MetaMask / MetaMask/phishing-warning

Improve fuzzylist logic in eth-phishing-detect

Open
#45 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
20
Forks
17
PR merge metrics
No merged PRs in 30d

Description

from @Gudahtt:

The fuzzylist is not safe to extend in its current form. We should freeze it until we improve that functionality to make it more effective at blocking imposter sites, less prone to false positives, and less alarming for users.

There are a few fairly low-effort changes we could make to improve this:

1. Increase the levenstien tolerance from `2` to `1`, dramatically reducing the number of matches (and thus reducing false positives)
2. Make the warning page less alarming for fuzzylist matches (e.g. yellow instead of red, less alarming copy)
3. Make the warning page emphasize the risk of the website being an impostor of a specific target, so users can better evaluate risk on their own. https://github.com/MetaMask/phishing-warning/issues/37
4. It's hard for a user to look at a site and know if it's malicious or not, but most people would probably be confident that [unity.com](http://unity.com/) isn't trying to pretend to be [invity.com](http://invity.com/).
5. Add detection for invisible confusable characters, so we can detect obvious imposters and treat them more harshly
6. Add confusable character support to the warning page, so we can better highlight easy-to-miss differences between the suspected domain and potential target that it may be pretending to be.

Looking at some recent Trezor examples:

- [#9471](https://github.com/MetaMask/eth-phishing-detect/pull/9471/files): This is meant to be confusable for "Trezor" directly. Unsure how our detector works with confusables today. This might still pass with a tolerance of 2, since we're passing in punycode and our detector doesn't treat punycode any differently.
- [#9472](https://github.com/MetaMask/eth-phishing-detect/pull/9472): This one would be blocked by a tolerance of 1
- [#9409](https://github.com/MetaMask/eth-phishing-detect/pull/9409): Two entries, one which is another confusable imposter, simimler to the first bullet. The second uses a longer domain, so not currently handled by our fuzzylist, but maybe a good target if we wanted to start doing substring matching.
- [#9239](https://github.com/MetaMask/eth-phishing-detect/pull/9239/files): both longer domains, so not covered.

from @legobeat :

Let's consider

https://github.com/MetaMask/eth-phishing-detect/pull/9407
https://github.com/MetaMask/eth-phishing-detect/pull/9610
https://github.com/MetaMask/eth-phishing-detect/pull/9602

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the fuzzylist logic in eth-phishing-detect and the warning page, then compare the referenced pull requests and phishing-warning issue #37. Define which combination of tolerance, warning presentation, and confusable-character detection is in scope; done should reduce false positives while making likely impostor relationships clearer to users.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.