MetaMask is listed only in the "web wallets" section of the official Ethereum wallet guide. Obviously, MetaMask is written in Javascript and runs in a web browser. But this is also true of the MyCrypto desktop client, which runs in an stripped down version of Chromium via Electron. The MyCrypto Desktop client is listed in the desktop wallets section of the guide.

Is there some additional aspect of the way MetaMask works which may have caused its inclusion in the web wallets section? Maybe the fact that it auto updates like all browser extensions? Or does it load remote javascript files when it runs, posing a security risk even if it is set not to auto update?

  • Hi there. Just a quick one: I realise that page is linked to from the "official" site (i.e. from ethereum.org/use/…), but I don't think that makes EthHub in any way official itself. To answer your question: probably just a case of semantics, or conflation of the terms "browser" and "web". Sep 11, 2019 at 16:43

1 Answer 1


I've had a quick poke around using Chrome's DevTools.

do you know whether MetaMask loads any external resources?

It doesn't seem to load resources per se, but does make various external - though expected - calls to external services.


This is the Ethereum client used by Metamask. MM constantly polls Infura to ensure its view of the chain is up to date (e.g. last block, etc.), as well as performing all the RPC-related calls required during a transaction.

e.g. https://api.infura.io/v1/jsonrpc/mainnet

(And various other Infura paths.)


Presumably to translate crypto to dollar values for the UX when performing a transaction.

i.e. https://ethgasstation.info/json/ethgasAPI.json

Another thing to consider when assessing your threat profile is that MM is open source, and has a good number of forks. Things like backdoors can probably be ruled out. Something that has occurred in the past is fake versions of the app finding their way into app stores, such as this one in the Google Play store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.