3 ms·
Certainly! Check out the resource detailing our Ad Confirmation process at https://github.com/brave/brave-browser/wiki/Security-and-privacy-model-for-ad-confirm
by jonathansampson 5y ago
Certainly! Check out the resource detailing our Ad Confirmation process at https://github.com/brave/brave-browser/wiki/Security-and-privacy-model-for-ad-confirmations https://github.com/brave/brave-browser/wiki/Security-and-pri... (it's a little old, but should be helpful). We leverage the Privacy Pass approach too, so reading https://www.petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf https://www.petsymposium.org/2018/files/papers/issue3/popets... will also help understand our process. I hope this helps!
- x4e 5y agoPerhaps I am misunderstanding what you sent, but isn't this just a way for the user to report that they viewed an add, not prove that they viewed it?
- jonathansampson 5y agoThe cryptographic proofs are baked-into the confirmation and reporting process. A sufficiently-capable attacker could conceivably trick the browser into thinking a native OS ad-notification was displayed, we do rely on the OS to inform us at this point (though preview versions of Brave do not have this dependency), but we have considered this as well. The main threat here would be an attacker who attempts to automate the confirmation process, and potentially duplicate it across various VMs or OS instances. Fortunately, we've considered this too. For reasons I hope are obvious, I can't go into greater detail here.