Giveth-dapp: Metamask should only ask for signing on actions

[krrisis]

Issue:
Now when you get to beta.giveth.io you always get a pop up by metamask and have to sign when getting to the page you first land on (whether homepage or direct link to dac, campaign or milestone). This is unneeded and very time-wasting when you go to the DApp 10x a day.
I do not need to be logged in most of the time, I just want to view or copy info or copy links.

Reproduce:
Go to any page on the beta.
Every time you have to sign in (if signed out).
I have my aragon, giveth & personal metamask on there, so most of the time it is set to mainnet.
I cannot change network or address in this notification (see screenshot), so I need to sign anyways or cancel, then change network & address, then sign again.

Solution:

• only ask to sign when I hit buttons like donate, my milestones, my profile, .. anything that actually needs my info

Example of wrong pop up below, wrong address, wrong network

[krrisis]

Extra issue, after signing in (on whatever page) and then going to My Milestones (not doing anything but just going there), it asks me to sign in again! Pretty sure that action is unnecessary as I'm not creating any transactions and I am already signed in?

[vojtechsimetka]

@krrisis I beliefe @perissology can better answer and correct me if I'm wrong, but I think you misunderstand the MetaMask messages there. (mind you they are not the clearest but outside our ability to improve other than suggesting a better way to an issue on the MetaMask github)

1. The connect button that pops is actually needed at the moment you arrive to the DApp. Metamask no longer exposes any information about the user to the dapps unless you connect. This means that without you granting the access with the CONNECT button, we don't see your address and can not pull information about you. You can test this by clicking on CANCEL and you will see that we are unable to detect who you are.

2. However, I do agree that the SIGN IN does not need to happen before you make any transaction. Initially we had it like that but it was causing a lot of problems for some reason and throwing errors. Just to explain a little bit better what is going on here: we need you to sign in not so that you can make transaction but so that you are authenticated to update the Feathers cache service and have better user experience. Each time you make transaction, we write to Feathers that this transaction is pending so that it appears in the UI. So when you make donation for example, the server knows you made it even before it is written to the blockchain. To improve the user interaction, what we are doing in the native version of the DApp is removing this write to Feathers database and instead storing all such info in your local browser database.

[ewingrj]

1. complain to metamask. They should be caching your approvals so you don't need to do it each time. You can also turn on privacy mode in metamask (via settings, but I wouldn't do it) and you won't get this popup

[krrisis]

Thanks for the extensive explanation for this one. I understand that some of the issues are on metamask's side, but can we not by default have a 'sign in' button at the top right and not have any request happening before you ask? Anyone who comes to the DApp for any reason always gets a sign in pop up the second they land on any page and this really is not too user-friendly.
Go for example to gitcoin.co - you do not get any pop-up. If I want to be recognized or manage my own bounties, I hit the sign in button and get started.
Same for example with mycrypto.com, I only get a pop up when I take any action.

Eg writing now an article, linking to sooo many Milestones and Campaigns, each and every person will get pop-ups if they just want to understand the DApp. People who just want to check us out will always get that pop-up. I'm also in the DApp so often just for checking which Milestones are filled via the Unicorn DAC (I don't need to see my own data for this, just amounts). Can we not by default just not have any metamask pop-up as of the moment I hit the sign in button?

[markoprljic]

Thanks for clarification Vojtek, and thanks Kris for writing the explanation of the issue. I hear you all and I would like to see even a temporary solution with a clear sign-in button (that Kris proposed) and ask for connecting MM only then.

Additionally we can go brag about caching to MM team by submitting a request?

[vojtechsimetka]

The sign-in button sounds like good idea and potentially great UX improvement. (To be tested if ppl prefer to click on sign-in button rather than being immediately prompted. Probably yes)

Before going to metamask with PR “fixing” the UX, I would like you to understand why there is this connect prompt. In crypto people generally value privacy. Many don’t use Facebook, have disabled cookies and use services that do not track them. This is especially true when dealing with their crypto assets. If you go back 1 year, you will realize, that users going to the DApp were never asked to connect metamask. They opened the DApp and saw their profile right away. This is awesome right? You go on a page and right away the content is personalized to you. Well maybe not so much... the thing is, that any website could easily see your public address without you doing any action right as you opened the website. Nothing is stopping the website owner from associating the wallet address with your profile on that website. Meaning anyone could very easily link your ethereum addresses with your name (facebook profile etc) without you even knowing it. Thats why they build this “annoying feature”. So now, metamask will notify you that any given website wants to know your eth address and asks you for permission to do so. Could it be done better? Probably. Is this something that should be removed? Definitely not.