Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brave, the false sensation of privacy

ebin.city

Post reply on HN
Print view View original

421–430 of 501 posts

Re: Brave, the false sensation of privacy

#421

Post by jonathansampson »

mattalex wrote: post #409
jonathansampson wrote: post #335

Earlier quoted context omitted.

I recently did a 5 minute video on the history of digital advertising, with an introduction to Brave's model: https://youtu.be/LsrrT502luI . Per https://brave.com/rewards and https://creators.brave.com , users opt-in to Brave Rewards and begin participating with privacy-preserving Ads. Each ad nets you, the user, 70% of the associated revenue. Rewards come in the form of BAT, which moves more easily and comes with co…

I understand that money goes in through the advertisers: But how is that money sufficient to maintain the current websites? You watch fewer ads than before, which means (if the ads pay the same) that each website gets on average (i.e. if the split is the same as before) less money. As you describe it, only 70% of the ad-revenue actually reaches the user, meaning even if you watch the same amount of ads, websites get…

I think you're conflating the user with the publisher here; the user received 0% of the ad revenue in the past. With Brave, the user receives 70% of the ad revenue (the other 30% goes to Brave, which builds and maintains this apparatus).

You're correct that publishers lose revenue when ads are blocked on their sites, but not blocking ads means users are at an increased risk of being abused by malicious third-party actors. This is one of the main issues with ad and content blockers: they keep users safer, but they take revenue from content creators.

Brave is working on a model that reduces fraud, increases rewards for content creators, and rewards users for their attention. This won't be built overnight, let alone over a few short years. That said, we are making tremendous progress, now settling over 8-figures each month for verified content creators.

As Brave matures and develops, more options will become available for users and content creators to earn more.

As for transaction fees when converting BAT, you are correct. There are often transaction fees involved. But those often depend on how much you're moving around, if you're buying or selling, etc. Uphold and Gemini (our other partner in this space) may also differ between each other.

You're right about heavily centralization around Brave too. This is why we're working on THEMIS (https://brave.com/themis/), a protocol for decentralizing the Brave Ads ecosystem. We recently wrapped-up an effort in that space and blogged about progress: https://brave.com/themis-rfcc-wrap-up/.

We don't have stats to share on how many Brave users are self-funding their wallets vs earning with Rewards. That said, the latter category is naturally going to be much, much larger. It is also not an either-or thing either; many people opt-in to Brave Ads and also buy BAT to supplement their attention-based earnings.

I don't think the goal is to get rid of ads entirely, but rather to yield power to the user. Not everybody has disposable income, and therefore many people would prefer to opt-in to privacy-respecting ads, earn rewards for their attention, and support the Web by those means. For those who wish to self-fund, that is possible. They don't need to opt-in to Brave Ads either.

Re: Brave, the false sensation of privacy

#422

Post by jonathansampson »

shilad wrote: post #419
wmitty wrote: post #16

> Their adblocker is just a fork of uBlock Origin, This does not appear to be true. Here is the github repo for their open source adblock engine written in rust: https://github.com/brave/adblock-rust Here is a (somewhat dated) article describing it by the authors: https://brave.com/improved-ad-blocker-performance/ > Google will take decisions that benefit their advertisement business, like making impossible to use ad…

The Epic Privacy Browser Team is integrating uBlock into Epic in their next update and didn't find a significant degradation in performance from any Chrome limitations, nor a significant performance improvement in Brave's implementation. Epic's mobile browsers were built on Brave/Chromium, but now that Brave has endpoint and other dependencies as mentioned it doesn't explain, it isn't possible to continue to build on…

"…now that Brave has endpoint and other dependencies as mentioned it doesn't explain…"

What unexplained endpoints/dependencies does Brave have? I believe I demonstrated otherwise (with links to external resources) here: https://news.ycombinator.com/item?id=27552530.

