Firefox and Chrome are competing over ad blocker extensions

There’s growing disagreement over how much room browsers should allow for ad blocking — Chrome and Firefox are finally on opposite sides of the battle.

The break is centered on a feature called web requests, which is commonly used in ad blockers and is critical to any system that wants to block domain wholesale. Google has long had security issues with Web Requests and worked to cull it from the latest extension standard, called manifest V3, or MV3 for short. but, in a recent blog postMozilla made it clear that Firefox will continue to support web requests, leaving the door open for the most sophisticated forms of ad blocking.

Google’s tactics have been heavily criticized by privacy advocates – Electronic Frontier Foundation has is a vocal opponent — but the search company hasn’t wavered. Although Firefox’s share of the desktop market is much smaller than Chrome’s, it could be an opportunity for Mozilla’s product to really define itself. For Google, though, sticking with MV3 will have a huge impact on the overall role of ad blocking in the modern web.

Understanding Listing V3

The changes in Manifest V3 are part of a planned overhaul of the Chrome browser extension manifest file specification, which defines the permissions, functions, and system resources that any extension can use.

According to the currently valid specification – Manifest V2 – the browser extension can use API feature called web request Observe traffic between browsers and websites and modify or block requests to certain domains. The example provided by Google for developers shows an extension script that will block the browser from sending traffic to “evil.com”:

Web requests are powerful and flexible, and can be used for good and bad. This feature is used by ad blocking extensions to block incoming and outgoing traffic between certain domains and the user’s browser.In particular, they block domains where ads will be loaded and prevent information from being sent from the browser to either Thousands of tracking domains Collect data about Internet users.But the same functionality can be used maliciously Hijack the user’s login credentials or insert additional advertisements into web pageswhich is Google’s reason for changing its functionality in Manifest V3.

Under the new specification, the blocking version of the Web Request API has been removed, and Superseded by an API called Declarative Network Requests. Instead of monitoring all data in network requests, the new API forces extension makers to specify rules ahead of time about how certain types of traffic should be handled, and when the rules are triggered, extensions are able to perform a narrower set of actions.For some extensions, this is apparently not a problem: Adblock Plus, one of the most popular ad blockers, already supports MV3’s changes – although it’s worth noting that the extension has a Financial relationship with Google. However, others may be more severely affected.

Google has described the changes as benefits for privacy, security and performance, but critics see it as a calculated effort to limit the impact of ad blocking on a company that is almost entirely funded by ads. (In its SEC filing, Google has been citing “new and existing technologies to block online advertising” as a risk factor that could impact revenue. )

But some creators of ad-blocking and privacy-preserving extensions say the change will erode the effectiveness of their products.Jean-Paul Schmetz, CEO of privacy-focused browser extension Ghostery, specifically targets Google for implementing the MV3 standard as the company recently Privacy Statement:

“While Google ostensibly pushes the message of ‘privacy by design,’ it still asserts a monopoly over the entire ecosystem by killing digital privacy companies that are already working to put users back in control of their data,” Schmetz told Reuters edge through email.

The Ghostery extension is a prime example of a product heavily affected by Google’s changes. In addition to blocking ad content, the extension analyzes the communication between the website and the user’s browser for data that may inadvertently identify unique website visitors and replaces it with generic data before web traffic leaves the browser.Doing so requires the ability to dynamically modify network traffic, therefore, will Severely limited by MV3 restrictionsthe developers said.

Ad blocker developers are also concerned, as the impact of these changes will extend far beyond the Chrome browser. The MV3 specification is chromium Project, an open-source web browser created by Google that underlies not only Chrome but also Microsoft Edge, a privacy-focused Brave lightweight browser Opera, and many others. Since Chromium supports these projects, browsers that rely on it eventually must also Migrating to MV3 Extended Formatand extensions for these browsers will no longer be able to use web requests for ad blocking.

Mozilla fights back

As the main developer of Chromium, Google has enormous influence over what browser extensions can and cannot do. This differentiates non-Chromium based browsers (especially Firefox and Safari) as they have the opportunity to take a different approach to extension design, and can now differentiate themselves with a more permissive approach to ad blocking.

For compatibility reasons, Mozilla will still use most Manifest V3 specification in Firefox so that extensions can be ported over from Chrome with minimal changes. Crucially, however, after Google’s phase-out, Firefox will continue to support blocking via web requests, allowing even the most sophisticated anti-tracking ad blockers to function properly.

As Chief Security Officer Marshall Erwin said, to justify this decision, Mozilla clearly recognizes that privacy is a core value for those who use its products. edge.

“We know content blocking is important to Firefox users and want to make sure they have access to the best privacy tools available,” Erwin said. “In Firefox, we block tracking by default, but still allow ads to load in the browser. If users want to take the extra step to block ads entirely, we think it’s important for them to be able to do so.”

As for Google’s claims about the security benefits of its MV3 changes, Erwin said the immediate security benefits of preventing web requests from blocking are “not obvious” — especially after retaining the other non-blocking features of web requests — and don’t appear to be significant Reduce the possibility of data breaches.

Regardless, Google seems to be holding on.Despite a flurry of criticism from ad blocker developers, Google spokesman Scott Westover told edge The company does support blocking, and only intends to limit the type of data certain extensions can collect.

“We’re excited to see Mozilla support Manifest V3, which aims to make extensions safer for everyone,” Westover said. “Chrome supports and will continue to support ad blockers. We’re changing the way web request blocking works because we’re making fundamental changes to how extensions work to improve the security and privacy features of our extension platform.”

Westover said Google has heard positive feedback on the changes from many content blocking extension developers, noting that edge Well received by the makers of Adblock Plus.

Firefox’s stance on ad blocking may encourage more users to switch to the browser, which is currently estimated to make up for Less than 8% of the desktop browser market Compared to Chrome’s 67%. Once Manifest V2 support ends in June 2023, any user of a Chromium-based browser will see the change in functionality more noticeable. Until then, Mozilla will patiently defend privacy, even if sometimes you have to dig it deep in professional blogs.