MetaMask / MetaMask/metamask-mobile
Fix misleading "Basic Functionality" toggle [Security]
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### What is this about?
The "Basic Functionality" toggle is dishonest and harms user privacy. For example turning on so called "Basic Functionality" turns on the *entirely optional* Metamask rewards program. While there is some differentiation between different privacy features and their toggle, user expectations are clearly being taken advantage of to push optional features.
### Scenario
Users should be able to toggle features at the finest possible level since people's livelihoods are at stake. An entire navigation button should not appear/disappear when an unrelated toggle is pressed.
### Design
_No response_
### Technical Details
_No response_
### Threat Modeling Framework
There are two distinct threats that toggles should be categorized under:
# Leaks IP Address
- This is dangerous, but can be mitigated (as mentioned directly in the app), for example with a VPN.
# Wallet Correlation
- This is cannot be mitigated by third party tools and is wholly in the hands of metamask.
- Wallet correlation can literally mean life or death in certain situations, and so should be treated with extraordinary importance and detail.
- If I have one wallet (used for being anonymous gay political dissident) and Metamask leaks that it is transactingg from the same place as a second wallet (used for church donations in my name), t here are places where I will be killed, and metamask would be to blame.
- The only option is to have multiple wallets running from different devices or under different VPNs, which for example is practically impossible on a mobile device. In other words, the only current option is to treat metamask as leaky/insecure and only for toy purposes.
### Acceptance Criteria
- Does toggling a given feature turn on/off an unrelated feature?
- Can I start with bare minimum functionality and one by one add features, or only groups of features at a time?
- Are toggles separated by severity of threat with large header one saying IP LEAK and the other saying IDENTITY LEAK/WALLET CORRELATION?
### Stakeholder review needed before the work gets merged
- [x] Engineering (needed in most cases)
- [x] Design
- [ ] Product
- [ ] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [ ] Security
- [ ] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)
### References
_No response_
Contributor guide
Research direction
Start by locating the mobile implementation of the “Basic Functionality” toggle and the Metamask rewards program, then compare their behavior with the acceptance criteria. Done means unrelated features can be controlled independently, users can enable features individually, and the threat categories are clearly separated after design and stakeholder review.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100