5 ms·
Seems like a bit of a stretch. You really shouldn't be putting anything extremely sensitive into a browser anyway, and Keybase calls it out themselves. Yes, it'
by wobblyasp 5y ago
Seems like a bit of a stretch. You really shouldn't be putting anything extremely sensitive into a browser anyway, and Keybase calls it out themselves. Yes, it's missing from the extension page, but that's really the only "mistake" they've made.
- akerl_ 5y agoSo why does Keybase inject the textbox there? Injecting an input for a secure chat app into an insecure location is going to make people who trust keybase misunderstand the security profile of that input.
- wobblyasp 5y agoIs there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page
- akerl_ 5y agoPer the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM
- captn3m0 5y agoOther than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.