Metamask-extension: Should we allow approved sites use inline installation?

[danfinlay]

From a user on Slack:

A big challenge for us has been onboarding, specifically having new users install MetaMask. We thought it would be a lot easier if they could install it directly from our site and not have to go to through the Google Play store.
I was wondering if you'd be willing to add our domain (https://REDACTED.com) so we could implement inline installation of MetaMask directly from our site? https://developer.chrome.com/webstore/inline_installation#verified-site

[kumavis]

id be fine allowing any site to do it, are we allowed to do a wildcard?

[danfinlay]

Related to #2369.

[tomhschmidt]

Hi Metamask Team! We at 0x are big fans and want to offer inline Metamask installation as part of our onboarding flow on 0xproject.com. Would it be possible to get our site whitelisted on the Metamask Chrome Extensions Store listing?

[danfinlay]

Hi @tomhschmidt, we tried to get inline install working on our own site, but didn't quite crack it, and now are usually buried in higher priority issues. If you could show us how to give you inline install access, I almost think we would be willing to give wildcard install access (what would the fear be? That someone tricks a user into installing the official extension?)

I'm open to people who can think of attack vectors here, for reasons why we shouldn't permit this or wildcard inline install.

[tomhschmidt]

@danfinlay thanks for the fast response! Sadly, getting inline installs approved w Chrome extensions is a bit tedious. You (as the Metamask Google Developer account) have to claim that you own 0xproject.com and I (as 0x) have to host a hash that you receive from Google on a 0xproject.com endpoint to verify your ownership, so there's no "wildcard" option, per se.

I think we're going to continue to develop our user onboarding as-is (with linking ppl out to Google Chrome store to install Metamask) and if we find this step to be particularly painful or churny, we'll reach back out to see if there's a better solution here.

[danfinlay]

Closing since it sounds tedious at the moment, and thus not a high priority.

[tomhschmidt]

Hey @danfinlay -

Had a chance to meet with the Radar Relay team and they said that Metamask installation is the largest source of churn in their onboarding process right now. Given their data, I'd prefer to move this up as our team (and I'm sure many other teams) want to maximize the number of people who can start using our dApps.

Looking through the Chrome extension inline installation instructions, it seems like the steps for the Metamask team are:

1. Check Inline Install under the Chrome Developer Dashboard entry for MetaMask

For each website with inline installation

1. Navigate to https://www.google.com/webmasters/tools/home, click Add Property and enter the address of the desired website (e.g. 0xproject.com)
2. Choose a verification method. I think HTML meta tag is probably the easiest for most people.
3. Send the meta tag to the team that wants to implement inline installation
4. Team adds meta tag to their site
5. MetaMask team navigates back to https://www.google.com/webmasters/tools/home and clicks Verify Property
6. Inline installation should now work on the verified third-party website following the instructions here

Realize this sounds a bit tedious and down to brainstorm ways to make it easier for all parties, but I really believe this could be a huge lift towards dApp adoption based on the churn data we've seen so far.

Thoughts?

[danfinlay]

Hi Tom,

I'm glad you're thinking about reducing churn in the ecosystem, and making user onboarding as easy as it can be- That's what we do all day, too!

Check Inline Install under the Chrome Developer Dashboard entry for MetaMask

We've done this.

Realize this sounds a bit tedious and down to brainstorm ways to make it easier for all parties, but I really believe this could be a huge lift towards dApp adoption based on the churn data we've seen so far.

We haven't even gotten inline install set up on our own page, and I don't think any of us are interested in going through this process for every "verified partner", largely because while easing adoption is one of our top priorities, making sure the product works well is currently an even higher priority (would you rush people onto the Titanic?)

We actually are currently considering no longer maintaining a list of verified tokens, because it's quickly become a drain on our own efforts, expecting us to do security analysis on things we've never heard of, while simultaneously maintaining the product that hosts those reviews.

If an extra click is driving people away at this point, I don't think it's awful, I think we're all safer for it. This space is full of technical hurdles, and if stepping through the Chrome store is the point that somebody gets fed up, and gives up, I'm really glad they never had to deal with gas prices, nonces, or backing up a seed phrase, and it's probably better for them that they aren't impulse-purchasing tokens. If they really believe in a project, they'll do what it takes to invest.

As MetaMask becomes more stable, manages privacy correctly, and is a little easier to use, I think we'll naturally find the time required to sand out the stray hitches like inline installation, and hopefully at that time we can work out arrangements to allow easier third-party installation, too.

Maybe it won't even be an extension installation, maybe we'll use Mascara by then!