HIN (Http INterceptor)

FAQ & Documentation

Version 1.0.4 of July 24, 2015

Overview

HIN (Http INterceptor) is a browser extension for Chromium-compatible browsers. It is a highly versatile tool, useful for privacy enhancement, Web development and testing. HIN uses the chrome.webRequest API to intercept the browser's traffic and make adjustments (either of the HTTP headers, or by cancelling or redirecting) using a rule-based matching engine. This allows for very highly selective behavior based on the particular sites being visited.

HIN only adjusts HTTP headers, and never modifies the actual content of Web pages (e.g. to remove ads or any other information). Also, HIN does all modifications "in flight" and never directly reads or writes browser data such as cache, history, cookie store, etc.

Frequently Asked Questions

Q: Does HIN ever modify Web page content (e.g. to remove ads)?

No. HIN never touches, either by reading or writing, the content ("body") of an HTTP response. HIN only acts on a request/response by cancelling, redirecting, or adjusting HTTP headers. HIN uses no Chromium extension "content scripts."

Q: Does HIN wipe or clean out cache, cookies, browsing history, etc.?

No. HIN never directly reads or writes the browsing data such as history, cookies, cache, etc. That information can be wiped out by the user using the "Clear browsing data" function built into Chromium. There are also numerous excellent extensions to help manage this browser-captured data. However, HIN may influence (usually, to reduce) the content of these privacy-reducing data stores when it cancels or redirects a request, blocks cookies, etc.

Q: What should be Chromium privacy settings be set to in order to work best with HIN?

The following options are recommended under "Settings:"

Q: How do I sync my customized HIN rules and actions to multiple browsers?

HIN uses the "local storage" facility and settings will not sync to multiple instances of your Chromium browsers. To sync your customized rules and actions, use the Export facility on the Options page to dump out the options JSON, transfer the JSON to the other browser's computer, and then import the JSON on the Options page on that computer. This procedure works across operating systems and Chromium versions.

Q: I've created some useful rules I would like to share, how can I do that?

The best way to do this is to share the JSON data for the rule(s) and any newly added action(s) they perform via the usual means of Email, chat, etc. You may also post to the HIN
discussion forum or Email them to the HIN author for inclusion as default rules.

Q: I'm not sure I like the default rules. Why are the default rules the way they are, and how can I change them?

The default rules are set up to provide a typical degree of privacy enhancement, including opting out of auto-sign-in for certain types of Web services where one generally is only "reading" the material (e.g., search, video, news, finance) while retaining auto-sign-in for services where one is generally "writing" and maintaining individualized content (e.g., Email, calendar, contacts). There are some services where this distinction is not as clear, e.g. YouTube auto-sign-in may be desired to make use of playlists or to upload content. The simplest way to disable a default rule that opts out of auto-sign-in for a service you do want is to disable that rule by clicking it in the HIN dropdown.

More detailed adjustments can be made, and default rules disabled via the toolbar dropdown, or removed entirely by editing the JSON rule data in the Options page. It is strongly advised to export and save a copy of any customizations made, so that they can be recovered later.

Q: Why does HIN override the "New tab" page?

HIN overrides the "new tab" page to ensure that it can intercept the URLs for new tabs, which would otherwise be impossible. This is particularly important when the new tab page is one provided by one of the built-in search engine providers, and that provider's services need to be subject to the "auto-sign-in opt-out" describe in this FAQ. Overriding the "New tab" page also allows HIN to more effectively intercept URLs at startup time when the "Open the New Tab page" is used as the startup URL.

Q: Does HIN log my Web request activity anywhere?

Never persistently on disk, and only on a very limited basis in memory, when all of the following are true: Debug event information resides only in memory, never on disk, and disappear when the CLEAR button is clicked on the debug page, or browser is completely closed. Note that neither closing the Debug page nor turning off debug capture by themselves will clear out the currently captured events, but rather, they will continue to appear when the debug page is re-opened. This is an intentional feature to aid analysis of the events. When the number of debug requests exceeds the limit "Debug FIFO size" configured on the Options page, debug events for requests in excess of that number are discarded on a first-in, first-out basis.

