cloudflare/pp-browser-extension

cloudflare/pp-browser-extension

Description: Client for Privacy Pass protocol providing unlinkable cryptographic tokens

Language: TypeScript

License: BSD-3-Clause

Stars: 404

Forks: 14

Open issues: 11

Created: 2023-10-20T13:01:24Z

Pushed: 2026-05-09T01:38:53Z

Default branch: main

Fork: no

Archived: no

README: 

Silk - Privacy Pass Client for the browser


This browser extension implements the client-side of the Privacy Pass protocol providing unlinkable cryptographic tokens.

**Specification:* Compliant with IETF draft-ietf-privacypass-protocol v11.

Support:

• ✅ Public-Verifiable tokens (Blind-RSA)
• 🚧 Private-Verifiable tokens (VOPRF)
• 🚧 Batched tokens
• 🚧 Rate limited tokens

Installation

| [Chrome][chrome-store] | [Firefox][firefox-store] | | -- | -- | | [][chrome-store] | [][firefox-store] |

How it works?

Privacy Pass Attesters: 🟩 [Cloudflare Research with Turnstile][cf-url]

[cf-url]: https://pp-attester-turnstile.research.cloudflare.com/ [chrome-store]: https://chrome.google.com/webstore/detail/privacy-pass/ajhmfdgkijocedmfjonnpjfojldioehi/ [firefox-store]: https://addons.mozilla.org/firefox/addon/privacy-pass/

Get tokens

• If a website requests a Privacy Pass token, the extension is automatically going to request you to perform the associated challenge.
• One page will open with a challenge to be solved.
• Solve successfully the challenge and the extension will get one token.

See [FAQs](#faqs) and [Known Issues](#known-issues) section: if something is not working as expected.

---

Installing from Sources

We recommend to install the extension using the official browser stores listed in [Installation](#Installation) section above. If you want to compile the sources or your browser is not supported, you can install the extension as follows.

Building

git clone https://github.com/cloudflare/pp-browser-extension
nvm use 20
npm ci
npm run build

Once these steps complete, the dist folder will contain all files required to load the extension.

Running Tests

nvm use 20
npm ci
npm test

Manually Loading Extension

Firefox

1. Open Firefox and navigate to [about:debugging#/runtime/this-firefox/](about:debugging#/runtime/this-firefox/) 1. Click on 'Load Temporary Add-on' button. 1. Select manifest.json from the dist folder. 1. Check extension logo appears in the top-right corner of the browser.

Chrome

1. Open Chrome and navigate to [chrome://extensions/](chrome://extensions/) 1. Turn on the 'Developer mode' on the top-right corner. 1. Click on 'Load unpacked' button. 1. Select the dist folder. 1. Check extension logo appears in the top-right corner of the browser. 1. If you cannot see the extension logo, it's likely not pinned to the toolbar.

Edge

• Open Edge and navigate to [edge://extensions/](edge://extensions/)
• Turn on the 'Developer mode' on the left bar.
• Click on 'Load unpacked' button in the main panel.
• Select the dist folder.
• The extension will appear listed in the main panel.
• To see the extension in the bar, click in the puzzle icon and enable it, so it gets pinned to the toolbar.

---

Highlights

2023 -- The extension updates to Privacy Pass Protocol draft 16, with the cryptographic part in a dedicated library cloudflare/privacypass-ts. Introducing the notion of Attesters and Issuers.

2022 -- The Privacy Pass protocol can also use RSA blind signatures.

2021 -- In this blog post, we announced the v3 version of this extension, which makes the code base more resilient, extensible, and maintainable.

2020 -- The CFRG (part of IRTF/IETF) started a working group seeking for the standardization of the Privacy Pass protocol.

2019 -- The CAPTCHA provider hCaptcha announced support for Privacy Pass, and the v2 version was released.

2018 -- The Privacy Pass protocol is based on a _Verifiable, Oblivious Pseudorandom Function_ (VOPRF) first established by Jarecki et al. 2014. The details of the protocol were published at PoPETS 2018 paper authored by Alex Davidson, Ian Goldberg, Nick Sullivan, George Tankersley, and Filippo Valsorda. Its homepage is still available at https://privacypass.github.io.

Acknowledgements

The creation of the Privacy Pass protocol was a joint effort by the team made up of George Tankersley, Ian Goldberg, Nick Sullivan, Filippo Valsorda, and Alex Davidson.

The Privacy Pass team would like to thank Eric Tsai for creating the logo and extension design, Dan Boneh for helping us develop key parts of the protocol, as well as Peter Wu and Blake Loring for their helpful code reviews. We would also like to acknowledge Sharon Goldberg, Christopher Wood, Peter Eckersley, Brian Warner, Zaki Manian, Tony Arcieri, Prateek Mittal, Zhuotao Liu, Isis Lovecruft, Henry de Valence, Mike Perry, Trevor Perrin, Zi Lin, Justin Paine, Marek Majkowski, Eoin Brady, Aaran McGuire, Suphanat Chunhapanya, Armando Faz Hernández, Benedikt Wolters, Maxime Guerreiro, Cefan Rubin, Thibault Meunier and many others who were involved in one way or another and whose efforts are appreciated.

---

FAQs

As a user, how can I add new attestation methods

Depending on your browser settings, the local storage of your browser may be cleared when it is restarted. Privacy Pass stores passes in local storage and so these will also be cleared. This behavior may also be observed if you clear out the cache of your browser.

My website support Privacy Pass authentication scheme, but the extension does nothing

This can be an issuer issue, or a Chrome issue. In the later case, make sure you implement a [client replay…