8 ms·

Brave appears to install VPN Services without user consent

168 points by mindracer 3y ago

crossroadsguy 3y ago
So I was really disappointed in Firefox as my second browser (first is Safari; yeah it's the platform lock; Apple should be forced to open it up). So few days back I decided to set up on my new (2020) MacBook Air and this time I installed Brave. Goodness! It's a dumpster fire. Wallets, crypto, and what not - all over. I scrambled around and disabled, fixed some and all that but then things kept happening and I panicked and immediately uninstalled it clean and then installed Firefox. I will keep cursing Mozilla for actively and consistently ruining Firefox but this really is the better browser out there, even now. Unless there are others that I have not tried. Vivaldi, Opera? Are they good now? Is Camino living in shape or form even now? I would not mind a Mozilla blessed theme/extension pack that turns Firefox into Camino of olden times. But the best would be forcing Apple to open the OS' browser gates.
- PH95VuimJjqBqy 3y ago
  you panicked over using a browser?
- BAHKA 3y ago
  What lock are you talking about on macOS? What gates should Apple open and why? You can use any browser you wish, be it Firefox, Chrome, Brave, whatever. I have been using Macs since 2008 and can't remember myself using Safari for anything else then just to download Firefox or Chromium-based something...
  - crossroadsguy 3y ago
    I think I messed up my comment mixing locking of browser space on iOS and added that to macOS as well but yes that’s not the case. But then what could be the reason Firefox feels very slow and not as performnat compared to Safari - I think Appel may not be to blame? Anyway that’s what I meant and I was wrong. My bad.
- soundnote 3y ago
  That seems odd. Like, yeah, it has a bunch of stuff, but it's also very easy to toss out what you don't like. Just right click whatever elements in the browser UI you don't like and they're gone, new tab page is customizable. The rest is checking Appearance settings and that's it. You get Chrome, but better, more or less.
baz00 3y ago
Brave is crapware and always has been. If you actually care about privacy rather than want to pay lip service to some marketing, then there are better options.
- SteeCee 3y ago
  Care to share the best options? I'm interested.
  - pluc 3y ago
    There's only one that isn't Chrome.
    - pbhjpbhj 3y ago
      Links it is then :oP
      - barbazoo 3y ago
        you mean Lynx?
        pbhjpbhj 3y ago
        No, links is (was?) ab updated branch of lynx that optionally does images, media loading, and some simple JavaScript. I haven't used it for quite a while, at least a decade.
      - pluc 3y ago
        Honestly, Firefox with all the "privacy" addons I have (NoScript, CookieMaster, uBlock, Decentraleyes, behind a PiHole), the experience I have on the web is probably closer to Lynx than it is to stock Chrome in that it's heavily content-focused.
  - baz00 3y ago
    Firefox + uBlock Origin + Privacy Badger + not shit ISP.
PretzelPirate 3y ago
I don't use Brave, but software updates install new stuff all the time. I don't see why this is news. Now if they start routing all of your traffic through their VPN, that would be news. I don't think every new feature an application depends on needs user consent to install.
- pbhjpbhj 3y ago
  Sure other shitheads-run browsers do this, but that does not make it OK to bundle software for new services into an update without getting user consent. "Do you want to install Brave Vpn with your update?" That's not hard.
  - zen928 3y ago
    The added software is their implementation detail, not your individual concern. Presumably, you've given permissions to run the application that didn't change (it was always capable of doing this and you initially agreed) or required you to consent to new changes to run it. This is as banal as including an extra npm package that takes slightly more work to execute.
    - pbhjpbhj 3y ago
      I'm not asking whether they can weasel around it. "you gave me permission to come in your house, and I was always capable of defecating on the floor, so..." Well sure, but we should, and I do, expect more.
- jjulius 3y ago
  >... but software updates install new stuff all the time. There's "new stuff" [nods head] and "new stuff" [shakes head].
pbhjpbhj 3y ago
Yep, they did this drive by installation to me. Very disappointed. Not yet uninstalled, I mean, I still have Firefox (but have finally got around to moving my data away from their sync). Really? Unsolicited bundling is not okay.
JohnFen 3y ago
This had two results for me -- the first is that my employer has forcibly uninstalled all brave installations in our company and has forbidden its use, and the second is that I have voluntarily uninstalled brave from my personal machines.
- freedomben 3y ago
  Yep, they need to immediately issue a "this was an accident, we're really sorry, and it will never happen again" or else they need to accept that this is the rational response
  - hju22_-3 3y ago
    It'll just happen again anyway, it's not like this is their first blunder like this.
basisword 3y ago
It’s incredible how often they manage to shoot themselves in the foot.
- vorticalbox 3y ago
  I know right? I was very excited for Bat and the whole brave browser now I'm back on Firefox because I just can't be bothered keeping up with who is doing what privacy eroding "feature" this week.
