New Update Google’s Manifest V3 Still Hurts Privacy, Security, and Innovation

[SpiderWeb]

BTW, aren't Adguard and Ghostery both browser extension open source? Does it mean if gorhill of uBO can't manage to come up with a solution, he can simply look at Adguard & Ghostery's code to have an idea and come up with a similar solution?

Driving GorHill out of business is Google's dream but they can't because he works on uBO as a hobby. The truth is the API that uBO is using is perfectly compatible with Manifest V3. But Google Chrome only allows enterprises to utilize that API. Imagine if someone said that only corporations are allowed to use firewalls, consumers must allow all traffic in and out. This is how completely bonkers Google has become. Chromium will deface the Internet and the question is, will people migrate to Firefox fast enough to provide balance like they did in the 2000s? If Mozilla goes bankrupt, we're all screwed.

 

[n8chavez]

I'm curious, does everyone think that because of manifest v3 everyone will need to switch to non browser-based blocking methods, such as AdGuard for Windows? Or, do you think uBo is a gecko-based browser will still suffice?

 

[Kongo]

I'm curious, does everyone think that because of manifest v3 everyone will need to switch to non browser-based blocking methods, such as AdGuard for Windows? Or, do you think uBo is a gecko-based browser will still suffice?

Quote from the Mozilla blog:

After discussing this with several content blocking extension developers, we have decided to implement DNR and continue maintaining support for blocking webRequest. Our initial goal for implementing DNR is to provide compatibility with Chrome so developers do not have to support multiple code bases if they do not want to. With both APIs supported in Firefox, developers can choose the approach that works best for them and their users.

Source: Manifest v3 update

 

[oldschool]

I'm curious, does everyone think that because of manifest v3 everyone will need to switch to non browser-based blocking methods, such as AdGuard for Windows?

Ultimately we'll have to wait and see what unfolds in '23 but clearly MV3 and outstanding chromium bugs are causing fits for chromium developers. Just check some links in above posts.

 

[ForgottenSeer 92963]

Quote from the Mozilla blog:


Source: Manifest v3 update

Well that is good news, Mozilla Firefox keeps supporting webRequest API until the netRequest API support's all use cases required by extension developers.0

Anyone knows whether Mozilla has said something about background pages being replaced by service workers?

 

[SpiderWeb]

I remain optimistic because we have survived this standoff before with Internet Explorer. People thought that browser had a complete monopoly over the market. Firefox was the balance even though Firefox never had a majority, it was popular enough to be an escape and force companies to rethink. I was a big Firefox users most of the 2000s and switched to Chrome around 2010 because it finally supported extensions and was snappier. But Chrome has become Google's vehicle to force people into thinking that Google = Internet. Remember it took Microsoft more than a decade to finally beat Mozilla's market share.

I am honestly truly convinced that when uBO and the other adblockers stop working, we will see a mass migration back to browsers that support privacy. Have you turned off your adblocker and DNS-based blocking recently? The Internet is impossible to navigate without them. You just get overwhelmed by massive ads that take up all of your bandwidth and CPU cycles.

 

[Nightwalker]

I remain optimistic because we have survived this standoff before with Internet Explorer. People thought that browser had a complete monopoly over the market. Firefox was the balance even though Firefox never had a majority, it was popular enough to be an escape and force companies to rethink. I was a big Firefox users most of the 2000s and switched to Chrome around 2010 because it finally supported extensions and was snappier. But Chrome has become Google's vehicle to force people into thinking that Google = Internet. Remember it took Microsoft more than a decade to finally beat Mozilla's market share.

I am honestly truly convinced that when uBO and the other adblockers stop working, we will see a mass migration back to browsers that support privacy.

I am not so sure about that, the internet and its users are radically different compared to that era, nowadays the internet is full of "average" users that simple dont care about adblockers and privacy; worst of all is that browsers arent that "hot" for most people anyway, apps are enough for them (Instagram, Spotify, Tik Tok, Youtube, facebook and so on).

Many "geeks" and privacy advocates will migrate for sure (well, I think most already stopped using Chrome sometime ago), but it wont be nearly enough to make a dent in Google Chrome marketshare.

Ps: Just my guess but I think privacy advocates and people that care about Manifest v3 already migrated from Chrome and it seems that it didnt had much impact at all, so I dont think much will change with MV3 doomsday.

 

[blackice]

I know a lot of privacy issues are wrapped up in tracking, but it’s interesting the great lengths people are going through to not support the creators of the content they consume. I can’t afford a subscription to every site and channel I consume, I’d rather see ads.

 

[oldschool]

I know a lot of privacy issues are wrapped up in tracking, but it’s interesting the great lengths people are going through to not support the creators of the content they consume. I can’t afford a subscription to every sight and channel I consume, I’d rather see ads.

