Privacy tools explained with Among Us

When I was deep into the privacy community, doing stuff like fully encrypting my disk with VeraCrypt, keeping ProtonVPN on with a kill switch, and using Signal instead of Telegram, I came across a bunch of browser extensions that everybody seemed to recommend together. Adblocker, Privacy Badger, LocalCDN. I installed all of them and treated them as collectibles. More tools, more privacy.

It took me an embarrassingly long time to notice that the three of them do three different jobs, and that two of them barely overlap. Among Us is how it finally made sense to me, so that is how I will explain it.

A web page is not one place. When you open a news article, the article itself comes from the news site, but the fonts might come from Google, the script library from a CDN, the ads from an ad company, the comments from a company the news site contracted, and the Like button from Facebook. The Electronic Frontier Foundation, the nonprofit that makes Privacy Badger, opens its own explanation of the tool with this same picture. To check it was not an exaggeration I loaded the Inquirer front page once and logged every request. Four hosts were the Inquirer's own. Twenty-four were other companies, and they got fifty-four requests between them.

Every request the Inquirer front page made in one load on 5 September 2026, grouped by the company that received it.

In Among Us terms, the site you typed in is the ship you boarded. Every third-party request is a crewmate who walked in from somewhere else. Some of them are doing tasks, like the font and the script library. Some of them are impostors, like the analytics pixel whose only job is to remember you were here. The problem is that from the outside they look identical. Each one is a request leaving your browser, and each request carries your IP address and the page you are on.

The three tools are three different ways of dealing with the crew.

Adblockers

uBlock Origin, AdBlock Plus, and the rest work from filter lists. The big one is EasyList, which removes most adverts from international webpages and is maintained by four people (Fanboy, MonztA, Khrin, and Yuki2718) with help from a forum. Its sibling EasyPrivacy targets tracking rather than ads. A filter list is a long set of rules that match URLs and page elements. If a request matches a rule, the blocker stops it before it leaves your browser.

In the game this is an emergency meeting where everyone already has a list of names, and anyone on the list gets voted out on sight. It works well enough that almost everyone runs one, and it takes the ads out of the page entirely rather than only stopping the tracking part. The catch is that a tracker not on the list walks straight past, and keeps walking past until a maintainer notices and adds it.

If you can list everything, why is this not solved? Because the other side reads the list too, and the list is only ever a description of what the ads looked like last week. I pulled the EasyList commit history while writing this. In the first week of September 2026 the repository got between 138 and 187 commits a day. On the 8th, by mid-afternoon UTC, Fanboy alone had pushed over ninety commits titled "M: Update", roughly one every eight minutes since early morning.

Most of those commits look like this one. Three new domains, all random letters, added to the ad server list.

+||donalpapmeat.com^
+||lzazqrrmqjvov.top^
+||wkzmfbrbxstzq.space^

Ad networks register throwaway domains faster than anyone can type them, which is why that one file has over forty thousand lines and grows every day. The other kind of commit goes the opposite direction. On the same day Khrin changed one existing rule because it was breaking something on CNN, and carved out an exception so the rule no longer applies to XMLHttpRequest calls.

-||brightline.tv^$third-party
+||brightline.tv^$third-party,~xmlhttprequest

The bigger players do not bother with new domains. Facebook in 2019 started splitting the word Sponsored on its ads into scrambled pieces of text so that no rule could match it, the maintainers wrote rules for the scrambling, and Facebook changed it again. Some trackers get served from a subdomain of the site you are on, through a CNAME record that quietly points at the tracking company, so a blocker that only looks at the hostname sees a first-party request and lets it through. uBlock Origin on Firefox has been able to unmask those since 2020. When YouTube started blocking adblock users outright in late 2023, the lists were updated within hours, YouTube changed its detection, the lists were updated again, and that went on for weeks. A filter list is never finished. It works because a handful of people keep it current, every day, by hand.

Privacy Badger

Privacy Badger is made by the EFF and it deliberately does not use a list. Their FAQ says: "we define what tracking looks like, and then Privacy Badger blocks or restricts domains that it observes tracking in the wild." Whether something counts as a tracker depends on how the domain behaves, not on a maintainer's judgment.

Concretely, it watches the third-party domains that embed images, scripts, and ads in the pages you visit, and it looks for the techniques trackers use: cookies that uniquely identify you, local storage "supercookies", canvas fingerprinting. If it sees the same third-party host doing that on three separate sites, it stops loading anything from that host. Three is not many. I opened the Inquirer, Rappler, and Philstar front pages in a row and these eight domains were on all of them.

