This tool protects your private data while you browse

A squad of machine scientists astatine the University of California San Diego and Brave Software person developed a instrumentality that volition summation protections for users' backstage information portion they browse the web.

The tool, named SugarCoat, targets scripts that harm users' privacy—for example, by tracking their browsing past astir the Web—yet are indispensable for the websites that embed them to function. SugarCoat replaces these scripts with scripts that person the aforesaid properties, minus the privacy-harming features. SugarCoat is designed to beryllium integrated into existing privacy-focused browsers similar Brave, Firefox, and Tor, and browser extensions similar uBlock Origin. SugarCoat is open source and is presently being integrated into the Brave browser.

"SugarCoat is simply a applicable strategy designed to code the lose-lose dilemma that privacy-focused tools look today: Block privacy-harming scripts, but interruption websites that trust connected them; oregon support sites working, but springiness up connected privacy," said Deian Stefan, an adjunct prof successful the UC San Diego Department of Computer Science and Engineering. "SugarCoat eliminates this trade-off by allowing the scripts to run, frankincense preserving compatibility, portion preventing the scripts from accessing user-private data."

The researchers volition picture their enactment astatine the ACM Conference connected Computer and Communications Security (CCS) taking spot successful Seoul, Korea, Nov. 14 to 19, 2021.

"SugarCoat integrates with existing content-blocking tools, similar advertisement blockers, to empower users to browse the Web without giving up their privacy," said Michael Smith, a Ph.D. pupil successful Stefan's probe group, who is starring the project.

Most existing content-blocking tools marque precise coarse-grained decisions: They either wholly artifact oregon wholly let a publication to run, based connected whether it appears connected a nationalist database of privacy-harming scripts. In practice, though, immoderate scripts are some privacy-harming and indispensable for websites to function—and astir tools inevitably take to marque an objection and let these scripts to run. Today, determination are much than 6,000 objection rules letting done these privacy-harming scripts.

There is simply a amended approach, though. Instead of blocking a publication wholly oregon allowing it to run, content-blocking tools tin regenerate its root codification with an alternate privacy-preserving version. For example, alternatively of loading fashionable website analytics scripts which besides way users, content-blocking tools regenerate these scripts with fake versions that look the same. This ensures that the content-blocking tools are not breaking web pages that embed these scripts and that the scripts can't entree backstage information (and frankincense study it backmost to the analytics companies). To date, crafting specified privacy-preserving replacement scripts has been a slow, manual task adjacent for privateness engineering experts. uBlock Origin, for example, maintains replacements for lone 27 scripts, compared to the implicit 6,000 objection rules.

How SugarCoat changes the game

The researchers developed SugarCoat precisely to code this spread by automatically generating privacy-preserving replacement scripts. The instrumentality uses the PageGraph tracing framework—Smith was cardinal to the improvement of the framework—to travel the behaviour of privacy-harming scripts passim the browser engine.

SugarCoat scans this information to place erstwhile and however the scripts speech to Web Platform APIs that exposure privacy-sensitive data. SugarCoat past rewrites the scripts' source code to speech to fake "SugarCoated" APIs instead, which look similar the Web Platform APIs but don't really exposure immoderate backstage data.

To measure the interaction of SugarCoat connected Web functionality and performance, the squad integrated the rewritten scripts into the Brave browser; they recovered that SugarCoat efficaciously protected users' backstage information without impacting functionality oregon leafage load performance. SugarCoat is present being deployed successful accumulation astatine Brave.

"Brave is excited to commencement deploying the results of the year-long SugarCoat probe project," said Peter Snyder, elder privateness researcher and manager of privateness astatine Brave Software. "SugarCoat gives Brave and different privateness projects a powerful, caller capableness for defeating online trackers, and helps support users successful power of the Web."

---

---

More information: Michael Smith et al, SugarCoat: Programmatically Generating Privacy-Preserving, Web-Compatible Resource Replacements for Content Blocking is disposable arsenic a PDF astatine brave.com/wp-content/uploads/2 … garcoat-ccs-2021.pdf