5 ms·

Brave Privacy Browser Is Whitelisting Trackers of Facebook and Twitter

36 points by rvnx 8y ago

lostmsu 8y ago
Looks like their claim about privacy protection is bogus, eh? It is still whitelisted in current.
smt88 8y ago
"until we find a better solution" to what? More context would help.
CDSlice 8y ago
Is this still in the current version?
- chopraaa 8y ago
  It is not.
  - kakarot 8y ago
    It's on the master branch... How did you determine it's not in the current version or will not be in the next version?
    - rvnx 8y ago
      Brave has two versions, Muon (legacy) running mostly JS code, and the Chromium-based (current), running mostly C++. The whitelist is in both versions
  - phit_ 8y ago
    looks like it is? https://github.com/brave/brave-core/blob/master/components/brave_shields/browser/tracking_protection_service.cc#L33 https://github.com/brave/brave-core/blob/master/components/b...
  - rvnx 8y ago
    What makes you believe so ? https://github.com/brave/brave-browser/issues/1108 https://github.com/brave/brave-browser/issues/1108 I'm trying to figure out if the code is still active case, but this is a quite recent ticket (after the release of the Chromium-based edition, and updated 4 days ago)
kakarot 8y ago
Way to ignore the comment directly before that line: > // Temporary whitelist until we find a better solution This post is sensationalist, flagged.
- rvnx 8y ago
  It's temporary since 3 years, that's why ;)
  - kakarot 8y ago
    Then link to the new repo and provide context. Just highlighting a line with absolutely no context is sensationalist. I'm sure there have been public discussions about this.
    - microwavecamera 8y ago
      I'm sure there have been public discussions about this. Can you substantiate this? Because that would be extremely relevant to the conversation. Making statements with absolutely no context just seems sensationalistic.
      - kakarot 8y ago
        I'm not entirely sure how I can substantiate an assumption.
        threatofrain 8y ago
        If you're sure that there's been public discussion about the matter, then surely you won't have to spend too much time looking it up on Google? Backing up assertions takes energy. Are you motivated enough to champion your own assertions?
        kakarot 8y ago
        Please understand the difference between an assumption and an assertion. I don't use Brave so there is zero motivation for me to dig into this issue. That's why my language expresses an assumption with the phrase "I'm sure". > then surely you won't have to spend too much time looking it up on Google? The more niche the topic, the harder it will be to find, even if it is publicly available. > Are you motivated enough to champion your own assertions? Now you're just being a twat. Why didn't you spend this energy contributing to the discussion by picking up where I left off and finding out if my assumption was correct? I guess it was easier to attempt to get some dopamine flowing by leveraging yourself into a superior position over someone on the internet.
forgotmypw2 8y ago
// Temporary whitelist until we find a better solution const whitelistHosts = ['connect.facebook.net', 'connect.facebook.com', 'staticxx.facebook.com', 'www.facebook.com', 'scontent.xx.fbcdn.net', 'pbs.twimg.com', 'scontent-sjc2-1.xx.fbcdn.net', 'platform.twitter.com', 'syndication.twitter.com', 'cdn.syndication.twimg.com'] a better solution for what, i wonder
- futureastronaut 8y ago
  That line is three years old, so how is this news now? And what's this "i wonder," do we not know how to use git here? https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a04bd521813da95e892055b3c2a3f https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a0... https://github.com/brave/browser-laptop/commit/6edf56775f25681555fb9219b86a18e15acb73f1 https://github.com/brave/browser-laptop/commit/6edf56775f256... https://github.com/brave/browser-laptop/commit/4c30cd08af9dda75a0e3d6ef634abbbdc2a39c74 https://github.com/brave/browser-laptop/commit/4c30cd08af9dd... https://github.com/brave/browser-laptop/commit/0652274db0aeee79d22d4a48d1195d47ce3e42e8 https://github.com/brave/browser-laptop/commit/0652274db0aee...
  - rvnx 8y ago
    I guess it's new that it was discovered, nobody seems to have noticed while it's a major issue for a privacy tool.
  - kerng 8y ago
    Security vulnerabilities commonly are discovered after a product releases... sometimes many years later.
regnerba 8y ago
The related commits are years old. This isn't new. Last commit to that line was 3 years ago with the comment "unblocking embedding of twitter timelines". https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a04bd521813da95e892055b3c2a3f https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a0... Also I just realized that is an archived repo that isn't used any more. I took a quick look through the newer repos and couldn't find any kind of hard coded whitelist like that. Am I missing something?
- rvnx 8y ago
  As mentioned by phit_: https://github.com/brave/brave-core/blob/master/components/brave_shields/browser/tracking_protection_service.cc#L33 https://github.com/brave/brave-core/blob/master/components/b...
  - regnerba 8y ago
    Ah, they put an underscore in the var name this time. Thanks for the link.
bevacqua 8y ago
Three years old in an archived repo, hmm…
groovecoder 8y ago
Huh ... I thought that must be a sensationalist headline but sure enough - a fresh download of Brave browser loads facebook.com on pinterest.com. https://imgur.com/a/M4B9kJ2 https://imgur.com/a/M4B9kJ2
bbondy 8y ago
Hi Im Brave's CTO. There's a balance between breaking the web and being as strict as possible. Saying we fully allow Facebook tracking isn't right [1], but we admittedly need more strict-mode like settings for privacy conscious users. We do block Facebook at least as good as uBlock origin with EasyPrivacy. The referenced code is in a separate component which does the same as Disconnect blocking. We're taking this seriously internally and we'll iterate on where we are to improve the situation. We're looking at if we can polyfill a local JS resource instead for example as one option if it doesn't make further requests. [1]: https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L41 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb... https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L42 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb... https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L43 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb...

