Introduction
Safety and security are two important considerations when choosing how to store your cryptocurrency assets. History has proven that using online exchange accounts is the least secure route, even though they offer the greatest convenience to using your crypto. In our comprehensive guide to cryptocurrency wallets, we highlighted some reasons why using a hardware wallet may be the most secure way to store your digital currencies. However, the biggest drawback to this method is that it is cumbersome to access your assets. A good compromise between security and convenience is the use of software wallets which include mobile and web wallets. MetaMask is a great example of a web and mobile wallet because it exists as a browser extension and a mobile app for iOS and Android devices. Metamask is not just a storage medium; it has more utility and features, as we will discuss in this guide. However, most crypto wallet providers have fallen for crypto hacks and phishing attacks. As one of the most popular crypto storage options in the market, we will mainly focus on how MetaMask fends off attacks and keeps its users’ assets secure.
What Is MetaMask?
MetaMask is a web3 cryptocurrency software wallet that is accessible through the web and mobile interface. Web3 is the next generation of the internet, powered by blockchain technology, and MetaMask is one of the tools to access it. Not all web-based crypto wallets are web3 compliant, and so far, MetaMask is one of the most popular choices for people to run smart contracts and interact with decentralized applications (dApps) off their web browsers. MetaMask was built in 2016 by New York-based Ethereum development studio ConsenSys Software Inc., a company under the helm of Ethereum co-creator Joseph Lubin. At the time of its launch, MetaMask was only created to hold Ethereum coins and tokens based on ERC standards. Up until recently, the wallet only supported Ethereum (ETH) and Ethereum-hosted tokens, but users are now able to store Binance Smart Chain (BSC) tokens as well because BSC is a fork of (derived from) Ethereum’s Go client. As such, MetaMask can store tokens on both Ethereum and BSC networks and enable users to interact with dApps designed to run on top of the two networks.
How Does MetaMask Work?
Most cryptocurrencies are based on the popular public-key cryptography that uses two sets of keys to control funds on decentralized networks: public and private keys. MetaMask is designed to store the private keys that unlock tokens on a blockchain. In analogous terms, the public key is like a bank account number that can be shared with a counterparty or the public. The private key, on the other hand, is akin to an ATM PIN that you use to access the funds in your bank account. MetaMask (and other crypto wallets) are tools that are used to store these private keys. Over the last few years, MetaMask’s functionality has grown, and the wallet is now web3 enabled. Some of its extra functions include:
Acting as a bridge between a web browser and dApps;Holding non-fungible tokens (NFTs);Swapping between different tokens supported on Ethereum and BSC networks;Buy Ethereum in-app through third-party integrations with Wyre and Transak.
What makes a crypto wallet safe and secure?
Before we discuss MetaMask’s approach to asset safety and security, here are some of the factors to consider when analyzing whether a crypto wallet will keep your digital assets secure:
Nature of the wallet – you need to determine what kind of wallet it is. Whether it is an online web wallet, mobile, desktop or hardware. You need to determine if it holds private keys in hot or cold storage. The former refers to a situation where the wallet is actively connected to the internet while the latter is where private keys are stored offline. Cold wallets are generally safer to use than hot wallets.Third-party wallet integrations – given that hot wallets are more prone to attacks, some wallet providers have opted to partner with hardware wallet companies to provide seamless integrations to provide increased security for assets while retaining the convenience of using a software wallet.Security tools – it’s important that crypto wallets provide extra security tools to their users such as second-factor authentication (2FA), password or even biometric authentication to enable them to better secure their wallets.
Is MetaMask Safe?
Let’s consider how MetaMask secures its users’ assets. Notably, since its inception in 2016, MetaMask has not reported any significant security incident(s) affecting its systems. Here’s why:
Local data storage – MetaMask stores private keys and other metadata about the user on the device in which the wallet is installed. This data storage choice means that the wallet, whether it’s the web version or mobile, avoids using a centralized server which is often targeted by hackers. Keeping sensitive information about the wallet on the local storage allows the wallet owner to be fully responsible for the safety of their assets, and in the unfortunate event that they are hacked, losses are minimized to the individual victim.Hardware wallet integration – hardware wallets are significantly more secure than MetaMask web or mobile wallet and given that as a hot wallet, its security measures have a ceiling, the company has opted to partner with the highly secure hardware wallet manufacturers Ledger and Trezor. Now users can easily hold their digital assets on a Trezor wallet, for example, and access them through the intuitive MetaMask interface. Previously, a user had to transfer assets between wallets.Security tools – both MetaMask versions (i.e., web and mobile,) users are required to set up a password to access their wallets. Even for synced wallets between the web and mobile interfaces, passwords have to differ for extra security.Privacy measures – MetaMask takes appropriate measures to ensure the privacy of its users while navigating the nascent web3 environment. Typically, whenever you visit a dApp website, the application will request the MetaMask plugin on your browser to access your information, including the public address and balances. Initially, this information was provided to all websites by default, but now the wallet plugin will request permission from the user to allow it to share this information. This extra step ensures that a user’s information is only shared with approved dApps, and this increases asset safety.Open-source – the MetaMask source code is available for auditing on the public Github platform, where anyone is able to audit it and report on any vulnerabilities to the software. This way, the security of the wallet is constantly monitored, thus improving user trust and helping protect users from hackers.
