diff --git a/MIPs/mip-eth-sign.md b/MIPs/mip-eth-sign.md index 4ea69f9..e534f4d 100644 --- a/MIPs/mip-eth-sign.md +++ b/MIPs/mip-eth-sign.md @@ -10,7 +10,7 @@ Created: 2024-05-15 --- ## Summary -This proposal seeks to fully discontinue the `eth_sign` signature method in MetaMask due to its inherent security risks. The `eth_sign` method allows signing arbitrary data, posing a significant phishing risk. As of last year, `eth_sign` was disabled by default, but could be re-enabled in MetaMask's settings. This proposal aims to discontinue support entirely. +This proposal seeks to fully discontinue the `eth_sign` signature method in MetaMask due to its inherent security risks. The `eth_sign` method allows blind signing of arbitrary data without the `\x19Ethereum Signed Message` prefix, posing a significant phishing risk. As of last year, `eth_sign` was disabled by default, but could be re-enabled in MetaMask's settings. This proposal aims to discontinue support entirely. ## Motivation The primary motivation for discontinuing this method is to enhance user security. The `eth_sign` method's capability to sign arbitrary data makes it vulnerable to phishing attacks, where malicious actors can deceive users into blindly signing harmful transactions or data since the hex data being signed can't be decoded and made readable to the signer. Even with `eth_sign` being disabled by default, there is still a risk that users are enticed to re-enable it when they should not. By removing support for this method entirely, we aim to reduce the attack surface and protect MetaMask users from potential threats.