This is a touch of FUD. Firefox sends what you type into the search/address bar to google for search suggestions by default, yes. Your perhaps unintended implication here is that all keystrokes are being logged and sent to google.
> Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.
This is a bit of a misstatement of the research; Rather they found that Brave doesn't tag users' installs with persistent IDs by default in startup telemetry or update requests, while most of the rest of the competition do. This means Brave has a superior initial privacy state but says nothing about the overall usage posture. Is it better? Possibly but that's not the conclusion the researchers actually came to.
Here's an example of why the first line of FUD is dangerous: "Brave's BAT is basically just a way for users to be tracked as they go about navigating the web."
This is an easy throw-away statement with little substance and likely little to no truth behind it.
A more concrete example might be that the so-called "Privacy Preserving Product Analytics API" that collects data on Brave users' installs gets enough data to pretty easily fingerprint a user if you wanted to. You don't need many data points to identify an individual from a large group.
It doesn't look like this is the case, fwiw. (Unless your HN profile lists an outdated handle?)
Keystrokes in the URL bar.
It would have been better to say "by default Firefox literally sends every keystroke you type in the URL bar to Google".
In my opinion it is a user-hostile "feature", and should be pointed out, but not in way that could be so wildly misinterpreted.
I agree. I don't like a lot of what Mozilla does but I don't like Brave at all, so I'll gladly defend Mozilla against hyperbole coming from Brave. Brave isn't even a browser, so I just ignore it most of the time.
Describing the cost without explaining the why is really putting a spin on things.
Firefox literally sends your keystrokes to Google, right out of the box. Brave, however, was found to be the most private popular browser by reputable researchers: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.
Brave [never] hijacked links either. Affiliate Links were offered among suggested sites for relevant search input. So if you searched "Binance," the browser would offer (among other suggestions), an affiliate link for the site. Users could then choose to browse to the property with the affiliate link, and in so doing support the development of Brave. No impact to privacy or security at all.
The mistake here was with input handling. Built to handle search input, this feature also mistakenly handled fully-qualified domains. While we intended the app to offer affiliate links (when relevant) to something like "what is binance?", it was also offering them for "binance.us". The latter case was corrected quickly (and the feature itself was disabled out of the box).
More about that on our blog: https://brave.com/referral-codes-in-suggested-sites/.
To your second point, about setting up crypto wallets and soliciting donations on behalf of non-participating publishers, you're mistaken there as well.
To prime the support-system in Brave (called Brave Payments at the time), we staked Brave users with tokens, inviting them to direct those tokens to creators they would like to support. More clearly, Brave gave Brave users say over where Brave ought to direct its own tokens.
Unfortunately, our UI/UX wasn't very clear about which creators were verified, and which were not (we followed the Twitter approach, marking verified creators with a checkmark, but doing nothing for others). This resulted in some confusion at the end of 2018, where users were directing Brave's tokens to non-participating creators (most notably Tom Scott).
We received considerably helpful feedback about how the system could be improved (both from a UI/UX side, and operationally). Frankly, I don't think I've ever seen our team work so hard, and churn out such a monumental update in so little time. We had made massive changes within 48 hours IIRC. Creators were explicitly marked as verified or unverified in all cases, the BAT that Brave stakes with users would remain in the local wallet until it could be received by a verified creator. And BAT that sat pending for 90 days would be unlocked again for the user to direct elsewhere.
Tom Scott was kind enough to review our changes, and explicitly gave us his approval soon-thereafter. What is now 'Brave Rewards' wouldn't be doing so well today were it not for Tom and so many other incredible users helping us find the best path forward.
More about that on our blog: https://brave.com/rewards-update/