Friday, December 8, 2023

Firefox and Chrome are squaring off over ad-blocker extensions

Must read

There’s a growing divide over how many camera browsers should be left for ad blocking – and Chrome and Firefox have arrived on opposite sides of the battle.

The breakthrough focuses on a feature called Web Request, which is often used in ad blockers and is crucial for any system looking to block a wholesale domain. Google has long been concerned about the security of Online Request and has worked to remove it from the latest extension standard, called Manifest V3, or MV3 for short. But, in a recent blogMozilla explained that Firefox will maintain support for Web Request, keeping the door open for the most advanced forms of ad blocking.

Google’s strategy has been widely criticized by privacy advocates – the Electronic Frontier Foundation has was a vocal opponent – but the search engine was not shaken. Although Firefox has a much smaller share of the desktop marketplace than Chrome, it could be an opportunity for the Mozilla product to really define itself. For Google, however, staying with MV3 will have a huge impact on the overall role of ad blocking on the modern web.

Understanding Manifest V3

The changes in Manifest V3 are part of a planned revision to the specification for Chrome’s browser extension manifest file, which defines the permissions, capabilities, and system resources that any extension can use.

Under the currently active specification – Manifest V2 – browser extensions can use an An API function called Web Request observe traffic between the browser and the website and modify or block requests to certain domains. The example Google provides for developers shows an extension that would block the browser from sending traffic to “”:

The Online Request feature is powerful and flexible, and can be used for both good and bad purposes. Ad-blocking extensions use the feature to block incoming and outgoing traffic between certain domains and a user’s browser. In particular, they block domains that will load advertisements and stop sending information from the browser to any of the thousands of tracking domains which collect data about internet users. But the same function can be used maliciously for hijack users’ login credentials or embed additional advertisements on web pageswhich was Google’s rationale for changing how it works in Manifest V3.

Under the new specification, the blocking version of the Web Request API has been removed and replaced with an API called Declarative Net Request. Instead of monitoring all the data in a network request, the new API forces extension makers to specify rules in advance about how certain types of traffic should be handled, with the extension capable of making a narrower set when a rule is triggered. For some extensions, this doesn’t seem to be a problem: Adblock Plus, one of the most popular ad blockers, has been in favor of MV3’s changes – though it’s worth noting that the extension has a financial relationship with Google. Others, however, may be more severely affected.

Google has touted the changes as an advantage to privacy, security and performance, but critics see it as a calculated effort to limit the impact of ad placement on a company that is almost entirely funded by advertising. (In its SEC filesGoogle constantly cites “new and existing technologies that block online advertising” as a risk factor that could affect revenue.)

But the creators of some ad-blocking and privacy-protecting extensions said the change would undermine the effectiveness of their products. Jean-Paul Schmetz, CEO of the privacy-focused browser extension Ghostery, specifically targeted Google’s imposition of the MV3 standard in light of the company’s recent privacy statements:

“While Google is pushing a message of‘ privacy by design ’on the surface, it still claims a monopoly over the entire ecosystem by stifling digital privacy companies that are already working to give users back control of their data,” Schmetz said. The Edge by email.

The Ghostery extension is a prime example of a product that would be severely affected by Google’s changes. In addition to blocking ad content, the extension analyzes communications between a website and a user’s browser to search for data that could inadvertently identify a unique visitor and replace it with general data before web traffic leaves the browser. Doing this requires the ability to modify network traffic on the flight and, as such, will be severely limited by the MV3 restrictionssay the developers.

Advertiser developers are also concerned, as the effects of these changes will go far beyond the Chrome browser. The MV3 type is part of the Chrome project, an open source web browser created by Google that forms the basis of not only Chrome but also Microsoft Edge, the privacy-focused Brave, a lightweight Opera browser, and many others. Because Chromium supports these projects, browsers that depend on it will also eventually need to migrate to the MV3 extension formatand extensions for those browsers will then no longer be able to block advertising via Internet Request.

Mozilla repulses

As the main developer of Chromium, Google exerts tremendous power over what browsers can and cannot do. This separates browsers that are not based on Chromium – especially Firefox and Safari – because they have a chance to take a different approach to extension design and can now distinguish themselves by a more permissive approach to ad blocking.

For compatible reasons, Mozilla will still use most of the Manifest V3 specification in Firefox so that extensions can be ported from Chrome with minimal changes. But, importantly, Firefox will continue to support blockchain via Internet Request after Google removes it, enabling the most advanced anti-tracking ad blockers to function normally.

Justifying that decision, Mozilla was clear in recognizing that privacy is a core value for people who use its products, as chief security officer Marshall Erwin said. The Edge.

“We know that blocking content is important for Firefox users and we want to make sure they have access to the best privacy tools available,” Erwin said. “In Firefox we block tracking by default but still allow ads to load in the browser. If users want to take the extra step to completely block ads, we think it’s important to enable them to do so.”

Regarding Google’s claims about the security benefits of its MV3 changes, Erwin said that immediate security gains from preventing Web Request blocking were “not obvious” – especially since other non-blocking Web Request features were retained – and not it seemed. make significant reductions in the likelihood of data flow.

Anyway, at least I didn’t go down without explaining myself first. Despite the uproar from critics of ad blocker developers, said Google spokesman Scott Westover The Edge that the company maintained a blockchain and only intended to limit the type of data that some extensions could collect.

“We’re excited to see Mozilla support Manifest V3, which aims to make extensions safer for everyone,” Westover said. “Chrome supports and will continue to support ad blockers. We are changing the way blockchain requests work because we are making fundamental changes to how extensions work to improve the security and privacy features of our extension platform.”

Google has heard positive feedback on changes by many developers of content blocking extensions, Westover said. The Edge praise from the creators of Adblock Plus.

It is possible that Firefox’s stance on ad blocking will encourage more users to switch to the browser, which is currently estimated to compensate. less than 8 percent of the desktop browser market compared to Chrome’s 67 percent. Once Manifest V2 support ends in June 2023, changes in functionality will become more apparent to users of any Chromium-based browser. Until then, Mozilla will patiently make the case for privacy, even if sometimes you have to search for it in depth in a specialist blog.


More articles

Latest article