browser privacy
which browser to use, which extensions actually help, and how to set them up
choosing a browser
- brave — recommended. chromium base means every chrome extension works, and it ships privacy defaults you’d otherwise install extensions to get
- chrome — use with the extensions below if you’re locked into the google ecosystem, but accept that google itself is a data broker in the pipeline
- firefox — historically the privacy default; not currently recommended as a primary browser after mozilla’s 2025 terms-of-use rewrite (context). still fine for occasional use with strict config
- microsoft edge — not recommended (context). heavy microsoft telemetry, aggressive nudging to switch back after you set another default, bundled bing/copilot/rewards features you cannot fully disable
brave is the pragmatic recommendation because it uses chromium (so the extensions in this guide work identically to chrome) but changes the defaults — ad and tracker blocking are on out of the box, fingerprint randomization is built in, and there’s no google account integration nudging you at every turn. the tradeoff is brave’s own experiments (bat rewards, sponsored top-sites, brave search) — all optional, all off-able in settings.
must-have extensions
- uBlock Origin Lite — content and script blocker
- Privacy Badger — heuristic tracker blocker
- Canvas Blocker — anti-fingerprinting
for each of the three, after install, open the extension’s options page and set the same three flags: allow in incognito on, allow access to file urls on, collect errors off. these live at chrome://extensions/?id=<extension-id>. brave uses the same urls.
uBlock Origin Lite
- install: Chrome Web Store
- hardened filter list to import: pastebin.com/raw/aN0nghe5
- options page:
chrome://extensions/?id=ddkjiahejlhfcafbddmgiahcphecmpfh - enable: allow in incognito, allow access to file urls
- disable: collect errors
uBlock Origin Lite is the manifest v3 successor to the original uBlock Origin. it blocks ads, trackers, and coin miners using regularly-updated filter lists. the hardened import above is more aggressive than the defaults — expect a small number of sites to break; disable per-site as needed. it’s the single biggest privacy improvement you can make in a browser, and it’s free.
Privacy Badger
- install: Chrome Web Store
- recommended config screenshot: i.imgur.com/OWDJ8oi.png
- options page:
chrome://extensions/?id=pkehgijcmpdhfbdbbnkijodmdjhbjlgp - enable: allow in incognito, allow access to file urls
- disable: collect errors
privacy badger from the eff is a heuristic tracker blocker — instead of using a fixed filter list, it watches which third-party domains follow you across sites and starts blocking them automatically. it overlaps with ublock’s tracker blocking but catches trackers that aren’t on any list yet. minimal maintenance; runs in the background.
Canvas Blocker
- install: Chrome Web Store
- recommended config screenshot: i.imgur.com/Jhb0RJb.png
- options page:
chrome://extensions/?id=nomnklagbgmgghhjidfhnoelnjfndfpd - enable: allow in incognito, allow access to file urls
- disable: collect errors
canvas fingerprinting is a tracking technique where a site draws a hidden image using html5 canvas or webgl and hashes the pixel output — because the pixels vary slightly across gpu / driver / os combinations, the hash becomes a stable identifier for your device even in incognito. canvas blocker adds noise to the pixel output so the fingerprint changes on every page load, defeating the technique.
brave built-ins to enable
if you use brave, you get most of the above for free. the settings worth flipping on that aren’t on by default:
- settings → shields → trackers & ads blocking → aggressive
- settings → shields → fingerprinting blocking → strict
- settings → shields → block scripts → on (this will break some sites; toggle per-site as needed)
- settings → privacy & security → webrtc ip handling policy → disable non-proxied udp
- settings → leo (ai) → off unless you actively use it
- settings → brave rewards → off unless you actively want it
- settings → new tab page → disable sponsored images, disable news feed
general tips
- use different browser profiles for different threat models — work, personal, banking, throwaway
- never sign into your primary google account in a browser you also use for research / general browsing
- clear cookies + storage on browser close for any profile that doesn’t need persistent sessions
- use a search engine that doesn’t log you (brave search, duckduckgo, kagi) as your default — searches are as revealing as browsing history
- disable third-party cookies at the browser level (default in brave; opt-in in chrome)
- use https-only mode — brave and chrome both offer it in settings
- test your fingerprint at coveryourtracks.eff.org after configuring extensions