4 ms·

I asked Jonathan Sampson about this and it's a developing conversation. [1] > For some partners, Brave will set a custom header to identify the browser. We use

I asked Jonathan Sampson about this and it's a developing conversation. [1] > For some partners, Brave will set a custom header to identify the browser. We use the Chrome user-agent string, so accounting for traffic coming from Brave is otherwise hard. [...] As an example, if you navigate to https://www.marketwatch.com/ https://www.marketwatch.com/ you will notice a custom header. [image of header listing containing X-Brave-Partner: dowjones] [1] https://twitter.com/BraveSampson/status/1094713424452505601 https://twitter.com/BraveSampson/status/1094713424452505601

driverdan 8y ago
> We use the Chrome user-agent string It shouldn't. It should use Brave since it's not Chrome.
- hirsin 8y ago
  That's a nice thought, but in reality lots of poorly coded sites out there do UA sniffing instead of feature detection. So lots of sites break (including many Google sites) if they think you don't have Chromium feature sets.
  - ndnxhs 8y ago
    Honestly the user agent string should just be removed. The correct way to use it seems to be do not do anything with it so why does it still exist.
    - spurgu 8y ago
      If you don't have an "officially recognized" UA string some websites will assume you're a scraper/crawler/bot/ and rightfully so.
      - threatofrain 8y ago
        That's just a heuristic of the times. Soon bots will be much smarter than that.
        seba_dos1 8y ago
        They already are.
      - ndnxhs 8y ago
        If I was ever trying to scrape a website that blocked my user agent I would just set the user agent to chrome on windows. Every library I have used supports setting whatever UA you want.
  - drusepth 8y ago
    Won't lots of sites also break if you don't have Chromium feature set but report you do? A more descript UA here ("Brave but built on Chromium") seems magnitudes better than imitating a native Chrome UA to avoid bad code that specifically looks for Chrome/ium, no?
- atomical 8y ago
  At one point they were using a different user agent so that Brave couldn't be blocked. Of course the same people that care about this sort of thing are the same people that want to track you without your consent.
DyslexicAtheist 8y ago
pretty weak response so far. His explanation as to whether this might make a user more prone to fingerprinting was a total cop-out too. It does make you more prone to fingerprinting "but only to their audience" isn't a good enough answer. Customers/partners which users have no control over and are expected to trust Brave executives as acting in their best interest. Where is the foundation that justifies this trust?
- atomical 8y ago
  They are just getting started. You have the right to be skeptical but you would be better served turning that skepticism towards Google. Brave plans to do all machine learning for their ad tech locally in the browser. Can you imagine Google ever doing that to protect their user's privacy?
  - toyg 8y ago
    Does it make any real difference whether they beat you with a crowbar or a baseball bat? In the end, you're still bleeding.
- lapnitnelav 8y ago
  That's my exact issue with Brave - though I do like what they're aiming for despite being in the ad-tech business. I don't think it's the browser's role to police such things, it should be a dumb agent only requesting content, displaying it and not leaking any sensitive stuff. I believe the way forward is to have another 3rd party where you can manage those things. Want to create one persona per category of website you visit? Even go as far as one per website? Doesn't matter, your metadata, you own it and more importantly your browser stays out of that business.

driverdan 8y ago

> We use the Chrome user-agent string It shouldn't. It should use Brave since it's not Chrome.

hirsin 8y ago
That's a nice thought, but in reality lots of poorly coded sites out there do UA sniffing instead of feature detection. So lots of sites break (including many Google sites) if they think you don't have Chromium feature sets.
- ndnxhs 8y ago
  Honestly the user agent string should just be removed. The correct way to use it seems to be do not do anything with it so why does it still exist.
  - spurgu 8y ago
    If you don't have an "officially recognized" UA string some websites will assume you're a scraper/crawler/bot/ and rightfully so.
    - threatofrain 8y ago
      That's just a heuristic of the times. Soon bots will be much smarter than that.
      - seba_dos1 8y ago
        They already are.
    - ndnxhs 8y ago
      If I was ever trying to scrape a website that blocked my user agent I would just set the user agent to chrome on windows. Every library I have used supports setting whatever UA you want.
- drusepth 8y ago
  Won't lots of sites also break if you don't have Chromium feature set but report you do? A more descript UA here ("Brave but built on Chromium") seems magnitudes better than imitating a native Chrome UA to avoid bad code that specifically looks for Chrome/ium, no?
atomical 8y ago
At one point they were using a different user agent so that Brave couldn't be blocked. Of course the same people that care about this sort of thing are the same people that want to track you without your consent.

DyslexicAtheist 8y ago

pretty weak response so far. His explanation as to whether this might make a user more prone to fingerprinting was a total cop-out too. It does make you more prone to fingerprinting "but only to their audience" isn't a good enough answer. Customers/partners which users have no control over and are expected to trust Brave executives as acting in their best interest. Where is the foundation that justifies this trust?

atomical 8y ago
They are just getting started. You have the right to be skeptical but you would be better served turning that skepticism towards Google. Brave plans to do all machine learning for their ad tech locally in the browser. Can you imagine Google ever doing that to protect their user's privacy?
- toyg 8y ago
  Does it make any real difference whether they beat you with a crowbar or a baseball bat? In the end, you're still bleeding.
lapnitnelav 8y ago
That's my exact issue with Brave - though I do like what they're aiming for despite being in the ad-tech business. I don't think it's the browser's role to police such things, it should be a dumb agent only requesting content, displaying it and not leaking any sensitive stuff. I believe the way forward is to have another 3rd party where you can manage those things. Want to create one persona per category of website you visit? Even go as far as one per website? Doesn't matter, your metadata, you own it and more importantly your browser stays out of that business.