Just by reading source-code. Every day the browser downloads from "laptop-updates" server a list of hosts and list of headers to inject. This is supposed to h

Just by reading source-code. Every day the browser downloads from "laptop-updates" server a list of hosts and list of headers to inject. This is supposed to help websites to identify that the user is running Brave (but there are other exceptions in the code, like at https://github.com/brave/browser-laptop/blob/master/js/data/siteHacks.js#L50 https://github.com/brave/browser-laptop/blob/master/js/data/... ) but in practice, the Brave developers can inject any header into any website remotely. Every single Brave installation is uniquely tracked by a "download-id" which makes the backdoor even more powerful.