I understand that a completion flag parameter with Boolean value of 1 is used by Blake2 when it’s compressing the final block of the digested message.
This ensures that one cannot load the state of a blake2 implementation with a blake2 digest and continue on (length extension attack).
However I was just thinking, given that blake2 is open source, couldn't one just create a variant of blake2 that doesn't contain the completion flag, run the original message through it to obtain a non 'completed' digest and then use this as the state to mount a length extension attack through the standard version of blake2?
Which seems so trivial, I'm surprised we consider it length extension proof.
Surely loading the state of SHA-256 is only slightly more hassle than forking blake2, modifying and loading the state.