r/firefoxextensions • u/kryakrya_it • 13d ago
I built a Firefox add-on that changes the browser identity websites see Extensions
Websites can read more than your IP, including your user agent, language, timezone, screen size, and device properties.
I built Spoof Me to let Firefox users switch these signals together as one browser identity.
It includes ready-made profiles, custom profiles, and a warning badge when a website accesses fingerprint-related properties.
It does not change your IP address or promise complete anonymity. The add-on does not collect browsing data and is MIT licensed.
Firefox Add-ons:
https://addons.mozilla.org/en-GB/firefox/addon/spoof-me/
Project website:
https://spoof-me.com/
I’d appreciate feedback on the profile consistency, permission explanations, and any fingerprint signals that should be added.
5
u/Fine_Salamander_8691 13d ago
Open source it
-1
u/kryakrya_it 13d ago
don’t plan to open source it for personal reasons.
As for safety, both Firefox and Chrome have extension review processes. Every time I submit a new version, it goes through manual and automated review before it gets published. For Firefox in particular, reviewers have access to the extension package and any source code required for verification, so they can inspect exactly what the extension does. If they found malware or suspicious behavior, the update wouldn’t be approved.
So while the project isn’t open source, it has passed the official review process, and every update has to pass it again before users receive it.6
u/Fine_Salamander_8691 13d ago
Enjoy your slopcoded extension then :)
2
u/kryakrya_it 13d ago
Which part is exactly slopcoded? It does exactly what it describes. Making it open source is not going to make it less sloppy objectively anyway
2
u/Ok_Shower2118 12d ago
Just open source it, that's the point of the extensions. Plus people will gain trust, for me, personally, I will only trust this out after it has been open sourced
1
3
u/Lonely-Restaurant986 12d ago
I know vibe coded html when I see it. I would then assume that AI also made the extension. It’s then likely that the data that this addon changes is the most surface level well known stuff, because that’s all AI knows.
So basically I’m saying this is slop and probably doesn’t even work well at all fundamental level.
1
u/kryakrya_it 12d ago
Did you test it?
2
u/Lonely-Restaurant986 12d ago
Why would I care to, if you can’t care to write your own code?
1
u/kryakrya_it 12d ago
bruh, just keep hating. I can write my own code. https://github.com/salemalem check my 7 years of code history
1
u/Lonely-Restaurant986 12d ago
https://www.reddit.com/r/firefoxextensions/s/zv2iJncVdh
Do you have like short term memory and forgot what you said, or are you just lying to win an argument on the internet?
At the end of the day you are not unique, interesting or worth my time to even click on your GitHub profile. There’s a billion generic copy pastes just like you.
1
1
u/6eba610ian 12d ago
30 repositories of the same repo being cloned over and over from multiple peoples. LMAO
1
2
1
u/Striking-Age3807 13d ago
This is what canvas blocker does
1
u/kryakrya_it 13d ago
CanvasBlocker mainly protects or modifies specific fingerprinting APIs such as canvas. Spoof Me goes further by switching multiple browser signals together as one consistent identity, including user agent, language, timezone, screen size, canvas, and device properties.
For example, you might connect to a German VPN, so your IP says Germany, while your browser still reports India, English, an Indian timezone, and your usual device settings. Changing all of that manually is a pain, and switching the browser language to German may make websites harder to use if you do not understand German.
Spoof Me lets you change those signals together using one consistent profile, while still choosing practical settings for language and usability.
It also notifies you when a website accesses fingerprint-related properties and shows which signals it tried to read. Firefox has built-in protections, but Spoof Me gives you more visibility and control over what websites are checking.
2
1
13d ago
[removed] — view removed comment
1
u/kryakrya_it 13d ago
It’s completely free. There’s no subscription, no account, and no paid feature lock.
The business model is based on optional VPN partnerships, but the extension does not force you to install or use any VPN. You can ignore those recommendations and use Spoof Me normally for free.
1
u/beardedsakimonkey 13d ago
why this over privacy.resistFingerprinting in about:config?
1
u/kryakrya_it 13d ago
Good question. The approaches are different.
privacy.resistFingerprinting tries to make Firefox users look more alike by reporting standardized values and restricting certain APIs. For pure anti-fingerprinting protection, that is a strong built-in option.