You make a valid point. Not all ads are intrusive, etc. and it's a means of support for those you visit.

 

[SpiderWeb]

I am not so sure about that, the internet and its users are radically different compared to that era, nowadays the internet is full of "average" users that simple dont care about adblockers and privacy; worst of all is that browsers arent that "hot" for most people anyway, apps are enough for them (Instagram, Spotify, Tik Tok, Youtube, facebook and so on).

Many "geeks" and privacy advocates will migrate for sure (well, I think most already stopped using Chrome sometime ago), but it wont be nearly enough to make a dent in Google Chrome marketshare.

Ps: Just my guess but I think privacy advocates and people that care about Manifest v3 already migrated from Chrome and it seems that it didnt had much impact at all, so I dont think much will change with MV3 doomsday.

The demographic for sure, that's the one concern I have. Back then the Internet was much younger and more tech savvy. We were ready to make the switch immediately. But, have you used the Internet without adblock lately? LOL I tried for like 10 min and it was unusable. Every site has massive banners and interstitials with videos that autoplay. Ads taking up more than 50% of the screen making it hard to focus son the actual contect. So much clickbait. I don't think the average Internet user can survive browsing the web without adblock for more than 1 day. They will switch not out of choice but out of necessity to navigate the Internet without losing their minds lol.

 

[Digmor Crusher]

I will do anything possible to avoid ads, change ad-blockers, change browsers, whatever it takes, I despise advertising. And I've yet to find a site that I find interesting or useful enough to subscribe to. I even record all my tv shows so that I can fast forward thru the commercials. Ads are making tv and the internet unwatchable and unusable.

 

[Arequire]

I know a lot of privacy issues are wrapped up in tracking, but it’s interesting the great lengths people are going through to not support the creators of the content they consume. I can’t afford a subscription to every site and channel I consume, I’d rather see ads.

Unfortunately 'support' is a one-way street for publishers. They rage at users who block their ads, but good luck getting any support from them when those exact same ads are pushing malware to users. Then it's all 'Oh it's not our responsibility. We only display the ads."
If I paid someone to create a poster with "Kill the elderly" on it and hung it in my living room window, when the cops show up to arrest me for promoting violence, me saying "Oh you can't arrest me. I didn't create the poster, I'm only displaying it." isn't going to fly, so why should publishers be treated any different?

The way I see it, if publishers can't guarantee the ads being displayed on their site are free of malicious code, or are unable/unwilling to offer compensation to anyone affected by any malicious ads that crop up, then users shouldn't be chastised for taking measures to protect themselves.

 

[ForgottenSeer 92963]

What I have seen of young people confirms with what @Nightwalker is posting. Younger generation accepts that advertising is a constant background noise. I don't have the source at hand anymore, but I have read a study on the correlation between the length and frequency of the advertising intervals corresponding with the the attention span (time) of kids at (high)school. Another observation study confirmed that youngsters pick up their phone and start to socialize digitally during TV advertising. They seem to accept and understand that advertising funds the 'free' internet services they are using (valid point made by @blackice and @oldschool).

The irony of advertising is that when everyone is shouting for attention, people tend to give less attention and are harder to reach. Brave's own advertising (from which people can still can opt out) has a 4 times higher click through rate than market average (that is an incredible 400% higher response).

So despite Google's big-data and user-tracking we will see more alternative advertising vehicles (Brave, Vivaldi, Opera) in future with a better timed and dosed advertising frequency to prevent people like @Digmor Crusher and @SpiderWeb doing everything they can to prevent ads to reach them.

Also economic-political forces like the EU privacy laws, China's internet wall and territory claims and Russia's geo-political USSR revival will eventually split the internet into different digital worlds.

 

[Deletedmessiah]

I've moved half of my browsing to Firefox for months and I'm pretty satisfied with the browser for now but I worry about its future. They fired a big portion of their developers a year ago. And those were team working on Rust/security. I hope they can turn things around and continue to survive. To those more knowledgeable on the subject, how do you think will things go? Having the internet in control of a massive advertising company is awful.

As far as adblocking goes, aren't the most used adblockers, ABP and Adblock? So people are already using inferior options as it is, so I don't see a lot of people moving away from Chrome because of ublock and adguard.

 

[Kongo]

I've moved half of my browsing to Firefox for months and I'm pretty satisfied with the browser for now but I worry about its future. They fired a big portion of their developers a year ago. And those were team working on Rust/security. I hope they can turn things around and continue to survive. To those more knowledgeable on the subject, how do you think will things go? Having the internet in control of a massive advertising company is awful.

As far as adblocking goes, aren't the most used adblockers, ABP and Adblock? So people are already using inferior options as it is, so I don't see a lot of people moving away from Chrome because of ublock and adguard.

