Brave and TC: a lot of trackers and more. Is that expected?

[andrelam]

He could work for Google! Lets fork Brave I blocked Brave on nextdns.io will log for a week, maybe something interesting happens.

[andrelam]

I’ve asked Jonathan Sampson at Brave for a reaction, in fact he already did:
here

And he pointed me to another browser review:
here (Douglas J. Leith
School of Computer Science & Statistics, Trinity College Dublin, Ireland
24th Feb 2020∗)

Have fun reading and take your own conclusion, it’s alway difficult who or what to believe. We can’t check it all ourselves, at least I can’t.

[tyxo]

@egx470

interesting test would be to use TC the exact same way for a week or so and see what the results are with another browser (Firefox?). Granted, one would need to have similar browsing habits during this time as well as similar browser settings in place. Curious?

@nottolino (or anyone else) what do you think

They will differ. Contnent, in a way trackers too, are delivered based on several factors.
This approach will give you only little information. It is maybe better to look how a browser communicates (unknown/hidden connections), how unique it is (https://amiunique.org/, Tools from EFF’s Tech Team | Electronic Frontier Foundation) and so on.

[egx470]

Another area of interest to me was how they differ in sync. I use and appreciate syncing across a few devices.

From what I gathered with Brave all data was stored and encrypted on the client-side (our devices). I like this, what I don’t like is I can’t choose the passphrase which I would like to. I would do this by using a system generated passphrase in a FOSS password manager where it can be encrypted and stored.

With Firefox the sync data is encrypted client-side (our devices) and the encryption key is stored there. What I don’t like is that the data and authentication key are transferred to Mozilla’s servers and stored there in an encrypted state (self hosted NextCloud vs say Pcloud from my understanding).

Hope I understood correctly . This also swayed my decision.

Brave

Firefox

*Edit: nope, looks like sync on Brave is also stored in a cloud. I am having deja-vu think I already figured this out once before (so much info).

Excited to see any insight gained from what @nottolino and @andrelam are doing. Thanks for your willingness to help all of us collectively.

[egx470]

@tyxo

It is maybe better to look how a browser communicates (unknown/hidden connections), how unique it is (https://amiunique.org/ , Tools from EFF’s Tech Team | Electronic Frontier Foundation) and so on.

Thanks for this info. Have you done this? If so what did you find (FF vs Brave)?

I have tested Brave HERE and the results were better than other browsers (fingerprint less unique mostly), anyone know how Brave vs Firefox stacks up with this tool? I also received insight from @marcdw HERE.

Edit: Another thing I like about FF is its more mature and has better extensions (Privacy Badger, etc.) which Brave isn’t quite there yet. Do extensions open one up to a larger attack surface? I would think so.)

But… The fingerprint of Brave vs FF? I believe Brave wins here.?

Edit: @XjFred also did some testing HERE. Maybe @XjFred can weigh in on what he remembers from these tests? (Kinda already did in this thread, wonder if there is any other insight to share)

[XjFred]

@egx470

Edit: @XjFred also did some testing HERE . Maybe @XjFred can weigh in on what he remembers from these tests? (Kinda already did in this thread, wonder if there is any other insight to share)

Yep, already sent the result : only Brave succeed in the CoverYouTracks tool (both trackers and fingerprinting). The EFF gives loads of explanation about what is fingerprinting and about the data sent by browsers.

Brave is build with the same feature for everyone. So one can easily understand that using it, you can’t be unique.

@andrelam

I’ve asked Jonathan Sampson at Brave for a reaction, in fact he already did:
here

Thank you ! Nice document.

[TheLastProject]

Responding to a previous explanation for the “whitelist”, the author emphatically claims the engineers at Brave don’t understand how JavaScript works. If I’m not mistaken, the author is responding to Brendan Eich (Brave’s CEO), who happens to also be the creator of JavaScript.

This is the most obvious logical fallacy ever. Having created something doesn’t mean knowing every single thing about it after years of evolving. That’s like saying Carl Benz would know everything about Tesla because Teslas are cars and Carl Benz invented the car… If Brendan knows everything about modern JavaScript so well, why is he CEO and not CTO?