- radicaldreamer 3y ago
  Its by design
Fervicus 3y ago
My main is Firefox but I have to occasionally use a Chromium based browser. Used to use Edge before it went to shit and have been using Brave ever since. Is there a better alternative?
- dewey 3y ago
  Same, I'm using Firefox for everything at work but unfortunately many Google services (GCP, Meet) don't work as well on Firefox as they do on Chrome. For that reason I'm using https://choosy.app https://choosy.app to define which urls open in which browser, works very nicely!
  - commoner 3y ago
    For Linux users, Junction is a FOSS browser picker that works just like Choosy does on macOS. These browser pickers are more flexible than selecting just one default browser, and being able to inspect URLs before opening them is a nice security feature. https://github.com/sonnyp/Junction https://github.com/sonnyp/Junction
- commoner 3y ago
  Ungoogled Chromium is a Chromium-based browser with Google services stripped out. - Project and source: https://github.com/ungoogled-software/ungoogled-chromium https://github.com/ungoogled-software/ungoogled-chromium - Binaries: https://ungoogled-software.github.io/ungoogled-chromium-binaries/ https://ungoogled-software.github.io/ungoogled-chromium-bina...
CountGeek 3y ago
This list of Firefox forks was posted not so long ago - https://news.ycombinator.com/item?id=37735443 https://news.ycombinator.com/item?id=37735443 - librewolf (Desktop) [1] - Mull (Android) [2] - Iceraven (Android) [3] - Mercury (Desktop) [4] - Pulse Browser (Desktop) [5] - Waterfox (Desktop) [6] - Floorp (Desktop) [7] --> This submission - Pale Moon (Desktop) [8] - Mullvad Browser (Desktop) [9] - Tor browser (Desktop - Android) [10] This list is not inclusive. It probably contains the famous forks. [1] https://librewolf.net https://librewolf.net [2] https://gitlab.com/divested-mobile/mull-fenix https://gitlab.com/divested-mobile/mull-fenix [3] https://github.com/fork-maintainers/iceraven-browser https://github.com/fork-maintainers/iceraven-browser [4] https://github.com/Alex313031/Mercury https://github.com/Alex313031/Mercury [5] https://pulsebrowser.app https://pulsebrowser.app [6] https://www.waterfox.net https://www.waterfox.net [7] https://floorp.app/en https://floorp.app/en [8] https://www.palemoon.org https://www.palemoon.org [9] https://mullvad.net/en/browser https://mullvad.net/en/browser [10] https://www.torproject.org/download/ https://www.torproject.org/download/
- contact9879 3y ago
  note that each of these has their own issues. From a security/privacy pov, Mull, Mullvad Browser, and Tor Browser are generally most respected. I'm not familiar with floorp or pulse.
  - _lvbh 3y ago
    What are the issues for Librewolf?
    - contact9879 3y ago
      LibreWolf is one of the better Firefox forks but it doesn't have automatic updates and you're relying on a relatively small team to keep it up-to-date. At that point, Mullvad Browser would be a better choice.
      - commoner 3y ago
DueDilligence 3y ago
.. now my staff understand more why Brave is prohibited on work devices.
porridgeraisin 3y ago
Windows service entries are more like systemd unit files aren't they. I don't think brave starts a vpn or downloads any separate binary onto your pc without asking you.
qntmfred 3y ago
I use Brave and I'm not super disturbed by this. The Windows Service isn't even running, it's just installed (presumably to reduce friction in the case I were to start using their VPN I wouldn't have to go through an additional installation process). Sure, it's a little bit more intrusive than is ideal for people who like to keep a close on what gets installed into Services, but at the end of the day, is there a real problem here?
- clemailacct1 3y ago
  This is my take as well. You have a service thats installed for one-click operations from Brave customers that want to use their VPN. The VPN service doesn't run in the background post-installation and no tunnels are established. I see the customer experience reasoning here. Can someone explain the actual risks - I'm not seeing any.
  - belthesar 3y ago
    This is my read on the situation: Unsolicited, a company, whether I trust them or not, has said "Hey, I'm gonna install this network interface on your computer. Don't worry I won't turn it on unless you tell me to, but if I do, then all your traffic will pass through me. It's there just in case you need it. But don't worry, I won't flip the switch until you tell me to. I can, but I won't. It's not a big deal. Trust me." I'm really not keen on this. In order to install a service, Brave's update agent must have Administrator level privileges on the system, which is how it is setup on the default system-wide install. I didn't install a VPN Provider when I installed Brave, I installed a browser. The action to, by default, add additional network interfaces to my machine, that given that the updater has the permissions to install, also has the permissions to activate, could at any point send all traffic on my machine through that Wireguard tunnel that I did not knowingly authorize the install of. We all assume risks when we install software made by other folks, regardless of whether we can view its source or not. We have to provide some implicit trust to the makers of software to make choices that are inline with our desires and interests as a result of that. For me, this is a choice that is in violation of that trust, and that's not acceptable to me. I'm not sure I'm going to die on this hill, but Brave has certainly reached a new level of the trust thermocline, and like others, I'm going to be evaluating whether I keep their browser on my systems going forward.
