I can’t believe that in 2023 someone built a browser wallet - @MutinyWallet is a terrible idea and NOBODY should use it! We spent YEARS (2014 - 2017) trying to find ways to secure @MyMonero’s web wallet release against an ever-increasing series of attacks including: - registering thousands of domains to block phishing attempts - paying @PhishFort thousands of Dollars to monitor and takedown phishing sites - working with tier 1 ISPs to block ongoing BGP rerouting attacks - became deeply embedded with @gandi_net’s security team after hundreds of social engineering attempts at stealing our domain - working with @Cloudflare when an insider was allegedly trying to sell access to our CF control panel - took full advantage of things like the HSTS preload list and SRI (even when it wasn’t widely supported) - creating an entire browser plug-in called SafeBrowse which used DNS TXT records to serve out-of-band hashes of JavaScript and HTML objects to ensure they were safely delivered to the browser - working with @tayvano_ to share intel as they faced similar challenges with @myetherwallet Despite all of that, the cumulative losses of users JUST to MyMonero phishing sites must be in the millions of Dollars. I cannot begin to tell you how soul-crushing it is when a user insists that they are technically competent and weren’t stupid, only to have them dig into their browser history and realise they weren’t on the .com but on some phishing site😔 Eventually we released mobile and desktop apps, because even though we can’t have reproducible builds on iOS devices, it’s at least an attack surface we all understand. Classes of attacks like phishing apps in the Google App Store are fixable, and hardly infinite. It is literally impossible to secure a web wallet attack surface, which is why tools like BrainWallet were deprecated and removed from the live internet. Don’t use web wallets!