After all Manifest v3 will most likely have a good impact on Mozilla Firefox as it’s one of the only non-chromium based browsers that will continue allowing content blocking without losing quality of the blocking. Still I am also pretty excited for the upcoming DuckDuckGo Browser which will have its own engine too.

 

[SeriousHoax]

I think even those who opposed Manifest V3 at the moment like Firefox, Brave, Opera, Vivaldi etc. will eventually follow Google's path a couple of years or more later.
Also, the points about younger generation made above are correct. Most of them don't care about ads, let alone know about Manifest V3. As a basic example, In a local forum of my country yesterday, some guys (mostly less than 22 years old) who are supposed to be geeks were talking about adblockers and facebook video ads. Surprisingly, none of them know anything about Manifest V3.
BTW, since most people here don't seem to use facebook I should let them know that it's impossible to block facebook video ads. The host/urls that facebook use to serve normal video and video ads are identical. So it's not possible for filter maintainers to differentiate them. Fanboy couldn't do it, Adguard couldn't either. I even sent Alex of Adguard my browser's HAR log file, but that didn't help. So if Google wants, they can implement such things in the future, making it even harder for us to block ads. But they have not yet. I'm not taking Google's side here, but thankfully this Manifest V3 is at least better than what facebook does.

 

[ForgottenSeer 92963]

Although the "Kill the elderly poster" is a nice and funny read, most websites serving ads serve some ads of their own, but mostly offer advertising space which is filled in by bidder auctions on advertising platforms (networks). The owner of the website has no control on the ads pushed onto his advertising space, so it is legally hard to target the website owner as responsible.

To show you relevant ads, those adserving networks have to track you to get to known your preferences and interests (preferable across website visits and from different devices). Google thinks its competitors are the reason people are annoyed and install adblockers. The competition just does not have enough big-data to offer good interest based targeting algorithms and fit for purpose tracking mechanisms. These competitors not only annoy the users but Google also (because their clients don't use Google's platform ).

To prevent more loss of advertising income due to adblockers, Google offers new and enhanced mechanisms to track and target you (privacy sandbox and interest cohorts). These enhanced privacy and tracking mechanisms make it harder for Google competitors to offer similar level of returning visitor insights (cross browsing session and cross device tracking). At the same time Google wants to regain control on the content by taking the blocking away from the adblock extension. Not only handles the adblocker the actual blocking over to the browser, it is also limited to use a limited set of Google defined block rules, can't push on the fly rules updates and is restricted in the number of rules it can use.

Some of the MT-forum members think (hope), that users will turn away massively to alternative browsers, but let's have a look at the numbers. The big three browsers on mobile are Chrome (62%), Safari (28%) and Samsung Browser (5%). The big five on desktop are Chrome (65%), Safari (9.8%), Edge (9.5%), Firefox (9.2%) and Brave (5%). On the mobile market the new Mv3 won't change a thing for browser usage: Chrome on Android does not has an adblocker. The only market in danger for Chrome is the desktop market.

In 2021 desktop browsers only contributed for 38% of the web traffic. The market share of website visitors using a desktop browser has been eroding and is expected to continue to shrink in the future also. This trend implies that the risk of people now using Chrome with an adblocker who switch to another browser will have less impact in two years from now. Let; s assume that when Mv3 becomes effective only 35% of the webtraffic comes Desktops.

An interesting study (link) states that the "The desktop adblocking is past its peak" Data from several studies show a decrease in adblock usage. From around 60% of the users installing an adblocker in 2016, to around 40 percent in 2022 (US 38% EU 40% and UK 42%). This seems in line with other projections from technical polls which show that around 40% of all Windows user agents have an adblocker installed.

Google would not be Google when they would not have factually substantiated their decision to make life harder for adblockers. When all 40 percent of the Windows users (75% of desktop) with an adblocker would change from Chrome to another browser the desktop market share of Chrome would drop with 18% only (62%x40%x75%). By the time Mv3 limitations are implemented, desktop based browsing only is 35% of the websites visits. Hence we are talking about 18%x35% is 6.3% of the webtraffic. Well 6.3% over a lot of turnover is still substantial you may think, but all desktop users now having installed an adblocker don't contribute to Google's advertising income!

So even when all Chrome users with adblocker would switch to another browser, it would not affect Google's revenue. A 100% switch seems unlikely, so every desktop user staying on Chrome will add to Google's advertising revenue. As above calculation shows, Google's decisions are data driven. When half of the adblock Chrome users walk away, Mv3 will result in a 3% turnover increase, so frankly my dear, Google does not give a ........ (famous last sentence of Gone with the wind)

 

[blackice]

It isn’t much different than pirating movies. There is a cost to the transaction, but the user decides they will take the content without paying the price (in this case being served ads). The one difference being no one has the defense of saying a Blu-ray might give their player some malware, though that would be creative.

