Firefox and Chrome outperform ad blocker extensions

There is a growing division over how much space Internet browsers should leave to block ads – and Chrome and Firefox have ended up on opposite sides of the fight.

The rip focuses on a feature called Web Request, commonly used in ad blockers and crucial to any system looking to block domain wholesale. Google has always had security concerns about the web request and has worked to exclude it from the latest extension standards, It’s called Manifest V3Or MV3 for short. But, In a recent blog postMozilla explained that Firefox will maintain support for Web Request, keeping the door open for the most sophisticated form of ad blocking.

Google’s strategy has come under fire from privacy advocates – the Electronic Frontier Foundation has done it It was an outright opponent – But the search company was not affected. Although Firefox has a much smaller share of the desktop market than Chrome, it could be an opportunity for the Mozilla product to really define itself. For Google, though, adhering to MV3 will have a significant impact on the overall ad blocking role on the modern web.

Understanding Manifest V3

The changes in Manifest V3 are part of a planned overhaul of the Chrome browser extension’s manifest file specification, which defines the permissions, capabilities, and system resources that an extension can use.

Under the currently active specification – Manifest V2 – browser extensions can use a . file API feature called web request To monitor the traffic between the browser and the website and to modify or block requests to certain domains. The example Google gives developers shows an extension script that prevents the browser from sending traffic to “evil.com”:

Web Request is powerful and flexible, and it can be used for both good and bad purposes. Ad blocking extensions use this feature to block incoming and outgoing traffic between certain domains and the user’s browser. In particular, they block domains that will load ads and stop sending information from the browser to any file Thousands of tracking fields that collects data about Internet users. But the same feature can be used maliciously Hijack users’ login credentials or insert additional ads into web pageswhich was Google’s rationale for changing how it works in Manifest V3.

Under the new specification, the blocking version has been removed from the Web Request API and It has been replaced by an API called net declarative order. Rather than monitoring all the data in a network request, the new API forces extension makers to pre-define rules about how they handle certain types of traffic, with the extension able to perform a narrower set of actions when the rule is triggered. For some extensions, it seems this won’t be a problem: Adblock Plus, one of the most popular ad blockers, has appeared in favor of MV3 changes – although it’s worth noting that the extension has Financial relationship with Google. However, others may be more affected.

Google presented the changes as a privacy, security, and performance advantage, but critics see it as a calculated attempt to limit the impact of ad blocking on a company that is funded almost entirely by ads. (in SEC . filingsGoogle continually cites “new and existing technologies that block online ads” as a risk factor that could affect revenue.)

But the makers of some ad-blocking and privacy-protection extensions said the change would undermine the effectiveness of their products. Jean-Paul Schmitz, CEO of the privacy-focused browser extension Ghostery, has taken a special goal of Google’s enforcement of the MV3 standard in light of the company’s latest release. Statements about privacy protection:

“While Google is pushing the ‘privacy by design’ message to the surface, it continues to assert its monopoly on the entire ecosystem by stifling digital privacy companies already working to give users back control over their data,” Schmitz said. the edge by e-mail.

The Ghostery extension is a prime example of a product that could be severely affected by changes to Google. Besides blocking advertising content, the extension analyzes communications between a website and a user’s browser to look for data that can inadvertently identify a unique visitor to the site and replace it with general data before network traffic leaves the browser. Doing so requires the ability to modify web traffic on the go, and as such, it will be severely curtailed due to MV3 limitationsAs the developers say.

The developers of ad blockers are also concerned that the effects of these changes will reach far beyond the Chrome browser. The MV3 specification is part of chrome Enterprise, an open source web browser created by Google that forms the basis for not only Chrome but also Microsoft Edge, the privacy-focused lightweight Opera browser Brave, And many other things. Since Chromium supports these projects, browsers that depend on it will eventually have to Move to MV3 Extension FormatExtensions for these browsers will no longer be able to block ads using Web Request.

Mozilla pushes back

As the primary developer of Chromium, Google exercises an enormous amount of power over what browser extensions can and cannot do. This differentiates browsers that don’t rely on Chromium – notably Firefox and Safari – because they have a chance to take a different approach to extension design and are now in a position to set them apart by a more permissive approach to ad blocking.

For compatibility reasons, Mozilla will still use most . files From the Manifest V3 specification in Firefox so that extensions can be moved from Chrome with minimal changes. But, crucially, Firefox will continue to support web-request blocking after Google phases out it, enabling more sophisticated ad blockers to function as normal.

In justifying this decision, Mozilla was clear in recognizing that privacy is a core value for the people who use its products, Chief Security Officer Marshall Irwin said. the edge.

“We know that content blocking is important to Firefox users and we want to ensure that they have access to the best privacy tools available,” Erwin said. “In Firefox, we block tracking by default but still allow ads to load in the browser. If users want to take the extra step of blocking ads completely, we think it is important to enable them to do so.”

As for Google’s claims about the security benefits of its MV3 changes, Irwin said the immediate security gains from preventing web requests from being blocked were “unclear” — particularly since other non-blocking features of a web request were retained — and did not appear to make significant reductions in the potential for leaks. data.

Regardless, Google appears to be on its way. Despite a wave of criticism from ad-blocking developers, Google spokesperson Scott Westover the edge The company supports the ban and is only meant to limit the type of data some extensions can collect.

“We are excited to see Mozilla support Manifest V3, which aims to make add-ons more secure for everyone,” Westover said. Chrome supports and will continue to support ad blockers. We’re changing how network request blocking works because we’re making fundamental changes to how extensions work in order to improve the security and privacy features of our extension platform.”

Westover said, noting that Google has heard positive feedback about the changes from many content-blocking extension developers the edge To praise from the makers of Adblock Plus.

Firefox’s stance on ad blocking will likely encourage more users to switch to the browser, which is currently estimated to be a component Less than 8 percent of the desktop browser market Compared to 67 percent of Chrome. Once support for Manifest V2 ends in June 2023, the changes in functionality will become more visible to users of any Chromium-based browser. Until then, Mozilla will patiently advocate for the privacy issue, even if you sometimes have to dig into it in depth in a niche blog.