There's a growing debate about how much room browsers should provide for ad blocking, and Chrome and Firefox have found themselves on opposing sides.
The flaw is centered on a function known as Web Request, which is often included in ad blockers and is critical for any system that attempts to block out entire domains.
Google has long been concerned with Web Request's security and has pushed to remove it from the most recent extension standard, known as Manifest V3, or MV3 for short. However, Mozilla stated in a recent blog post that Firefox will continue to support Web Request, allowing for the most advanced forms of ad blocking.
STATING WITH MV3 FOR GOOGLE WILL HAVE A MAJOR IMPACT ON THE OVERALL ROLE OF AD BLOCKING.
The Electronic Frontier Foundation has been a loud opponent of Google's method, which has been roundly lambasted by privacy experts, but the search giant has not been swayed. Despite the fact that Firefox has a far lesser percentage of the desktop market than Chrome, this could be a chance for Mozilla's product to shine. Sticking with MV3 will, however, have a significant impact on the entire function of ad blocking on the modern web for Google.
MANIFEST V3 UNDERSTANDING
The improvements in Manifest V3 are part of a larger redesign of Chrome's browser extension manifest file, which describes the permissions, capabilities, and system resources that every application can access.
Browser extensions can leverage an API feature called Web Request in the presently active specification — Manifest V2 — to observe traffic between the browser and a website and change or prevent requests to certain sites.
Web Request is a powerful and flexible function that can be exploited for both good and harm. The capability is used by ad-blocking extensions to prevent incoming and outgoing communication between specific domains and a user's browser. They specifically block ad-loading domains and prevent information from being sent from the browser to any of the thousands of tracking domains that collect data on internet users. The same capability, however, can be used maliciously to steal users' login credentials or place additional advertising into web pages, which is why Google changed how it works in Manifest V3.
THE SAME FEATURE CAN BE MALICIOUSLY USED TO HIJACK USERS' LOGIN PASSWORDS OR INSERT EXTRA ADVERTISEMENTS INTO WEB PAGES.
The blocking version of the Web Request API has been deprecated in favor of Declarative Net Request in the new standard. Rather of monitoring all data in a network request, the new API requires extension developers to provide rules in advance about how particular types of traffic should be handled, with the extension being able to do a more limited set of actions when a rule is activated. This does not appear to be a problem for some extensions: One of the most prominent ad blockers, Adblock Plus, has endorsed the MV3 improvements - however it's worth noting that Adblock Plus has a financial relationship with Google. Others, on the other hand, may be more seriously affected.
Critics see the changes as a calculated effort to limit the impact of ad blocking on a company that is almost entirely funded by ads. Google has presented the changes as a benefit to privacy, security, and performance, but critics see them as a calculated effort to limit the impact of ad blocking on a company that is almost entirely funded by ads. (Google frequently mentions "new and existing technology that block ads online" as a risk factor that could harm income in its SEC filings.)
However, the authors of certain ad blocking and privacy-protecting extensions claim that the move will make their solutions less effective. In light of Google's recent pronouncements on privacy, Jean-Paul Schmitz, CEO of the privacy-focused browser plugin Ghostly, took specific aim at the company's imposition of the MV3 standard:
You must be logged in to post a comment.