Security

The end of privacy-enhancing browser plugins?

The Internet is a dangerous place. Some companies are spying on you and, want to get as much of your private information as possible. What are your interests? What sites are you visiting? What can we sell you? Your information is the new gold.

As a countermeasure, a range of browser plugins has been developed to enhance your privacy by blocking information-gathering attempts. A few of the most common and well-known extensions are uBlock Origin and Privacy Badger. These plugins all use Manifest V2, which grants them certain functionality and determines their permissions in the browser.

This Manifest is like a contract between the browser and the plugin. Using browser plugins doesn’t come without risks. A plugin can do things a web page cannot. On the other hand, a plugin is not just installed; the user needs to make a conscious choice to install it. Still, there are vicious plugins out there that can cause you or your computer harm.

As a way to deal with some of these issues and, at the same time, improve browser performance, Google has developed a third version of the Manifest, MV3. In this third version of the Manifest, an extension can no longer load script files from the Internet and, at the same time, also limit how plugins can interfere with the loading and monitoring of resources. Many privacy-friendly extensions, such as uBlock Origin and Privacy Badger, will see their capabilities significantly reduced using MV3; thus, they are still MV2 extensions.

On the 16th of November, 2023, Google announced the deprecation of MV2 in the Chrome browser to happen June 2024. From this date, MV2 plugins will not be able to be installed in the browser, and already installed plugins will be deactivated. Many privacy-friendly plugins are working on versions that will work with MV3 (*, **), but these will be severely limited and less effective than their MV2 versions. Chrome users will have fewer privacy protections because of this change. EFF is the organization behind Privacy Badger, and they make a lengthy explanation of the issues with MV3 in their blog.

Some Chromium-based browsers, like Brave and Vivaldi, have built-in tracking script blockers. This deprecation will not impact this functionality since they are built straight into the browsers and not using the plugin APIs. Neither will these changes affect Safari or Firefox; they will implement MV3 support but still allow support for the functionality required by many of these plugins.

This is another step Google takes to put sticks in your privacy-friendly wheels—one small step at a time. The best thing you can do is move away from Chrome to Firefox, and you will still be able to use both uBlock Origin and Privacy Badger without these constraints. I do not see an exodus from Chrome because of this. But it is worth watching Google Chrome and its next steps.

And, of course, if you can change to a browser like Firefox. Please do it!