I'm not talking about a fantasy future world but the world we have today.
Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
1,108 karma · joined July 4, 2011
[ my public key: https://keybase.io/alexei; my proof: https://keybase.io/alexei/sigs/_Wx0Ql1tQXR8Me59VHsoIVEy38ZPTMg6I47YDBF3eY8 ]
Chrome Web Store reviewers have been letting malicious extensions slide for years, and Manifest V3 did nothing to change that.
For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/
???
>You must not use device fingerprints...
Compare to the update: https://support.google.com/platformspolicy/answer/15738904
[no mention of device fingerprints]
>The changes... [are] less prescriptive with partners in how they target and measure ads.
Main Menu > Extensions > Extensions Manager > Privacy Badger > Settings > Tracking Domains > search for youtube.com > tap to update the toggle for youtube.com to red
Privacy Badger can replace YouTube embeds with "click to activate" placeholders. Faster browsing, better privacy, easy-to-use controls, at least when the replacement works properly.
See "Pro tip #1" in https://www.eff.org/deeplinks/2024/01/privacy-badger-puts-yo...
Limit online advertising to contextual ads, and to the same attribution methods advertisers have access to with traditional (TV, print and billboard) ads.
Is your browser a user agent or an advertiser agent?
Privacy Badger can replace YouTube embeds with "click to activate" placeholders. Faster browsing, better privacy, easy-to-use controls (when the replacement works properly ...).
See "Pro tip #1" in https://www.eff.org/deeplinks/2024/01/privacy-badger-puts-yo...
[1] https://privacybadger.org/#How-is-Privacy-Badger-different-f...
[2] https://privacybadger.org/#Is-Privacy-Badger-compatible-with...
uBlock Origin is indeed an excellent privacy tool. However, uBlock Origin is not a replacement for Privacy Badger (nor is Privacy Badger a replacement for uBlock Origin). For one, uBlock Origin uses manually compiled ad blocker lists, while Privacy Badger automatically learns using heuristics. Both approaches have their pluses and minuses. Our FAQ goes into what makes Privacy Badger different here[1] and here[2].
> Also it has been known that having both privacy badger and uBlock origin causes conflicts and issues.
As far as I know, the two extensions work well together. Could you point me to some of these issues?
[1] https://privacybadger.org/#How-is-Privacy-Badger-different-f...
[2] https://privacybadger.org/#Is-Privacy-Badger-compatible-with...
We wrote the following call to action a couple of years ago in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st...
> Google needs to cancel moving to service workers, restore blocking webRequest, and halt Manifest V2 deprecation until all regressions in functionality are addressed.
To their credit, Google did halt MV2 deprecation. They fixed bugs, filled in functionality gaps (examples: userScripts API, the Offscreen API cludge), and made a number of improvements to DNR, their limited-by-design replacement for the powerful and flexible webRequest API. Google also relaxed their initial, entirely unreasonable service worker lifetime requirements.
So where are we now with service workers and DNR?
The requirement to base extensions on service workers adds complexity and headaches to developers, but because of various policy changes and workarounds, it is no longer the issue it was two years ago. Google put in a lot of effort to make service workers kind of work for extensions. I think the end result is it's now harder to make a browser extension, but service workers are no longer a deal breaker.
However, blocking webRequest is still mostly gone, unavailable outside of a specific proxy authentication use case, and DNR is still not an acceptable replacement.
There are still outstanding functionality gaps such as https://github.com/w3c/webextensions/issues/302, which is interesting in that much of the tracking that privacy extensions are no longer able to properly handle is by Google!
But more importantly, DNR is fundamentally not an adequate replacement for webRequest.
As we wrote in https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st...
> [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve.
The gist is that we now all depend on Google to keep evolving the API to keep up with advertisers and trackers. Google is a massive advertising company. Chrome extensions already had one "lost decade", where nothing much happened until the Manifest V3 proposal.
It's just not a good idea to let Google hold the keys to anti-tracking tech.
I am not comfortable making that assumption! We already went through one "lost decade" for Chrome extensions.
The fundamental problem is that DNR is not an adequate replacement for webRequest. From something I wrote[2] a couple of years ago:
> [R]emoving blocking webRequest won’t stop abusive extensions, but will harm privacy and security extensions. If Manifest V3 is merely a step on the way towards a more "safe" (i.e., limited) extensions experience, what will Manifest V4 look like? If the answer is fewer, less-powerful APIs in service of “safety”, users will ultimately suffer. The universe of possible extensions will be limited to what Google explicitly chooses to allow, and creative developers will find they lack the tools to innovate. Meanwhile, extensions that defend user privacy and safety against various threats on the Web will be stuck in the past, unable to adapt as the threats evolve.
[1] https://github.com/w3c/webextensions/issues/302
[2] https://www.eff.org/deeplinks/2021/12/googles-manifest-v3-st...
https://github.com/w3c/webextensions/issues/151#issuecomment...
Google is an advertising company. Chrome extensions already experienced a lost decade, where nothing much happened until the Manifest V3 "proposal". It's not a good idea to let Google hold the keys to anti-tracking tech.
[1] I stand corrected, DNS lookups are not part of webRequest in MV2 Chrome either. This doesn't change my larger point.
The most interesting thing from the post may be that fixing tracking redirects is partially broken in Google’s Manifest V3: https://github.com/w3c/webextensions/issues/302
Google also happens to be a major link mangler and tracker.
So, link cleaner (and generally privacy) MV3 extensions in Chrome can only offer a half-broken experience to their users. A Chrome dev recently expressed support for fixing this in the issue linked above, but MV3 is already required for all new extensions in Chrome Web Store.
I think the biggest concern is to only install extensions from developers and organizations you trust.
As for your browser fingerprint, on the one hand, the more custom your browser setup, the more you stand out. On the other hand, Privacy Badger exists to reduce pervasive, non-consensual tracking. We especially aim to block pervasive fingerprinters, along with other obnoxious types of trackers.
More about Privacy Badger below, adapted from https://privacybadger.org/#Is-Privacy-Badger-compatible-with...
While there is a lot of overlap between the various manually-edited advertising/tracker lists and Privacy Badger, unlike list-based tools, Privacy Badger automatically learns to block trackers based on their behavior. This means that Privacy Badger may learn to block trackers your list-based tool doesn’t know about.
Besides automatic learning, Privacy Badger comes with other advantages like cookie blocking, click-to-activate placeholders for potentially useful tracker widgets (video players, comments widgets, etc.), and outgoing link click tracking removal on Facebook and Google (recently updated, see https://www.eff.org/badger-link-tracking-protection-update).
Privacy Badger is also a political tool. Privacy Badger sends the Global Privacy Control signal to opt you out of data sharing and selling, and the Do Not Track signal to tell companies not to track you. If trackers ignore your wishes, Privacy Badger will learn to block them. By using Privacy Badger, you support the Electronic Frontier Foundation and help fight for a better Web for everybody.
>By default, Privacy Badger receives periodic learning updates from Badger Sett, our Badger training project. This “remote learning” automatically discovers trackers present on thousands of the most popular sites on the Web. Privacy Badger no longer learns from your browsing by default, as “local learning” may make you more identifiable to websites. You may want to opt back in to local learning if you regularly browse less popular websites.
-- https://privacybadger.org/#How-does-Privacy-Badger-work
The full writeup:
https://www.eff.org/deeplinks/2020/10/privacy-badger-changin...