The idea was to make it easier for my friends and I to send encrypted messages over any medium. Facebook Messanger, Slack, G chat / hangouts, etc. Facebook couldn't look into our messages, and everything was pretty easy. It took two clicks, which was a pain.. but because we were security conscious we could power through.
On the other hand, most people I work with, my family, other friends, etc. don't have the patience for that. It needs to be no clicks to at max one click. The current route keybase is continuing to take is a command line interface with multiple commands necessary.
The CLI is simply not going to catch on for the normal user. The experienced users just use their own PGP keys and manage it.
As for the new interface, it does look nice. However, the fact it needs to be a unique chat name is kind of a pain. Why not just sign a unique identifier to the chat, then rename locally? Similar to the way Signal does it? Also, what happens if you recent your PGP key?
Have you thought about having the extension read all of the page, look for PGP encrypted message and automatically decrypt the message? It wouldn't be compute intensive if you optimized for a specific website. Also getting the submitted message and encrypting on the fly?
Also, have you thought about how this could work for phones?
That's how it works, just searches the page for the pgp messages. It checks for messages on DOM changes.
FireFox on mobile enables add-ons, so it would work on desktop or mobile if I wanted to do that. However, this was more of a proof of concept. It worked and works well with friends, but we no longer use it all that much.
Usable security sure is hard. My problem is I was invited to keybase back in the old days by a friend. I played with it, and soon forgot it existed. I've just been trying it out again, and it has changed a lot for the better. I feel like someone who isn't completely incapable of computers could make sense of it with some coaching. However, getting grandmother on keybase probably will never happen. :)
[edit] But what is up with the command line tools on macOS? I expected to find them in one of the usual bin locations so it would be in $PATH, but I ended up just aliasing it in my zshrc. It would seem that a symlink to the executable from /usr/local/bin would be appropriate if it needs to stay inside the .app bundle.
How did you deal with text injection into react forms on facebook?
Whenever I interact with text in a form field on facebook via a browser extension, it is not picked up by react, and the original text is what is picked up on submission. I've banged my head into this problem repeatedly. Is there an easy fix or is this something much more subtle?
I mean on the encrypt side, not the decrypt side. When I try to put text into a react form, react doesn't pick it up - it still uses the original text in the input form. I will definitely look at that code though, thanks!
I won't pretend to be an expert, but very vaguely, if I know anything about react: you would have to modify the local state of the form (if it's possible at all by a 3rd party in fb frontend code) and react/flux will modify the dom for you. If you go more directly (on the DOM for example) you will get overwritten by the current state as soon as react re-renders
sorry I'm not @lettergram, so I cannot really help you with his code; I never tried to inject code into a facebook page, but I can imagine that especially after minification it's going to be a pain to do
18 months or so ago I wrote an app called AnyCrypt, utilizing Keybase under the hood: http://lettergram.github.io/AnyCrypt/
The idea was to make it easier for my friends and I to send encrypted messages over any medium. Facebook Messanger, Slack, G chat / hangouts, etc. Facebook couldn't look into our messages, and everything was pretty easy. It took two clicks, which was a pain.. but because we were security conscious we could power through.
On the other hand, most people I work with, my family, other friends, etc. don't have the patience for that. It needs to be no clicks to at max one click. The current route keybase is continuing to take is a command line interface with multiple commands necessary.
The CLI is simply not going to catch on for the normal user. The experienced users just use their own PGP keys and manage it.
As for the new interface, it does look nice. However, the fact it needs to be a unique chat name is kind of a pain. Why not just sign a unique identifier to the chat, then rename locally? Similar to the way Signal does it? Also, what happens if you recent your PGP key?