Will Manifest V3 prevent sites I visit being able to see I have BW extension installed?

Ask the Community Password Manager
1

Howdy you wonderful people. I LOVE BitWarden. Used it for a while now after leaving 1P on Mac.

I have used Firefox for many years, the so called ‘hardened’ format, plus plugins for privacy (lots of them). Friends in the know have recently educated me somewhat, telling me that my browser fingerprint is extremely unique, so I am moving over to Brave.

I ran a finger print test and found the following results for the percentage of browsers my browser ‘blends’ into:

  1. Brave with aggressive settings but NO extensions = 55%
  2. Brave with BitWarden installed = 0.385%

That scared me somewhat (which I hope isn’t irrational of me!)

I really want to reduce my fingerprint, and 55% to less than 0.4% is a huge difference. But I can’t live without BW extension. So my questions are:

  1. How much should I be concerned about this. Is 0.385% not as bad as it looks when using ‘randomized fingerprint’ technique implemented in Brave browser?

  2. Is there any way around this? The only alternative I can think of is using the vault app and copy/pasting logins. That would be a huge headache for me (thousands of logins!)

  3. I read about the upcoming move to Manifest V3 (https://blog.shahednasser.com/chrome-extension-tutorial-migrating-to-manifest-v3-from-v2/). I am no techie, so I don’t understand much about it, but I was told this MAY prevent ‘extension fingerprinting’. If that’s true, I’d love to know if BitWarden will be using that soon?

PS This is what I was told about V3 and how it will defend against extension fingerprinting techniques: “extensions will be able to enable “use_dynamic_url” option, which will change the resource URL for each session (so browser restart). Safari is already doing this mandatory for all their extensions.”

2

Hey there, I can confirm that the team is indeed working on Manifest V3 support. I updated the post title to encourage community conversation around this topic, feel free to adjust it back to the original if needed. I also use Firefox with strict settings and security is often balance between security and convenience, for example, you could opt to use web vault + desktop app but then would not have access to autofill.

3

Hi, thanks for replying. Yes good idea re topic title :slight_smile:

Not sure if you’re able to answer or not, but can you comment on whether I am right in thinking that Manifest V3 will prevent sites from seeing what extensions i have installed (specifically BW in this case)?

Yes, in this case it’s privacy v convenience, security is another matter as Brave (Chromium) is inherently a tad more ‘secure’ than Firefox (from exploits/hacks/injections etc), but both are fine for me from a security perspective.

Right now, it’s not even a case of privacy v convenience as much as fingerprinting protection v convenience :slight_smile:

4

PS you might want to check spelling of last word in Title :slight_smile:

Will Manifest V3 prevent sites I visit being able to see I have BW extension installed?

5

Hah, updated, thanks :+1: