The fuzzylist is not safe to extend in its current form. We should freeze it until we improve that functionality to make it more effective at blocking imposter sites, less prone to false positives, and less alarming for users.
There are a few fairly low-effort changes we could make to improve this:
Increase the levenstien tolerance from 2 to 1, dramatically reducing the number of matches (and thus reducing false positives)
Make the warning page less alarming for fuzzylist matches (e.g. yellow instead of red, less alarming copy)
It's hard for a user to look at a site and know if it's malicious or not, but most people would probably be confident that unity.com isn't trying to pretend to be invity.com.
Add detection for invisible confusable characters, so we can detect obvious imposters and treat them more harshly
Add confusable character support to the warning page, so we can better highlight easy-to-miss differences between the suspected domain and potential target that it may be pretending to be.
Looking at some recent Trezor examples:
#9471: This is meant to be confusable for "Trezor" directly. Unsure how our detector works with confusables today. This might still pass with a tolerance of 2, since we're passing in punycode and our detector doesn't treat punycode any differently.
#9472: This one would be blocked by a tolerance of 1
#9409: Two entries, one which is another confusable imposter, simimler to the first bullet. The second uses a longer domain, so not currently handled by our fuzzylist, but maybe a good target if we wanted to start doing substring matching.
AlexHerman1
commented
1 year ago
from @Gudahtt:
The fuzzylist is not safe to extend in its current form. We should freeze it until we improve that functionality to make it more effective at blocking imposter sites, less prone to false positives, and less alarming for users.
There are a few fairly low-effort changes we could make to improve this:
2to1, dramatically reducing the number of matches (and thus reducing false positives)Looking at some recent Trezor examples:
from @legobeat :
Let's consider
https://github.com/MetaMask/eth-phishing-detect/pull/9407 https://github.com/MetaMask/eth-phishing-detect/pull/9610 https://github.com/MetaMask/eth-phishing-detect/pull/9602