MetaMask / MetaMask/metamask-extension
Warn user if they are pasting their SRP into a website
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Taken from [this community post](
https://community.metamask.io/t/idea-help-the-users-to-not-get-scammer/10082).
To reduce the risk of being phished by a website, we could monitor when users paste their SRP, and then warn them and log the offending site for possible blocking.
Pasting is available as a DOM api like this:
```javascript
document.addEventListener('paste', (event) => {
console.log('pasted', event);
})
```
We wouldn't want to store the SRP in plaintext in every contentscript (massively increasing its memory footprint), so some other ways we could make it work instead would be:
- Send each paste content to the background for comparison (only works when unlocked)
- Store a hash of the SRP that can be used for the comparison (background or maybe even contentscript?)
Contributor guide
Research direction
Start by reviewing the browser DOM paste event and how content scripts communicate with the background in this extension. Compare the two proposed SRP-comparison approaches, including the unlocked-state limitation and plaintext memory concern. Done should include a user warning and logging of the offending site without storing the SRP in plaintext in every content script.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100