Will the proposed Manifest V3 changes to Chrome break Privacy Badger?

[zikalify]

https://www.theregister.co.uk/2019/01/22/google_chrome_browser_ad_content_block_change/

[ghostwords]

It's not entirely clear yet, but at this point it seems that the changes proposed in the Manifest V3 document are made to support basic list-based blockers only. It's not clear how Manifest V3 would allow for more complex extensions like uBlock Origin, uMatrix, or Privacy Badger. I would like to learn more about this situation from Chromium developers.

[ghostwords]

Devlin writes:

Our goal is not to break extensions. We are working with extension developers to strive to keep this breakage to a minimum, while still advancing the platform to enhance security, privacy, and performance for all users.
...
The most helpful feedback for us is the exact cases that this would impact, their importance, and the reasons they are impossible through either the declarative API or through other extension APIs.

[ghostwords]

An overview of the Manifest V3 proposal's impact upon Privacy Badger

Privacy Badger is a browser extension that automatically learns to block invisible trackers.

Instead of keeping lists of what to block, Privacy Badger learns by watching which domains appear to be tracking you as you browse the Web. Privacy Badger sends the Do Not Track signal with your browsing. If trackers ignore your wishes, your Badger will learn to block them. Privacy Badger starts blocking once it sees the same tracker on three different websites.

The Manifest V3 proposal thoroughly breaks this description. It appears that Privacy Badger will no longer be able to dynamically learn to block trackers, report what it blocked on a page, block cookies from being set or sent, strip referrer headers, nor properly support EFF's Do Not Track policy.

If you remove what makes Privacy Badger unique, replacing it with basic list-based blocking, what are you left with?

Replacing persistent background pages with ServiceWorkers

A non-persistent event-driven background page does not work well for extensions that need to keep ephemeral state.

• Privacy Badger maintains per-tab data that includes things like which third-party domains were detected and/or blocked on the page.

• It may be possible to continuously save and restore state from storage as a workaround, but this runs counter to the stated performance goals of moving away from persistent background pages. It seems that persistent background pages are a much better fit for certain (stateful) types of extensions.

• As Privacy Badger requires the webRequest API (more on this below), a persistent background page is required as per Chrome extension docs:

  The webRequest API is incompatible with non-persistent background pages.

There are likely other issues (will a ServiceWorker background page support functioning in Incognito contexts, which is essential for privacy and security extensions?), but they are eclipsed by the fundamental mistake of trying to shoehorn stateful extensions into an exclusively event driven model.

Restricting origin access / Manifest Host Permission Specification

Making users confirm extension access (host_permissions) does not seem to make sense for general-purpose content blocking (adblocker/privacy/security) extensions. Outside of edge cases (for example, a Facebook.com-specific extension), content blockers need access across all URLs. Redundantly prompting users for permission to run these scripts (on top of the existing notification users see when initially installing Privacy Badger) will be unhelpful and confusing.

As Chrome extension docs for permissions state:

Use required permissions when they are needed for your extension’s basic functionality.

Dynamic Content Scripts

Many of Privacy Badger's content scripts need to run on all pages in order to do things like detect localStorage-based tracking and canvas fingerprinting, or deny JavaScript access to cookies and localStorage to "yellowlisted" third-party domains.

It would be great to finally have dynamic, before-anything-else injection of content scripts (https://crbug.com/478183). However, as per the host_permissions note above, it doesn't make sense to make users have to re-confirm this access via permission dialogs.

WebRequest

Removing "blocking" (synchronous request/response interception) from webRequest will break core Privacy Badger functionality.

The declarativeNetRequest API is an entirely inadequate replacement as it supports onBeforeRequest blocking and redirection only (not header/body inspection or modification), and seems to support (a limited number of) hardcoded rules only.

