AdGuard

Browser extensions block advertising inside the browser and nowhere else, which leaves everything a browser is not. AdGuard takes the other approach, filtering traffic for the whole machine so applications outside the browser are covered too.

That difference is the entire AdGuard product, and it comes with a mechanism worth understanding before installing anything, because it changes something about how your machine handles encrypted connections.

Filter lists, custom rules, per-application exceptions and a log of what was blocked sit around that mechanism in the way you would expect.

Why it has to install a certificate

Here is the AdGuard technical core, and almost nothing explains it plainly.

Nearly all web traffic is encrypted between your machine and the site. Something sitting outside the browser and filtering that traffic cannot read it, because encryption is doing exactly what it was designed to do.

The way around that is interception. The software presents itself as the destination, decrypts what arrives, filters it, re-encrypts it with its own certificate, and hands it to the application. For the application to accept that, the software’s own certificate authority has to be installed on the machine as a trusted one.

That is not a shortcut or a flaw in the design. It is the only way anything outside the browser can filter encrypted traffic, and every product doing system-wide filtering works the same way, including several protection suites people already run without noticing.

What that changes for you

The AdGuard consequence is specific and deserves stating rather than glossing over.

Once the certificate is installed and filtering is active, the certificate your browser shows you for any site is the filter’s rather than the site’s. A knowledgeable poster on a security forum put the difficulty precisely, which is that you now see the filter’s own certificate everywhere and would not notice anything unusual if something were wrong.

In practice that means the browser’s own indication of who you are connected to stops being the site’s own proof and becomes the filter’s assurance about it.

Whether that trade is acceptable depends on what you want. It is what filtering outside the browser requires, it is unavoidable for that purpose, and it is entirely avoidable if the browser is all you care about.

The browser extension needs none of this

Here is the comparison that decides the AdGuard question, and it is the argument people make against the paid application.

A browser extension operates inside the browser, seeing requests before they are encrypted on the way out and after they are decrypted on the way in. It is already looking at clear text, so it has no interception to perform and no certificate to install.

So for advertising on web pages, the extension achieves the same result by a simpler route. The system-wide application adds nothing there.

What it adds is everything else, meaning advertising inside desktop applications, in software that displays sponsored panels, and in anything that fetches its content without going through a browser at all.

That is the whole decision in one sentence. Pay and install a certificate if you want advertising blocked outside the browser, and use the free extension if you do not.

Blocking by name, without any of it

A third approach avoids both the certificate and the extension, costs nothing, and covers the whole machine.

Advertising and tracking hosts are known, published and stable. Sending those names nowhere means the connection never forms, so nothing has to be intercepted or decrypted, because there is nothing to intercept.

That handles a great deal of advertising and it cannot do the finer work. Rules that hide an element on a page, or that block one request from a domain you otherwise need, require seeing the traffic, which name-based blocking never does.

A manager for the system’s own name mapping, with curated lists attached is the simplest version of the idea.

Filtering as a proxy instead

The other established route to what AdGuard does across every application, and it is the one that predates all of this.

A local proxy sits between your applications and the network, and applications configured to use it have their traffic filtered. That reaches every application without the software inserting itself into the system’s network handling.

Privoxy does exactly that, with rules written by hand rather than subscribed to, which suits somebody who wants to understand every rule in operation.

The trade there is configuration. Nothing arrives working, applications need pointing at the proxy, and encrypted traffic raises the same difficulty by a different route.

The other things it does

Beyond advertising, the AdGuard filtering position allows several related jobs.

Tracking requests are blocked using the same lists and rules, which is the part that matters more than the advertising for anybody who cares about being followed between sites.

Parental filtering blocks categories of site for a machine used by children, and because it works below the browser it cannot be sidestepped by opening a different browser.

Per-application control decides which programs are filtered and which are left alone, which matters when something breaks and you need to exclude it rather than turn everything off.

The log shows what was blocked and why, which is how you work out that a page failed because a rule caught something it should not have.

Conclusion

AdGuard does something browser extensions cannot, which is reaching advertising in software that is not a browser. If sponsored panels inside desktop applications are what irritates you, this is the category of tool that addresses them and there is no way around the mechanism it uses.

Understand that mechanism before deciding. Filtering encrypted traffic from outside the browser means installing a certificate authority and accepting that sites will present the filter’s certificate rather than their own. For advertising on web pages alone, a free extension does the same work without any of that, and blocking known hostnames covers a surprising amount of the rest for nothing.