Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brave, the false sensation of privacy

ebin.city

Post reply on HN
Print view View original

381–390 of 501 posts

Re: Brave, the false sensation of privacy

#381

Post by jonathansampson »

gentleman11 wrote: post #373
pmurt7 wrote: post #334

Earlier quoted context omitted.

The entire ad catalog is sent on your machine and some ad engine running inside the browser decides which ads to show you. It's funny seeing all these folks nitpicking at Brave but who are fine using Google or Microsoft every day

Do you have to download the chosen ad or is it already on your system? If you selectively downloaded ads, your ip address could give you away and you get a floc like situation

The ad catalog for your region is downloaded; it comes with click-through URLs, titles, body text, and some other information. There is no connection made beyond this to retrieve any other ad-related data. You can see what your own regional catalog contains by visiting https://sampson.codes/brave/ads/my_region/.

Re: Brave, the false sensation of privacy

#382

Post by jonathansampson »

ehutch79 wrote: post #362
pmurt7 wrote: post #334

Earlier quoted context omitted.

The entire ad catalog is sent on your machine and some ad engine running inside the browser decides which ads to show you. It's funny seeing all these folks nitpicking at Brave but who are fine using Google or Microsoft every day

I don't really care about brave either way, it's just dubious that the ads are somehow untrackable when you apparently get credit for seeing them some how?

We use zero-knowledge proofs and blinded tokens to track when an ad has been viewed by a user. But there is no user data involved here. The magic of cryptography is that you can prove you viewed the ad without telling us anything about you

Re: Brave, the false sensation of privacy

#383

Post by mthoms »

ehutch79 wrote: post #362
pmurt7 wrote: post #334

Earlier quoted context omitted.

The entire ad catalog is sent on your machine and some ad engine running inside the browser decides which ads to show you. It's funny seeing all these folks nitpicking at Brave but who are fine using Google or Microsoft every day

I don't really care about brave either way, it's just dubious that the ads are somehow untrackable when you apparently get credit for seeing them some how?

You misunderstand. The sensitive data here is your browsing history (and all that it infers). Brave never sees that.

But yes, when you view an ad, that gets recorded somewhere (so that you can get rewards, and the advertiser can be billed).

You decide if you’re comfortable with this or not. The feature is easily turned on or off.

Re: Brave, the false sensation of privacy

#384

Post by freediver »

jonathansampson wrote: post #338
ehutch79 wrote: post #324

Earlier quoted context omitted.

If it's fetching ads, it has to 100% be sending some data to someone, who is likely able to correlate it and track you. It doesn't take much.

A regional catalog is downloaded routinely. The only "data" going out is your region (e.g. the United States). This returns a protobuf catalog of ads for your region. Your device privately studies this catalog for relevant entries. When an ad is shown, it's presented as a native notification on the OS. This means the user sees a title (text), and a body (text). Screenshots of these notifications are on https://brave.…

> The only "data" going out is your region (e.g. the United States).

Every request Brave makes "home" will transfer private data like IP address of the user and browser fingerprint, regardless of the payload. Can you clarify what is done with this data?

Also if it is true what says in the article that some requests "home" can not be disabled, why is that the case?

Re: Brave, the false sensation of privacy

#385

Post by mumblemumble »

ipaddr wrote: post #367
mumblemumble wrote: post #146

Earlier quoted context omitted.

I am guessing that the parent comment has it right. This is admittedly outside my area of expertise, but I would assume that the system they have for managing BATs is subject to the US's Know Your Customer laws, which require financial institutions (including crypto exchanges) to, well, know their customer. Personally. They have to figure all that out before they give you access to your account. Which means, yeah, th…

kyc laws only applies to exchanges that allow cashing out. I don't understand why kyc would be required here. The browser user should be the miner getting a reward as a private key. They should be able to move it to any exchange (this is where kyc is required) or trade privately. Why they chose to implement the design in this way is not what I would expect.

> kyc laws only applies to exchanges that allow cashing out. I don't understand why kyc would be required here.

Because cashing out is kind of the entire point of BAT?

If creators couldn't redeem their BATs for actual spendable currency, they wouldn't really be any different from a Facebook Like button that people have to pay to click.

Re: Brave, the false sensation of privacy

#386

Post by jonathansampson »

pmurt7 wrote: post #298
causality0 wrote: post #295

Earlier quoted context omitted.

