sneak/AutistMask
1
0
Fork 0
Code Issues 67 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

security: announce a fresh EIP-6963 provider UUID per page load (closes #398) #412

Open
clawbot wants to merge 1 commits from issue-398-fresh-provider-uuid into next
pull from: issue-398-fresh-provider-uuid
merge into: :next
Conversation 0 Commits 1 Files Changed 5
+127 -42
1 Commits
Author SHA1 Message Date
sneak 60d2b24cd1 security: announce a fresh EIP-6963 provider UUID per page load (closes #398)
e2e / e2e-chrome (push) Failing after 0s
Details
e2e / e2e-firefox (push) Failing after 0s
Details
check / check (push) Successful in 44s
Details 
The provider UUID was generated once, stored in extension storage, and
announced verbatim to every page on every load and across restarts, so any
site — connected or not — could read a stable cross-site, cross-session
identifier for the install: a supercookie contradicting the "no tracking"
promise. EIP-6963 wants a fresh UUIDv4 per announcement instead.

inpage.js now announces a per-load crypto.randomUUID() and persists nothing;
the eip6963Uuid storage key and the AUTISTMASK_PROVIDER_UUID content-script
message are removed. That key was a standalone top-level storage entry, never
part of the versioned autistmask profile, so stateSchema.js and the
persisted-field harness are untouched and no existing profile is affected.

A jest test asserts two loads announce different UUIDv4s and that one load
reuses a single UUID across re-announcements.

Model: opus-4-8
 2026-09-21 23:35:57 +00:00