36 points by rvnx 8y ago

lostmsu 8y ago

Looks like their claim about privacy protection is bogus, eh? It is still whitelisted in current.

smt88 8y ago

"until we find a better solution" to what? More context would help.

CDSlice 8y ago

Is this still in the current version?

chopraaa 8y ago
It is not.
- kakarot 8y ago
  It's on the master branch... How did you determine it's not in the current version or will not be in the next version?
  - rvnx 8y ago
    Brave has two versions, Muon (legacy) running mostly JS code, and the Chromium-based (current), running mostly C++. The whitelist is in both versions
- phit_ 8y ago
  looks like it is? https://github.com/brave/brave-core/blob/master/components/brave_shields/browser/tracking_protection_service.cc#L33 https://github.com/brave/brave-core/blob/master/components/b...
- rvnx 8y ago
  What makes you believe so ? https://github.com/brave/brave-browser/issues/1108 https://github.com/brave/brave-browser/issues/1108 I'm trying to figure out if the code is still active case, but this is a quite recent ticket (after the release of the Chromium-based edition, and updated 4 days ago)

kakarot 8y ago

Way to ignore the comment directly before that line: > // Temporary whitelist until we find a better solution This post is sensationalist, flagged.

rvnx 8y ago
It's temporary since 3 years, that's why ;)
- kakarot 8y ago
  Then link to the new repo and provide context. Just highlighting a line with absolutely no context is sensationalist. I'm sure there have been public discussions about this.
  - microwavecamera 8y ago
    I'm sure there have been public discussions about this. Can you substantiate this? Because that would be extremely relevant to the conversation. Making statements with absolutely no context just seems sensationalistic.
    - kakarot 8y ago
      I'm not entirely sure how I can substantiate an assumption.
      - threatofrain 8y ago
        If you're sure that there's been public discussion about the matter, then surely you won't have to spend too much time looking it up on Google? Backing up assertions takes energy. Are you motivated enough to champion your own assertions?
        kakarot 8y ago
        Please understand the difference between an assumption and an assertion. I don't use Brave so there is zero motivation for me to dig into this issue. That's why my language expresses an assumption with the phrase "I'm sure". > then surely you won't have to spend too much time looking it up on Google? The more niche the topic, the harder it will be to find, even if it is publicly available. > Are you motivated enough to champion your own assertions? Now you're just being a twat. Why didn't you spend this energy contributing to the discussion by picking up where I left off and finding out if my assumption was correct? I guess it was easier to attempt to get some dopamine flowing by leveraging yourself into a superior position over someone on the internet.

