MetaMask / MetaMask/metamask-extension

Warn user if they are pasting their SRP into a website

Open
#13,923 3 comments 2 reactions 0 assignees View on GitHub
INVALID-ISSUE-TEMPLATE needs-design team-accounts-framework type-enhancement type-security
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

Taken from [this community post](
https://community.metamask.io/t/idea-help-the-users-to-not-get-scammer/10082).

To reduce the risk of being phished by a website, we could monitor when users paste their SRP, and then warn them and log the offending site for possible blocking.

Pasting is available as a DOM api like this:
```javascript
document.addEventListener('paste', (event) => {
console.log('pasted', event);
})
```

We wouldn't want to store the SRP in plaintext in every contentscript (massively increasing its memory footprint), so some other ways we could make it work instead would be:
- Send each paste content to the background for comparison (only works when unlocked)
- Store a hash of the SRP that can be used for the comparison (background or maybe even contentscript?)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the browser DOM paste event and how content scripts communicate with the background in this extension. Compare the two proposed SRP-comparison approaches, including the unlocked-state limitation and plaintext memory concern. Done should include a user warning and logging of the offending site without storing the SRP in plaintext in every content script.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.