Q: Why would I need something like HIN when I have "incognito mode?" Can/should I use HIN in incognito mode?

Chromium supports an "incognito" mode, also called "private mode" on some browsers. Incognito mode and HIN serve two different, complementary purposes. Incognito mode limits the normal accumulation of privacy-reducing information on the browser by: suppressing history logging; storing cookies and cached documents only in memory; clearing out such information when the browser is closed; and other behavior. While this is useful, the browser already allows the user to wipe this data with the "Clear Browsing Data" function. Incognito mode therefore simply provides a more convenient and reliable way of performing this operation on an automatic basis.

HIN complements incognito mode by preventing the accumulation of privacy-reducing information on web sites visited by limiting the browser's ever sending some of that information (mostly cookies, but also User-Agent information, Referer URLs, cache tags, etc.) to those sites, on a highly selective basis. This is information, collected by the site operators, that the user would otherwise not be able to erase by any means, and therefore HIN is in a substantive supplement to incognito mode for privacy.

On an extension's installation or update, Chromium disables its use in incognito mode, and warns even after it is explicitly enabled, due the possibility that the extension may log browsing history or otherwise compromise privacy. However, HIN does not log activity except in very limited case of in-memory debug events that disappear on close (see below). Therefore it is advised HIN be enabled in incognito mode, and the HIN Options page will display a warning if HIN is not enabled in incognito mode, with advice on how to enable it.

Q: Are there URLs that cannot be intercepted?

YES, in the cases below. A side-effect of this is that HIN has no way of knowing what it is missing as far as traffic that should be filtered, but is not. The only way to determine the actual traffic is to use a lower-level analysis tool, such as the Developer Tools in the browser, a logging HTTP proxy server (e.g. "mitmproxy"), lower-level network analysis ("sniffer") tools such as tcpdump, tcpflow, WireShark, etc.

The chrome.webRequest API, and therefore HIN, will generally fail to intercept and filter the following URLs:

Q: Does HIN access external resources or use third party libraries?

No. HIN is entirely self-contained, uses no third-party libraries, and has in its extension manifest the entry "content_security_policy": "default-src 'self'" which limits its loading of content to what comes with the extension.

Q: How can I know my copy of HIN is authentic and does what this document claims?

The HIN archive has a unique digest ("fingerprint") which can be verified by calculating the digest of your downloaded archive and comparing with the expected, published digest. The digest is the result of applying the SHA-256 algorithm to the gzip'd TAR archive (.tar.gz), e.g., the command "sha256sum" can be used to calculate the 64-character hex string. To allow review and verification of functionality, all the HIN Javascript code is written in a clear, un-obfuscated, well-commented manner and review by users for correctness is highly encouraged. Note that HIN
license terms do not allow for modification of the software, but do allow for unlimited redistribution without fee.

Q: Why is the installation procedure the way it is?

HIN installation differs from Chromium extensions distributed on the Google Chrome Web Store (GCWS). Because the HIN
license forbids anyone to collect a fee for redistribution, HIN cannot be hosted on the GCWS, because GCWS charges a fee to participate in its extension publishing process. As a result, users are subject to barriers to installation, put in place by the Chromium developers, in cooperation with Google, that make it more difficult to install HIN and other benevolent, useful, non-GCWS-hosted, extensions. Following are the methods for installing HIN in various situations:

  1. Enterprise Administrators managing centralized policies can arrange for HIN to be installable directly from the Web by adding the the URL http://www.alma.com/chromium/* to the array value for ExtensionInstallSources policy. Individual users must download, save and unpack the HIN archive and use one of the next two methods.
  2. On Mac and Linux, unpack the archive, then using a GUI file browser (Finder on Mac, nautilus on Linux), drag the "hin.crx" extension file into the browser page at the chrome://extensions URL. You will be prompted to add HIN.
  3. On Mac, Linux or Windows, unpack the archive, then go to chrome://extensions URL, check the box "Developer mode," click "Load unpacked extension," browse to the directory "hin" in the unpacked archive, and load it. On Windows thereafter there will appear a prompt each startup to disable extensions in developer mode, and this needs to be dismissed by clicking "Cancel" on each startup. Users who find this popup useless or annoying should contact the Chromium developers to request its removal.

