{"action":"created","issue":{"url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/4703","repository_url":"https://api.github.com/repos/MetaMask/metamask-extension","labels_url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/4703/labels{/name}","comments_url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/4703/comments","events_url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/4703/events","html_url":"https://github.com/MetaMask/metamask-extension/pull/4703","id":337355415,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk4NTYyODU3","number":4703,"title":"EIP-1102: Opt-in provider access","user":{"login":"bitpshr","id":334586,"node_id":"MDQ6VXNlcjMzNDU4Ng==","avatar_url":"https://avatars1.githubusercontent.com/u/334586?v=4","gravatar_id":"","url":"https://api.github.com/users/bitpshr","html_url":"https://github.com/bitpshr","followers_url":"https://api.github.com/users/bitpshr/followers","following_url":"https://api.github.com/users/bitpshr/following{/other_user}","gists_url":"https://api.github.com/users/bitpshr/gists{/gist_id}","starred_url":"https://api.github.com/users/bitpshr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitpshr/subscriptions","organizations_url":"https://api.github.com/users/bitpshr/orgs","repos_url":"https://api.github.com/users/bitpshr/repos","events_url":"https://api.github.com/users/bitpshr/events{/privacy}","received_events_url":"https://api.github.com/users/bitpshr/received_events","type":"User","site_admin":false},"labels":[{"id":573693206,"node_id":"MDU6TGFiZWw1NzM2OTMyMDY=","url":"https://api.github.com/repos/MetaMask/metamask-extension/labels/T12-DONOTMERGE","name":"T12-DONOTMERGE","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2018-07-02T03:09:48Z","updated_at":"2018-09-12T14:47:53Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/MetaMask/metamask-extension/pulls/4703","html_url":"https://github.com/MetaMask/metamask-extension/pull/4703","diff_url":"https://github.com/MetaMask/metamask-extension/pull/4703.diff","patch_url":"https://github.com/MetaMask/metamask-extension/pull/4703.patch"},"body":"This PR adds initial support for opt-in provider access as per [EIP-1102](https://github.com/ethereum/EIPs/blob/master/EIPS/eip-1102.md).\r\n\r\nThe need to implement this EIP became more pressing due to the frequency and seriousness of recent phishing attempts. As such, an approach was taken that involves minimal code changes and focuses solely on user-approved provider injection. Multiple domains can be concurrently approved so there's no \"one-dapp-at-a-time\" UX issue. This PR doesn't rely on [GABA](https://github.com/metamask/gaba) and instead intends to be a more immediately-mergeable solution to the influx of malicious attacks on users.\r\n\r\nNew dapp startup flow:\r\n\r\n1. Dapp requests provider access\r\n2. User is presented with approval screen\r\n3. If user approves, provider injected, dapp notified\r\n4. If user rejects, nothing happens (prevents rejection-based fingerprinting)\r\n5. For convenience, approved domains are cached\r\n\r\n## Required next steps\r\n\r\n- [x] Decide on rollout date **(11/02)**\r\n- [x] Publish blog post **(https://goo.gl/PCvxuY)**\r\n- [ ] Update web3 deprecation message\r\n- [ ] Release transitionary API\r\n- [ ] Release new FAQ documentation **(MetaMask/faq#116)**\r\n- [ ] Release changes\r\n\r\n## Proposed rollout process\r\n\r\nhttps://gist.github.com/bitpshr/701a9d61ea1025cc95ce41d22cbc78c4\r\n\r\n## Example detection code\r\n\r\nhttps://gist.github.com/bitpshr/61dde0d847ab28250047c0f17dc2434f\r\n\r\n## WIP blog post\r\n\r\nhttps://docs.google.com/document/d/1hAUEHH8paqChBGBCRXkItLp5tAHsk2f6bPnuRNCm3S4/edit\r\n\r\n## Basic example showing cached domain approval\r\n\r\n![preview](https://i.gyazo.com/390e70eabe3e0bb860b0b7b4f64b4cae.gif)\r\n\r\nResolves #3930 \r\nRefs #714"},"comment":{"url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/comments/420676469","html_url":"https://github.com/MetaMask/metamask-extension/pull/4703#issuecomment-420676469","issue_url":"https://api.github.com/repos/MetaMask/metamask-extension/issues/4703","id":420676469,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDY3NjQ2OQ==","user":{"login":"paulbarclay","id":13022101,"node_id":"MDQ6VXNlcjEzMDIyMTAx","avatar_url":"https://avatars1.githubusercontent.com/u/13022101?v=4","gravatar_id":"","url":"https://api.github.com/users/paulbarclay","html_url":"https://github.com/paulbarclay","followers_url":"https://api.github.com/users/paulbarclay/followers","following_url":"https://api.github.com/users/paulbarclay/following{/other_user}","gists_url":"https://api.github.com/users/paulbarclay/gists{/gist_id}","starred_url":"https://api.github.com/users/paulbarclay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulbarclay/subscriptions","organizations_url":"https://api.github.com/users/paulbarclay/orgs","repos_url":"https://api.github.com/users/paulbarclay/repos","events_url":"https://api.github.com/users/paulbarclay/events{/privacy}","received_events_url":"https://api.github.com/users/paulbarclay/received_events","type":"User","site_admin":false},"created_at":"2018-09-12T14:47:53Z","updated_at":"2018-09-12T14:47:53Z","author_association":"NONE","body":"It's going to be an uphill battle to successfully transition all live dapps in <6 weeks, given that there's no live version of metamask that can be tested against, no final test code out there, and no messaging push yet. The hard part is doing wide enough messaging and still giving enough time for devs to implement and test (it's not \"just add a line of code\"; it's \"add the code, check the UX, adjust the flow appropriately, handle the edge cases\"). At an absolute minimum the breaking change should be messaged in the extension itself.\r\n\r\nAnd, as was commented in another thread, we need to be able to read the state of the web3 injection - a boolean that highlights \"approved\" or \"not approved\" state - so we can show state appropriately, and put the call \"ethereum.enable()\" at the right point in the UX flow (which is not going to be at window load for may apps.\r\n\r\nI assume the state selection persists through a reload, so I don't have to re-enable every time the page is loaded?\r\n\r\n(overall, I support the change from a philosophy perspective, but think it's a poor choice from a UX/adoption perspective. It's a positive for a small percentage of the ~500k people who currently use metamask, but worse for almost all of the next 5 million)"}}
{"actor":{"display_login":"paulbarclay"}}