Brave Adblocker

02-05-2021
 |  [RAND-100] - Comments



Brave Browser is a Chromium fork with many interesting features not found elsewhere, such as built-in Adblock and other extensions, fingerprinting protection, a cleaner Preferences menu compared to other Chrome forks, and the (opt-in) ability to automatically support (pay) the websites you visit. The developers describe it as 'A browser with your interests at heart.'[1] with the built-in privacy protections.

Spyware Level: High

Brave is self updating software, uses Google as the default search engine, has built-in telemetry, and even has an opt-out rss-like news feed similar to Firefox Pocket. These shouldn't be the things that come to mind if someone were to imagine a privacy oriented browser.

Whitelisting spyware from Facebook and Twitter

  • AdBlocker Ultimate is designed with a singular purpose: remove all ads so you can focus your attention on the content you want. Features - Remove all ads - Block malware and tracking - Improve browser performance - No 'acceptable' ads or whitelisted websites/ad networks AdBlocker Ultimate is a free extension that blocks ads and malicious domains known to spread malware; it also disables sneaky.
  • Brave is on a mission to fix the web by giving users a safer, faster and better browsing experience while growing support for content creators through a new attention-based ecosystem of rewards. Available on Android, iOS, Windows, macOS and Linux.
  • Adblock Plus, the most popular ad blocker on Firefox, Chrome, Safari, Android and iOS. Block pop-ups and annoying ads on websites like Facebook and YouTube.

On its website, Brave claims that 'Brave fights malware and prevents tracking, keeping your information safe and secure. It’s our top priority.'[6]. Yet despite this claim, Brave actually disables its tracking protections for Facebook and Twitter's scripts that allow them to track people across the web.[5] Brave has been actively downplaying the role that JavaScript plays when tracking someone.

🚫 AdBlock Web Browser The Brave Private Browser App is designed with a free built-in AdBlocker (pop up blocker). Brave's free adBlocker protects you from ads which track you as you browse the mobile web, securing your privacy and private browsing history.


'Loading a script from an edge-cache does not track a user without third-party cookies or equivalent browser-local storage, which Brave always blocks and always will block. In other words, sending requests and receiving responses without cookies or other means of identifying users does not necessarily create a tracking threat.'[7]


This couldn't be more far from the truth. Just because a website isn't able to store cookies, doesn't mean it can't uniquely identify you. Using JavaScript from Facebook and Twitter would be more than enough to track you and blocking cookies alone isn't going to stop that. Just as a quick point of reference to what information JavaScript can scrape, you might want to visit this website.

They later on added an option to the extension to disable all of the JavaScript, but this new feature seems to be nothing more than the JavaScript switch found in vanilla Chromium. They recently added an option here to block some of the scripts from Facebook, Twitter, and LinkedIn after receiving pushback as a result of the controversy.

A quick note on the whitelisting trackers: This specific point on whitelisting trackers isn't making the case of Brave being spyware as much as it's making the case of Brave's privacy features being snake oil.

Auto-updates

Brave will check for updates every time you run it, and you can't turn it off from the browser. Athough, it's on Brave's low priority list to add an option to do so[2]. The reason why it's low priority would be because it's been over a year and there hasn't been an implementation of it yet.

Brave Ad Blocker Not Working

Anti-privacy search engine by default

Google is the default search engine of Brave. For a browser that claims to be privacy oriented, this is a red flag. They at least make it easy for you to change the default search engine on the first run.

Brave has built-in telemetry

While running, Brave will make lots of requests to the domain p3a.brave.com as telemetry. They claim they store the collected data for several days[8]. Telemetry should be the last thing to come to mind if someone were to imagine a privacy oriented browser. This feature is an opt-out that can be disabled. This opt-out can be disabled here.

Brave Today

Brave now has new feature similar to Firefox Pocket called Brave Today. If you don't know what Firefox Pocket is, it's basically an rss-like news feed that's shown in every blank tab. This feature Brave has is sadly an opt-out rather than an opt-in and sends lots of requests to Brave's servers. It can't seem to be disabled it in and of itself, but setting the tabs to blank seems to stop the requests.

SafeBrowsing

Brave uses SafeBrowsing. It's a feature that tries to 'protect' the user from potentially unsafe websites and extensions. However, it sends requests to fetch the information required. Judging by some of the information in the Miscellaneous requests worth noting section, it wouldn't be too far-fetched of Brave to use Google's SafeBrowsing rather than their own implementation. This opt-out can be disabled here.

Adblocker

Brave Rewards

Brave has a rewards program. You can find more information about it here[3]. At first glance it looks like the rewards program is an opt-in, but the browser makes requests to these domains regardless if you sign up or not:

rewards.brave.com

api.rewards.brave.com

grant.rewards.brave.com

Miscellaneous requests worth noting

Brave on first run sends a request to fetch the library used for checking spelling errors:

Brave on first run sends a request to variations.brave.com. A guess would be that this request has to do with the crypto aspect of the rewards program. It could also be some way of verifying the list of affiliates. The later is unlikely because the request that fetches the list of affiliates is constant to whether or not the seed request is made:

Right after the request to variations.brave.com is made, Brave fetches the list of affiliates through laptop-updates.brave.com. As stated before, the previous request doesn't seem to be a requirement for this request.

Brave Ad Blocker Review

Brave makes a request to static1.brave.com every once and a while, which looks like it's used to fetch plugin information[4]? When the url was placed into the browser, it was directed to Google's error 404 page[9]. This seems kind of unsettling that one of Brave's domains would do that:

A quick curl --head static1.brave.com shows that Brave uses Google's gstatic, which uses Cloudflare as well:

On the first run, Brave fetches five extensions from brave-core-ext.s3.brave.com and tries to install them:

Sources

This article was created on 5/7/2018

Brave Adblock Vs Ublock Origin


This article was last edited on 12/30/2020

Brave Ad Blocker Download

If you want to contribute to this website, you can always make a pull request.

Brave Ad Blocker Download

All contributions must be licensed under the CC0 license to be accepted.