Live data from Hacker News

Brave taking cryptocurrency donations “for me” without my consent

twitter.com

271–280 of 354 posts

Re: Brave taking cryptocurrency donations “for me” without my consent

#271
post #141
post #82

Earlier quoted context omitted.

My impression is that Brave's current model actively hurts small creators that would otherwise get some of that money sooner on the donation services they have signed up for, without waiting for Brave's $100 withdrawal threshold to be reached, if it ever does. I'd be surprised if this will be deemed legal, once more people will find out that there is a company collecting donations in their name and without their cons…

>I'd be surprised if this will be deemed legal I'm surprised how anyone could think this was a good idea, or even legal. What wouldn't surprise me is an incoming class action.

We hadn't considered that many creators would interpret our UI/UX as "solicitation" vs. "letting a user do a thing they want to do in our browser."

In any event, the confusion is 100% our fault and we're working on updating the UI and language to be clear based on all the feedback we've gotten. We must do better.

Re: Brave taking cryptocurrency donations “for me” without my consent

#272

Earlier quoted context omitted.

It's been a while since I started using Brave but I felt they were pretty up front with how the payments worked. I do understand the frustration though of those who don't see this. Brave could warn visitors donating when the content owner hasn't set up Brave Payments. Brave could refund said money back to the visitor if it goes unclaimed after a while. Just random ideas from someone who actually likes their attempt.

My understanding is that automatically refunding as part of the agreement with the Brave user is probably workable. Even more workable is to be opt-in only. That's what I would do (to the point that I developed a protocol that's purely opt-in).

After all the very passionate feedback yesterday here and on Twitter, we're reworking things to make it clear who's participating in Brave Rewards and will receive tips and who's not and won't. We erred in shipping UI/UX that didn't make this clear enough. We're fixing this.

Re: Brave taking cryptocurrency donations “for me” without my consent

#273
post #117

Earlier quoted context omitted.

Honest question: Why do you suspect that? (I work at Brave. We're all very, very nerdy here. It'd be helpful to understand why a fellow nerd suspects we're up to no good.)

You're taking money for people without a good way of getting it to them (or ensuring that they want the money at all). My friend Mark had an accident and I think he needs help paying for it. Would you give me some money to help Mark pay for his medical bills? Thank you, I'll just put it in my bank account until Mark asks me for the it. Trust me, I'm trying very hard to let Mark know I have money for him. I'm going to…

This was not our intention.

We shipped a UI/UX that was confusing. We originally used checkmarks to denote creators participating in the program but did not have clear language or markers for creators not participating in then program. Many have pointed out the problem with that, which is helpful!

That's all being updated now and will hopefully roll out very soon. We've heard the feedback and will make sure no creator assets are used for non-verified creators, that it's clear non-participating creators are not in fact participating, and that any tips sent their way will not in fact reach them unless they choose to participate. We're also adding more clarification around what happens to funds "tipped" to non-participating creators.

We want it to be clear if Mark is part of Brave Rewards or not.

Re: Brave taking cryptocurrency donations “for me” without my consent

#274
post #227
post #117

Earlier quoted context omitted.

You're taking money for people without a good way of getting it to them (or ensuring that they want the money at all). My friend Mark had an accident and I think he needs help paying for it. Would you give me some money to help Mark pay for his medical bills? Thank you, I'll just put it in my bank account until Mark asks me for the it. Trust me, I'm trying very hard to let Mark know I have money for him. I'm going to…

I find it interesting this was not responded to as it is a great and easily understood description of how one could see Brave as a scam.

Response posted above! I was waiting to make sure I understood what actions we are taking in response to all the feedback.

Re: Brave taking cryptocurrency donations “for me” without my consent

#275

Earlier quoted context omitted.

So I typed my domain into the setup thing and I got this: "Hello. It looks like you are using WordPress!" "Your domain is NOT using HTTPS.Uh oh! Your domain is NOT using HTTPS. You will need to fix that before continuing." "The following error was encountered: SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: sslv3 alert handshake failure" Why do I need to be using HTTPS before you'll think about pay…

I mean, they are not wrong, you should be using HTTPS.

