poanetwork / nifty-wallet

A fork of MetaMask focused on the usability of real-world applications
https://chrome.google.com/webstore/detail/nifty-wallet/jbdaocneiiinmjbjlgalhcelgbejmnid
MIT License
92 stars 42 forks source link

Privacy issue - user accounts are disclosed when subscribing to accounts change #422

Open ilanolkies opened 3 years ago

ilanolkies commented 3 years ago

What browser and version did you use?

Google Chrome latest

What operating system did you use?

Mac OS

Do you have screenshots showing the problem?

Screen Shot 2020-11-12 at 19 34 31

What is your issue?

If developer suscribes to accounts change and the user accepts to share one wallet, the developer can then listen to all user's accounts when one changes. I created an account to use in one dapp and another in another dapp. When I went back to the first dapp I selected back my account and it logged all the accounts i have ever created... This is leaking user information.

I think it would be good to analyse new Metamask features that lets user select the selected account and the share only that account in the array of accounts logged by account changed.