Skip to content

Commit

Permalink
Update MIPs/mip-eth-sign.md
Browse files Browse the repository at this point in the history
Update with a more descriptive explanation.

Co-authored-by: Shane <[email protected]>
  • Loading branch information
vandan and shanejonas authored May 22, 2024
1 parent 76ffe8d commit 69c449e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion MIPs/mip-eth-sign.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Created: 2024-05-15
---

## Summary
This proposal seeks to fully discontinue the `eth_sign` signature method in MetaMask due to its inherent security risks. The `eth_sign` method allows signing arbitrary data, posing a significant phishing risk. As of last year, `eth_sign` was disabled by default, but could be re-enabled in MetaMask's settings. This proposal aims to discontinue support entirely.
This proposal seeks to fully discontinue the `eth_sign` signature method in MetaMask due to its inherent security risks. The `eth_sign` method allows blind signing of arbitrary data without the `\x19Ethereum Signed Message` prefix, posing a significant phishing risk. As of last year, `eth_sign` was disabled by default, but could be re-enabled in MetaMask's settings. This proposal aims to discontinue support entirely.

## Motivation
The primary motivation for discontinuing this method is to enhance user security. The `eth_sign` method's capability to sign arbitrary data makes it vulnerable to phishing attacks, where malicious actors can deceive users into blindly signing harmful transactions or data since the hex data being signed can't be decoded and made readable to the signer. Even with `eth_sign` being disabled by default, there is still a risk that users are enticed to re-enable it when they should not. By removing support for this method entirely, we aim to reduce the attack surface and protect MetaMask users from potential threats.
Expand Down

0 comments on commit 69c449e

Please sign in to comment.