We have been working on migration to Manifest v3 (MV3) for some time and today we are shipping a JShelter version 0.18 that implements stateless replacement for background pages which is a first step towards MV3. MV2 extensions were allowed to create background pages. These pages allow running JavaScript …

In the previous post of this series, What is Manifest v3 and how it affects JShelter, we've stressed the limitations of the new WebExtensions APIs, along with the challenges and the threats it poses to privacy and security extensions such as JShelter. As part of our strategy to mitigate these …

Over the years, privacy and security-oriented browser extensions in the same category of JShelter (e.g. uBlock or NoScript, whose code is partially inherited by JShelter through the NoScript Commons Library), have been forced into multiple complex refactorings and modernizations, including complete rewrites such as those required by the transition …

You might have noticed that recent versions improved JShelter performance. This blog post explains the improvements in more detail and contains graphs. The improvements are based on the bachelor thesis of Martin Zmitko. If you are interested in this topic, you will find more information in the thesis. We thank …

JShelter's audience is international. As not all people speak English, JShelter is now adding support for internationalization. Hence, it can be translated into languages other than English. The webextension API already contains APIs that help to translate extensions. This way we can localize not only the interface of the extension …

We are working to improve the internationalization of JShelter. While the webextension API already contains APIs for internationalization, not everything works great. This post is written for webextension developers as well as JShelter developers working with strings presented to our users. Please see our other post if you are looking …

The JavaScript Restrictor (JSR) project (supported by NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310) is heading towards its end, and we summarize what …

Today devices contain various sensors for reading information about the device's position, state, and environment. Such equipment is typical for mobile devices like cellphones, tablets, or laptops that often include sensors for obtaining geolocation or device orientation data. Another example is a smartwatch that could monitor the heartbeat rate of …

We recently submitted a position paper about JShelter for CNIL Privacy Research Day 2022 and posted the paper on arXive. If you are interested in the project or if you are already using JShelter, we recommend reading the paper as it explains the project, its historical decisions, the thread model …

This project started as JavaScript Restrictor at Brno University of Technology. As announced in a previous post, we got funding from NLNet NGI0 PET Fund. Furthermore, NLNet allowed us to cooperate with another NGI0 PET Fund project - JShelter project (formerly known as JavaScript Shield project) run by Free Software Foundation …

We want to identify fingerprinting attempts by counting the number of different APIs employed by a page, especially those not frequently used for benign purposes. This blog post introduces a new fingerprinting protection mechanism - FingerPrint Detector (FPD) available in JShelter 0.6. This tool allows users to gain more control …

This post introduces browser fingerprinting and anti-fingerprinting mechanisms. We explain what JShelter implements and the strengths and downsides of the anti-fingerprinting mechanisms. In short, browser fingerprinting is a stateless tracking method vastly prevalent on the web in recent years. Similarly to a human fingerprint, browser fingerprinting tries to find a …

A previous blogpost introduced a methodology to measure the usage of JavaScript APIs on the web by crawling the web. The starting point of our web crawling research is the work of Peter Snyder. Most importantly, we wanted to compare the differences in JS API usage between browsers with and …

Browser fingerprinting is a more and more popular technique used to identify browsers. The fingerprint is computed based on the results of JavaScript calls, the content of HTTP headers, hardware characteristics, underlying operating system and other software information. Consequently, browser fingerprints are used for cross-domain tracking. However, users cannot clear …

We recently found a blog post about ThreatMetrix Inc. (a part of LexisNexis) scanning locally open ports for about 30,000 web sites, including eBay. The figure below shows that a browser tries to connect to ports commonly used for remote access to the computer (e.g., RDesktop, VNC, TeamViewer …