[egx470]

Lots of passion on this topic.

No doubt similar conversations are happening at Brave and Mozilla (wanting to be the objective “best” in the eyes of the users).

Understanding the background and situations behind the companies helps me see a strong reason why there is such fierce competition. I love this because the result is better tools with more privacy for us. I highly doubt Mozilla will turn a blind eye (and not introduce something) to fingerprinting long term.

[Taurus]

Firefox blocks fingerprinting: What is fingerprinting and why you should block it

[egx470]

@andrelam

And he pointed me to another browser review:
here (Douglas J. Leith
School of Computer Science & Statistics, Trinity College Dublin, Ireland
24th Feb 2020∗)

This is eye poping! Even if you just read the concluding “VIII Conclusions”. Thanks for sharing @andrelam

[egx470]

@Taurus I’m going based off of the tests previously mentioned in this thread. Which to believe? Actual test at EFF or articles/description from Mozilla? Maybe both are correct but describing different fingerprinting methods?

Cover Your Tracks

Time for me to go back to school to get a Doctorate of Computer Science/Security Joking aside, I must say thank you to all here as I have learned much in the past few months.

[Taurus]

Oh, I forgot about the top of the thread. Yeah, who do we believe? Good question.

[egx470]

@Taurus my gut tells me it is this👇

@egx470

Maybe both are correct but describing different fingerprinting methods?

[andrelam]

The author does not use his real name, and states this:

This is completely false. They’re blatantly lying to their users. Anyone who knows a bit about how JavaScript works and it’s capacities to track you without the need of using cookies will be laughing after reading that.

No explanation, just some ranting. We don’t know who this author is, so we can’t check. Did you read the paper of Douglas J. Leith? He’s a professor, i think i’m going for that truth.

[andrelam]

Now “Brave” Jonathan even wants to help me examine the data , he pointed me to this tool Did a quick look, seems to be a nice tool, you can examine the data sent and received (tried with desktop version), I think you can also use it to examine your phone.

[Doppel-D]

Although the sheer number of permissions is impressive: Firefox v89.1.1 → 20, Brave v1.26.74 → 33. Exodus state three trackers for Firefox, zero for Brave.

Fennec Version 89.1.1 from F-Droid: 2 Trackers, 18 permissions, at least some less than Firefox ;- )

Firefox Klar v8.16.0: one tracker, nine permissions

PS: Although these numbers vary slightly depending where you look. Exodus inside Aurora or Exodus website

Addendum: Fennec F-Droid is based on the latest Firefox release (codenamed Fenix).
It has proprietary bits and telemetry removed, but still connects to
various Mozilla and Google services that can track users.

[andrelam]

When you install HTTP toolkit Android app you can see the requests from browsers (5 trackers in the App )

Very easy to setup, scan a qr, grant vpn acces and the requests are visible, very cool!

[nottolino]

Thanks to you all. This forum, as I said in the beginning, it’s an invaluable source of information.
I would particularly thank @TheLastProject for providing the link on which the discussion revamped.

I’m not sure I understood all the details and subtleties on the matter, but here you are some info on my side.

1. Firefox (no extensions) on the phone is completely unusable with TC.

2. Brave on my Linux mint allowed me to discover that my bank is tracing me. Navigation is DEFINITELY slow but possible

3. Firefox on Linux mint (ublock installed) didn’t say a word about my bank

[egx470]

@nottolino

I would particularly thank @TheLastProject for providing the link on which the discussion revamped

+1, thanks for starting the deeper conversation @TheLastProject.

Something that might be of interest to those here, is this recently started thread by @marcdw

WebApps developer frustration

WebApps, and to a lesser degree GApps Browser, have been a part of my custom ROM setups for a long time. The dev, Toby Kurien, may call it quits in the near future. Frustration with Google and Android, the Web, and devices one has less control over are a few.reasons. An interesting post on his GitHub. Cool that he’ll be moving content to Gemini. Issue # 253 (Future of WebApps, Web and Android, and other philosophical issues) at tobykurien/WebApps