forgotmypw2 8y ago

// Temporary whitelist until we find a better solution const whitelistHosts = ['connect.facebook.net', 'connect.facebook.com', 'staticxx.facebook.com', 'www.facebook.com', 'scontent.xx.fbcdn.net', 'pbs.twimg.com', 'scontent-sjc2-1.xx.fbcdn.net', 'platform.twitter.com', 'syndication.twitter.com', 'cdn.syndication.twimg.com'] a better solution for what, i wonder

futureastronaut 8y ago
That line is three years old, so how is this news now? And what's this "i wonder," do we not know how to use git here? https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a04bd521813da95e892055b3c2a3f https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a0... https://github.com/brave/browser-laptop/commit/6edf56775f25681555fb9219b86a18e15acb73f1 https://github.com/brave/browser-laptop/commit/6edf56775f256... https://github.com/brave/browser-laptop/commit/4c30cd08af9dda75a0e3d6ef634abbbdc2a39c74 https://github.com/brave/browser-laptop/commit/4c30cd08af9dd... https://github.com/brave/browser-laptop/commit/0652274db0aeee79d22d4a48d1195d47ce3e42e8 https://github.com/brave/browser-laptop/commit/0652274db0aee...
- rvnx 8y ago
  I guess it's new that it was discovered, nobody seems to have noticed while it's a major issue for a privacy tool.
- kerng 8y ago
  Security vulnerabilities commonly are discovered after a product releases... sometimes many years later.

regnerba 8y ago

The related commits are years old. This isn't new. Last commit to that line was 3 years ago with the comment "unblocking embedding of twitter timelines". https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a04bd521813da95e892055b3c2a3f https://github.com/brave/browser-laptop/commit/c4cd7c1dc41a0... Also I just realized that is an archived repo that isn't used any more. I took a quick look through the newer repos and couldn't find any kind of hard coded whitelist like that. Am I missing something?

rvnx 8y ago
As mentioned by phit_: https://github.com/brave/brave-core/blob/master/components/brave_shields/browser/tracking_protection_service.cc#L33 https://github.com/brave/brave-core/blob/master/components/b...
- regnerba 8y ago
  Ah, they put an underscore in the var name this time. Thanks for the link.

bevacqua 8y ago

Three years old in an archived repo, hmm…

groovecoder 8y ago

Huh ... I thought that must be a sensationalist headline but sure enough - a fresh download of Brave browser loads facebook.com on pinterest.com. https://imgur.com/a/M4B9kJ2 https://imgur.com/a/M4B9kJ2

bbondy 8y ago

Hi Im Brave's CTO. There's a balance between breaking the web and being as strict as possible. Saying we fully allow Facebook tracking isn't right [1], but we admittedly need more strict-mode like settings for privacy conscious users. We do block Facebook at least as good as uBlock origin with EasyPrivacy. The referenced code is in a separate component which does the same as Disconnect blocking. We're taking this seriously internally and we'll iterate on where we are to improve the situation. We're looking at if we can polyfill a local JS resource instead for example as one option if it doesn't make further requests. [1]: https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L41 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb... https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L42 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb... https://github.com/brave/adblock-lists/blob/f25b698aff4666bbd6a6038ec029855e971b57cc/brave-unbreak.txt#L43 https://github.com/brave/adblock-lists/blob/f25b698aff4666bb...