Could client-side code could read what is placed in the DOM after decrypted by the browser extension? It seems many things (e.g. ad sense) reads the DOM on the client side to determine the context of the ads it will place. Correct me if I'm wrong.
I too was thinking exactly this. I watched the crypto walkthrough video on the kickstarter page and though what was shown looked solid, it didn't mention this. Would it turn into a client-side JS-war between the extension and the host (FB, etc)? It would be nice if someone involved in the project could mention this and why it's not a problem. Thanks! Edit: clarified.
I think it would be possible to read the content if it was just inserted into a <div> in the DOM or something. But the priv.ly link that is pointing to the content could be replaced by an iframe, and then it wouldn't be accessible to outsiders code, because of same-origin policy, I think. Not sure how it's actually done, though, I didn't dig any deeper.