Why? I don’t have any user accounts on my site. Just stuff. And I’m too busy drawing new stuff to try and get HTTPS working.

I had ads on it just fine without HTTPS. I’ve had PayPal links without it, I’ve had Patreon links. Getting Brave hooked up is a giant pain in the ass compared to everything else I’ve tried.

Re: Brave taking cryptocurrency donations “for me” without my consent

#276
post #147

Earlier quoted context omitted.

Honest question: Why do you suspect that? (I work at Brave. We're all very, very nerdy here. It'd be helpful to understand why a fellow nerd suspects we're up to no good.)

https://twitter.com/ummjackson/status/1076221401353207808 Your UI really looks like Tom Scott has signed up to receive donations through you, not like you've scraped his photo and name off twitter and written a fundraising plea with zero mention that he's never heard of you and that you won't even try to contact him until $100 accumulates and then only half-assedly. For most of us this is our first exposure to your m…

We agree it's confusing and are shipping updates very soon that will make it clear, driven by all the feedback we've received here and on Twitter. We didn't set out to confuse people but clearly we did. Not our intention. We will do better.

Re: Brave taking cryptocurrency donations “for me” without my consent

#277

Earlier quoted context omitted.

So I typed my domain into the setup thing and I got this: "Hello. It looks like you are using WordPress!" "Your domain is NOT using HTTPS.Uh oh! Your domain is NOT using HTTPS. You will need to fix that before continuing." "The following error was encountered: SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: sslv3 alert handshake failure" Why do I need to be using HTTPS before you'll think about pay…

That's a ridiculous complaint and you know it. Oh no, you have to wait 5 minutes for DNS propagation, what a scam!

Half a day and it still hadn’t propagated. If I could just stick a snippet of text in my site somewhere like I’ve done to authorize with other things it’d be fine, but Brave wants me to dig into this site that’s been working fine for a decade and make it HTTPS before they’ll let me do that.

Most creators are less technical than me and wouldn’t have even gotten that far, and if Brave was taking donations in their name they’d never get paid out. Which kinda sounds scammy to me.

Re: Brave taking cryptocurrency donations “for me” without my consent

#278

Earlier quoted context omitted.

So I typed my domain into the setup thing and I got this: "Hello. It looks like you are using WordPress!" "Your domain is NOT using HTTPS.Uh oh! Your domain is NOT using HTTPS. You will need to fix that before continuing." "The following error was encountered: SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: sslv3 alert handshake failure" Why do I need to be using HTTPS before you'll think about pay…

We're always trying to make the verification process better. On the one hand, it's a pain. On the other, we don't want to let someone other than you pass themselves off as you. The DNS and HTML snippet methods are similar to how verification works for many of Googles publisher and advertiser services, for what it's worth. Sorry this has proven frustrating but I hope DNS updates for you soon!

So just to compare:

I can set up PayPal donations by including a simple link.

I can set up Patreon donations similarly.

I’ve claimed my site with Google by putting a file in a hidden place. Worked fine over HTTP.

But Brave? Brave, I gotta get this ten year old site converted over to HTTPS. Or wait for DNS to propagate for half a day. All the while y’all might be “taking donations” for me that I’ll never see unless I get this sorted out. Honestly I’ve spent enough time on this that if I don’t see that your site’s seeing my DNS tweak when I poke at it today I’ll probably just see about making my site refuse to serve my content to Brave instead; I’m happy serving my stuff for free but not happy with y’all making money off of it.

Re: Brave taking cryptocurrency donations “for me” without my consent

#279
post #159

Earlier quoted context omitted.