Re: Brave, the false sensation of privacy

#423

Post by fordsmith »

gjsman-1000 wrote: post #11

I find Brave Rewards very egregious. You get lots of BAT and the marketing copy hypes it up immensely without mentioning, anywhere, that you need to provide your SSN and Driver's License to a third-party (Uphold) if you actually, you know, want to cash out. This seems particularly irritating because, let's say you set your browser to show you the max amount of ads for a while. You saved up for a few months, decided y…

You are also forgetting that another option is coming soon. Most of the userbase hates uphold, and they are adding Gemini soon, which should be much better.

Re: Brave, the false sensation of privacy

#424

Post by jonathansampson »

freediver wrote: post #384
jonathansampson wrote: post #338

Earlier quoted context omitted.

A regional catalog is downloaded routinely. The only "data" going out is your region (e.g. the United States). This returns a protobuf catalog of ads for your region. Your device privately studies this catalog for relevant entries. When an ad is shown, it's presented as a native notification on the OS. This means the user sees a title (text), and a body (text). Screenshots of these notifications are on https://brave.…

> The only "data" going out is your region (e.g. the United States). Every request Brave makes "home" will transfer private data like IP address of the user and browser fingerprint, regardless of the payload. Can you clarify what is done with this data? Also if it is true what says in the article that some requests "home" can not be disabled, why is that the case?

What browser fingerprint are you seeing in your research? I don't believe Leith et al found any such issue in their review at https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf, nor did I in https://brave.com/popular-browsers-first-run/.

I'm happy to discuss any requests you like; we also document all of this to the best of our ability on GitHub as well (https://github.com/brave/brave-browser/wiki).

As for disabling requests, this is a valid petition. Our goal is to have no extra requests when and where possible. We've worked hard to keep them to a minimal. There are some requests (e.g. product update requests) that we've been hesitant to make more easily blockable, since this could potentially leave large swaths of Brave users disconnected, and increasingly vulnerable.

Re: Brave, the false sensation of privacy

#425

Post by x4e »

pmurt7 wrote: post #298
causality0 wrote: post #295

Earlier quoted context omitted.

Does integrating it into the browser have any performance benefits over using an extension?

Brave ad blocker is written in Rust and browser extensions in JavaScript, so it should be faster

uBlock Origin is using Web Assembly now for certain critical code. Anyway performance differences between the two have always been negligible and often fluctuating.

Re: Brave, the false sensation of privacy

#426

Post by roca »

roenxi wrote: post #177
roca wrote: post #152

Earlier quoted context omitted.

I don't think you understand how Chromium works. Google makes all the important decisions. People have advocated for independent governance (e.g. some kind of Chromium Foundation) but Google isn't interested. E.g. Brave opposes Google in some ways but they have no say in the development of Web standards implemented by Chromium.

It is open source. If someone doesn't like a decision they can fork the codebase. Mozilla's Gecko has been beaten down to sub-double-digit market share, they're less relevant right now than when IE6 was >75% of the market. They have no power to influence the direction the web moves in. And yet life is going on better than ever. If you want a counterbalance to stop Google making the important decisions, Firefox has fa…

Browser vendors can carry small patches against Chromium but significant changes are very costly to carry long-term as the code changes under you. Furthermore, Google controls how heavy that burden is for you. In practice browser vendors who choose Chromium don't challenge Google's Web platform decisions except in very narrow cases like FLoC. In contrast Mozilla and Apple examine every Google-proposed Web platform feature or change to see whether it makes sense.

Mozilla's influence over the Web platform is much lower than it was but it is also far from zero. Lots of major sites still test in Firefox. Apple has even more influence. That is why Google doesn't yet has absolute power over the Web platform.

Re: Brave, the false sensation of privacy

#427

Post by x4e »

jonathansampson wrote: post #382
ehutch79 wrote: post #362

Earlier quoted context omitted.

I don't really care about brave either way, it's just dubious that the ads are somehow untrackable when you apparently get credit for seeing them some how?

We use zero-knowledge proofs and blinded tokens to track when an ad has been viewed by a user. But there is no user data involved here. The magic of cryptography is that you can prove you viewed the ad without telling us anything about you

Do you have any reading material about how you achieved this?