Because the HIN license allows anyone to post HIN unmodified on any site without fee, users who would like to see HIN on GCWS may contact Google to request waiver of the fee so it can be posted there. Users may also contact Chromium developers to request removal of the installation barriers for non-GCWS distribution sites.

Q: What are the licensing terms for HIN?

HIN may be used or re-distributed by anyone free of charge, but may not be modified. See the file
LICENSE.html included with the distribution for details.

Q: Why does HIN exist? What is the motivation?

The original motivation for HIN grew out of a desire to opt out of the "auto sign-in" function provided by many providers of free and commercial Web services. Consider a provider of Web-based services that includes Email and Web search. When one logs in to the provider's free Web-based mail service, one will also, usually with no option to prevent it, be automatically be signed in to that same provider's Web search and other services. This happens by way of an HTTP "cookie" stored on the browser by the provider. Activities entirely unrelated to Email use, e.g. search queries, will then be logged by the provider along with with the cookie tied uniquely to the ID that was used to sign into Email. Thus the cookie can be used to uniquely identify the Email user as the submitter of those search queries, even though the user's use of the Email service was completely unrelated to the Web searches. But a user might wish his search queries not be logged in a way that can attribute the query to him individually via the cookie set by the Email service.

HIN was designed to allow users to opt out of this "auto-sign-in," specifically by stripping out HTTP cookie information in a highly selective, "surgical" way (by URL matching). Because the cookies are blocked only for some URLs, it is not necessary to log out of a search provider's other services (e.g. mail, calendar). From here it was straightforward to make HIN a general purpose "HTTP interceptor."

Q: Who are you?

I am the author of HIN, John K. Hinsdale of Princeton Junction, NJ, USA. To contact me, email
chromium-hin@alma.com.

Rules

Rules overview

When globally enabled, HIN works by intercepting each HTTP request from the browser and applying a sequence of rules, each with a match condition and optional sequence of actions (see below) to be performed on requests matching the condition. For purposes here, the term "request" refers, as in the chrome.webRequest documentation, collectively to the HTTP request sent by the browser together with the HTTP response that comes back. If multiple rules match a request, all their enabled actions are performed. The match condition is a logical composition of tests, usually string comparisons, applied against the content of the HTTP request, specifically the request method (GET, POST, etc), and the URL (e.g., "http://www.foobar.com/baz"). There is not yet an ability for a rule to match on other request information such as the headers, nor any part of the response such as the HTTP status or response headers.

Actions are referenced in a rule by name and described in the next section.

Rules Syntax

The rules in place are given by the key rules: in the HIN Options JSON data. The value of this key is an array of JSON objects, each of which is a named rule and has the following required components:

Match Syntax

A match condition is a JSON value that is evaluated by the HIN matching engine to yield "true" or "false" value that decides if the rules is a match for the request (in which case the rule's enabled actions are performed). The condition can take the following forms: To see numerous examples, open the HIN Options page and study the default rules.

Actions

HIN actions are given by the key actions: in the HIN Options JSON data. The value of this key is an array of JSON objects, each of which is a named action, and has the following required components:

Action Syntax

An action operation is a JSON value, either a string representing a single verb (i.e., an operation with no arguments), or an array of the form [verb, arg, ...]. These can be:
To see numerous examples, open the HIN Options page and study the default actions.

Functional Documentation

Overview

HIN is disabled on installation and will do nothing until you globally enable it. HIN will install a "fighter jet" icon on your extensions toolbar, which is red when HIN is globally disabled, and blue when HIN is enabled. Most functionality is accessible directly from this icon. To globally enable/disable HIN, just click the first menu item in the popup that appears when you click the toolbar icon.

Toolbar Icon Menu

The toolbar icon menu items are:

Functionality Intentionally not Provided by HIN

HIN by design does not provide some useful functions which other extensions provide:

Future Development

The following improvements are being considered: Suggestions for features are welcome; post to the
discussion forum or contact the author.