[Security] Crypto Wallets is enabled by default in private mode

[kholbekj]

Description

When entering safe-mode and accessing a page, the meta-mask extention remains active and connected to the site.

Steps to Reproduce

1. Enable crypto wallet
2. connect to a Dapp
3. open a private session
4. go to same dapp.

Actual result:

The wallet is picked up, and the website can read the address of the user.

Expected result:

The wallet is not by default on (or at least connected to the app), so that the app cannot immediately identify the user.

Brave version (brave://version info)

Brave | 1.18.75 Chromium: 87.0.4280.101 (Official Build) (64-bit)
-- | --
Revision | 9407c80213cda69c2b7abcb4fa8e3f74488f4956-refs/branch-heads/4280@{#1807}
OS | Linux
JavaScript | V8 8.7.220.29
Flash | (Disabled)
User Agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.101 Safari/537.36
Command Line | /opt/brave.com/brave/brave --enable-dom-distiller --disable-domain-reliability --no-pings --extension-content-verification=enforce_strict --extensions-install-verification=enforce --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --sync-url=https://sync-v2.brave.com/v2 --lso-url=https://no-thanks.invalid --variations-server-url=https://variations.brave.com/seed --enable-features=PrefetchPrivacyChanges,WebUIDarkMode,AutoupgradeMixedContent,DnsOverHttps,LegacyTLSEnforced,PasswordImport,ReducedReferrerGranularity --disable-features=AllowPopupsDuringPageUnload,VideoPlaybackQuality,TabHoverCards,AutofillEnableAccountWalletStorage,PrivacySettingsRedesign,NotificationTriggers,SmsReceiver,TextFragmentAnchor,IdleDetection,NetworkTimeServiceQuerying,PasswordCheck,AutofillServerCommunication,SignedExchangeSubresourcePrefetch,SafeBrowsingEnhancedProtection --flag-switches-begin --flag-switches-end
Executable Path | /opt/brave.com/brave/brave

[diracdeltas]

@ryanml @bbondy will this be fixed when Dapp detection is removed? i agree that websites in incognito mode should not be able to see the wallet ID, at least not without user permission

[bbondy]

I think it is different

[kholbekj]

Am I wrong to say it is metamask? Looking at the console, it does seem so.

[srirambv]

Verification passed on

Brave	1.20.100 Chromium: 88.0.4324.146 (Official Build) (64-bit)
Revision	406dc88511162d6598242f2c709be1414a042fb0-refs/branch-heads/4324@{#2088}
OS	Linux

• Verified steps from issue description
• Verified Crypto Wallet is not enabled by default on private window
  

---

Verification passed on

Brave	1.20.100 Chromium: 88.0.4324.146 (Official Build) (64-bit)
Revision	406dc88511162d6598242f2c709be1414a042fb0-refs/branch-heads/4324@{#2088}
OS	Windows 10 OS Version 2009 (Build 19042.746)

• Verified steps from issue description
• Verified Crypto Wallet is not enabled by default on private window
  

---

Verification passed on

Brave	1.20.100 Chromium: 88.0.4324.146 (Official Build) (x86_64)
Revision	406dc88511162d6598242f2c709be1414a042fb0-refs/branch-heads/4324@{#2088}
OS	macOS Version 10.15.7 (Build 19H114)

• Verified steps from issue description
• Verified Crypto Wallet is not enabled by default on private window