3 ms·
As the post says, this isn't a vulnerability in Keybase; it's a vulnerability in anyone who assumes that people use the same username on different sites.
by mholt 12y ago
As the post says, this isn't a vulnerability in Keybase; it's a vulnerability in anyone who assumes that people use the same username on different sites.
- steakejjs 12y agoHey this is my blog post and that's not all it says. At the time, keybase used a font allowed me to perfectly copy (and make it look like twitter/github was verified) people's profiles. Totally a lame vulnerability? Yes. Pretty effective? Also yes. If you go back in the github issue[1], it was even good enough to fool Chris, who founded the site, for 10 seconds. [1] https://github.com/keybase/keybase-issues/issues/397 https://github.com/keybase/keybase-issues/issues/397