• Privacy Badger needs to dynamically create rules.
• Privacy Badger's rules interact with each other. A request that would be blocked may be overriden to "cookie-blocked" instead by the user, or it may be registered as a DNT-compliant domain and thus allowed.
• Rules need to be further qualified by things like whether the request/response domain is third-party to the top-level document.
• Privacy Badger needs to report what it did (blocked, etc.) on a page.
• Privacy Badger needs to be able to modify content headers (block cookies, strip referrers, perhaps modify ETag headers, ...).
• Privacy Badger would benefit from being able to modify response bodies like WebExtensions can in Firefox. The webRequest API should be gaining, not losing functionality.
• Privacy Badger needs to encourage privacy-respecting ads by continuing to enforce the EFF Do Not Track policy. This means Privacy Badger needs to continue being able to check blocked domains for declarations of DNT compliance.

The above is not meant to be an exhaustive list. The point is that it is a fundamental mistake to try to shoehorn all content intercepting extensions into the limited-by-design declarative model.

[pipboy96]

Related: ungoogled-software/ungoogled-chromium#706.

[pipboy96]

See the issue in HTTPS Everywhere's repository for statements recently made by browser vendors: EFForg/https-everywhere#17268.

[sillyjaybird]

@ghostwords I'm finding little current info on MV3 generally and wondering if you've learned anything new about it's impact on Privacy Badger? Is any work being done to develop a POC/ MV3-compliant version of the extension?

[ghostwords]

You can read our latest update on the EFF blog, Google’s Manifest V3 Still Hurts Privacy, Security, and Innovation. While the post doesn't go into Privacy Badger specifically, we talk about what happened around Manifest V3 in the last two years, what's (still) wrong with it, and how it could be better.

I have been participating in the W3C WebExtensions Community Group to advocate for extension developers and to raise awareness of the many problems with Manifest V3.

Privacy Badger in Manifest V3 is blocked by at least one (long-outstanding) bug, Chromium Issue 102421: webRequest listeners not called after service worker stops.

[sillyjaybird]

Since the rollout of 2023 is fast approaching, is an MV3 compatible version of Privacy Badger in development?

[ghostwords]

Yes, I'm working on it. I'll post an update when we have something to share.

[sillyjaybird]

@ghostwords MV2 deprecation slated for June '24. How is MV3 development going?
https://developer.chrome.com/blog/resuming-the-transition-to-mv3/

[ghostwords]

It's going! We've been making changes to prepare Privacy Badger for non-persistent background processes, be it an event page (Firefox) or an extension service worker (Chrome). We're now moving content filtering from webRequest to declarativeNetRequest.

[ghostwords]

Privacy Badger version 2024.5.30 is live in Chrome Web Store. You can get get this update now by visiting chrome://extensions/, enabling "Developer mode" and clicking the "Update" button.

Producing this version took months of running to stay in place. MV3-based Privacy Badger is not a "lite" version of Privacy Badger. It is functionally similar to MV2-based Privacy Badger, slightly better in some ways, and worse in other ways, some of which will get fixed over the coming months.

[sillyjaybird]

Privacy Badger version 2024.5.30 is live in Chrome Web Store. You can get get this update now by visiting chrome://extensions/, enabling "Developer mode" and clicking the "Update" button.

Producing this version took months of running to stay in place. MV3-based Privacy Badger is not a "lite" version of Privacy Badger. It is functionally similar to MV2-based Privacy Badger, slightly better in some ways, and worse in other ways, some of which will get fixed over the coming months.

Are you able to describe the feature pros and cons of the MV3 version and which ones may get fixed over time? Or will you do this later as development progresses or is finalized, e.g. via an EFF blog post?

[ghostwords]

I've got to put out a few fires first. Afterwards, I'll be able to start documenting and generally sharing more. But there are few "pros". Manifest V3 is a huge mess. If Google wanted to, they could have rolled out a Manifest 2.5 with all of the pros and none of the cons, you know?

[sillyjaybird]

I've got to put out a few fires first. Afterwards, I'll be able to start documenting and generally sharing more. But there are few "pros". Manifest V3 is a huge mess. If Google wanted to, they could have rolled out a Manifest 2.5 with all of the pros and none of the cons, you know?

I don't know how many developers contirbute to the project, but will you maintain both MV2 and MV3 versions or settle on the latter when it's more polished given it's shortcomings?

[ghostwords]

We will maintain MV2 Privacy Badger for as long as it makes sense to do so. Right now only Chrome is on MV3.

I think the biggest bright side here is that we should now be much closer to having Privacy Badger for Safari on macOS.