MetaMask, among different dApp browsers, has committed to cease injecting Web3 into user browsers on November. 2, on account of a recently-uncovered privacy issue, which means it'll need a brand new postMessage API, according to Paul Bouchon, writing in Medium.

MetaMask, an Ethereum wallet and dApp browser that allows users to visit the distributed web, has automatically injected a web instance for the web page along with an Ethereum supplier, enabling the dApp to achieve the blockchain, access user account addresses, and propose transactions.

Privacy Gap Uncovered

The existing generation of dApp browsers, however, contains a privacy exposure. Malicious sites can scan the injected objects and track Ethereum users, even once the extension is locked. Such an attack is mentioned as “fingerprinting” and make users vulnerable to a variety of attacks.

For example, malicious players have already been ready to launch phishing campaigns and invasive advertising using the exposed data. Once the extension unlocks, the wicked players also can see the victim’s Ethereum address, from which they can gain access to private data, like transaction history, balance, and other data.

To protect the privacy, dApp browsers as well as MetaMask, imToken, Status, and Mist would require updates to existing dApps.

The dApp browsers will no longer automatically inject a web instance or Ethereum provider when the page loads. The dApps will got to request a provider from the browser which will then ask the user to approve or disapprove access to the Ethereum blockchain. The provider will be injected into the web page if access is approved.

Users will begin to check more “login” buttons on dApps, one of which will cause a MetaMask pop-up requesting the user to grant site access to their account information. The sites that are approved will be cached until the user’s list is cleared.

The approval pattern is similar to asking for access to a user’s microphone or camera, Bouchon noted.

Ethereum users will be able to deny blockchain access for those websites they think about untrustworthy. This way, unwanted websites won't be able to target them without their knowledge. Instead, users will have manage over their privacy by injecting the provider into a web page after granting approval.

Developers to need Approved providers

Developers, for their part, will no longer be able to expect a Web3 instance or Ethereum provider to already be on the window when a page loads. Instead, dApps will post a message requesting a provider from the browser by posting a message. The dApps will have to register to be notified when the user approved provider is injected. The provider can know if injection happens via window.ethereum, and will simultaneously have to ask for a provider.

For the Web3.js API, an Ethereum provider will be injected following user approval, not a web instance. The dApps that require Web3.js will have to load the actual version they have instead of a version the browser injects. A Web3 instance can still be injected by using a Web3 flag once requesting a provider.

There is no guarantee concerning the Web3 version that will be injected after the request is created, meaning the tactic is only suggested for convenience in debugging and developing.

The modification has been a troublesome decision for MetaMask, Bouchon noted, however it's necessary to prevent users from being subjected to violations of privacy.

MetaMask believes it can defend privacy and security in providing a user-centric web.