Yea, only allowing servers to send a naked error code matched against a list of preloaded human-readable strings on the clients seems to be the only option that

Yea, only allowing servers to send a naked error code matched against a list of preloaded human-readable strings on the clients seems to be the only option that's actually social-engineering proof. If custom error messages are really needed, you could allow them as a special option while making it obvious through the client UI that this is sent from an untrusted source (field hidden by default, warning displayed when full error message is expanded). The safest option now is just to consider Electrum as insecure by default. Same with Ethereum's Parity desktop and Metamask. They're convenient for day to day use but don't trust them with big amounts. EDIT: Seems that's already been discussed in the issue: https://github.com/spesmilo/electrum/issues/4968#issuecomment-450169512 https://github.com/spesmilo/electrum/issues/4968#issuecommen...