News for hackers. Stuff that matters.

A comment on Getting Started with Brave. Parent comment

Re:Getting Started with Brave by nobunaga on Monday January 11, 2021 @04:54PM (#25737864)
What other browser has injected a referrer to a link that has been entered into a browser URL bar and has benefited the company personally? As a engineer that has worked on global products myself, I find it extremely concerning that something like that made it to the public and it seems quite unbelievable that it was a simple mistake, but then again, I wasn't the person who coded it. There has been plenty of 'mistakes' that brave has needed to backtrack on and apologise for. Other browsers that have been around longer than brave have not been found to behave in ways brave has even though I am sure many researchers poke holes in it. If you would like to point out the behaviour of other browsers and compare it to the controversies that Brave has had, feel free to do so and prove many of the doubters wrong. The affiliate link is one of many examples. My other point is that you can also get the privacy protections Brave touts from other browsers as well, but without the shady past that Brave has a history of.
[ Parent | on HN ]
Re:Getting Started with Brave by matthewrobertso on Monday January 11, 2021 @05:09PM (#25738120)
Can you link some other examples then? You keep using the affiliate link one but it doesn't seem very convincing to me. My takeaway from the comments on this post has been that some people really don't like brave but are either unwilling or unable to explain with more than surface-level criticisms.
[ Parent | on HN ]
Re:Getting Started with Brave by nobunaga on Monday January 11, 2021 @05:18PM (#25738253)
I think if you just google for 'Brave controversies' you would get quite a few, like I just did now. There are also plenty of links in this submission. From content injection to taking money on behalf of people that have no idea its even happening, and this coming from a browser whose selling point is privacy.

https://securityboulevard.com/2019/02/brave-browser-sacrific...

https://www.computerworld.com/article/3284076/brave-browser-...

https://community.brave.com/t/does-brave-inject-buttons-onto...

https://twitter.com/vj_chidambaram/status/107647481470831001...

[ Parent | on HN ]
Re:Getting Started with Brave by jonathansampson on Monday January 11, 2021 @05:28PM (#25738441)
Your first link is incorrect; Brave doesn't whitelist trackers. The Facebook/Twitter option enables embedded posts from those platforms on other domains. These frames, however, do not transfer cookies and do not permit the third-party access to storage. You can alter this behavior in brave://settings/socialBlocking.

Your second link suggests Brave replaces ads on websites; this is also wrong. Brave removes harmful third-party ads and trackers (as these harvest user data, and violate privacy). Brave offers an alternative model (Brave's privacy-respecting opt-in model) instead, which reward users with 70% of the associated revenue, while leaving their data untouched.

Your third link is, I believe, asking about our in-situ tipping buttons. These are triggers for the Tipping panel within Brave, enabling you to tip BAT to users on Twitter, GitHub, and elsewhere. I'm not sure what concerns you about this; these can be turned off in brave://rewards, if you like.

The last link you provided is also quite misleading. Brave distributed BAT grants to users, enabling those users to earmark tokens for content creators. Our interface at the time identified "verified" creators as such, but didn't make an equally explicit identification of unverified creators. This lead to some confusion. But as a result of Tom Scott's feedback in 2018, we saw massive improvements made to our UI/UX and tipping model over 48 hours or so. Today unverified creators are clearly identified as such, and tips are held for them on the user's device, rather than in a settlement wallet. See also https://brave.com/rewards-update/

[ Parent | on HN ]
Re:Getting Started with Brave by matthewrobertso on Monday January 11, 2021 @05:41PM (#25738680)
That you had to google these and didn't know them offhand made me skeptical, but I'll attempt to summarize the articles to see what the criticisms are:

1. https://securityboulevard.com/2019/02/brave-browser-sacrific... Brave has a whitelist for some facebook urls for loading scripts from third party domains. Found the brave community thread imaged in the post: https://community.brave.com/t/how-to-disable-facebook-twitte... My read of this thread is not having the whitelist breaks authentication using facebook and they offer an extension to remove the whitelist.

2. https://www.computerworld.com/article/3284076/brave-browser-... This is about the opt-in basic attention token system, where users can replace ads served by websites with ones that reward them with cryptocurrency. I have used brave for a while and don't use this system (using the built in ad block instead). I don't see this as a negative.

3. https://community.brave.com/t/does-brave-inject-buttons-onto... This is about some piece of the basic attention token system that apparently injects tip buttons into websites. I don't use the basic attention token system so this does not impact me.

4. https://twitter.com/vj_chidambaram/status/107647481470831001... This is apparently about the basic attention token system donation feature not sending out donations that do not meet a threshold. Again, I do not use this system. But I saw this mentioned by someone else in one of the comments on this post and the response mentioned Brave has changed their policies to refund people within 90 days if the donation is not claimed.

[ Parent | on HN ]
Re:Getting Started with Brave by jonathansampson on Monday January 11, 2021 @05:56PM (#25738994)
A few notes (you'll see that I also had a response below):

1. We whitelist scripts to load, so as to enable Facebook and Twitter posts to be embedded into other sites. But, we don't whitelist/enable the tracking aspect of these scripts. We block them from accessing cookies and other local storage. You can modify this behavior in brave://settings/socialBlocking

2. Brave has never replaced ads on pages. We block harmful, third-party ads and trackers. And, separately, we offer a privacy-respecting digital advertising model. As you point out, our model of showing ad notifications is opt-in.

3. These are harmless tip-triggers shown near Tweets, GitHub comments, and more. Similar to what you would see with an extension like Pocket, where buttons are added near items so you can add them to a reading list, etc.

4. Tips made to unverified creators remain in the user's wallet. There's no threshold requirement here; if you tip 1 BAT to a verified creator, that tip will go out immediately. If you tip 1 BAT to an unverified creator, it will remain in your wallet for up to 90 days.

2.

[ Parent | on HN ]
Re:Getting Started with Brave by nobunaga on Monday January 11, 2021 @06:14PM (#25739379)
Umm I knew of them, I was being sarcastic as I had to do your job of researching something rather than you actually spending some effort to do your own job.

I think everyone's threshold for what constitutes breach of trust is different. If you accept content injection, unreported whitelists and other similar behaviour from a browser which touts privacy as its selling point ok, then thats your call. But this kind of behaviour is unacceptable from my and many other people's perspective. Which other major browser injects any content in to a website without the users request? Do you see people being ok with being impersonated by Brave without their knowledge? Especially when these mistakes just seem to keep happening, at some point you have to question the intention. Again maybe you are ok with it, but people should be informed about these practices and make their own call. To most people, this is not ok. What other browser has had this level of controversy (outside of chrome possibly) and they have been in business longer than brave.

[ Parent | on HN ]
Re:Getting Started with Brave by matthewrobertso on Monday January 11, 2021 @06:36PM (#25739761)
You are not responding to my investigation of your issues and just asserting your initial argument again. You have not demonstrated content injection beyond some BAT related tipping feature. All of the controversies you have pointed to are extremely minor and justifiable. I become more convinced as I read your posts you started with your conclusion and are working backwards to evidence.
[ Parent | on HN ]