I know a bunch of crypto wallets which works in IFRAMEs and similar technologies right inside a web browser without needing to install any plugins:
But are they protected from a phishing Dapp attack? In case Dapp wants to trick you and hide the actual amount of ETH send or any other way, modify wallet UI inside a web browser?
Storage isolation
Extensions:
Browser extension-based wallets such as MetaMask use isolated local storage that only the extension can access, with no way for a website to access. The extension can push data to the website, or the website can request data by doing message passing requests. Private keys are stored in the sandboxed local storage and requests are made from the website to the extension to sign messages. The extension returns the signed message to the website.
Web-based:
Browser-based crypto wallets such as Authereum, Portis, Torus, and Fortmatic, use sandboxed local storage as well via an iframe. Unlike cookies, local storage is strictly restricted by domain, meaning that if a website sets a value in local storage, then only that website can read the value; so alice.com cannot read bob.com's local storage. To sandbox local storage sensitive values, they are set under a controlled subdomain, for example x.wallet.com, since no other website will be able to read the local storage. This subdomain contains no UI is meant for iframed communication only. The web3 provider's of those wallets load a hidden iframe on the website, which is used to communicate to the subdomain containing the sandboxed storage; so for example Alice on dapp.com using Authereum, the Authereum sdk connects to x.authereum.org using an iframe and send postMessage requests to the iframe from the website to sign messages. This restricts the website from reading sensitive data such as private keys and only allow the website to send sign requests similarly to how wallet extensions work.
Not all web-based wallets have sandboxed local storage so you should avoid using those since any website can read the stored sensitive data but the wallets mentioned here are safe in that regard.
Protection against phishing attacks
Phishing attacks occur when a user is tricked into thinking they are using a known website but instead are using a malicious website that resembles the legitimate website. Authereum, Portis, and Torus are username and password based login solutions so they open up the login auth window in a new popup or redirect. This allows the user to verify the domain of the website for legitimacy. Google auth does this pattern as well. Besides opening a new window on login for the user to verify, some web-based wallet providers also open a new window when signing messages and transactions to verify the request.
Click jacking occurs when a website is loaded via an iframe on the website and the website overlays a different UI on top of the iframed website with pointer-events set to none and then tricks the user into entering information or clicking a button on the overlayed UI but they are actually clicking a button on the iframed website. This is dangerous because the action on the iframed website can be something like sending funds to the attackers wallet.
To prevent the wallet site to be loaded in an iframe at all, all the wallet site has to do is set the HTTP header X-Frame-Options: DENY, which is what Authereum and Portis are doing so they are safe from these attacks.
Trusting content scripts
It's easy to verify browser extension source code by using source viewer plugins, but to avoid an extension from auto-updating with malicious code, a user can install the extension manually to lock it down to a version by getting the source code from github if it's open source or from downloading the source scripts.
Since with web-based wallets the wallet site owner controls the content scripts then you have to trust that the content scripts managing the sensitive key data won't be malicious since the wallet site owner or an attacker that got access to the wallet site can at any point update the website source code with bad code.
To trust content scripts, the wallet site can be hosted on IPFS since the web address is the content hash meaning you can trust that it won't change. Authereum is one wallet that already offers this by visiting authereum.eth or by resolving the contenthash property of their ENS name.
Convenience
Web-based wallets are portable because you can use the same wallet on any OS, browser, desktop or mobile, while with browser extension you are stuck with the environment you are using the extension from. Extensions are highly inconvenient but offer more storage isolation guarantees. With contract-based accounts however, more security features can be offered on the wallet side.
Contract-based accounts
MetaMask, Portis, Torus, and Fortmatic are all externally-owned account based (EOA) which means that funds are stored and manged by a single key. If an attacker gains access to the signing key, then they also have access to the funds stored at that key.
Contract-based accounts (CBA), such as Authereum, provide more security guarantees because each account contract can have multiple keys to manage it and each key may also have limited authority over what actions it can do.
Advantages of contract-based accounts:
Disclaimer: I am a cofounder of Authereum, one of the wallets listed in the question.
To answer your original question, yes many web-based crypto wallets are safe. As you mentioned, some wallets use iframes in order to protect the user from a malicious application. With this architecture, a user's private keys are never exposed to a dapp in plain text.
It is true that a malicious dapp can try to get a user to sign malicious data. There are additional measures that can be put in place by the web-based crypto wallets.
As @tom-teman mentioned, a user can verify legitimacy of a login by verifying the URL of a new window.
There are additional protections that Authereum has in place to help keep users safe. Some of these are possible due to the contract-based architecture of a user's wallet. The following is a non-exhaustive list of Authereum security features:
Note: Authereum is fully non-custodial and censorship resistant. While the above features are a part of the Authereum system, they are not required and can be bypassed by Authereum users if they feel they are being censored.
You can check out some of the difference between these web-based crypto wallets here.
Portis displays the login page in a new window, which allows users to verify the URL. Not a foolproof solution, but a good way to combat this issue.
Consequent transactions are signed in an iframe, which could be spoofed, but the assumption is that users log into applications that they trust.