mhsdef 3y ago
I know we like to get the pitchforks out, but, it appears to be accidental: https://github.com/brave/brave-browser/issues/33726 https://github.com/brave/brave-browser/issues/33726
- dewey 3y ago
  Where does it say that it was an accident?
  - contact9879 3y ago
    it's an issue opened by brave's vp noting that the current behaviour should be corrected
    - dewey 3y ago
      That doesn't mean it was an accident, it could just mean that they realized it's a problem. Especially as this issue was opened after this HN submission got posted.
      - gtvwill 3y ago
        They realized they were gonna get bad looks for it so they covered that shiz up as if it were a mistake. Marketing damage control.
      - belthesar 3y ago
        Issue opened 3 hours ago, thread posted 2 hours ago. I look at Brave with skepticism as one should with a company that flirts with crypto, but in giving them a fair shake, it's important to keep the facts straight. That said, in keeping the facts straight, an issue opened a week ago citing this as a problem was closed in favor of the one opened by the Brave VP.
        MichaelZuo 3y ago
        > That said, in keeping the facts straight, an issue opened a week ago citing this as a problem was closed in favor of the one opened by the Brave VP. That seems somewhat shady, unless there was a credible explanation?
Jare 3y ago
I took one for the team and updated Brave to latest. No VPN services of any kind that I can see. Could it be that I'm in EU?
jbc1 3y ago
Can someone explain the context of this apparently being a big deal?
- jjtheblunt 3y ago
  I believe the concern is that the installed VPN can act as a man in the middle, watching all your IP traffic, in the worst case, and doing god knows what with the data in it.
- rchaud 3y ago
  They installed their homemade VPN as part of the general browser install, without disclosing it or giving users ability to opt-out. It's now possible for them to start proxying traffic through their servers, also without disclosing it to you. While this is likely just a case of them aggressively bundling their paid service bloatware, the fact that it's built into the app should be concerning.
  - Vinnl 3y ago
    Why would they need the in-between step of installing-but-disabling it first? If they are planning to do that, and you already have Brave installed, can't they just install it at that point?
- starttoaster 3y ago
  Brave bundles VPN software with their privacy focused browser. Web privacy focused people tend to distrust everything by default. Web privacy focused people begin thinking of Brave someday turning on the VPN service and tunneling your traffic through VPN nodes they control with nefarious intent. I think that's the gist. Tbh, just installing a service that's disabled is, by itself, not that scary to me. If they were to ever turn it on without my consent, that's a real problem.
  - SahAssar 3y ago
    > Web privacy focused people begin thinking of Brave someday turning on the VPN service and tunneling your traffic through VPN nodes they control with nefarious intent. No, it is more that any one company that installs unwanted stuff on my computer is probably not some thing I trust as a privacy-focused software. Besides that VPN services have extremely broad permissions to look at or modify traffic, so it might be a attack target if not properly secured (which it might not be if it was "accidentally" installed). It also might signal that brave is looking to become a much broader company besides their current browser-crypto-ads thing, which is worrying for privacy. There are many reasons for an accidentally or not-really-accidentally vpn service being installed behind the users back is alarming.
christophilus 3y ago
It looks like, on Windows, Brave installs their VPN service in a state that requires them to be started manually. They aren’t disabled, but they also aren’t running. It’s not great, but also doesn’t seem like a pitchforkable offense. Maybe I’m too much of a Brave fan, though. I probably use it 50% of the time and FF the other 50%.
- nickstinemates 3y ago
  How do you decide which to use
  - christophilus 3y ago
    I use Brave on iOS because it has a list of great features like downloading videos for offline viewing (with no ads). And has great adblocking baked in. On desktop it’s kinda random, but I slightly favor FF just out of the principle of fighting the browser monoculture.
tengbretson 3y ago
Is this anymore troublesome than it also installing a tor client and torrent downloader by default? Isn't this called shipping features?
wepple 3y ago
At first sniff this felt dodgy to me, but then when I thought about it: a software update pushes arbitrary code to your machine that you willingly execute. You either take the risk and live with it or don’t.
- wepple 3y ago
  Perhaps this is a case of “something against my expectations occurred” and that’s true; but only because it was extremely obvious and we spotted it.
deleted 3y ago
[deleted]
cutler 3y ago
The article's opt-out excuse for a privacy policy killed it for me.

