4 ms·

There is no "scammy" behavior in our past. What you're linking to here is an affiliate link offering from pre-search UI in the browser. This involved no user da

There is no "scammy" behavior in our past. What you're linking to here is an affiliate link offering from pre-search UI in the browser. This involved no user data, no privacy impact, etc. See the official response here (with screenshots, so as to clarify how the feature actually worked): https://brave.com/referral-codes-in-suggested-sites/ https://brave.com/referral-codes-in-suggested-sites/. If an affiliate link offering (shown plainly, and prior to any navigation event) worries you, wait until you see what other browsers are getting away with. If you're using Chrome, Edge, or Firefox, your browser serves as an out-of-the-box keylogger, sending each keystroke off to Google (Chrome and Firefox) or Bing (Edge) as you type into the address bar. Even an unintentional pasting of sensitive information gets transmitted.

nobunaga 6y ago
What other browser has injected a referrer to a link that has been entered into a browser URL bar and has benefited the company personally? As a engineer that has worked on global products myself, I find it extremely concerning that something like that made it to the public and it seems quite unbelievable that it was a simple mistake, but then again, I wasn't the person who coded it. There has been plenty of 'mistakes' that brave has needed to backtrack on and apologise for. Other browsers that have been around longer than brave have not been found to behave in ways brave has even though I am sure many researchers poke holes in it. If you would like to point out the behaviour of other browsers and compare it to the controversies that Brave has had, feel free to do so and prove many of the doubters wrong. The affiliate link is one of many examples. My other point is that you can also get the privacy protections Brave touts from other browsers as well, but without the shady past that Brave has a history of.
- matthewrobertso 6y ago
  Can you link some other examples then? You keep using the affiliate link one but it doesn't seem very convincing to me. My takeaway from the comments on this post has been that some people really don't like brave but are either unwilling or unable to explain with more than surface-level criticisms.
  - nobunaga 6y ago
    I think if you just google for 'Brave controversies' you would get quite a few, like I just did now. There are also plenty of links in this submission. From content injection to taking money on behalf of people that have no idea its even happening, and this coming from a browser whose selling point is privacy. https://securityboulevard.com/2019/02/brave-browser-sacrifices-security/ https://securityboulevard.com/2019/02/brave-browser-sacrific... https://www.computerworld.com/article/3284076/brave-browser-begins-controversial-ad-repeal-and-replace-tests.html https://www.computerworld.com/article/3284076/brave-browser-... https://community.brave.com/t/does-brave-inject-buttons-onto-reddit-and-other-sites-3/91188 https://community.brave.com/t/does-brave-inject-buttons-onto... https://twitter.com/vj_chidambaram/status/1076474814708310016 https://twitter.com/vj_chidambaram/status/107647481470831001...
    - jonathansampson 6y ago
