Keybase’s browser extension subverts its encryption
While they could have expanded better on their reasoning for not using iframes, I feel this is an overly dramatic post.<p>The browser extension is not their main product and they explicitly say so. The author is completely dismissing [0] the entire product just because of a side project, which in the worst case scenario could be fixed by the community by submitting a patch.<p>It is also strange that the author seems to feel the need to reinforce the sensationalism of this post by linking something completely unrelated to Keybase.<p>Also, where are the quotes on this post coming from? Where is the rest of the communication?<p>There is really nothing to see here.<p>[0] - "Initially, I planned to take a closer look at the crypto in Keybase, to see whether I can find weaknesses in their implementation. But that’s off the table now."<p>[1] - "But as experience shows (<a href="https://palant.de/2018/07/11/ftapi-secutransfer-the-secure-alternative-to-emails-not-quite" rel="nofollow">https://palant.de/2018/07/11/ftapi-secutransfer-the-secure-a...</a>), the claim “end-to-end encryption” doesn’t automatically translate into a secure implementation."