Wallet doxxes user even with max privacy settings.

[MicahZoltu]

An HTTP request is made to https://relayer.ambire.com/v2/identity/<address>/portfolio-additional even if you configure the wallet for maximum privacy.

1. Install Ambire browser extension (Firefox, v6.18.5)
2. Disable everything in the privacy opt-outs.
3. Disable all RPCs except Ethereum.
4. Configure Ethereum RPC to use a user-defined RPC server.
5. Create a new account.
6. Notice that a request was made by the extension to https://relayer.ambire.com/v2/identity/<address>/portfolio-additional where <address> is the address of the newly created account.

[MicahZoltu]

It appears this isn't the only doxxing that occurs. Others include:
https://cena.ambire.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd&panVal={%22a%22:%22<address>%22,%22b%22:0}
https://cena.ambire.com/api/v3/simple/token_price/ethereum?contract_addresses=0x88800092fF476844f74dC2FC427974BBee2794Ae,0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48&vs_currencies=usd&panVal={%22a%22:%22<address>%22,%22b%22:0}
https://cena.ambire.com/api/v3/trending/?panVal={%22a%22:%22<address>%22,%22b%22:0}
https://cena.ambire.com/api/v3/scamchecker/get_update?version=14320&panVal={%22a%22:%22<address>%22,%22b%22:0}

There are also many other requests that don't appear to directly ship out the user's address, but are a potential source of metadata leakage such as requests to ambire and coin gecko for what appears to be token icons (one could potentially doxx an account by the set of tokens it requests, especially when correlated with the timing of those requests).

For the icons, Ambire could just ship with a collection of the most common icons (it isn't that big of a set for the ones users actually care about) and let users optionally fetch additional icons only when the try to view a particular token rather than in bulk when scanning the account for tokens. Even better would be to have the "fetch token icon" be an explicit user interaction rather than making external requests by default without user consent.

The price checks should (IMO) also be something that can be disabled. While it is a common desire to be able to check prices, when a user wants to operate in max privacy/autonomy mode there should be no external requests. You can fallback to on-chain price feeds against something like USDC with only the JSON-RPC endpoint available, or just disable the conversion feature entirely when the user disables this privacy opt-out.

Note: The icon fetches seem to happen every time the extension popup is clicked. This is wasteful and these should be cached.

[MicahZoltu]

There also appears to be a privacy opt-out for transaction decoding that doesn't appear in the list during initial extension configuration. I only found it by poking around in the settings after installing the wallet, so when I thought I was in max privacy mode it turns out I was not.

While an API can provide more up-to-date transaction decoding services than local, this is a feature that largely doesn't need a server to handle. You can build a quite competent/functional transaction decoding system entirely without a remote server. See The Interceptor for an example of an extension that does transaction decoding and presentation entirely client side.

[Ivshti]

We're reviewing all of the above - on initial look some of those are bugs, some are WIP features. Expect details and fixes soon

[superKalo]

Thanks for the detailed reports @MicahZoltu 👏

I'd like to further amplify what @Ivshti said - these are things we're actively working on and we have progress on some of these points even before this report. The latest production version is not yet a CROPS level, yes, but we’re slowly moving towards it while carefully balancing between graceful degradations of the UX.

You’re right on your observations and I'm structuring them so you know what's the status (and what's being worked on):

1. /portfolio-additional, confirmed. Reason is it returns some extra data like in-app banners, rewards data, gas tank balances, and more. Unlike the rest of our portfolio discovery it isn't gated behind the auto-discovery opt-out at all. I’ll follow u up on this one, we’re discussing internally how to first split this and then - approach the all related things around you mentioned.

2. cena.ambire.com, confirmed. We use some of these as hints in our internal analytics. The consensus we agreed (and are working on) is that it needs an opt-out of it’s own. I'll follow up when these efforts are merged.

3. Opt-outs missing from onboarding (during initial extension configuration), confirmed. It is in our plans to bring those in there. It's purely due to technical complications why we haven't expose all of them in the initial configuration at first place, on our TODO list.

4. Prices, icons, decoding - agreed that "max privacy" should mean no requests beyond your own RPC, with fiat conversion degrading gracefully, etc. I’ll follow u up on those as well as soon as the efforts around them gets merged & shipped towards production.