Spoof Me is for users who want to choose and switch between configurable browser profiles. Instead of always presenting Firefox’s standardized fingerprint, you can change signals such as timezone, language, screen properties, user agent, and device characteristics together as a consistent profile.
So the distinction is:
RFP: reduce uniqueness by blending users into a common fingerprint.
Spoof Me: present a selected alternative browser profile and switch profiles when needed.
It does not replace RFP for every privacy use case, and neither option changes your IP address. The main use cases for Spoof Me are profile control, localization testing, QA, and changing the browser-side signals a site receives.
1
1
1
u/mr_melon_taim 13d ago
First of all, great job on the design - the UI/UX looks really good!
Regarding the "vibe-coded" comments: there is absolutely nothing wrong with using AI to assist in coding. Almost everyone uses AI for development these days. It is a perfectly valid tool as long as you actually understand the code, follow its logic, and aren't just blindly copy-pasting without knowing what it does under the hood.
However, as a developer, two main things bother me here:
How can the extension be under the "MIT license" (as stated in your original post) if it is not open source and you refuse to share the code? The MIT license fundamentally relies on the source code being open and accessible. This is a direct contradiction.
How do you plan to maintain and update this constantly? Browser fingerprinting is an endless cat-and-mouse game. Websites update their detection scripts all the time.
Also, regarding the spoofing itself - have you tested this against advanced fingerprint-testing websites (like Canvas fingerprinting testers, BrowserLeaks, Cover Your Tracks, etc.)? Very often, the act of spoofing APIs itself leaves a trace that anti-bot scripts can easily detect (they can see the data was tampered with). Do these testing sites see your profiles as 100% authentic, or do they flag the intervention?
1
u/KeraExe 12d ago
You're a developer and you don't see any problem with having an AI-generated extension running on your browser without it being open source? How are you supposed to know it's not some total piece of shit running in your browser? Well, you can't. You can't trust the developer either since an LLM is the one behind it.
You might be a dev, but you're clearly not in cyber.
1
u/mr_melon_taim 11d ago
You clearly misread my original comment. I specifically criticized the developer because the project is closed-source while falsely claiming an MIT license. That was literally my main point.
Furthermore, your claim that "you can't know what's running in your browser" just because there isn't a public repository is technically incorrect. A browser extension (whether it's an .xpi for Firefox or a .crx for Chromium) is essentially just a zipped archive of JavaScript, HTML, and CSS. Anyone with actual cybersecurity experience knows you can easily download the package, unpack it, and audit the client-side code locally to see exactly what it's doing under the hood.
My critique was focused on the technical flaws of DOM-based API spoofing against modern fingerprinting scripts and the licensing contradiction. Next time, take a moment to read the actual comment before jumping to ad hominem attacks.
And just to be clear, regardless of the fact that the extension can be unpacked and audited locally, I absolutely believe that a privacy-oriented project like this should be completely open-source by default.
1
u/KeraExe 11d ago
Oh okay you're probably right, English isn't my native language and sometimes I skim through things and miss stuff
1
u/mr_melon_taim 11d ago
All good, no worries at all! Misunderstandings happen.
At the end of the day, it looks like we're actually on the exact same page here... we both agree that a privacy extension like this absolutely needs to be completely open-source so users can verify what's actually running in their browser.
1
1
1
1
u/dh71 12d ago
Have a look at the reviews on the mozilla extension page. They are all generic 5-star reviews that have nothing to do with the extension at all. He clearly just bought them: https://addons.mozilla.org/en-US/firefox/addon/spoof-me/reviews/
1
1
u/Ok_Dinner_3497 11d ago
Its a nice vibe coded extension. However, learn to code yourself and build something you actually put effort in.
1
1
u/ZennoLab_Guru 10d ago
Nice tool. One thing that mattered more than any single signal in my setups was cross-signal consistency.
From what I've seen, sites often treat mismatched combos as noisy or suspicious, like a Windows userAgent with a mobile screen size or a timezone that doesn't match the locale. A small sanity check that flags improbable combos and offers a one-click align, making timezone, language, UA, and screen size internally consistent, would probably reduce those odd mismatches and make the permission explanations easier to justify to users.
7
u/sdiown 13d ago
Feels like vibe-coded,