Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brave Browser, wiping history still leaves trace of visited sites

github.com

Post reply on HN
Print view View original

21–30 of 210 posts

Re: Brave Browser, wiping history still leaves trace of visited sites

#21

Post by rydre »

kohtatsu wrote: post #9
niftylettuce wrote: post #3

If you need an alternative to Brave, then see https://news.ycombinator.com/item?id=23708688 . This comment also shares the auto-suggestions-for-profit which is another reason I'm not using it. Since I cannot use DDG nor Brave, the only alternative (besides the currently bloated Firefox -- in my biased opinion) is ungoogled-chromium.

Are you a former DDG employee? And to clarify you do use the DDG search engine, just not their browser.

DDG's CEO has a shady background. It's not as privacy centric as they claim to be.

Re: Brave Browser, wiping history still leaves trace of visited sites

#22

Post by jonathanstrange »

rydre wrote: post #13
jonathanstrange wrote: post #10

Earlier quoted context omitted.

Why would you make this assumption? It seems perfectly reasonable to me to assume, in the absence of evidence to the contrary, that a program actually does what it claims to do.

I sometimes do computer forensics for clients and you can be sure that you leave traces. You'd need to wipe out the area of the disk over and over again to fully remove it (sometimes it'll still remain despite that, for undisclosed reasons).

yes I know, even the Gutmann wipe is no longer effective and SSDs are essentially unwipeable, but that's not what this is about. It's about the software not wiping (or not even deleting) data at all when you'd expect it to do so. Generally, you'd expect software to do what it tells you.

Re: Brave Browser, wiping history still leaves trace of visited sites

#23

Post by bartread »

Fiveplus wrote: post #15
girst wrote: post #4

well, compared to undisclosed affiliate marketing for trading sites[1], soliciting of donations without consent[2] or the recent redirection through affiliate links[3], this seems pretty tame. [1]: https://github.com/brave/brave-browser/issues/8793 [2]: https://davidgerard.co.uk/blockchain/2019/01/13/brave-web-br... [3]: https://news.ycombinator.com/item?id=23442027

I'm already using Windows and despite me ticking all privacy checks - I am, as such, trusting MS with my data. Might as well switch over to Edge when I need a chromium-based browser. Threads like these move me in inch closer to that decision. (currently default: Firefox and secondary: Brave) ps: Edge's reader mode and narrator are top-notch.

I can definitely see the reasoning. I suppose I'm still debating whether it's good to have all my personal information with only one company or spread around a bit more.

If I was going to plump for one company, Microsoft might not be the worst choice simply because their business model doesn't revolve around monetizing my personal information.

Re: Brave Browser, wiping history still leaves trace of visited sites

#24

Post by [deleted] »

rydre wrote: post #13
jonathanstrange wrote: post #10

Earlier quoted context omitted.

Why would you make this assumption? It seems perfectly reasonable to me to assume, in the absence of evidence to the contrary, that a program actually does what it claims to do.

I sometimes do computer forensics for clients and you can be sure that you leave traces. You'd need to wipe out the area of the disk over and over again to fully remove it (sometimes it'll still remain despite that, for undisclosed reasons).

[deleted]

Re: Brave Browser, wiping history still leaves trace of visited sites

#25

Post by canofbars »

jonathanstrange wrote: post #22
rydre wrote: post #13

Earlier quoted context omitted.

I sometimes do computer forensics for clients and you can be sure that you leave traces. You'd need to wipe out the area of the disk over and over again to fully remove it (sometimes it'll still remain despite that, for undisclosed reasons).

yes I know, even the Gutmann wipe is no longer effective and SSDs are essentially unwipeable, but that's not what this is about. It's about the software not wiping (or not even deleting) data at all when you'd expect it to do so. Generally, you'd expect software to do what it tells you.

The best way to wipe an SSD is to have full disk encryption and then wipe the key off the ssd. Even if you do manage to recover the key which is a big if, you still need the key in your brain. Combined with writing random data over the ssd you will be lucky to pull anything out of it.