I hate what ads have turned into, some sites are unusable without a blocker. And it’s a vicious cycle that sites take more bids from ad networks to make up for the rise in ad blocking. It would be interesting to see what happens if @Kees1958 suggestion that the peak of ad blockers has passed is correct.

I have always been very curious how prevalent malvertising actually is, because it mostly seems like a justification for just not being served ads outside of a few high profile cases. Also, I’ve always been curious how effective browser security extensions are at blocking malvertising, if it is served by a legitimate ad network, and no ad blocker is being used.

 

[Arequire]

The owner of the website has no control on the ads pushed onto his advertising space, so it is legally hard to target the website owner as responsible.

Sure. I understand that. And I do see how publishers could argue that their lack of control releases them from responsibility. I mean, ultimately it was the ad network responsible for serving the ad(s) that failed to adequately screen their inventory. With that said, both parties likely profited from the ad being served (the ad network getting paid to serve the ad, and the publisher from either the impressions or, if the ad was pay-per-click, the visitors who clicked the ad), and for both to refuse to acknowledge their role in facilitating the delivery of malware, while offering nothing in the way of compensation to users who've potentially had their financial security decimated, just seems disgraceful to me.

It isn’t much different than pirating movies. There is a cost to the transaction, but the user decides they will take the content without paying the price (in this case being served ads). The one difference being no one has the defense of saying a Blu-ray might give their player some malware, though that would be creative.

A problem with the piracy analogy is that by pirating a movie, you are directly violating legally binding property rights placed on that movie. It's a clear breach of the law.
Publishers don't have the same legal standing. No one signed a contract with them agreeing to view ads in exchange for accessing the content on their website. And while publishers argue that there's an unwritten agreement between them and visitors to their site, and that viewing ads is the price users must pay for accessing their content, their argument collapses when you think about the fact that their unwritten agreement would also have to extend to the myriad of—mostly invisible—third parties present on most websites nowadays.

I have always been very curious how prevalent malvertising actually is, because it mostly seems like a justification for just not being served ads outside of a few high profile cases. Also, I’ve always been curious how effective browser security extensions are at blocking malvertising, if it is served by a legitimate ad network, and no ad blocker is being used.

I'm super curious about this too. I've tried researching it in the past but all I got was 'malvertising on the increase' without any actual prevalence data. Which sucks because my usage of an ad blocker is primarily based on the potentially paranoid view that by not using an ad blocker I'm increasing the likelihood of my device getting infected exponentially.

 

[blackice]

Sure. I understand that. And I do see how publishers could argue that their lack of control releases them from responsibility. I mean, ultimately it was the ad network responsible for serving the ad(s) that failed to adequately screen their inventory. With that said, both parties likely profited from the ad being served (the ad network getting paid to serve the ad, and the publisher from either the impressions or, if the ad was pay-per-click, the visitors who clicked the ad), and for both to refuse to acknowledge their role in facilitating the delivery of malware, while offering nothing in the way of compensation to users who've potentially had their financial security decimated, just seems disgraceful to me.


A problem with the piracy analogy is that by pirating a movie, you are directly violating legally binding property rights placed on that movie. It's a clear breach of the law.
Publishers don't have the same legal standing. No one signed a contract with them agreeing to view ads in exchange for accessing the content on their website. And while publishers argue that there's an unwritten agreement between them and visitors to their site, and that viewing ads is the price users must pay for accessing their content, their argument collapses when you think about the fact that their unwritten agreement would also have to extend to the myriad of—mostly invisible—third parties present on most websites nowadays.


I'm super curious about this too. I've tried researching it in the past but all I got was 'malvertising on the increase' without any actual prevalence data. Which sucks because my usage of an ad blocker is primarily based on the potentially paranoid view that by not using an ad blocker I'm increasing the likelihood of my device getting infected exponentially.

Morally my personal feeling is that it doesn’t have to be illegal. You are taking something without paying for it, which is why there are so many pay walls now. People aren’t going to work for free when the ad revenue dries up. This is why sites have been dropping dead for years. You can use a different term than pirating, but the end result is you consume content without compensating the creator. I really would like some sort of middle ground, but I fear we’ve blown right past it. Ads are terrible and nobody wants to see them, including me. But, I don’t feel I’m owed the fruits of someone else’s labor just because there’s no legally binding contract. That’s just my personal conviction.

I started using Ad blockers for the same reason. Some security guru insisted on it. So I got paranoid that the ads were out to get me. The fear mongering for clicks in the security article industry is aggravating, as it’s hard to understand the real risks without any data.