3 ms·

Interesting. How did you discover this? Can you post something about how they are using this data in the actual header itself?

• rvnx 8y ago
  Just by reading source-code. Every day the browser downloads from "laptop-updates" server a list of hosts and list of headers to inject. This is supposed to help websites to identify that the user is running Brave (but there are other exceptions in the code, like at https://github.com/brave/browser-laptop/blob/master/js/data/siteHacks.js#L50 https://github.com/brave/browser-laptop/blob/master/js/data/... ) but in practice, the Brave developers can inject any header into any website remotely. Every single Brave installation is uniquely tracked by a "download-id" which makes the backdoor even more powerful.
  • TazeTSchnitzel 8y ago
    Does it do any kind of whitelisting of what kind of headers can be sent?
    • rvnx 8y ago
      No