How Google Chrome is declaring war against ad blockers

I’ve written a lot about ad blockers in the last few weeks, from Google’s Chrome updates making some popular options inoperable, to alternatives that will work, to my reason for blocking every ad on YouTube. So when I was contacted by representatives from Ghostery, a German company that operates an ad-blocker extension and other privacy products, I was eager to pick their brains.

I’ve been a technology writer for over 10 years, and I can wax poetic on building PCs and keyboards all day. But I’m not a web developer or programmer of any kind, so I relished the opportunity to get an expert opinion on the changes in Chrome’s extension support, from Manifest V2 to V3. The V3 changeover, and its more restrictive access model to some of the browser’s most important internal functions, is the big reason that uBlock Origin won’t be compatible with Chrome and Chromium browsers soon.

What’s changing in Chrome’s Manifest V3

Ghostery

Ghostery let me speak with Krzysztof Modras, the director of engineering and product, and company CEO Jean-Paul Schmetz. And the first thing I asked was, what’s the big difference in the Manifest V3 extension support that’s causing all these issues for ad blockers?

“The most important limitation of Manifest V3 is the removal of extension access to the browser’s network layer,” Modras said. “The enforcement of this declarative approach disables advanced on-device protection and in turn will significantly limit innovation in the privacy space. Extensions will lose important tools and permissions that have previously allowed them to quickly react to new threats directly from the user device.”

“[Google said] the goal was to improve privacy, but that never actually happened,” said Schmetz. Because effective extensions compliant with Manifest V3 will need to request access to every single website — something that UBlock Origin Lite does in order to work on the new standard — users could become complacent with these requests, and make themselves more vulnerable to rogue actions.

Martyn Casserly

Modras pointed out that, while ad-blocking extensions can’t directly modify network requests, other extensions can still get access to user data. So locking access to the layer without fully locking it down is creating a potential security vulnerability: Rogue extensions can continue to abuse other permissions to monitor and potentially relay all that data, even though ad-blocking extensions can’t modify or block it for the user.

“Google’s approach to extensions in the browser appears to be limiting them to be as single-purpose as possible,” said Schmetz, “ideally working on just one website. So serious tools will need to request ‘wide host permissions’ that come with ‘scary’ security messages about access to ‘usernames and passwords.’”

Manifest V3 has other restrictions that make ad blocking harder, including limits for static and dynamic rules. The immediate effect users will see is that updates to ad-blocking lists will come slower, and some pages that experienced breakage won’t be fixed as fast as under Manifest V2.

Schmetz believes that Google sees user-installable extensions as a detriment to Chrome as a browser and a platform, at least from its perspective as a company focused on advertising and user data. When Chrome launched in 2008, its biggest competition was Firefox, so extension support was a must-have feature. But Schmetz points out that the Android version of Chrome still has no browser extension capabilities years later, even though Firefox on Android has had this for quite a while.

Chrome is currently the #1 browser in the world, with 65 percent of the market on both desktop and mobile. Edge, also based on Chromium, is a distant second on desktop, with Apple’s Safari at about 25 percent on mobile.

Is Google intentionally hampering ad blockers?

On the subject of Google’s intentions as the maintainer of Chrome, I decided to be blunt. “Do you think Google made the Manifest V3 changes to protect its advertising interests and leverage Chrome’s market share?” I asked.

“The true answer to that is that Google is probably too complicated as an organization to do that efficiently,” said Schmetz. “What is absolutely clear is that they tried to make Chrome a more predictable platform, because Chrome for them is a very important platform for the rest of their monopolies.

“One of the first uses of extensions on Chrome was to change the default search engine. Ghostery is about making sure Chrome isn’t leaking data left and right, as well as blocking ads. Google has its own analytics services, which we block.

“From the perspective of Google, no extension makes Chrome better, for the user, for Google, for Google’s customers. But I don’t think [Google CEO] Pichai said ‘we’ve gotta kill extensions for our ad business,’ not at all.”

Modras added some technical context. “Protecting their ad business is something Google will never admit to openly. They’ll say, ‘if we disallow add-ons for intercepting the network layer, then Chrome will be X percent faster.’”

Though Ghostery is free, like most ad-blockers, it is a private company that offers a suite of privacy tools for $4.99 a month. So it’s worth pointing out that it has interests of its own at play. Like most of its competition including AdBlock Plus and AdGuard, Ghostery has made its application compatible with Manifest V3…because the alternative simply isn’t viable commercially.

uBlock Origin is an interesting divergence, as it’s an open-source project that appears to still be handled by one developer. uBlock Origin Lite is a completely separate extension, and it’s far more limited than both the original version and other V3-compliant ad-blockers — a deliberate design choice. Modras says that uBO developer Raymond Hill made it compliant with Google’s guidelines without any attempt to get around the limitations to illustrate exactly why they aren’t practical, something that’s demonstrated in Ramond Hill’s own words.

