Why is it useful to enable embedding of the UI?

If the Cryptshare User Interface shall appear as part of a web site you need to enable embedding.
If the users visit the Cryptshare User Interface directly (not within a web site) you are recommended to disable embedding.

Why should embedding be disabled?

Although the attack scenario for Cryptshare is not highly critical, embedding offers the possibility to run a so called 'ClickJacking' attack.

What happens within a 'ClickJacking' attack?

Prerequisite for this kind of attack is, that the attacker has somehow redirected the user to a web site in his own control.

Within this site the attacker has embedded Cryptshare, yet invisible for the user. The site shows a button faking a specific behavior, for instance a Facebook I-Like Button. The User clicks this button, but what he cannot see, is that he's actually clicking a button in the background (Which would be a button within the Cryptshare Application).

So the user triggers a Cryptshare behavior although he is thinking he is doing something different.