168 points by mindracer 3y ago

So I was really disappointed in Firefox as my second browser (first is Safari; yeah it's the platform lock; Apple should be forced to open it up). So few days back I decided to set up on my new (2020) MacBook Air and this time I installed Brave. Goodness! It's a dumpster fire. Wallets, crypto, and what not - all over. I scrambled around and disabled, fixed some and all that but then things kept happening and I panicked and immediately uninstalled it clean and then installed Firefox. I will keep cursing Mozilla for actively and consistently ruining Firefox but this really is the better browser out there, even now. Unless there are others that I have not tried. Vivaldi, Opera? Are they good now? Is Camino living in shape or form even now? I would not mind a Mozilla blessed theme/extension pack that turns Firefox into Camino of olden times. But the best would be forcing Apple to open the OS' browser gates.

PH95VuimJjqBqy 3y ago
you panicked over using a browser?
BAHKA 3y ago
What lock are you talking about on macOS? What gates should Apple open and why? You can use any browser you wish, be it Firefox, Chrome, Brave, whatever. I have been using Macs since 2008 and can't remember myself using Safari for anything else then just to download Firefox or Chromium-based something...
- crossroadsguy 3y ago
  I think I messed up my comment mixing locking of browser space on iOS and added that to macOS as well but yes that’s not the case. But then what could be the reason Firefox feels very slow and not as performnat compared to Safari - I think Appel may not be to blame? Anyway that’s what I meant and I was wrong. My bad.
soundnote 3y ago
That seems odd. Like, yeah, it has a bunch of stuff, but it's also very easy to toss out what you don't like. Just right click whatever elements in the browser UI you don't like and they're gone, new tab page is customizable. The rest is checking Appearance settings and that's it. You get Chrome, but better, more or less.

baz00 3y ago

Brave is crapware and always has been. If you actually care about privacy rather than want to pay lip service to some marketing, then there are better options.

