MetaMask / MetaMask/phishing-warning

Move phish warning page to metamask.io domain

Open
#148 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
20
Forks
17
PR merge metrics
No merged PRs in 30d

Description

Currently when you attempt to navigate to a blocked site, the redscreen page is served from `https://metamask.github.io/phishing-warning/v3.0.0/.........`

Screenshot 2024-01-29 at 11 09 13 AM

The warning page is our authority page to let users know of a scam they are about to visit. If we continue to serve it on non-metamask.io domain, we are training users to trust non-metamask domains for this security control.

Moving to metamask domain will isolate it from the rest of the metamask experiments that are served under `metamask.github.io/`

## Ref Links

- https://github.com/search?q=org%3AMetaMask+metamask.github.io%2Fphishing-warning&type=code

- extension https://github.com/MetaMask/metamask-extension/blob/develop/development/build/scripts.js#L191

- also some ledger thing also served from here: https://github.com/MetaMask/metamask-extension/blob/develop/offscreen/ledger-iframe.html

- mobile doesn't seem to be serving the same page lol. It's serving a page that apparently ships with the app?

- https://github.com/MetaMask/metamask-mobile/blob/main/app/components/UI/PhishingModal/index.js

![image](https://github.com/MetaMask/phishing-warning/assets/7924827/c5f26855-9396-464f-82f0-c3c5edb66817)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the deployment for metamask.github.io/phishing-warning and the extension references in development/build/scripts.js and offscreen/ledger-iframe.html. Review the linked mobile implementation in app/components/UI/PhishingModal/index.js, then identify all consumers that must point to the metamask.io-hosted warning page; done means the warning is served from the MetaMask domain without breaking those consumers.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
frontend, security, web-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.