Web3 wallet app MetaMask has introduced a number of new features designed to enhance privacy and give users more control, according to a March 14 blog post from the developer. The new features come after MetaMask was previously criticized for violating user privacy.
Previously, MetaMask would automatically connect to Ethereum using its Infura RPC node whenever a user first set up a wallet. According to a report by Ethereum node operator Chase Wright, while users can change the settings later, this still means that users' public addresses are transmitted to Infura before they have the opportunity to change nodes. Infura is owned by Consensys, the parent company of MetaMask.
Under the new Metamask extension labeled "10.25.0," users are prompted to choose to use "Advanced Configuration" during installation. Selecting this option reveals a number of configurable settings, including a setting that allows the user to select a different RPC node than the default Infura node. As well as letting users enter their node details, the Advanced Configuration dialog allows them to turn off incoming transactions, phishing detection, and enhanced token detection. Depending on the application's UI, these functions require sending data to third parties such as Etherscan and jsDeliver. Privacy-conscious users can now turn off these features during setup if desired.
According to the post, the new mobile version of MetaMask also includes privacy enhancements. Previously, the app did not allow users to connect one account to a Web3 application while leaving another account disconnected. Users can only choose to connect all of these or none at all.
However, the new version allows users to choose the specific accounts they want to connect to the app without revealing other addresses they control. In its post, Metamask said it has always been committed to protecting the privacy of its users and believes these new features align with those values, noting: “Data exploitation is against MetaMask’s core values. Instead, we believe in equipping our community with the fundamental principles that guide our growth true ownership and privacy. We are committed to protecting the privacy of our users so that you don’t, Nor will it end up being exploited by another central entity."
On Nov. 23, MetaMask was heavily criticized by the crypto community for publishing a privacy policy stating that it would collect users’ IP addresses. ConsenSys responded to the criticism on Nov. 24, saying that RPC nodes have been harvesting IP addresses and that the substance of the privacy policy is not new, although the language used in it has changed. On December 6, ConsenSys announced that IP addresses collected through Infura will no longer be stored for longer than 7 days.
