Deprecation of eth_sign

[kumavis]

gradually deprecate eth_sign

• include developer deprecation warning (link to personal_sign spec and eth-sign-util)
• disallow usage except for known domains e.g. etherdelta, admin.gnosis
• eventually remove completely

[2-am-zzz]

We will discuss this at our long term planning meet next Tuesday.

[danfinlay]

We might want to actually change the current behavior in favor of the personal_sign behavior, per discussion here.

[bdresser]

Work done in this PR, waiting to merge until EIP 712 is finalized

[bdresser]

EIP 712 is merged! unblocked ~

[danfinlay]

Blocked by us actually implementing EIP 712 per spec.

[danfinlay]

We have learned that adding a sufficient warning on the signature confirmation screen may have qualified as informed consent, and I would suggest this method no longer requires deprecation as long as we continue to adequately convey its gravity in the languages that we distribute under.

[danfinlay]

Correct. This is not blocked, I just am no longer sure it is necessary, as the signing method is in active use, as it's very useful for low-level development and prototyping.

[danfinlay]

That is one way of tucking it further away, but in my experience, this would just result in some applications instructing users to enable "developer mode". I think explicit warning is really the only tool we have to protect users, and we are already employing it. I'm not sure what we would gain by tucking it further away, other than friction, when we don't see any attacks successfully happening along this vector.

[jacobc-eth]

Given the staleness and lack of need for this, I'm going to go ahead and close this issue.