To which remote ethereum nodes does Metamask plugin send signed transactions? and are they exposed to denial of service attacks?

Question

So Metamask allows in it UI to connect to different ethereum nw (public/ testnet) right.

1. Do who is maintaining these peers?
2. Can I trust these peers?.
3. If so, can I setup similar service on my machine without subjecting my machine to DOS attack and affecting my machine? How can I do this?

Answer 1

1) INFURA (https://infura.io/) maintains those remote nodes.

2) You can trust those nodes for two reasons: Uptime and Relay of signed transactions (as opposed of keeping your private key in our servers). We strive to keep an uptime of 100% (which is our latest record). Transaction-wise, it is you, from your local machine the one that signs the transaction with your private key. That way you don't need to worry that we can use your account for malicious purposes. All that INFURA does is relaying that transaction to the network to be mined.

3) Everybody can setup the same service in their machine. You just need to run a local node and synchronise it with the network you want, then open the RPC to receive transactions only from 127.0.0.1, this means, only your machine can send signed transactions and reading requests to that node. If you set up the RPC feature to listen 0.0.0.0, you will be exposed to attacks from the outside.

Other security suggestions, but more advanced to implement, would be to setup a firewall to incoming requests to your machine to the RPC port and staying behind your home router (that's pretty enough in most cases).

TLDR: INFURA is the remote service behind metamask. INFURA does not keep your private keys, what you send is the only thing that gets relayed. INFURA core competence is keeping nodes in the network synchronized, releasing the user to worry about that matter.

Answer 2

more concretely metamask is connected to those infura's nodes :

const MAINET_RPC_URL = 'https://mainnet.infura.io/metamask'
const ROPSTEN_RPC_URL = 'https://ropsten.infura.io/metamask'
const KOVAN_RPC_URL = 'https://kovan.infura.io/metamask'
const RINKEBY_RPC_URL = 'https://rinkeby.infura.io/metamask'

global.METAMASK_DEBUG = 'GULP_METAMASK_DEBUG'

module.exports = {
  network: {
    mainnet: MAINET_RPC_URL,
    ropsten: ROPSTEN_RPC_URL,
    kovan: KOVAN_RPC_URL,
    rinkeby: RINKEBY_RPC_URL,
  },
}

if you choose a local node then metamask is connected to it.