Decentralization in reverse: MetaMask collects users’ IP addresses. So, how to avoid it?

Many people won’t like this. Recently, one of the most popular crypto wallets called MetaMask began collecting data about users’ IP addresses.  An IP address is a unique numeric identifier of a device on an IP-based computer network. That is, it is extremely easy for those who gain access to such information to determine who you are and where you are.

However, this is only done when using Infura, which is the default remote procedure call (RPC) provider. It is Infura that collects user IP addresses and Ethereum wallet addresses for transactions. RPC is a protocol for requesting data and information from a program running on a third-party computer server.

Let’s now look at why this decision was made, what the consequences are, and whether there are alternatives for those who want anonymity.

A terrible corporate solution

ConsenSys has announced that it is collecting user data related to its MetaMask network wallet service. This comes days after the decentralized cryptocurrency exchange (DEX) Uniswap made a similar update to its privacy policy. ConsenSys said it collects data related to user identities, such as contact information, profile information, etc.

“The updates to the policy do not result in more intrusive data collection or data processing and were not made in response to any regulatory changes or inquiries. Our policy has always stated that certain information is automatically collected about how users use our Sites, and that this information may include IP addresses. When users interact with Ethereum or other blockchains — such as by sending a transaction or requesting a balance — through an RPC provider such as Infura, the provider receives both the user’s IP and wallet address to provide the service. This is not Infura-specific and is consistent with how web architecture works generally, though we continue to pursue technical solutions to minimize this exposure, including anonymization techniques,” the publication says.

Renowned blogger Adam Cochran called it a “terrible corporate solution.” Actually, he’s not the only one. In his opinion, nothing is more important than consumer privacy, especially when it comes to financial data.

“Metamask has provided a great free service for a long time, but their decision to log IPs and tie it to transactions is unacceptable,” he wrote on Twitter.

But the tricks don’t end there.  It’s not just collecting data when you send TX — once you unlock the wallet, it records all your addresses under the same IP. This database creates a huge risk of DoxxingDoxxing is a digital attack involving publishing personal information about someone on the internet.. This was tweeted by blogger Micah Zoltu.

“Their policy needs to be updated to say: As soon as you unlock your account, Infura will collect your IP address and *all* of your addresses.  Also, when you connect a ledger it will send all of those addresses to Infura as well,” he warned.