How to secure your MetaMask wallet
Even though MetaMask is a relatively safe tool to store your digital assets, users need to take the initiative to secure their property by making good use of the available tools and maintaining utmost security hygiene. Here are some steps to take to protect assets stored within your MetaMask wallet:
Properly back up your seed phrase. A seed phrase is a collection of words, usually either 12 or 24, that can be used to recover private keys to a wallet. Software and hardware wallets come with seed phrases that must be well-kept. When you create a MetaMask wallet, make sure to write down the seed phrase and store it in a safe place.Create a strong password. MetaMask will always prompt you to create a password for each device on which you install the wallet. Keep it simple so you can easily remember but also hard for someone else to guess. If you forget your password, you will have to restore your wallet using the backup seed phrase, and if you lose access to your seed phrase, you can’t recover your assets.Only install MetaMask on a personal device. MetaMask stores the private key in an encrypted format on the device in which it is installed, and if this device is shared, funds held within the wallet are at risk. Therefore ensure that you only use MetaMask from a personal device. Also, if you plan to install a MetaMask wallet on a computer with a hard disk drive (HDD), ensure you have the contacts of your local hard drive recovery service shop in case of any malfunctions that can render your cryptocurrencies inaccessible. Having functional contact upfront can also make the situation less intense and could help to recover your coins faster.Connect to legitimate web applications. Avoid connecting your MetaMask wallet to unverified websites. Some of these web apps are designed by scammers to collect sensitive information on visitors to facilitate targeted phishing attacks. Others can scam you of your assets.Do not show your password or seed phrase to anyone. This might seem like an obvious suggestion, but there are instances when we are likely to share sensitive information inadvertently, such as during screen sharing. To avoid sharing your password or backup phrase, do not share your screen while backing up the seed phrase or creating a password.
Benefits of Using MetaMask
It supports assets and tokens on the popular Ethereum and Binance Smart Chain networks, two of the most dominant smart contract blockchains;It’s open-source, enabling independent security analysts to audit it, which contributes toward its security;MetaMask is free to use;The wallet is decentralized, meaning anyone can download, install and start using it without adhering to any regulatory provisions;Both its web and mobile interfaces are intuitive and beginner-friendly;MetaMask is one of the few web3 enabled wallets ensuring its future-proof as the world wide web transitions into a more interactive network through dApps;The wallet has an inbuilt exchange feature to help swap between thousands of Ethereum and BSC tokens;Even though MetaMask is a hot wallet, it has forged important partnerships by integrating with hardware wallets to better protect its users’ assets.
MetaMask Drawbacks
As a hot wallet, MetaMask is prone to remote attacks;The wallet supports only two blockchain networks;MetaMask is only available as a browser plugin and mobile app. There is not a desktop version yet;The wallet is centralized as it is run by the Ethereum development studio ConsenSys.
MetaMask alternatives
There are not many worthwhile MetaMask alternatives, but two of the best options out there are:
1. Coinbase Wallet
Coinbase Wallet is a standalone software wallet by the leading US-based crypto trading platform Coinbase. It is available as a mobile and browser plugin like MetaMask. Unlike MetaMask, however, the Coinbase wallet supports more crypto assets on multiple blockchain networks. It is also web3 enabled and has seamless integration with Coinbase exchange. Note: Read our comprehensive Coinbase review or the Coinbase Wallet section for more details.
2. Trust Wallet
Trust Wallet is also a standalone crypto wallet associated with the leading cryptocurrency exchange Binance. Unlike MetaMask and Coinbase Wallet, Trust wallet is only available as a mobile app, but it has similar features to its rivals. It’s web3 enabled, can be used to store a variety of crypto assets, and supports staking. Its support for web3 is, however, different because instead of having a native browser integration as the other two wallets, it has a built-in dApp browser to interact with the decentralized apps straight from the wallet interface.
Final thoughts
MetaMask certainly plays an important role within the Ethereum network. It helps users connect to the vast Ethereum ecosystem and keep their assets safe. Because of its important role, it needs to ensure that its interface is not only useful but also safe and secure. As highlighted in this text, the wallet’s developer has put in place the necessary infrastructure to protect users, including providing them with tools to protect themselves. One thing to always remember is that security is a personal initiative. You can have the best tools but still, end up a victim. Always practice crypto wallet safety hygiene when using MetaMask, such as creating strong passwords, avoiding sharing devices on which the wallet is installed, and safely backing up your seed phrase.
Storing digital assets (coins, tokens and non-fungible tokens);Interacting with decentralized applications (dApps) on Ethereum and Binance Smart Chain networks;Exchanging between tokens through the swap feature;Buying Ethereum using third-party brokerage services.
Storing sensitive information about the wallet within the device on which it is installed and avoids using centralized storage on servers;It’s open-source to allow the blockchain community to contribute towards its development and to independently audit it for vulnerabilities;It maintains the privacy of wallet information by disabling information sharing with websites by default;Providing integration with hardware wallets Trezor and Ledger;Providing its users with tools to secure their accounts, such as passwords and biometric login credentials on the mobile app.
