Google’s Proposed 'WebBundles' Is A Threat To Privacy And The Open Web, Brave Said

Google has Chrome, the most popular web browser. The company also operates Chromium, the engine that powers Chrome, and many other browsers.

As an ad-driven company that thrives on user data, Google has for a long time leveraged its power to use technology in its disposal to benefit its own. There is nothing wrong with that, if and only if, users have the option to stop Google from gathering more than they want.

'WebBundles' is a web specification proposed by Google as a web standard.

It is specifically designed to ensure the integrity of a web page and its sub-resources by allowing websites to collect resources together into a single package.

By packaging up website resources into a .wbn file, content delivery networks (CDN) can also be used to serve the sites, as opposed to remote servers.

While the standard is a good thing, Peter Snyder, Senior Privacy Researcher at Brave Software (developer of privacy-focused web browser Brave), said that the standard could make advertisers and malicious actors circumvent privacy and security protections.

The researcher warned that WebBundles could have serious ramifications for the privacy of internet users and the transparency of the web.

According to a blog post from Peter Snyder:

In general, the standard could:

• Make URLs Meaningless: Instead of downloading each website's image and JavaScript file independently, WebBundles allow browsers to download all files needed to load an entire page as one "bundle".

  This makes URLs no longer the common, global references to resources on the web.

• Allow Sites to Evade Privacy and Security Tools: Because URLs in WebBundles become arbitrary references to resources in the bundle, and not globally shared references to resources, this will allow websites to evade privacy and security tools in several ways.

  For example, malicious websites could evade privacy tools by randomizing URLs, reusing URLs, and hide dangerous URLs.

• Make Privacy Violations that are Currently Difficult, Easy: Ways of circumventing privacy protections are already possible, but expensive, fragile and difficult.

  For example, it’s true that websites can use a large number of URLs to refer to the same file, and make things difficult for blocking tools to operate. But the practices are difficult to accomplish perfectly.

  WebBundles can make those attempts dramatically easier because it is cheaper.

What's more, the standard could also render ad-blockers useless, preventing them from intercepting website trackers via the usual avenue.

Snyder first expressed concern about the plans in February and claimed to be collaborating with the relevant parties to rectify issues with the standard, but apparently to no avail.

"We’ve tried to work at length with the WebBundle authors to address these concerns, with no success."

"We also encourage others in the Web privacy and security community to engage in the conversation too, and to not implement the spec until these concerns have been resolved."

"At root, what makes the web different, more open, more user-centric than other application systems, is the URL. Because URLs (generally) point to one thing, researchers and activists can measure, analyze and reason about those URLs in advance.”

"While we appreciate the problems the WebBundles and related proposals aim to solve, we believe there are other, better ways of achieving the same ends without compromising the open, transparent, user-first nature of the Web. One potential alternative is to use signed commitments over independently-fetched subresources. These alternatives would fill a separate post, and some have already been shared with spec authors."

"We strongly encourage Google and the WebBundle group to pause development on this proposal until the privacy and security issues discussed in this post have been addressed."