-
Specter dashboard
-
Specter popup on nytimes.com
Inspiration
Privacy is treated as a technical problem — but it's a human one. Every time someone opens a news article, searches for a symptom, or reads about a political event, dozens of invisible scripts record exactly what they did. Most people have no idea. Tools like uBlock Origin exist, but they work off blocklists maintained by volunteers — they can only catch trackers that have already been identified. New trackers, first-party proxies, and behavioral fingerprinters slip through completely. I wanted to build something that gave anyone — not just security researchers — real, structured visibility into what their browser was silently doing on their behalf.
What it does
Specter is a Chrome extension that intercepts every network request your browser makes and classifies it in real time into one of six categories: legitimate third-party, analytics, ad network, behavioral tracker, fingerprinting script, or session replay tool.
Everything runs locally — no request data, URLs, or browsing history ever leaves your machine. A weighted signal classifier evaluates each request against 11 behavioral features including URL patterns, tracking parameters, CORS headers, response timing, and CDN signatures. The result is a live dashboard showing exactly what each site is doing behind the scenes, complete with confidence scores, per-site privacy summaries, and session history. Specter doesn't block anything — it makes the invisible visible, putting the user back in control of their own information.
How we built it
Specter is built entirely on Chrome Manifest V3 using a service worker and the webRequest API — no build step required, load unpacked directly. The classifier runs synchronously in the extension using 11 weighted signals derived from request metadata. Features are extracted purely from behavioral patterns — URL structure, timing relative to page load, response size, header signatures, tracking parameters — with no dependency on domain identity.
The ML pipeline uses XGBoost trained on labeled request data, serialized to ONNX for fast in-browser inference. The dashboard is built with D3.js for real-time timeline visualization of request bursts relative to page load events.
Challenges we ran into
Manifest V3 was the first wall. Google's MV3 migration significantly restricted the webRequest API compared to MV2, requiring careful navigation of what could be observed versus intercepted. Building a classifier that doesn't rely on domain matching meant engineering features entirely from request behavior — which required building and labeling a dataset from scratch. Handling edge cases like multi-part TLDs (co.uk, com.au), brand CDNs, and iframe initiator attribution added significant complexity to what looked like a simple parsing problem.
Accomplishments that we're proud of
Getting the classifier to detect novel trackers — requests that wouldn't appear on any blocklist — purely from behavioral signatures. Building something that is genuinely useful as a privacy tool for everyday users, not just developers. And demonstrating that meaningful digital privacy tooling doesn't require sending your data anywhere.
What we learned
That the gap between blocklist-based and behavior-based detection is much larger than expected. Trackers evolve faster than blocklists update, and first-party proxying of session replay tools means domain matching misses a significant slice of real-world tracking. Digital privacy isn't just a security concern — it affects anyone who uses a browser, which is everyone.
What's next for Specter
A public tracker leaderboard showing the worst offending sites by tracker count, making the scale of the problem visible to non-technical users. Automatic privacy audit reports exportable as PDF. A Firefox port to reach a broader audience. And continuous retraining of the ML classifier as new tracker patterns emerge — because blocklists will always be one step behind.
Log in or sign up for Devpost to join the conversation.