SteeCee 3y ago
Care to share the best options? I'm interested.
- pluc 3y ago
  There's only one that isn't Chrome.
  - pbhjpbhj 3y ago
    Links it is then :oP
    - barbazoo 3y ago
      you mean Lynx?
      - pbhjpbhj 3y ago
        No, links is (was?) ab updated branch of lynx that optionally does images, media loading, and some simple JavaScript. I haven't used it for quite a while, at least a decade.
    - pluc 3y ago
      Honestly, Firefox with all the "privacy" addons I have (NoScript, CookieMaster, uBlock, Decentraleyes, behind a PiHole), the experience I have on the web is probably closer to Lynx than it is to stock Chrome in that it's heavily content-focused.
- baz00 3y ago
  Firefox + uBlock Origin + Privacy Badger + not shit ISP.

PretzelPirate 3y ago

I don't use Brave, but software updates install new stuff all the time. I don't see why this is news. Now if they start routing all of your traffic through their VPN, that would be news. I don't think every new feature an application depends on needs user consent to install.

pbhjpbhj 3y ago
Sure other shitheads-run browsers do this, but that does not make it OK to bundle software for new services into an update without getting user consent. "Do you want to install Brave Vpn with your update?" That's not hard.
- zen928 3y ago
  The added software is their implementation detail, not your individual concern. Presumably, you've given permissions to run the application that didn't change (it was always capable of doing this and you initially agreed) or required you to consent to new changes to run it. This is as banal as including an extra npm package that takes slightly more work to execute.
  - pbhjpbhj 3y ago
    I'm not asking whether they can weasel around it. "you gave me permission to come in your house, and I was always capable of defecating on the floor, so..." Well sure, but we should, and I do, expect more.
jjulius 3y ago
>... but software updates install new stuff all the time. There's "new stuff" [nods head] and "new stuff" [shakes head].

pbhjpbhj 3y ago

Yep, they did this drive by installation to me. Very disappointed. Not yet uninstalled, I mean, I still have Firefox (but have finally got around to moving my data away from their sync). Really? Unsolicited bundling is not okay.

JohnFen 3y ago

This had two results for me -- the first is that my employer has forcibly uninstalled all brave installations in our company and has forbidden its use, and the second is that I have voluntarily uninstalled brave from my personal machines.

freedomben 3y ago
Yep, they need to immediately issue a "this was an accident, we're really sorry, and it will never happen again" or else they need to accept that this is the rational response
- hju22_-3 3y ago
  It'll just happen again anyway, it's not like this is their first blunder like this.

basisword 3y ago

It’s incredible how often they manage to shoot themselves in the foot.

vorticalbox 3y ago
I know right? I was very excited for Bat and the whole brave browser now I'm back on Firefox because I just can't be bothered keeping up with who is doing what privacy eroding "feature" this week.
radicaldreamer 3y ago
Its by design

Fervicus 3y ago

My main is Firefox but I have to occasionally use a Chromium based browser. Used to use Edge before it went to shit and have been using Brave ever since. Is there a better alternative?

dewey 3y ago
Same, I'm using Firefox for everything at work but unfortunately many Google services (GCP, Meet) don't work as well on Firefox as they do on Chrome. For that reason I'm using https://choosy.app https://choosy.app to define which urls open in which browser, works very nicely!
- commoner 3y ago
  For Linux users, Junction is a FOSS browser picker that works just like Choosy does on macOS. These browser pickers are more flexible than selecting just one default browser, and being able to inspect URLs before opening them is a nice security feature. https://github.com/sonnyp/Junction https://github.com/sonnyp/Junction
commoner 3y ago
Ungoogled Chromium is a Chromium-based browser with Google services stripped out. - Project and source: https://github.com/ungoogled-software/ungoogled-chromium https://github.com/ungoogled-software/ungoogled-chromium - Binaries: https://ungoogled-software.github.io/ungoogled-chromium-binaries/ https://ungoogled-software.github.io/ungoogled-chromium-bina...