      Your first link is incorrect; Brave doesn't whitelist trackers. The Facebook/Twitter option enables embedded posts from those platforms on other domains. These frames, however, do not transfer cookies and do not permit the third-party access to storage. You can alter this behavior in brave://settings/socialBlocking. Your second link suggests Brave replaces ads on websites; this is also wrong. Brave removes harmful third-party ads and trackers (as these harvest user data, and violate privacy). Brave offers an alternative model (Brave's privacy-respecting opt-in model) instead, which reward users with 70% of the associated revenue, while leaving their data untouched. Your third link is, I believe, asking about our in-situ tipping buttons. These are triggers for the Tipping panel within Brave, enabling you to tip BAT to users on Twitter, GitHub, and elsewhere. I'm not sure what concerns you about this; these can be turned off in brave://rewards, if you like. The last link you provided is also quite misleading. Brave distributed BAT grants to users, enabling those users to earmark tokens for content creators. Our interface at the time identified "verified" creators as such, but didn't make an equally explicit identification of unverified creators. This lead to some confusion. But as a result of Tom Scott's feedback in 2018, we saw massive improvements made to our UI/UX and tipping model over 48 hours or so. Today unverified creators are clearly identified as such, and tips are held for them on the user's device, rather than in a settlement wallet. See also https://brave.com/rewards-update/ https://brave.com/rewards-update/
deleted 6y ago
[deleted]
tristan957 6y ago
So you are saying Brave does not have search suggestions when typing in the omnibar? Never used Brave.
- jonathansampson 6y ago
  Not on by default; if you want to send keystrokes out to a search engine, you have to explicitly enable this feature.
  - nobunaga 6y ago
    You realise other browers can also opt out of this feature right? Why did you even use this example if you have this feature, I mean keylogger, also in brave? Your responses here are not necessarily helping you or your product.
    - jonathansampson 6y ago
      I'm aware you can opt-out of this in other browsers, but the default is to emit user input to Google, without the user being made aware. In Brave, if you wish to send your keystrokes to a third-party, you must opt-in. That's the key difference here.
      - nobunaga 6y ago
        Thanks for confirming that Brave has keyloggers (by your own definition) and has no difference from other browsers.
        jonathansampson 6y ago
        No difference? There's a huge difference between transmitting user input with and without explicit consent. Do you think there is no difference between me taking your car without asking, and you lending me your car?
circularfoyers 6y ago
The fact that you disingenuously refer to search suggestions as a "keylogger" doesn't make me feel anymore confident in the honesty of your company. I feel as if this is a immature response given you purposefully avoid describing what it actually is (which is still something I disagree with being a default).
- jonathansampson 6y ago
  The reality is that users aren't necessarily aware that their keystrokes (and any unintentionally pasted input) are being sent to Google long before they explicitly navigate anywhere. Inspect the network activity and you will see a log of individual keystrokes (depending on how quickly you type) sent to Google. Firefox waits until you have 2 characters in the address bar before they send them off.
- stopChanging 6y ago
  I think it's a fair description to be honest. Granted, it's not some always running process grabbing your keypresses across different programs, but it is still a horrible privacy violation that is operating without most people's understanding. Accidentally screw up a copy-paste? ctrl-z as quick as you like, it's too late, one of your passwords has been sent out to google... It's a bit of an impassioned description of the feature, but this is a comment on HN, not some company press release. How neutered do we have to be that we can't make a point with emotion behind it. It's clearly much more hyperbole than "immature" or dishonest, is all I'm saying.

