A recent Github issue shows that Metamask broadcasts ETH addresses of its users to websites by default, raising concerns about privacy.