CountGeek 3y ago

This list of Firefox forks was posted not so long ago - https://news.ycombinator.com/item?id=37735443 https://news.ycombinator.com/item?id=37735443 - librewolf (Desktop) [1] - Mull (Android) [2] - Iceraven (Android) [3] - Mercury (Desktop) [4] - Pulse Browser (Desktop) [5] - Waterfox (Desktop) [6] - Floorp (Desktop) [7] --> This submission - Pale Moon (Desktop) [8] - Mullvad Browser (Desktop) [9] - Tor browser (Desktop - Android) [10] This list is not inclusive. It probably contains the famous forks. [1] https://librewolf.net https://librewolf.net [2] https://gitlab.com/divested-mobile/mull-fenix https://gitlab.com/divested-mobile/mull-fenix [3] https://github.com/fork-maintainers/iceraven-browser https://github.com/fork-maintainers/iceraven-browser [4] https://github.com/Alex313031/Mercury https://github.com/Alex313031/Mercury [5] https://pulsebrowser.app https://pulsebrowser.app [6] https://www.waterfox.net https://www.waterfox.net [7] https://floorp.app/en https://floorp.app/en [8] https://www.palemoon.org https://www.palemoon.org [9] https://mullvad.net/en/browser https://mullvad.net/en/browser [10] https://www.torproject.org/download/ https://www.torproject.org/download/

contact9879 3y ago
note that each of these has their own issues. From a security/privacy pov, Mull, Mullvad Browser, and Tor Browser are generally most respected. I'm not familiar with floorp or pulse.
- _lvbh 3y ago
  What are the issues for Librewolf?
  - contact9879 3y ago
    LibreWolf is one of the better Firefox forks but it doesn't have automatic updates and you're relying on a relatively small team to keep it up-to-date. At that point, Mullvad Browser would be a better choice.
    - commoner 3y ago

DueDilligence 3y ago

.. now my staff understand more why Brave is prohibited on work devices.

porridgeraisin 3y ago

Windows service entries are more like systemd unit files aren't they. I don't think brave starts a vpn or downloads any separate binary onto your pc without asking you.

qntmfred 3y ago

I use Brave and I'm not super disturbed by this. The Windows Service isn't even running, it's just installed (presumably to reduce friction in the case I were to start using their VPN I wouldn't have to go through an additional installation process). Sure, it's a little bit more intrusive than is ideal for people who like to keep a close on what gets installed into Services, but at the end of the day, is there a real problem here?

clemailacct1 3y ago
This is my take as well. You have a service thats installed for one-click operations from Brave customers that want to use their VPN. The VPN service doesn't run in the background post-installation and no tunnels are established. I see the customer experience reasoning here. Can someone explain the actual risks - I'm not seeing any.
- belthesar 3y ago
  This is my read on the situation: Unsolicited, a company, whether I trust them or not, has said "Hey, I'm gonna install this network interface on your computer. Don't worry I won't turn it on unless you tell me to, but if I do, then all your traffic will pass through me. It's there just in case you need it. But don't worry, I won't flip the switch until you tell me to. I can, but I won't. It's not a big deal. Trust me." I'm really not keen on this. In order to install a service, Brave's update agent must have Administrator level privileges on the system, which is how it is setup on the default system-wide install. I didn't install a VPN Provider when I installed Brave, I installed a browser. The action to, by default, add additional network interfaces to my machine, that given that the updater has the permissions to install, also has the permissions to activate, could at any point send all traffic on my machine through that Wireguard tunnel that I did not knowingly authorize the install of. We all assume risks when we install software made by other folks, regardless of whether we can view its source or not. We have to provide some implicit trust to the makers of software to make choices that are inline with our desires and interests as a result of that. For me, this is a choice that is in violation of that trust, and that's not acceptable to me. I'm not sure I'm going to die on this hill, but Brave has certainly reached a new level of the trust thermocline, and like others, I'm going to be evaluating whether I keep their browser on my systems going forward.

