I'm a developer and now using metamask as a user. To explore a dapp which is largely unknown to me, and how it functions, I have to connect my wallet, and I am given the message "only connect with sites you trust".
Trust is not an atomic concept, though - trust to do what, so this message is pretty unhelpful.
I'd like a clear description if possible of what connecting does and does not do. Just saying "only connect if you trust" seems to me a lost opportunity to improve security in practice.
e.g., it could say
"connecting to this site will allow it to read your wallet balances" (with tooltip: but will not allow it to spend your funds - that requires a further transaction authorisation from you)"
Is the statement above correct? As precise as it can be?
So, here's how I understand it (please correct me!)
'connect' = allow dapp to read wallet balances
'approve' = allow dapp to spend a specific token up to a spending limit
'authorise transaction' = actually spend funds
I'm also not clear on step (2) where you can also choose a spending limit lower than effectively infinite - it seems as if at that step, step (2), the dapp can spend funds in your wallet. But this seems untrue because if that were the case what is the point of (3). And if (3) is required, what is the point of (2)?
Sorry for the slightly frustrated sounding language here... Thanks.