When I was deep into the privacy community, doing stuff like fully encrypting my disk with VeraCrypt, keeping ProtonVPN on with a kill switch, and using Signal instead of Telegram, I came across a bunch of browser extensions that everybody seemed to recommend together. Adblocker, Privacy Badger, LocalCDN. I installed all of them and treated them as collectibles. More tools, more privacy.
It took me an embarrassingly long time to notice that the three of them do three different jobs, and that two of them barely overlap. So here is the version I wish somebody had drawn for me, in the only metaphor that ever made it stick.
The map
A web page is not one place. When you open a news article, the article itself comes from the news site, but the fonts might come from Google, the script library from a CDN, the ads from an ad company, the comments from a company the news site contracted, and the Like button from Facebook. The EFF's own explanation of Privacy Badger starts from exactly this picture, and it is the right place to start.
The site you typed in is the first party. Everyone else is a third party.
In Among Us terms, the site you typed in is the ship you boarded. Every third-party request is a crewmate who walked in from somewhere else. Some of them are doing tasks, like the font and the script library. Some of them are impostors, like the analytics pixel whose only job is to remember you were here. The problem is that from the outside they look identical. Each one is a request leaving your browser, and each request carries your IP address and the page you are on.
The three tools are three different ways of dealing with the crew.
The wanted poster
uBlock Origin, AdBlock Plus, and the rest work from filter lists. The big one is EasyList, which removes most adverts from international webpages and is maintained by four people (Fanboy, MonztA, Khrin, and Yuki2718) with help from a forum. Its sibling EasyPrivacy targets tracking rather than ads. A filter list is a long set of rules that match URLs and page elements. If a request matches a rule, the blocker stops it before it leaves your browser.
This is the emergency meeting where everyone already has a list of names, and anyone on the list gets voted out on sight. It is fast, it is precise, and it kills ads dead, which is why almost everyone runs one. The weakness is the same as the strength. A tracker that is not on the poster walks straight past, and stays past until a maintainer notices and adds it.
The sus meter
Privacy Badger is made by the Electronic Frontier Foundation and it deliberately does not use a list. Their FAQ puts it plainly: they define what tracking looks like, and the extension blocks domains it observes tracking in the wild. What counts as a tracker depends on how a domain behaves, not on anybody's judgment.
Concretely, it watches the third-party domains that embed images, scripts, and ads in the pages you visit, and it looks for the techniques trackers use: cookies that uniquely identify you, local storage "supercookies", canvas fingerprinting. If it sees the same third-party host doing that on three separate sites, it stops loading anything from that host.
Three sites, three strikes.
That is a sus meter. The crewmate is not on any list. It just keeps turning up in rooms it has no reason to be in, and after the third room the Badger calls the meeting and ejects it. Because this is learned rather than listed, it catches trackers nobody has written a rule for yet. The extension also ships with a head start. The EFF runs a training project called Badger Sett that visits thousands of popular sites and pre-learns the trackers on them, so a fresh install is not starting from zero.
Two details I found interesting once I read the FAQ properly. First, Privacy Badger does not block ads for being ads. It only blocks the ones that track you, which is a deliberate choice to give advertisers a reason to behave. Second, it sends the Global Privacy Control and Do Not Track signals to every site, and if a tracker ignores them, the Badger learns to block it anyway. Social widgets like the Like button get replaced with a click-to-activate placeholder, so the button does not phone home until you press it.
Never leave the ship
This one handles a leak the other two mostly ignore. Sites do not host every script themselves. A huge number of them load jQuery, Bootstrap, Font Awesome, or a Google font from a shared content delivery network: ajax.googleapis.com, cdnjs.cloudflare.com, code.jquery.com, cdn.jsdelivr.net, unpkg.com. Those scripts are legitimate. They are crewmates doing tasks. But every time your browser fetches one, the CDN operator, which is usually Google or Cloudflare, gets your IP address and the page that asked for the file.
An adblocker will not touch these because they are real code the page needs. Privacy Badger usually will not either, because serving a file is not tracking by its definition. So the request goes out, on every site, all day.
Same file either way. Only one of them tells Cloudflare about it.
LocalCDN's own description is that it emulates content delivery networks. It intercepts the request, finds the same library at the same version in a bundle it ships with, and injects that instead. Nothing leaves. In the game, you never have to go to MIRA HQ to pick up your tools, because somebody already stocked the storage room on the ship.
If the name Decentraleyes rings a bell, it is the same idea. LocalCDN started in 2020 as a fork of Decentraleyes with a longer list of libraries and CDNs, and it is the one that still gets regular updates. Run one or the other, never both, or they will fight over the same requests.
The old argument against this was that shared CDNs were good for speed, because a copy of jQuery cached from one site could be reused on the next. That argument is dead now. Browsers partition the HTTP cache by the site you are on, so a file cached from site A does not help on site B. Safari has done this since 2013, Chrome since version 86 in late 2020, and Firefox since version 85 in early 2021. The performance reason for public CDNs went away, and the privacy cost stayed.
Who catches what
Put the three side by side and the overlap is smaller than the "install all of these" advice suggests.
- The adblocker with EasyList and EasyPrivacy removes ads and every tracker that someone has already written a rule for. Most of them.
- Privacy Badger catches the trackers that are not on any list yet, and handles the social widgets and the opt-out signals.
- LocalCDN closes a specific leak, the shared library request, that neither of the others considers a problem.
What none of them do
They do nothing about the first party. The site you are on still sees everything you do on it, and the Privacy Badger FAQ is honest that this is out of scope. If you are logged in, that site knows who you are. They do not hide your IP address from anyone you actually connect to, which is what the VPN was for. And they can break things: Privacy Badger's placeholders exist because blocking a widget outright would leave a hole in the page, and LocalCDN can only substitute a library it has a copy of, so a site that uses an unusual version will fall back to the network anyway.
What I run now is an adblocker with the two Easy lists, Privacy Badger, and LocalCDN on Firefox. Firefox's own tracking protection overlaps with the Badger, and the EFF says the two get along. I no longer think of them as a collection. I think of them as three crewmates who happen to be very good at three different tasks, and I have stopped expecting any one of them to do the other two's job.
Sources: the Privacy Badger FAQ (how it works, the three-site rule, Badger Sett, GPC and DNT, what counts as a third party); EasyList (maintainers, EasyPrivacy); LocalCDN (supported CDNs and libraries); Chrome's HTTP cache partitioning announcement and Mozilla's network partitioning post (why shared CDN caching no longer helps).
Originally published at stimmie.dev. Also on Hashnode. A shorter first version is on Medium. Source and images on GitHub.
Top comments (0)