web_accessible_resources and UUID leaking

[atomGit]

i was just doing some long overdue reading on how extensions (and in turn the browser) can be fingerprinted and i see that if an ext. uses "web_accessible_resources" (and JS is enabled), it's possible for a website to get the UUID of the ext.

in the CRX manifest i'm seeing "web_accessible_resources" and i'd just like to get your take on whether it may be affected by this

Bug 1405971

[Rob--W]

I just double-checked, and no, my extension does NOT leak the origin/UUID.
My extension only issues HTTP GET requests, and someone previously reported that GET requests (i.e. the most common form of HTTP requests) are not affected by the bug at https://bugzilla.mozilla.org/show_bug.cgi?id=1405971#c46 .

Side note, whether web_accessible_resources is used or not, if the receiving site receives the Origin/UUID, then they will still be able to have a stable identifier of the client. The only thing that web_accessible_resources does is allowing anyone with knowledge of the UUID to detect whether it's the same client (i.e. active fingerprinting).

Side note 2: I guess that I can remove web_accessible_resources from my extension. I'm not sure why it's there (possibly to work around a bug in Chrome), but in any case it is not necessary for the core functionality of the extension.

[atomGit]

thanks Rob - since you're planning on removing web_accessible_resources i'll leave this open for you to close

[atomGit]

ps: you seem pretty familiar with this so maybe this is not needed, but here's some additional info if interested