Does integrating it into the browser have any performance benefits over using an extension?

Brave ad blocker is written in Rust and browser extensions in JavaScript, so it should be faster

Not only faster, but we aren't beholden to the APIs offered by Google and others. Manifest v3 threatened the existence of popular content-blockers like uBlock Origin. Since we are the browser, we aren't so limited. A recent example of how we are able to do more was with the introduction of CNAME blocking, which allowed us to identify when a third-party tracker had managed to be requested from a first-party URL: https://brave.com/privacy-updates-6/.

Re: Brave, the false sensation of privacy

#387

Post by HWR_14 »

gman83 wrote: post #18

I always find it odd that we worry so much about how much our browsers are tracking us, but almost nothing about what our ISPs are doing. Every time I've looked into it, it seems much worse. As far as I can tell, ISPs are legally allowed to sell your browsing history to third parties: https://arstechnica.com/tech-policy/2017/03/for-sale-your-pr...

I'm jealous of the fact that you're not aware that there is a solution for this. What do you think VPNs are selling? It's specifically relief from ISP-level tracking.

It's profitable enough that there seem to be ads for it baked into everything. I won't repeat their name here, but have you avoided that "Sponsored by NxxxVPN" all over the Internet/baked into every YouTube video that has sponsored videos?

Re: Brave, the false sensation of privacy

#388

Post by hiidrew »

schelling42 wrote: post #194
hiidrew wrote: post #67

I understand Eich has been controversial and Brave gets a lot of flak in return, regardless of issues like the ones raised in the article. Yet, I remain a fan of Brave because of Brave Rewards. I love being rewarded based on my usage, even if the amount is worthless and the ads are random crypto shit. The idea of a company actually spreading revenue based on my attention back to me makes me happy and I wouldn't mind…

> even if the amount is worthless and the ads are random crypto shit. Maybe you are not valuing your own resources enough. Ads draw time, concentration and other mental resources. So i can only believe that it will be a net-negative in the end. It can feel rewarding, but financially, the advertiser can't pay you enough.

That's true, the whole thing on my end is likely some fallacy.

On another note, I've always thought the idea of constructing your own ad profile could be interesting. Like selecting the types of products and related content that you'd want to be pushed.

From my understanding this is kind of the goal of social apps but it's obviously not self-directed. I guess it is in some capacity based on your behavior but it's not like you're intentionally clicking selecting you'd be interested and actually would maybe buy.

Re: Brave, the false sensation of privacy

#389

Post by yborg »

pityJuke wrote: post #31

In addition to some of the other oddities with the article (i.e. the absolutely wrong claim about Brave's ad blocker), I think the security between Chromium and Firefox is a bit too simplistic? This piece [1] might go too far in the other direction, but at the very least it outlines why there are deficiencies in Firefox, comparatively. [1]: https://madaidans-insecurities.github.io/firefox-chromium.ht...

The one thing the OP article doesn't actually do is claim that Firefox is more SECURE than Chrome/Brave, the arguments (mostly bad) are that it more private. And that pretty much goes without saying for Chrome, since its entire raison d'etre is to strip privacy from its users for Google. It's unfortunate that on platforms outside macOS you have to choose between risking your privacy being invaded or your device being invaded.

The reality in any case is that in every pwn contest every year, all the major browsers are exploited, usually with full sandbox escapes; Chrome has better security implementation but a huge install base that makes effort to crack it worthwhile, while Firefox is easier but has trivial market share.

Re: Brave, the false sensation of privacy

#390

Post by freediver »

prepend wrote: post #163
qeternity wrote: post #127

Earlier quoted context omitted.

Let's presume this were true - that the Government was also at fault (I don't agree) - why does that excuse Brave's behavior? If I go look at any other service which requires that kind of information, it's always right up front. Want a Robinhood account? Great, you have to provide the info when you open an acocunt.

I use brave and rewards but have never cashed out so didn’t provide any KYC info. I just donate BAT to sites. Brave does “request info up front” for users who want to use the wallet. Requesting it from users who won’t need it is a waste of time. All Robinhood users perform financial transactions, very few Brave users do.

Is the lack of other options to send micropayments to sites the reason you do this? If there was a way to one click send micropayments to sites from a browser that did not require you to watch ads, but you send your own money, would you do it?
Post reply on HN