FlashBanBuilt to be trusted, by collecting almost nothing.
Using a seizure shield reveals a health condition, and a browsing log shows where someone goes. So FlashBan's main protection is that it keeps almost nothing, and what it keeps never leaves your computer.
What FlashBan keeps
Everything is stored with Chrome's local extension storage, on your computer.
| Data | Where | How long |
|---|---|---|
| Your settings (sensitivity, protection strength, per-site switch) | this computer | until you change them |
| Domains, dates, counts, peak flash estimates and source types | this computer | 30 days, or until "Clear my data" |
| Accounts, identifiers, full URLs, page content, screenshots | never collected | – |
The one network request
For a cross-origin .webp or .apng image the page is already loading, FlashBan fetches the file's first bytes without cookies to tell a still image from an animated one; only a yes or no comes back. Links that point at your own computer or local network (localhost, 192.168.x.x, 10.x.x.x and similar) are refused, and such images simply stay dimmed. A public link that redirects to one is not yet stopped; see the limits below. GIFs are never probed: they always count as animated. There is no FlashBan server.
Attacks we test against
From our threat model. "Tested" means a passing unit test or an attack page in demo/adversarial/ that passes node harness/run.mjs against the real extension.
Harness evidence below is from main d474896 (dim + greyscale, Protection strength, red blocked): three headless runs on our Windows laptop, plugged in, 29/29 expected verdicts each run, all 16 attacks protected 3/3, all 8 benign/control pages allowed 3/3. Protection appeared 0.42 to 1.7 s after a strobe started on most pages; the overlay-killer page was locked down in 1.25 s every run. Full results on the team board. Later builds need their own checks.
| Threat | Defence | Status |
|---|---|---|
| A strobe timed between samples | Sampling with real timestamps | tested 12.5 and 30 Hz dimmed in 0.42–0.50 s |
| A big flash split into small tiles | Add flashing area up across elements | tested unit test |
| Red-only flashes that pass the brightness check | Separate red-flash detector; red flashing is always blocked | tested blocked (paused and covered) |
| Pixels hidden from analysis (tainted canvas, DRM) | Fail closed: dim and label | tested tainted canvas dimmed |
| Many strobes to exhaust the CPU | Per-page budget, then fail closed | tested protected by dimming |
| Page deletes or restyles the overlay | Closed shadow root, top layer, re-applied guard, then lockdown | tested locked down in 1.24–1.25 s |
| Page spoofs messages to the extension | Only our own extension id is trusted; every message shape-checked | tested unit tests |
| Flashing that starts after a calm intro | Detection never stops | tested dimmed after the calm intro |
| Remote code in the extension | No remote scripts, no eval, strict CSP | built by review |
| Our own overlay flickering | Nothing blinks; labels ease in once; anything that hides content appears at once; no motion under reduced motion | built |
| Dim set too light to protect | Every Protection strength step keeps the brightest pixel under the 0.10 change a flash needs (72% floor) | tested unit test |
| A page aims the image probe at your router or computer | Private and local addresses in the link refused before any request; redirects not yet checked | tested unit test |
Known limits
Not a medical device. FlashBan reduces exposure to flashing content. It can't guarantee protection: detection takes a fraction of a second, and media it can't read can only be dimmed. Don't rely on it as your only protection.
- Unreadable video
DRM and cross-origin video without CORS can't be measured, only dimmed.
- Detectable
Websites can tell FlashBan is installed by probing its extension files, which can reveal a health condition. Fix (bundling the content scripts) not done yet.
- First frames
The first frames of a new flash can reach the screen before FlashBan reacts; response time depends on the page, source and machine.
- Outside the browser
Apps, games and video outside Chrome aren't covered.
- Image probe
The still-or-animated probe for WebP/APNG can be fooled by the image's server, image hosts can see that this browser runs FlashBan, and a public image link that redirects to a local address is still followed.
- Iframes
Flashes split across iframes aren't added together; each frame is judged on its own.
- Displays
Brightness is computed from sRGB values. HDR, colour profiles and screen brightness aren't modelled.