Core

Metamask

Read

Avalanche

/send

<div class="protos">
 <div>
 <div>
 <div>
 A researcher who found evidence of data harvesting inside Ledger Live has revealed equally disturbing harvesters inside MetaMask and Avalanche browser extensions.
 <a rel="noopener noreferrer nofollow" title="MetaMask" href="https://thebittimes.com/tag/metamask.html">MetaMask</a>, the world’s most popular <a rel="noopener noreferrer nofollow" title="Crypto" href="https://thebittimes.com/tag/crypto.html">Crypto</a> wallet, uses a single pixel (‘1X1’) iFrame to embed trackers into its browser <a rel="noopener noreferrer nofollow" title="extension" href="https://thebittimes.com/tag/extension.html">extension</a>. The Ethereum- and ConsenSys-backed <a rel="noopener noreferrer nofollow" title="extension" href="https://thebittimes.com/tag/extension.html">extension</a> contains a data <a rel="noopener noreferrer nofollow" title="harvesting" href="https://thebittimes.com/tag/harvesting.html">harvesting</a> ‘analytics_iFrame’ within its code.
 For context, the iFrame is an old trick by web marketers. Publishers would secretly serve ad code inside an iFrame displayed as one, invisibly small pixel — tolling untold profits through invisible ad impressions. Due to years of iFrame abuse, many web browsers and advertising platforms ban iFrames altogether.
 <figure class="wp-block-image size-large"><img decoding="async" loading="lazy" width="1024" height="832" src="https://thebittimes.com/image/getimage/?url=https://protos-media.s3.eu-west-2.amazonaws.com/wp-content/uploads/2023/12/13082146/Screenshot-2023-12-13-at-2.20.28%E2%80%AFAM-1024x832.png" alt class="wp-image-56182" srcset="https://thebittimes.com/image/getimage/?url=https://protos-media.s3.eu-west-2.amazonaws.com/wp-content/uploads/2023/12/13082146/Screenshot-2023-12-13-at-2.20.28%E2%80%AFAM-1024x832.png 1024w, https://thebittimes.com/image/getimage/?url=https://protos-media.s3.eu-west-2.amazonaws.com/wp-content/uploads/2023/12/13082146/Screenshot-2023-12-13-at-2.20.28%E2%80%AFAM-1024x832.png 300w, https://thebittimes.com/image/getimage/?url=https://protos-media.s3.eu-west-2.amazonaws.com/wp-content/uploads/2023/12/13082146/Screenshot-2023-12-13-at-2.20.28%E2%80%AFAM-1024x832.png 768w, https://thebittimes.com/image/getimage/?url=https://protos-media.s3.eu-west-2.amazonaws.com/wp-content/uploads/2023/12/13082146/Screenshot-2023-12-13-at-2.20.28%E2%80%AFAM-1024x832.png 1398w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
 Many browsers and advertising platforms ban iFrames — but MetaMask still uses them.
 </figcaption>
 </figure>
 However, MetaMask still uses an invisible iFrame — perhaps hoping that no one would have thought to look through its outdated bits of CSS code. The iFrame within the browser extension circumvents traditional web safety services because the user voluntarily installs the extension and approves its permissions.
 Naturally, MetaMask requires new users to agree to its terms of use. It vaguely disclaims responsibility for third-party content and services — without specifically naming iFrame trackers, of course.
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
 By the way, just noticed Metamask uses a 1×1 pixel iframe for analytics LOL This is a web trick from the old days! Using 1×1 invisible GIFs to track page loads, later iframes. pic.twitter.com/lBMD7GKbny— REKTBuildr (@rektbuildr) December 10, 2023
 </blockquote>
 </div>
 </figure>
 “You access, rely upon, or use any third-party content or third-party service at your own risk. Consensys disclaims all responsibility and liability for any losses on account of your reliance upon or use of such content or services.”
 MetaMask’s terms do not clarify whether these third-party offerings include data harvesting or code hidden within iFrames.
 <h2 class="wp-block-heading" id="h-another-data-harvesting-operation-avalanche">Another data harvesting operation: Avalanche</h2>
 The same researcher who exposed data harvesting inside Metamask and Ledger Live also&nbsp;revealed concerning web extensions in&nbsp;another crypto wallet: Avalanche.
 Avalanche added analytics code to its Core App Chrome extension. Avalanche used to make all its code open source. However, at some point, it changed its licenses. The analytics portion of Avalanche’s extension is not open source.
 <figure class="wp-block-image size-large"><img decoding="async" loading="lazy" width="747" height="1024" src="https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp" alt class="wp-image-56183" srcset="https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp 747w, https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp 219w, https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp 768w, https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp 1120w, https://cdn.thebittimes.com/images/2023/12/13/f25d344d1dca438003bea65325202571.webp 1223w" sizes="(max-width: 747px) 100vw, 747px">
 <figcaption class="wp-element-caption">
 The analytics portion of Avalanche’s extension is not open source.
 </figcaption>
 </figure>
 Read more: Researcher finds data harvesting inside Ledger Live app
 Data <a rel="noopener noreferrer nofollow" title="harvesting" href="https://thebittimes.com/tag/harvesting.html">harvesting</a> includes transaction data, mouse clicks, and other actions users take while using <a rel="noopener noreferrer nofollow" title="Avalanche" href="https://thebittimes.com/tag/avalanche.html">Avalanche</a>’s wallet browser <a rel="noopener noreferrer nofollow" title="extension" href="https://thebittimes.com/tag/extension.html">extension</a> and its token, AVAX.
 Naturally, researcher REKTbuildr questioned why these web extensions, which also serve as crypto wallets for millions of people, need to use analytics trackers at all.
 As with REKTbuildr’s critique of Ledger Live, the researcher expects that Avalanche allows transmission of anonymized audience data to internal UI/UX teams or third-party advertisers.
 Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.
 </div>
 </div>
 </div>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/data-harvesting-found-in-metamask-avalanche-web-extensions-tbt73536.html">https://thebittimes.com/data-harvesting-found-in-metamask-avalanche-web-extensions-tbt73536.html</a>

Data harvesting found in MetaMask, Avalanche web extensions

Table of Contents

TheBitTimes

Other articles published on Dec 13, 2023

Spot Bitcoin ETF Approval: Blackrock, Fidelity, 2 Others Met US SEC This Week

Shiba Inu: 3 Massive Burns Coming This Week, Will Price Rally?

70mai Dashcams Offer 25% Discount with AI features – Revolutionize Your Road Safety

NodeKit Secures $1.2 Million in Investment Amidst Crypto Uptick

Decentralized Exchange OKX Suffers Major Hack Losing $400K, Exchange Initiates Action

Avalanche: AVAX Surges 85%, Can it Hit $50 Next?

Join our free newsletter for daily crypto updates!