What other browser has injected a referrer to a link that has been entered into a browser URL bar and has benefited the company personally? As a engineer that has worked on global products myself, I find it extremely concerning that something like that made it to the public and it seems quite unbelievable that it was a simple mistake, but then again, I wasn't the person who coded it. There has been plenty of 'mistakes' that brave has needed to backtrack on and apologise for. Other browsers that have been around longer than brave have not been found to behave in ways brave has even though I am sure many researchers poke holes in it. If you would like to point out the behaviour of other browsers and compare it to the controversies that Brave has had, feel free to do so and prove many of the doubters wrong. The affiliate link is one of many examples. My other point is that you can also get the privacy protections Brave touts from other browsers as well, but without the shady past that Brave has a history of.

Can you link some other examples then? You keep using the affiliate link one but it doesn't seem very convincing to me. My takeaway from the comments on this post has been that some people really don't like brave but are either unwilling or unable to explain with more than surface-level criticisms.

I think if you just google for 'Brave controversies' you would get quite a few, like I just did now. There are also plenty of links in this submission. From content injection to taking money on behalf of people that have no idea its even happening, and this coming from a browser whose selling point is privacy.

https://securityboulevard.com/2019/02/brave-browser-sacrific...

https://www.computerworld.com/article/3284076/brave-browser-...

https://community.brave.com/t/does-brave-inject-buttons-onto...

https://twitter.com/vj_chidambaram/status/107647481470831001...

Your first link is incorrect; Brave doesn't whitelist trackers. The Facebook/Twitter option enables embedded posts from those platforms on other domains. These frames, however, do not transfer cookies and do not permit the third-party access to storage. You can alter this behavior in brave://settings/socialBlocking.

Your second link suggests Brave replaces ads on websites; this is also wrong. Brave removes harmful third-party ads and trackers (as these harvest user data, and violate privacy). Brave offers an alternative model (Brave's privacy-respecting opt-in model) instead, which reward users with 70% of the associated revenue, while leaving their data untouched.

Your third link is, I believe, asking about our in-situ tipping buttons. These are triggers for the Tipping panel within Brave, enabling you to tip BAT to users on Twitter, GitHub, and elsewhere. I'm not sure what concerns you about this; these can be turned off in brave://rewards, if you like.

The last link you provided is also quite misleading. Brave distributed BAT grants to users, enabling those users to earmark tokens for content creators. Our interface at the time identified "verified" creators as such, but didn't make an equally explicit identification of unverified creators. This lead to some confusion. But as a result of Tom Scott's feedback in 2018, we saw massive improvements made to our UI/UX and tipping model over 48 hours or so. Today unverified creators are clearly identified as such, and tips are held for them on the user's device, rather than in a settlement wallet. See also https://brave.com/rewards-update/

That you had to google these and didn't know them offhand made me skeptical, but I'll attempt to summarize the articles to see what the criticisms are:

1. https://securityboulevard.com/2019/02/brave-browser-sacrific... Brave has a whitelist for some facebook urls for loading scripts from third party domains. Found the brave community thread imaged in the post: https://community.brave.com/t/how-to-disable-facebook-twitte... My read of this thread is not having the whitelist breaks authentication using facebook and they offer an extension to remove the whitelist.

2. https://www.computerworld.com/article/3284076/brave-browser-... This is about the opt-in basic attention token system, where users can replace ads served by websites with ones that reward them with cryptocurrency. I have used brave for a while and don't use this system (using the built in ad block instead). I don't see this as a negative.

3. https://community.brave.com/t/does-brave-inject-buttons-onto... This is about some piece of the basic attention token system that apparently injects tip buttons into websites. I don't use the basic attention token system so this does not impact me.

4. https://twitter.com/vj_chidambaram/status/107647481470831001... This is apparently about the basic attention token system donation feature not sending out donations that do not meet a threshold. Again, I do not use this system. But I saw this mentioned by someone else in one of the comments on this post and the response mentioned Brave has changed their policies to refund people within 90 days if the donation is not claimed.

