Hacker News Reader

Comment by AlexandrB | Hacker News Reader

> Yes. Exactly! That's the point - it restricts the ability for extensions to monitor, snoop, and steal content from every website you browse.

Does it though? The webRequest API still exists in MV3, but as read-only. So if you're interested in snooping everything you still can.

> That’s because Manifest V3 doesn’t change the observational APIs available to extensions. (For extension developers, that means Manifest V3 isn’t changing the observational parts of chrome.webRequest.) In other words, Manifest V3 will still allow extensions to observe the same data as before, including what URLs users visit and the contents of pages users visit.[1]

[1] https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...

View on HN

With Manifest v3, you can get adblocking without having to trust your adblocker extension, like on Safari. That's a significant benefit.

You can still opt into having your data stolen, but now it's no longer a requirement for adblocking.

Or, you could use Firefox and you could have both APIs available to you and you could choose whether you wanted strong adblocking or fewer extension permissions.

Manifest V3 doesn't get rid of the permissions that allow an extension to spy on you.

Yes, you can choose not to install extensions that use those permissions (although the current webextension permissions system is chock-full of holes and Manifest V3 still has many of those holes). But you can already make that choice. You can go to Firefox and install Ublock Origin Lite right now today if you want to make that choice: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

It's available on both Chrome and Firefox and you can install it and only grant it the blocking permission and nothing else.

Removing the blocking web request API in Manifest V3 does nothing to improve security. It doesn't offer you new choices, it just removes your choice to use a more powerful adblocker if you need one.

> Manifest V3 doesn't get rid of the permissions that allow an extension to spy on you.

Yes, but extensions have to go through review to be in supported channels, and review will absolutely look at over-entitlement of submitted extensions.

> Yes, but extensions have to go through review to be in supported channels, and review will absolutely look at over-entitlement of submitted extensions.

Okay, then Google can use that same review process for apps that request access to the blocking API. If you've decided to trust the review process to ferret out unneeded permissions, then copying Firefox's model and having a `blocking` permission should be fine.

Either way, removing blocking webRequests isn't improving anyone's privacy. The same review process is required that would have been required before, and the same kind of spying is possible when that review process fails.

I trust gorhill a lot more than I trust Apple or Google!

Except then, like safari, the size of your blocklist is limited by what the browser allows. Manifest V3 versions of extensions like uBlock Origin will be less effective at blocking ads and trackers.

Reply on news.ycombinator.com