MetaMask / MetaMask/phishing-warning
Improve fuzzylist logic in eth-phishing-detect
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 20
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
from @Gudahtt:
The fuzzylist is not safe to extend in its current form. We should freeze it until we improve that functionality to make it more effective at blocking imposter sites, less prone to false positives, and less alarming for users.
There are a few fairly low-effort changes we could make to improve this:
1. Increase the levenstien tolerance from `2` to `1`, dramatically reducing the number of matches (and thus reducing false positives)
2. Make the warning page less alarming for fuzzylist matches (e.g. yellow instead of red, less alarming copy)
3. Make the warning page emphasize the risk of the website being an impostor of a specific target, so users can better evaluate risk on their own. https://github.com/MetaMask/phishing-warning/issues/37
4. It's hard for a user to look at a site and know if it's malicious or not, but most people would probably be confident that [unity.com](http://unity.com/) isn't trying to pretend to be [invity.com](http://invity.com/).
5. Add detection for invisible confusable characters, so we can detect obvious imposters and treat them more harshly
6. Add confusable character support to the warning page, so we can better highlight easy-to-miss differences between the suspected domain and potential target that it may be pretending to be.
Looking at some recent Trezor examples:
- [#9471](https://github.com/MetaMask/eth-phishing-detect/pull/9471/files): This is meant to be confusable for "Trezor" directly. Unsure how our detector works with confusables today. This might still pass with a tolerance of 2, since we're passing in punycode and our detector doesn't treat punycode any differently.
- [#9472](https://github.com/MetaMask/eth-phishing-detect/pull/9472): This one would be blocked by a tolerance of 1
- [#9409](https://github.com/MetaMask/eth-phishing-detect/pull/9409): Two entries, one which is another confusable imposter, simimler to the first bullet. The second uses a longer domain, so not currently handled by our fuzzylist, but maybe a good target if we wanted to start doing substring matching.
- [#9239](https://github.com/MetaMask/eth-phishing-detect/pull/9239/files): both longer domains, so not covered.
from @legobeat :
Let's consider
https://github.com/MetaMask/eth-phishing-detect/pull/9407
https://github.com/MetaMask/eth-phishing-detect/pull/9610
https://github.com/MetaMask/eth-phishing-detect/pull/9602
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the fuzzylist logic in eth-phishing-detect and the warning page, then compare the referenced pull requests and phishing-warning issue #37. Define which combination of tolerance, warning presentation, and confusable-character detection is in scope; done should reduce false positives while making likely impostor relationships clearer to users.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100