mhsdef 3y ago

I know we like to get the pitchforks out, but, it appears to be accidental: https://github.com/brave/brave-browser/issues/33726 https://github.com/brave/brave-browser/issues/33726

dewey 3y ago
Where does it say that it was an accident?
- contact9879 3y ago
  it's an issue opened by brave's vp noting that the current behaviour should be corrected
  - dewey 3y ago
    That doesn't mean it was an accident, it could just mean that they realized it's a problem. Especially as this issue was opened after this HN submission got posted.
    - gtvwill 3y ago
      They realized they were gonna get bad looks for it so they covered that shiz up as if it were a mistake. Marketing damage control.
    - belthesar 3y ago
      Issue opened 3 hours ago, thread posted 2 hours ago. I look at Brave with skepticism as one should with a company that flirts with crypto, but in giving them a fair shake, it's important to keep the facts straight. That said, in keeping the facts straight, an issue opened a week ago citing this as a problem was closed in favor of the one opened by the Brave VP.
      - MichaelZuo 3y ago
        > That said, in keeping the facts straight, an issue opened a week ago citing this as a problem was closed in favor of the one opened by the Brave VP. That seems somewhat shady, unless there was a credible explanation?

Jare 3y ago

I took one for the team and updated Brave to latest. No VPN services of any kind that I can see. Could it be that I'm in EU?

jbc1 3y ago

Can someone explain the context of this apparently being a big deal?

jjtheblunt 3y ago
I believe the concern is that the installed VPN can act as a man in the middle, watching all your IP traffic, in the worst case, and doing god knows what with the data in it.
rchaud 3y ago
They installed their homemade VPN as part of the general browser install, without disclosing it or giving users ability to opt-out. It's now possible for them to start proxying traffic through their servers, also without disclosing it to you. While this is likely just a case of them aggressively bundling their paid service bloatware, the fact that it's built into the app should be concerning.
- Vinnl 3y ago
  Why would they need the in-between step of installing-but-disabling it first? If they are planning to do that, and you already have Brave installed, can't they just install it at that point?
starttoaster 3y ago
Brave bundles VPN software with their privacy focused browser. Web privacy focused people tend to distrust everything by default. Web privacy focused people begin thinking of Brave someday turning on the VPN service and tunneling your traffic through VPN nodes they control with nefarious intent. I think that's the gist. Tbh, just installing a service that's disabled is, by itself, not that scary to me. If they were to ever turn it on without my consent, that's a real problem.
- SahAssar 3y ago
  > Web privacy focused people begin thinking of Brave someday turning on the VPN service and tunneling your traffic through VPN nodes they control with nefarious intent. No, it is more that any one company that installs unwanted stuff on my computer is probably not some thing I trust as a privacy-focused software. Besides that VPN services have extremely broad permissions to look at or modify traffic, so it might be a attack target if not properly secured (which it might not be if it was "accidentally" installed). It also might signal that brave is looking to become a much broader company besides their current browser-crypto-ads thing, which is worrying for privacy. There are many reasons for an accidentally or not-really-accidentally vpn service being installed behind the users back is alarming.

christophilus 3y ago

It looks like, on Windows, Brave installs their VPN service in a state that requires them to be started manually. They aren’t disabled, but they also aren’t running. It’s not great, but also doesn’t seem like a pitchforkable offense. Maybe I’m too much of a Brave fan, though. I probably use it 50% of the time and FF the other 50%.

nickstinemates 3y ago
How do you decide which to use
- christophilus 3y ago
  I use Brave on iOS because it has a list of great features like downloading videos for offline viewing (with no ads). And has great adblocking baked in. On desktop it’s kinda random, but I slightly favor FF just out of the principle of fighting the browser monoculture.

tengbretson 3y ago

Is this anymore troublesome than it also installing a tor client and torrent downloader by default? Isn't this called shipping features?

wepple 3y ago

At first sniff this felt dodgy to me, but then when I thought about it: a software update pushes arbitrary code to your machine that you willingly execute. You either take the risk and live with it or don’t.

wepple 3y ago
Perhaps this is a case of “something against my expectations occurred” and that’s true; but only because it was extremely obvious and we spotted it.

deleted 3y ago

[deleted]

cutler 3y ago

The article's opt-out excuse for a privacy policy killed it for me.