A few notes (you'll see that I also had a response below):

1. We whitelist scripts to load, so as to enable Facebook and Twitter posts to be embedded into other sites. But, we don't whitelist/enable the tracking aspect of these scripts. We block them from accessing cookies and other local storage. You can modify this behavior in brave://settings/socialBlocking

2. Brave has never replaced ads on pages. We block harmful, third-party ads and trackers. And, separately, we offer a privacy-respecting digital advertising model. As you point out, our model of showing ad notifications is opt-in.

3. These are harmless tip-triggers shown near Tweets, GitHub comments, and more. Similar to what you would see with an extension like Pocket, where buttons are added near items so you can add them to a reading list, etc.

4. Tips made to unverified creators remain in the user's wallet. There's no threshold requirement here; if you tip 1 BAT to a verified creator, that tip will go out immediately. If you tip 1 BAT to an unverified creator, it will remain in your wallet for up to 90 days.

2.

Umm I knew of them, I was being sarcastic as I had to do your job of researching something rather than you actually spending some effort to do your own job.

I think everyone's threshold for what constitutes breach of trust is different. If you accept content injection, unreported whitelists and other similar behaviour from a browser which touts privacy as its selling point ok, then thats your call. But this kind of behaviour is unacceptable from my and many other people's perspective. Which other major browser injects any content in to a website without the users request? Do you see people being ok with being impersonated by Brave without their knowledge? Especially when these mistakes just seem to keep happening, at some point you have to question the intention. Again maybe you are ok with it, but people should be informed about these practices and make their own call. To most people, this is not ok. What other browser has had this level of controversy (outside of chrome possibly) and they have been in business longer than brave.

You are not responding to my investigation of your issues and just asserting your initial argument again. You have not demonstrated content injection beyond some BAT related tipping feature. All of the controversies you have pointed to are extremely minor and justifiable. I become more convinced as I read your posts you started with your conclusion and are working backwards to evidence.

The fact that you disingenuously refer to search suggestions as a "keylogger" doesn't make me feel anymore confident in the honesty of your company. I feel as if this is a immature response given you purposefully avoid describing what it actually is (which is still something I disagree with being a default).

I think it's a fair description to be honest. Granted, it's not some always running process grabbing your keypresses across different programs, but it is still a horrible privacy violation that is operating without most people's understanding.

Accidentally screw up a copy-paste? ctrl-z as quick as you like, it's too late, one of your passwords has been sent out to google...

It's a bit of an impassioned description of the feature, but this is a comment on HN, not some company press release. How neutered do we have to be that we can't make a point with emotion behind it. It's clearly much more hyperbole than "immature" or dishonest, is all I'm saying.

The reality is that users aren't necessarily aware that their keystrokes (and any unintentionally pasted input) are being sent to Google long before they explicitly navigate anywhere. Inspect the network activity and you will see a log of individual keystrokes (depending on how quickly you type) sent to Google. Firefox waits until you have 2 characters in the address bar before they send them off.

So you are saying Brave does not have search suggestions when typing in the omnibar? Never used Brave.

Not on by default; if you want to send keystrokes out to a search engine, you have to explicitly enable this feature.

You realise other browers can also opt out of this feature right? Why did you even use this example if you have this feature, I mean keylogger, also in brave? Your responses here are not necessarily helping you or your product.

I'm aware you can opt-out of this in other browsers, but the default is to emit user input to Google, without the user being made aware. In Brave, if you wish to send your keystrokes to a third-party, you must opt-in. That's the key difference here.

Thanks for confirming that Brave has keyloggers (by your own definition) and has no difference from other browsers.

No difference? There's a huge difference between transmitting user input with and without explicit consent. Do you think there is no difference between me taking your car without asking, and you lending me your car?