I can't really see how zero-knowledge proofs could solve this. There is no cryptographic way to prove that software executing on a clients machine triggered a notification. Especially on Linux where an open source notification manager could be modified to reject it.

Re: Brave, the false sensation of privacy

#428

Post by jonathansampson »

Barrin92 wrote: post #363
jonathansampson wrote: post #352

Earlier quoted context omitted.

"Brave runs on the exact same ad model as Chrome…" You couldn't be more mistaken here. I covered the history of digital advertising and the introduction of Brave's model here: https://www.youtube.com/watch?v=LsrrT502luI . In short, Brave's model is largely the inversion of Google's model. With Brave, users must opt-in. Google doesn't ask you to opt-in. With Brave, user data remains on device. Google requires the remo…

I did test out Brave a while ago and the reward system was on by default. I had to go to the settings to turn it off, and in fact this option did not sync. So whenever I installed it on a new device I had to turn it off again, and I suspect that's deliberate. I also don't think that Google shares my information with third parties, pretty sure they say explicitly they don't do that. And as to Brave's model of pooling…

Brave Ads/Rewards is definitely OFF by default in Brave (I just double-checked, https://imgur.com/UIASmf4). You're invited to enable it during the Welcome screen, but it's off by default. If you install Brave today (make sure you don't have an old profile sitting around in %localappdata%/BraveSoftware/ already) and observe otherwise, that's a bug (please let us know).

I think you're misunderstanding how Brave's anonymity works. We don't rely on something like k-anonymity where we hide users behind some common cohort ID. Suffice it to say, we're not big fans of FLoC: https://brave.com/why-brave-disables-floc/. Brave's anonymity is based on the inversion of the flow of data. Rather than collecting information about users, Brave transmits data from advertisers to the user's device for local scrutiny.

Google is in no way moving towards the Brave model; it they are far too dependent on user data, IMHO. Brave, on the other hand, was born with a Can't be Evil mindset; every step of the way we have built the application and service to preclude abuse and overreach.

Re: Brave, the false sensation of privacy

#429

Post by x4e »

jonathansampson wrote: post #349
fastball wrote: post #317

Earlier quoted context omitted.

Actually I'm less charitable than "lack of common sense" and chalk it up to hubris – I think what happened is that they couldn't really imagine why someone wouldn't want to accept donations from their viewers/consumers, regardless of source, and so just defaulted to collecting for everyone assuming everyone would love to hop on board the BAT train. This of course turned out not to be the case for various reasons and…

The BAT that was moving around at that time was from Brave. We allocated hundreds of millions of tokens back in 2017 to a User Growth Pool. We distributed tokens to users of the Brave Browser, and allowed them to send those tokens off to their favorite content creators. This is similar to how PayPal lets you email money to anybody, even if they aren't signed up on PayPal. Our thought here was that users could effecti…

The difference with emailing money on PayPal is that the recipient is notified. Brave was collecting currency on behalf of people without even notifying them.

Just because someone can collect the money/currency at a later date doesn't make it fine. If I collected money on behalf of charities yet only gave the money to the charity if they explicitly asked me for it, I doubt that would go down well with donors.

I could even use the situation to my advantage by gaining interest on the donations in the time between it is donated and I pass it on. I suspect Brave was benefiting in a similar way - all the donated money would not be traded while Brave were holding onto it, creating a scarcity which would benefit BAT's prices.

Re: Brave, the false sensation of privacy

#430

Post by jonathansampson »

Tepix wrote: post #339

German c't magazine tested all the main browsers in terms of privacy in the latest issue. Brave came out on top by a large margin. They even discovered that Edge sends a list of visited sites while in private browsing mode back to Microsoft! I've heard some negative things about Brave but i'm willing to give it a try now because it may just be noise. I can imagine the advertising industry being very motivated to keep…

Always look at the quality of work being done. The author's post is distinctively different from that of more reputable sources, such as the review done by Leith and team at https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.
Post reply on HN