To be fair, it's entirely possible they're not actually making use of that, or only in very limited circumstances, and it's less "how can we trick people" and more "we didn't really think about what that looks like, because we know we are the good guys", and given their anonymous design they need some out if they don't want to be stuck responsible for funds for eternity. If it's the latter, they're now finding out th…

That's a pretty accurate read on things. We've never actually recycled any funds and also hadn't considered that many creators would interpret our UI/UX as "solicitation" vs. "letting a user do a thing they want to do in our browser." In any event, the confusion is our fault and we're working on updating the UI and language to be clear based on all the feedback we've gotten.

How about instead you shut this off and rebuild it to be explicitly opt-in only?

Or, better for you personally: how about you hand in your resignation and retain an attorney?

Here's the thing: people who get away with this type of thing (sorry, "exciting and new crowdfunding option for creators", or whatever y'all prefer to call it) tend to get away with it only for as long as the targets of their "fundraising" are small-time creators who don't have the resources to pursue action against it. But sooner or later, even if only by accident, Brave's going to impersonate (sorry, "offer exciting crowdfunding options on behalf of") some entity that has resources, including lawyers, and it's going to end badly.

When that happens, a possible outcome is that they will suddenly "discover" all your statements on their behalf in this thread, and that's when it will end badly for you. Oh, that wasn't our position at all, oh, he wasn't authorized to speak like that on our behalf, oh, that's definitely not what we intended, we'll take action immediately to remedy that! The absolute best outcome of that for you is you get fired for cause. The worst outcomes involve you becoming the target of multiple legal actions.

I'm not an attorney and I'm not giving you legal advice. I will give you sincere personal advice: resign, hire an attorney. Find another job working somewhere that poses less of a threat to you.

As to why people will come after you, let me count the ways:

I know people who blog or create YouTube videos or whatever and are very careful not to monetize, because they're disabled and can't work but still need something to fill their days. But disability benefits are means-tested and income streams are constantly investigated. If a benefits agency decides that your scheme is providing income to a disabled person, congratulations! You just cut off their income, and they probably never even knew you existed. That's bad.

I have worked with several open-source projects that rely heavily on donations to keep going. They all have prominent things on their websites directing people where to go to donate, but you'd like to hijack that and instead send people to something the project doesn't know about and may not be able to collect on (especially given how often you flush the "donations" and how many hoops it seems people have to jump through, which many commenters have identified as something that makes them think this is a scam). Congratulations, you just took resources away from the project. And, for projects which use nonprofit foundations to manage fundraising, you just created tax issues -- what happens when the taxman doesn't believe the "we didn't know about them raising money for us" story?

And round and round and round we go. You're going to be hurting those people to make money. If you have a moral compass, it should be pointing heavily toward getting the hell out of there, as soon as you can.

Plus, crypto in general is in weird legal space to begin with. Lots of people can't afford to have you dealing in potentially unregistered securities in their names and without their knowledge or consent. In the US that could easily lead to federal felonies for them, because of what you did.

So, look. I've seen this pattern again and again and again. What Brave is doing is not a new idea. It's widely, roundly, solidly despised, both because it's an unwarranted intrusion on other people and because it creates such nebulous but frightening potential consequences for them. I've also been waiting for one of these crypto "fundraising" operations to finally go far enough that someone (either an entity with good lawyers, or a regulator) bothers to turn them into a smoking hole in the ground as an example to others. Maybe that's the ultimate fate of Brave; if it is, I won't shed any tears.

Re: Brave taking cryptocurrency donations “for me” without my consent

#280

Earlier quoted context omitted.

Search on this page for the word "fraud". Here's what I'd do in your position: remove anything on the internet which personally identifies you as an employee of your company. Nobody knows what is going to happen next, but be prepared for it.

There is zero chance an employee is going to get in trouble because a browser company they worked for collected funds in an escrow account to be released in the event that an intended recipient signs up.

There is a non-zero chance that a company in legal trouble will suddenly decide an employee wasn't authorized to speak on their behalf and so clearly misrepresent their perfectly legal and honest intentions, and throw that employee under a bus.

Best thing to avoid that, as I said in another comment, is to quit and get a lawyer.

Post reply on HN