Re: Brave Browser, wiping history still leaves trace of visited sites

#26

Post by oefrha »

> It doesn't seem to be anywhere (in text) in: /Users/mark/Library/Application Support/BraveSoftware

Of course it's not in text. It's a SQLite3 database:

  $ sqlite3 ~/'Library/Application Support/BraveSoftware/Brave-Browser/Default/Top Sites' .dump
  PRAGMA foreign_keys=OFF;
  BEGIN TRANSACTION;
  CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR);
  INSERT INTO meta VALUES('mmap_status','-1');
  INSERT INTO meta VALUES('version','4');
  INSERT INTO meta VALUES('last_compatible_version','4');
  CREATE TABLE top_sites (url LONGVARCHAR PRIMARY KEY,url_rank INTEGER,title LONGVARCHAR,redirects LONGVARCHAR);
  INSERT INTO top_sites VALUES('https://chrome.google.com/webstore?hl=en',0,'Web Store',NULL);
  COMMIT;
This is actually a database inherited from Chromium, so I'm not sure if the issue is inherited from Chromium.

Edit: Tried this on Chromium 86.0.4185.0, top sites db is cleared after clearing all browsing data, so probably not inherited from Chromium.

(Btw I wasn't able to repro on Brave because however many times I open news.ycombinator.com, it simply won't register in top sites -.-)

Re: Brave Browser, wiping history still leaves trace of visited sites

#27

Post by 1f60c »

rydre wrote: post #21
kohtatsu wrote: post #9

Earlier quoted context omitted.

Are you a former DDG employee? And to clarify you do use the DDG search engine, just not their browser.

DDG's CEO has a shady background. It's not as privacy centric as they claim to be.

Source?

Re: Brave Browser, wiping history still leaves trace of visited sites

#28

Post by 867-5309 »

jonathanstrange wrote: post #10
bb123 wrote: post #6

Is it fair to _ever_ say that clearing the history completely removes all traces of visited sites? I have always operated under the assumption that some trace will remain pretty much forever.

Why would you make this assumption? It seems perfectly reasonable to me to assume, in the absence of evidence to the contrary, that a program actually does what it claims to do.

that seems a little naive. what about actual evidence of performing said wipe? a little progress bar showing the 35× overwrite technique maybe, verified by a failed recovery. do any browsers have these small, open source capabilities baked in? seems like nowadays the only way to ensure and audit personal privacy is by having network inspection and disk utilities constantly monitoring these "pro-privacy" apps

Re: Brave Browser, wiping history still leaves trace of visited sites

#29

Post by rydre »

bartread wrote: post #19
rydre wrote: post #13

Earlier quoted context omitted.

I sometimes do computer forensics for clients and you can be sure that you leave traces. You'd need to wipe out the area of the disk over and over again to fully remove it (sometimes it'll still remain despite that, for undisclosed reasons).

Asking because I don't know: does that also hold true for SSDs if the sectors are overwritten (either with new data, or due to wear levelling)?

Correct. None of the publicly/commercially available software can do that, so don't worry most people won't pay for it.

Re: Brave Browser, wiping history still leaves trace of visited sites

#30

Post by 0xfffafaCrash »

bartread wrote: post #17
girst wrote: post #4

well, compared to undisclosed affiliate marketing for trading sites[1], soliciting of donations without consent[2] or the recent redirection through affiliate links[3], this seems pretty tame. [1]: https://github.com/brave/brave-browser/issues/8793 [2]: https://davidgerard.co.uk/blockchain/2019/01/13/brave-web-br... [3]: https://news.ycombinator.com/item?id=23442027

I've disliked Brave from the beginning. Initially because of the pretentious - and frankly appropriated - name, but now for the much more substantive reasons you've cited. Seriously, if you want a browser that gives you control over your data and privacy, use Firefox. It doesn't do any of this shady nonsense.

Brave is trash, but to say Firefox hasn't done shady things is a bit of joke after the whole incident where they sent full site URLs and interaction data over to Cliqz's servers for a random sampling of users in Germany while being neither opt-in nor clear to the users about what data was being sent.
Post reply on HN