Front pages of the Inquirer, Rappler, and Philstar, loaded one after another on 5 September 2026. Each number is how many requests that domain received during the load.

In the game this is the crewmate nobody reported, who keeps turning up in rooms it has no reason to be in, until after the third room the Badger calls the meeting and ejects it. Because the rule is about behaviour rather than a name, it catches trackers nobody has written a rule for yet. A fresh install does not start from zero either. The EFF runs a training project called Badger Sett that visits thousands of popular sites and pre-learns the trackers on them, and ships that with the extension.

Privacy Badger does not block ads for being ads, only the ones that track you, which the EFF says is deliberate, to give advertisers a reason to behave. It also sends the Global Privacy Control and Do Not Track signals to every site, and if a tracker ignores them the Badger learns to block it anyway. Social widgets like the Like button get replaced with a click-to-activate placeholder, so the button does not phone home until you press it.

LocalCDN

The third tool deals with a leak that the other two mostly leave alone. Sites do not host every script themselves. A large share of them load jQuery, Bootstrap, Font Awesome, or a Google font from a shared content delivery network: ajax.googleapis.com, cdnjs.cloudflare.com, code.jquery.com, cdn.jsdelivr.net, unpkg.com. Those scripts are legitimate, crewmates doing tasks, but every time your browser fetches one, the CDN operator, usually Google or Cloudflare, gets your IP address and the page that asked for the file.

An adblocker will not touch these because they are real code the page needs, and Privacy Badger usually will not either, because serving a file is not tracking by its definition. The request goes out on every site that uses the library, which is most of them.

The same jQuery request with and without LocalCDN installed.

LocalCDN describes itself as emulating content delivery networks. It intercepts the request, finds the same library at the same version in a bundle it ships with, and injects that instead, so nothing leaves the browser. In the game you never have to go to MIRA HQ to pick up your tools, because somebody already stocked the storage room on the ship.

If the name Decentraleyes rings a bell, it is the same idea. LocalCDN started in 2020 as a fork of Decentraleyes with a longer list of libraries and CDNs, and it is the one that still gets regular updates. Run one or the other, never both, or they will fight over the same requests.

The old argument against this was that shared CDNs were good for speed, because a copy of jQuery cached from one site could be reused on the next. That stopped being true a few years ago. Browsers now partition the HTTP cache by the site you are on, so a file cached from site A does not help on site B. Safari has done this since 2013, Chrome since version 86 in late 2020, and Firefox since version 85 in early 2021. What is left of the shared CDN is the privacy cost.

Put the three side by side and the overlap is smaller than the "install all of these" advice suggests.

uBlock Origin, AdBlock Plus, Privacy Badger, LocalCDN, Decentraleyes

• The adblocker with EasyList and EasyPrivacy removes ads and every tracker that someone has already written a rule for, which is most of them.
• Privacy Badger catches the trackers that are not on any list yet, and handles the social widgets and the opt-out signals.
• LocalCDN closes a specific leak, the shared library request, that neither of the others considers a problem.

None of them do anything about the first party. The site you are on still sees everything you do on it, and the Privacy Badger FAQ says plainly that this is out of scope. If you are logged in, that site knows who you are. They do not hide your IP address from anyone you actually connect to, which is what the VPN was for. They can also break things. Privacy Badger's placeholders exist because blocking a widget outright would leave a hole in the page, and LocalCDN can only substitute a library it has a copy of, so a site that uses an unusual version will fall back to the network anyway.

What I run now is an adblocker with the two Easy lists, Privacy Badger, and LocalCDN on Firefox. Firefox's own tracking protection overlaps with the Badger, and the EFF says the two get along. I stopped thinking of them as a collection once I understood that they are three crewmates doing three different tasks, and I have stopped expecting any one of them to do the other two's job.

Sources: the Privacy Badger FAQ (how it works, the three-site rule, Badger Sett, GPC and DNT, what counts as a third party); EasyList (maintainers, EasyPrivacy) and its GitHub repository (commit counts and diffs, pulled 8 September 2026); LocalCDN (supported CDNs and libraries); Chrome's HTTP cache partitioning announcement and Mozilla's network partitioning post (why shared CDN caching no longer helps).

Originally published at stimmie.dev. Also on Dev.to and daily.dev. A shorter first version is on Medium. Source and images on GitHub.