type into a webpage can be seen by anyone who controls the content being delivered. Not news, this title is clickbait.
- wobblyasp 5y agoSeems like a bit of a stretch. You really shouldn't be putting anything extremely sensitive into a browser anyway, and Keybase calls it out themselves. Yes, it's missing from the extension page, but that's really the only "mistake" they've made.
- akerl_ 5y agoSo why does Keybase inject the textbox there? Injecting an input for a secure chat app into an insecure location is going to make people who trust keybase misunderstand the security profile of that input.
- wobblyasp 5y agoIs there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page
- akerl_ 5y agoPer the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM
- captn3m0 5y agoOther than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.
- raesene9 5y agoI'm interested to see that Keybase is actually still maintained. After the Zoom Acqui-hire, they seemed to have moved on (last entry on their blog https://keybase.io/blog https://keybase.io/blog is May 21 2020) but there's activity on the GH repos, although nothing like the pace it used to develop (https://github.com/keybase/client/graphs/contributors https://github.com/keybase/client/graphs/contributors).
- TedDoesntTalk 5y agoAt the top the article says “Written 4 years ago”
- joecool1029 5y agoFurther discussion of this from yesterday: https://news.ycombinator.com/item?id=28814210 https://news.ycombinator.com/item?id=28814210
- philsnow 5y agoJust stop using browser extensions. No you don’t need a JSON prettifier that has full powers and can read data from web pages on any domain. You don’t need a thing to help you to compose English prose better (or maybe you do but don’t use the extension). The browser is the modern operating system, and we have made it trivial to allow users to pwn themselves with two clicks.
- alisonkisk 5y agoHow is your argument different from "don't use software to solve problems"?
- captn3m0 5y agoThe "JSON prettifier" example is exactly what compromised my browser once, long ago. I only found out because I noticed the "this extension is no longer available on the Chrome store" mention on the chrome://extensions page or something of the sort. It was silently ex-filtering list of all URLs I visited against a unique identifier.
- sp332 5y ago"exfiltrating"
- dcsommer 5y agoWhat about password managers? The browser built-in ones aren't always the best choice.
- zorked 5y agoWhy not?
- mynameismon 5y ago1. Lack of a master password, so anyone who knows the password to your laptop knows all your passwords 2. Inability to access them anywhere, anytime 3. Possibility of compromise in case of compromise of system[1] 4. No sharing 5. Absolutely terrible password generation (a string of random characters) [1]: https://null-byte.wonderhowto.com/how-to/hacking-windows-10-steal-decrypt-passwords-stored-chrome-firefox-remotely-0183600/ https://null-byte.wonderhowto.com/how-to/hacking-windows-10-...
- anonypla 5y agoJust one answer: https://keyoxide.org/ https://keyoxide.org/ It's such a good maintained alternative to keybase
- TedDoesntTalk 5y agoAt the top the article says “Written 4 years ago”
- blunte 5y agoZoom’s acquisition of Keybase could only mean bad things for Keybase. It means Keybase loses internal developer attention (since Zoom ostensibly bought it for the tech talent) and/or Zoom plans to somehow boost its own services through existing KB users (privacy loss, but also unlikely given the relatively small userbase). KB did also have some attraction because of its Stellar integration, but Stellar has not been managed well enough to attract enough developer attention (a different topic). It’s too bad Wire became so corporate. KB and Wire were arguably the most secure messenger systems, and now we’re stuck with Signal.
- atatatat 5y agoUsers here with Keybase in their profile remind me of citizen PATRIOT Act supporters
- watusername 5y agoWould be great if dang could add (2017) to the title so there's less confusion.