While Manifest V3 has changed quite a bit since its initial announcement, uBO Lite still has significantly less capability than its V2 progenitor. The tool is far less capable of blocking ads on YouTube, updating the lists of addresses to block has to wait for Google’s approval of major extension revisions via the Chrome Web Store, and users will have to grant full permissions to every site in order to get full blocking capability.

Ghostery’s approach to Manifest V3 compliance is different. While it’s remaining a single extension for all the browsers and platforms it supports, Modras says that it’s only modifying the core of the tool on Chrome at the moment for Manifest V3…though other Chromium-based browsers like Edge, Brave, and Vivaldi may have to come along eventually. The Firefox version of Ghostery will retain all its original capabilities.

Ghostery

Ghostery and others are still updating their methods, to retain V3 compliance and make the extensions better at blocking ads and other trackers. But losing access to the network layer is still the biggest stumbling block. “New techniques are being created, but the potential for innovation is greatly limited,” said Modras. “It has required serious investment from the entire industry to completely rebuild their adblocking engines.”

I asked them about alternative methods of blocking ads, like running a separate Windows program, or blocking at the network access level with a VPN or tools like the popular Pi-Hole.

They said that no OS-based tool will be able to help you with certain types of advertising or tracking, since modern browsers encrypt all their traffic. Once that data leaves the browser it becomes impossible to distinguish between the sites and the advertising — those programs can’t distinguish between a website serving up a fully rendered page or just sending in an image and hyperlink for an ad. “You need a browser extension specifically, and no other piece of software would be able to do that.”

An immediate example would be Google potentially switching to server-side ads, rendered on the same YouTube video stream as the primary video. There would be no way to block just the ad and not the entire video.

There are still methods for dealing with this — an extension called SponsorBlock already auto-skips advertising that YouTube creators put in their own videos. But that requires monitoring and analysis from thousands of users, sort of like a live traffic monitoring system getting aggregated data from individual drivers. It’s clear that whatever Google’s stated intention, Manifest V3 is going to make it much harder for ad blockers to fulfill their purpose.

While it’s possible that other Chromium-based browsers could avoid this upcoming change, it would require what’s called a “hard fork” of Chromium’s source code. And browser creators are either smaller companies and couldn’t afford the upkeep, or they’re heavily invested in the advertising market themselves, like Microsoft with its Chromium-based version of Edge.

‘Firefox is your best friend’

“So with all that in mind, do you recommend users move away from Chrome entirely?” I asked.

Schmetz makes no bones about it: “Firefox is the only major browser that’s going to avoid this, as long as they allow extensions to continue operating as they have been.” Firefox is still using Mozilla’s own Gecko rendering engine, completely separate from Chromium. And Ghostery’s own Ghostery Private Browser, available on all major platforms, is based on Firefox.

Ghostery

“If we were talking at the bar I would try to convince you that Firefox is your best friend. It’s possible that in the future only Firefox will allow ad blockers and be able to block certain kinds of ads. Ghostery still provides users with sufficient privacy protection in Chrome under Manifest V3, but users who want to maintain complete protection should install Ghostery on Firefox or switch to a privacy-first browser like Brave.”

I should point out that Mozilla, while operating with fully open-source software, is also a commercial enterprise. It has partnerships with companies like AdMarketplace to place advertisements on its start and home pages, and has recently purchased an advertising metrics company called Anonym. The Brave browser, founded by ex-Mozilla employees and touted as focused on user privacy, also has its own advertising platform and has been caught inserting referral codes for affiliate revenue.

(And for the sake of total transparency, PCWorld and our sister websites also collect affiliate revenue for links to retail stores — our disclaimer is at the top of this page.)

It’s possible that in the future only Firefox will be able to block certain kinds of ads.

Even ad-blocking extensions have not been without controversy. Many users switched from AdBlock Plus to uBlock Origin when the former announced an “acceptable ads program,” wherein certain advertisers would be let through the default settings if they conformed to standards such as no animation and only one script. AdBlock’s business partnerships with certain advertisers under the Acceptable Ads Committee is presumed to include compensation of some kind, though it’s still possible to change the default settings to a far wider ad filter.

The future of browsers

We spoke for a while on how likely it was that Chrome’s dominance of the browser market might come to an end. While it seems unlikely, it’s hardly unprecedented — in the ’90s Netscape yielded to Internet Explorer, which was usurped by Firefox as new generations of internet users searched for more powerful tools. Chrome attracted users away from Firefox in the early 2010s thanks to faster performance. So aside from more restrictions on ad blocking, what could make that kind of monumental shift again?

“The way users interact with the internet is always changing,” said Schmetz. “We might be the last generation focused on written content; younger users will want new ways to use browsers based on video.”

As an old-school writer, my heart skipped a beat at that — check out PCWorld on YouTube and TikTok, by the way. There are even a few shorts featuring my ugly mug.

“There is a growing awareness that there is too much power in Google’s hands,” Schmetz continued. “Google has more power than governments in some ways because its users are spread all over the globe…the U.S. and E.U. won’t be happy about that. This triple monopoly of browser, search, and advertising in the hands of Google will have to be put to a stop. And if you look at the Google and Apple deal, this extends to many other markets as well.”

Source link