  The web is used daily by billions. Even so, users are not protected from many
threats by default. This position paper builds on previous web privacy and
security research and introduces JShelter, a webextension that fights to return
the browser to users. Moreover, we introduce a library helping with common
webextension development tasks and fixing loopholes misused by previous
research. JShelter focuses on fingerprinting prevention, limitations of rich
web APIs, prevention of attacks connected to timing, and learning information
about the device, the browser, the user, and surrounding physical environment
and location. We discovered a loophole in the sensor timestamps that lets any
page observe the device boot time if sensor APIs are enabled in Chromium-based
browsers. JShelter provides a fingerprinting report and other feedback that can
be used by future security research and data protection authorities. Thousands
of users around the world use the webextension every day.
