I wrote up some notes on my skim through MetaMask’s crypto. Don’t worry, nothing scary in here. blog.cryptographyengineering.com/2022/01/14/an-…
Major surprise to me in reviewing this code is how immature the JS/Node/browser crypto ecosystem is in 2022. I wanted to say “just use <standard library>” but: what should that library be?
So instead of having proper well-maintained crypto libraries for securing all these assets, we have libraries from individual contributors. This is where OpenSSL was in 2000.
Also: MetaMask’s crypto dependencies are the easy part. What’s scarier is the hundreds of *non-crypto* dependencies the project has, some of which are owned by anonymous randos. As someone pointed out recently: it’s a supply chain attack waiting to happen.
MM’s developers have been working on a tool called LavaMoat, which is supposed to help stop these attacks. I have no idea how well it works. (h/t @paulmillr) medium.com/metamask/how-m…
Anyway lots of comments crapping on JS crypto in general and I just want to gently disagree. Whether you like it or not, this is where the field is going. We should have better crypto tools! And if web3 builds them for us, it’s doing us all a favor.
I just want more professionals in our field to get involved in making this ecosystem safer (and/or building alternative libraries) before we have to repeat 2005-2014 OpenSSL all over again.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
