TWC: Small: Extensible Web Browsers and User Privacy

现代的Web浏览器提供了“隐私浏览”模式，其中浏览器不记录用户的行为，例如他们访问了哪些网站。 这种模式对所有类型的用户都很有价值，从注重隐私的人到那些担心被极权主义政权迫害的人。 因此，浏览器实现者非常小心地尝试确保这些模式正确运行。 然而，现代浏览器是高度可扩展的：用户可以安装扩展来定制他们的浏览器，数百万人已经这样做了。 不幸的是，这是技术上的挑战，浏览器自动标记哪些扩展是隐私保护，哪些不是，所以浏览器目前不试图提供这样的指导-让用户自己find.This工作提出了一个类型系统，用于验证扩展是否违反隐私浏览模式。 这些类型将安全值（可能始终在私有模式下使用）与不安全值（可能导致隐私侵犯）区分开来。 类型系统被设计成“轻量级”的：从不执行不安全操作的扩展应该不加修改地进行类型检查，并且扩展作者必须只在使用不安全操作时注释他们的扩展代码。 通过此检查的扩展将保证它们不会执行违反隐私的操作，因此可以安全地安装在隐私浏览模式下。

Modern Web browsers provide a "private browsing" mode, wherein the browser does not record the user's behavior such as which sites they visited. This mode is valuable to users of all stripes, from the privacy-conscious to those those worried about persecution by totalitarian regimes. Browser implementers therefore take great care to try to ensure these modes function correctly. However, modern browsers are highly extensible: users can install extensions to customize their browser, and millions have done so. Unfortunately, it is technically challenging for browsers to automatically flag which extensions are privacy-preserving and which are not, so browsers currently do not attempt to offer such guidance -- leaving users to fend for themselves.This work presents a type system for verifying whether extensions violate private browsing mode. The types distinguish Safe values (that may always be used in private mode) from Unsafe ones (that may lead to privacy violations). The type system is engineered to be"lightweight": extensions that never perform unsafe actions should type check without changes, and extension authors must only annotate their extension code when an unsafe action is used. Extensions that pass this check are accompanied by a guarantee that they do not perform privacy-violating actions, and are thus safe to install in private-browsing mode.