Advertisement
There’s a growing disagreement over how much space browsers should leave for ad blocking – and Chrome and Firefox have ended up on opposite sides of the battle.
The breach focuses on a feature called Web Request, which is commonly used in ad blockers and is vital to any system attempting to wholesale block a domain. Google has long had security concerns about Web Request and has been working to excise it from the latest extension standard called Manifest V3, or MV3 for short. But in a recent blog post, Mozilla made it clear that Firefox will retain support for Web Request, leaving the door open to the most sophisticated forms of ad blocking.
Google’s strategy has been harshly criticized by privacy advocates – the Electronic Frontier Foundation has been a vocal opponent – but the search company has stood its ground. Although Firefox has a far smaller share of the desktop market than Chrome, it could be a chance for Mozilla’s product to really define itself. However, for Google, sticking with MV3 will have a huge impact on the overall role of ad blocking on the modern web.
Understand Manifesto V3
The changes in Manifest V3 are part of a planned revision of the specification for Chrome’s browser extension manifest file, which defines the permissions, capabilities, and system resources each extension can use.
Under the currently active specification – Manifest V2 – browser extensions can use an API function called Web Request to observe traffic between the browser and a website and modify or block requests to specific domains. The example Google provides for developers shows an extension script that would prevent the browser from sending traffic to evil.com:
The Web Request feature is powerful and flexible, and can be used for both good and bad purposes. Ad blocking extensions use the feature to block inbound and outbound traffic between specific domains and a user’s browser. In particular, they block domains that load ads and prevent information from being sent from the browser to any of the thousands of tracking domains that collect data about Internet users. However, the same feature can be used maliciously to hijack users’ credentials or inject additional ads into web pages, which was Google’s rationale for changing how it works in Manifest V3.
Under the new specification, the blocking version of the Web Request API has been removed and replaced with an API called Declarative Net Request. Instead of monitoring all of the data in a network request, the new API forces extension makers to set rules upfront about how specific types of traffic should be handled, with the extension able to perform a narrower set of actions when a rule is triggered. Apparently, this won’t be a problem for some extensions: Adblock Plus, one of the most popular ad blockers, has spoken out in favor of the MV3 changes – although it’s worth noting that the extension has a financial relationship with Google. However, others may be more affected.
Google has presented the changes as privacy, security and performance benefits, but critics see it as a calculated attempt to limit the impact of ad blocking on a company that is almost entirely funded by ads. (In its SEC filings, Google consistently cites “new and existing technologies that block online ads” as a risk factor that could impact revenue.)
However, the developers of some ad blocking and privacy extensions have stated that the change will undermine the effectiveness of their products. Jean-Paul Schmetz, CEO of privacy-focused browser extension Ghostery, specifically targeted Google’s adoption of the MV3 standard given the company’s recent privacy statements:
“While Google is forcing a ‘privacy by design’ message to the surface, it still maintains a monopoly over the entire ecosystem, smothering digital privacy companies that are already working to give users back control of their data,” Schmetz said The edge by email.
The Ghostery extension is a prime example of a product that would be seriously affected by Google’s changes. In addition to blocking advertising content, the extension analyzes communications between a website and a user’s browser to look for data that could unintentionally identify a unique website visitor and replaces it with generic data before network traffic leaves the browser. This requires the ability to change web traffic on the fly, and is therefore severely constrained by the MV3 limitations, the developers say.
Ad blockers are also concerned, as the impact of these changes will extend far beyond the Chrome browser. The MV3 specification is part of the Chromium project, an open-source web browser developed by Google that forms the basis of not only Chrome but also Microsoft Edge, the privacy-focused Brave, the lightweight browser Opera, and many others. Because Chromium underpins these projects, browsers that depend on it will eventually have to migrate to the MV3 extension format as well, and extensions for those browsers will then no longer be able to do ad blocking with Web Request.
Mozilla strikes back
As the main developer of Chromium, Google wields tremendous power over what browser extensions can and cannot do. This differentiates non-Chromium browsers – notably Firefox and Safari – because they have the opportunity to take a different approach to extension design and can now boast a more permissive approach to ad blocking.
For compatibility reasons, Mozilla will continue to use most the Manifest V3 specification in Firefox, allowing extensions to be picked up by Chrome with minimal changes. Crucially, however, Firefox will continue to support web request blocking after Google has phased it out, allowing the most advanced anti-tracking ad blockers to function as usual.
In justifying this decision, Mozilla clearly recognized that privacy is a core value for people who use its products, Chief Security Officer Marshall Erwin said The edge.
“We know that blocking content is important to Firefox users and want to make sure they have access to the best privacy tools available,” said Erwin. “In Firefox, we block tracking by default, but still allow ads to load in the browser. If users want to take the extra step of blocking ads entirely, we think it’s important to allow them to do so.”
Regarding Google’s claims about the security benefits of its MV3 changes, Erwin said that immediate security gains from removing web request blocking are “not obvious” — particularly given that other non-blocking web request features have been retained — and neither does the likelihood, apparently significantly reduce data leakage.
Regardless, Google appears to be staying the course. Despite strong criticism from ad blocker developers, Google spokesman Scott Westover said The edge that the company supported blocking and only intended to limit the type of data certain extensions could collect.
“We’re excited that Mozilla supports Manifest V3, which aims to make extensions safer for everyone,” said Westover. “Chrome supports ad blockers and will continue to do so. We are changing how network request blocking works because we are making fundamental changes to how extensions work to improve the security and privacy properties of our extension platform.”
Google has heard positive feedback about the changes from many content blocking extension developers, Westover said, showing The edge Praise from the makers of Adblock Plus.
It’s possible that Firefox’s ad-blocking stance encourages more users to switch to the browser, which is currently estimated to account for less than 8 percent of the desktop browser market, compared to Chrome’s 67 percent. Once support for Manifest V2 ends in June 2023, changes to the functionality will become more apparent for users of Chromium-based browsers. Until then, Mozilla will patiently plead for privacy, even if you sometimes have to dig deep into a specialized blog for it.
