2022-11-19 07:23:19
MobyMask, a new initiative from the MetaMask team to help proactively protect users from phishing, uses a dynamic web of trust for sourcing phishing reporters
MobyMask, a new initiative from the MetaMask team to help proactively protect users from phishing, using a dynamic web of trust for sourcing phishing reporters. That original version of MobyMask made it possible for any reporter to invite (or revoke invitations) for additional reporters, as well as submit (or clear) phishing reports. That first version had three major shortcomings:
- Because every report is on the blockchain, each user needs access to a full node, and must trust that full node with whatever they want to be kept safe from: twitter users, websites, anything.
- It costs some crypto to file every phishing report. The phishers are clearly phishing cheaply, and so reporting them must also be cheap.
- The average wallet is not keeping a local copy of the phishing list, and is unable to participate in helping keep their network peers safer.
Laconic is premiering today and launching a special MobyMask-caching Ethereum light client, which greatly reduces the cost for an individual or organization to host a trustworthy copy of the MobyMask anti-phishing registry. This creates a lightweight server process from which web services like MetaMask, WalletGuard, and Phishfort can start drawing their MobyMask phishing detection data, in a way that is easier for anyone to self-host.
Laconic is also working on a TypeScript version of their Watcher, which makes it possible for the list caching and peer-to-peer replication of that data to happen entirely from the browser.
In another future update, Laconic will also make it possible for users to gossip “counterfactual” phishing reports, which will allow phishing reports to have no cost to the reporter. These messages will be shared between peers, but will be fully provable on-chain, and the blockchain will only be needed for resolving conflicts in the registry and revoking access to reporters.
People running the MobyMask watcher client will both contribute to a more phisher resistant web, and gain access to a private API for looking up phishing reports, which they can then share as they like, either at no cost or for a fee.
While the initial version is a web of trust rooted within the MetaMask team (and reporters are invite-only, so there is currently no way for just anyone to start reporting), we aim to eventually allow users to subscribe to any number of roots of trust for reporting phishers, eventually allowing every user to be their own root of trust for sharing or sourcing phishing information, and eventually a similar system can work for verifying credible sources of other kinds of information, too (yes, that’s a big goal!).
In its final phase, we hope that any user who wants to will be able to run a “watcher” as part of their own wallet, and so the server costs will become effectively none, while the benefits are fully mutually beneficial among those participating.
104 views04:23
N