nobunaga 6y ago

What other browser has injected a referrer to a link that has been entered into a browser URL bar and has benefited the company personally? As a engineer that has worked on global products myself, I find it extremely concerning that something like that made it to the public and it seems quite unbelievable that it was a simple mistake, but then again, I wasn't the person who coded it. There has been plenty of 'mistakes' that brave has needed to backtrack on and apologise for. Other browsers that have been around longer than brave have not been found to behave in ways brave has even though I am sure many researchers poke holes in it. If you would like to point out the behaviour of other browsers and compare it to the controversies that Brave has had, feel free to do so and prove many of the doubters wrong. The affiliate link is one of many examples. My other point is that you can also get the privacy protections Brave touts from other browsers as well, but without the shady past that Brave has a history of.

matthewrobertso 6y ago
Can you link some other examples then? You keep using the affiliate link one but it doesn't seem very convincing to me. My takeaway from the comments on this post has been that some people really don't like brave but are either unwilling or unable to explain with more than surface-level criticisms.
- nobunaga 6y ago
  I think if you just google for 'Brave controversies' you would get quite a few, like I just did now. There are also plenty of links in this submission. From content injection to taking money on behalf of people that have no idea its even happening, and this coming from a browser whose selling point is privacy. https://securityboulevard.com/2019/02/brave-browser-sacrifices-security/ https://securityboulevard.com/2019/02/brave-browser-sacrific... https://www.computerworld.com/article/3284076/brave-browser-begins-controversial-ad-repeal-and-replace-tests.html https://www.computerworld.com/article/3284076/brave-browser-... https://community.brave.com/t/does-brave-inject-buttons-onto-reddit-and-other-sites-3/91188 https://community.brave.com/t/does-brave-inject-buttons-onto... https://twitter.com/vj_chidambaram/status/1076474814708310016 https://twitter.com/vj_chidambaram/status/107647481470831001...
  - jonathansampson 6y ago
    Your first link is incorrect; Brave doesn't whitelist trackers. The Facebook/Twitter option enables embedded posts from those platforms on other domains. These frames, however, do not transfer cookies and do not permit the third-party access to storage. You can alter this behavior in brave://settings/socialBlocking. Your second link suggests Brave replaces ads on websites; this is also wrong. Brave removes harmful third-party ads and trackers (as these harvest user data, and violate privacy). Brave offers an alternative model (Brave's privacy-respecting opt-in model) instead, which reward users with 70% of the associated revenue, while leaving their data untouched. Your third link is, I believe, asking about our in-situ tipping buttons. These are triggers for the Tipping panel within Brave, enabling you to tip BAT to users on Twitter, GitHub, and elsewhere. I'm not sure what concerns you about this; these can be turned off in brave://rewards, if you like. The last link you provided is also quite misleading. Brave distributed BAT grants to users, enabling those users to earmark tokens for content creators. Our interface at the time identified "verified" creators as such, but didn't make an equally explicit identification of unverified creators. This lead to some confusion. But as a result of Tom Scott's feedback in 2018, we saw massive improvements made to our UI/UX and tipping model over 48 hours or so. Today unverified creators are clearly identified as such, and tips are held for them on the user's device, rather than in a settlement wallet. See also https://brave.com/rewards-update/ https://brave.com/rewards-update/

deleted 6y ago

[deleted]

tristan957 6y ago

So you are saying Brave does not have search suggestions when typing in the omnibar? Never used Brave.

jonathansampson 6y ago
Not on by default; if you want to send keystrokes out to a search engine, you have to explicitly enable this feature.
- nobunaga 6y ago
  You realise other browers can also opt out of this feature right? Why did you even use this example if you have this feature, I mean keylogger, also in brave? Your responses here are not necessarily helping you or your product.
  - jonathansampson 6y ago
    I'm aware you can opt-out of this in other browsers, but the default is to emit user input to Google, without the user being made aware. In Brave, if you wish to send your keystrokes to a third-party, you must opt-in. That's the key difference here.
    - nobunaga 6y ago
      Thanks for confirming that Brave has keyloggers (by your own definition) and has no difference from other browsers.
      - jonathansampson 6y ago
        No difference? There's a huge difference between transmitting user input with and without explicit consent. Do you think there is no difference between me taking your car without asking, and you lending me your car?

circularfoyers 6y ago

The fact that you disingenuously refer to search suggestions as a "keylogger" doesn't make me feel anymore confident in the honesty of your company. I feel as if this is a immature response given you purposefully avoid describing what it actually is (which is still something I disagree with being a default).

jonathansampson 6y ago
The reality is that users aren't necessarily aware that their keystrokes (and any unintentionally pasted input) are being sent to Google long before they explicitly navigate anywhere. Inspect the network activity and you will see a log of individual keystrokes (depending on how quickly you type) sent to Google. Firefox waits until you have 2 characters in the address bar before they send them off.
stopChanging 6y ago
I think it's a fair description to be honest. Granted, it's not some always running process grabbing your keypresses across different programs, but it is still a horrible privacy violation that is operating without most people's understanding. Accidentally screw up a copy-paste? ctrl-z as quick as you like, it's too late, one of your passwords has been sent out to google... It's a bit of an impassioned description of the feature, but this is a comment on HN, not some company press release. How neutered do we have to be that we can't make a point with emotion behind it. It's clearly much more hyperbole than "immature" or dishonest, is all I'm saying.