Metamask-extension: Experiment with ENS security measures by Jim McDonald

[danfinlay]

At the ENS Workshop, Jim McDonald gave an excellent discussion on a variety of attacks that can be waged against the ENS, and how we can help address them.

One of those ways is an API he's set up for detecting a variety of homoglyph attacks, which he's sent to me, but rather than posting it here, I'm making it a note, to respect his api privacy for now.

This issue represents the intention to experiment with that API and see if we can do something useful with it, before exploring how to ramp it up to production readiness.

[danfinlay]

This could be a good bounty research topic, although we would need to specify the scope of the research before agreeing to a price.

[danfinlay]

We could just post a bounty for a successful implementation that is resistant to identical characters (coloring them, or throwing errors when trying to render a multi-language string), ideally working without a centralized API, but if the database was huge, it would have to be acceptable.

Bonus points if we came up with a peer to peer network for sharding the homoglyph database and peer gossiping it. (Just dreaming now)

[danfinlay]

We should maybe just add to the MyCrypto bounty for this:

https://github.com/MyCryptoHQ/MyCrypto/issues/382

[dternyak]

@danfinlay We'd certainly love to parter up on this! @pakaplace should be opening a PR against https://github.com/MyCryptoHQ/ens-validation today, so we can collaborate there if that works :)

[danfinlay]

Let us know how we can help, @dternyak!

[danfinlay]

For the reverse-resolution, MyCrypto's changes have been merged!

A simple ascii pre-conversion ensures minimal funny business, and warnings can be given otherwise:
https://github.com/MyCryptoHQ/ens-validation/pull/2

I wonder if there's an equivalent measure we could take for other languages...

[dternyak]

@danfinlay That's awesome! :) congrats!

[danfinlay]

Oh hey @dternyak I need a chat line with you. You weren't in MyCrypto slack anymore to my surprise!

Anyways, I've published your module, but will pass over the npm ownership if you want. Just wanted it published for easier use.

I actually was just pointing out your module was finished, not that we'd integrated it yet. Great work!

[dternyak]

Pinged on Slack!