Inspiration
Cyber One was inspired by the difficulty families face when managing online privacy. Many tools require technical knowledge or make promises users cannot easily verify. We wanted to give households understandable controls, separate family accounts, and clear choices about their information.
What it does
Cyber One combines household account management, a browser ad blocker, and a VPN prototype. Users can create accounts, save backup codes, recover access through verified email, and manage up to eight linked family accounts with separate credentials. Privacy disclosures explain data handling, and deletion controls let users remove their account information.
Our Chrome/Edge extension blocks requests to a curated list of advertising and tracking domains across websites. The Azure-hosted WireGuard VPN is configured but still undergoing connection testing. The website’s connection button and family connection indicators remain simulated until integration is complete.
How we built it
We built the website with HTML, CSS, JavaScript, and Node.js, using GitHub for collaboration and Vercel for hosting. PostgreSQL stores encrypted application state, with AES-256-GCM encryption, password hashing, and hashed backup codes. Email verification and recovery flows use expiring tokens.
The extension uses Manifest V3 and Chrome’s Declarative Net Request API to evaluate blocking rules locally without collecting browsing history. For VPN infrastructure, we deployed an Ubuntu server on Azure and configured SSH access, WireGuard keys, traffic forwarding, and network rules.
Challenges we ran into
Azure’s region policies and subscription restrictions made finding an available virtual machine difficult. We inspected subscription-specific availability through Cloud Shell and troubleshot SSH using network rules, server logs, and host fingerprints.
We also learned that a website cannot directly control a device’s internet routing or block ads across unrelated websites. That led us to separate the website, browser extension, and VPN infrastructure. Writing precise blocking rules was another challenge: matching an advertising domain should not accidentally block an unrelated URL that merely mentions it.
Accomplishments that we're proud of
We implemented linked family accounts, explicit deletion controls, encrypted storage, and a browser extension with minimal permissions. We also created a harmless local banner demonstration for comparing allowed and blocked requests.
Our website passed 40 automated tests, and the extension passed eight automated tests. These checks cover application behavior and extension logic; live browser and VPN verification remain separate validation steps.
What we learned
We learned that security requires understandable behavior alongside technical controls. Users need to know what a button changes, what information is stored, and where protection ends.
We also gained practical experience with cloud deployment, authentication, encryption key management, browser permissions, and network troubleshooting. Most importantly, we learned to distinguish implemented features from verified protection and communicate that difference honestly.
What's next for Cyber One
We plan to verify WireGuard handshakes and public-IP changes, connect authenticated website controls to the VPN client, and replace simulated indicators with actual tunnel status. We also want to add per-site filtering exceptions, strengthen authentication with passkeys or time-based codes, and improve onboarding through real user feedback.
