Purpose and Summary

As of today, we currently have safebrowsing capabilities built directly into the browser which has been great at protecting users on the Web. However, with the increased usage of Web3 features within Brave and the lack of adoption in previous safebrowsing services from Google, it’s become clear that we need support for safebrowsing capabilities specifically for Web3 to prevent scams, phishing attacks, and other malicious software which relies on Web3 infrastructure. To achieve a simple outcome of this we’d like to add a component for parsing a community maintained list called [eth-phishing-detect](https://github.com/MetaMask/eth-phishing-detect) which will determine if the navigation event takes the user to an origin on the list and then provide an interstitial if it is.

Spec
When the site calls `eth_getAccounts` RPC method to connect to the site (or equivalent on other chains), we hash the URL in line with safe-browsing v4 approach (not just origin, drainers are getting craftier) and submit the first 4 bytes of the hash to gate3. Gate3 is a web3 gateway service we host and operate in order to abstract various RPC infrastructure providers.
It checks the list and returns a subset of hashes that contain that prefix to the wallet
The wallet checks if the connected site matches one of the hashes returned.
If there’s no response from the backend before <TBD timeout> then we consider the request safe to prevent blocking wallet usage on a timeout.
If it does return a matching hash, it pops the interstitial within the wallet panel not the full site

Design

Wallet Panel interstitial warning

Opt out consent design (needs modification)

Alternatives

1. Extending Safe Browsing in Brave to add this list.
2. Extending Shields / adblock in Brave to add this list.
3. Creating a separate focused component to show an interstitial based on this list.
4. Convincing Google to pull the list into Safe Browsing