Brave is remotely injecting HTTP ad headers

Brave is remotely injecting HTTP ad headers laptop-updates.brave.com/promo/custom-headers

Attached: brave_browser-100732965-large.jpg (700x500, 56K)

Other urls found in this thread:

github.com/brave/browser-android-tabs/commit/911770a07549ce53f49a9d87a5a19b4da29fb767#diff-35dd256442c3c60f5bec67e5b2a86cda
github.com/qutebrowser/qutebrowser/issues/29#issuecomment-460024217
toptenreviews.com/software/internet/best-internet-browser-software/
twitter.com/BrendanEich/status/1094766068554379265
reddit.com/r/privacy/comments/ap9149/brave_privacy_browser_has_a_backdoor_to_remotely/
github.com/ghacksuserjs/ghacks-user.js
manytools.org/http-html-text/http-request-headers/
github.com/kiwibrowser/android
twitter.com/NSFWRedditGif

imagine using brave

github.com/brave/browser-android-tabs/commit/911770a07549ce53f49a9d87a5a19b4da29fb767#diff-35dd256442c3c60f5bec67e5b2a86cda

No amount of damage control is going to help here, kek.

Attached: 1499483393270.jpg (771x1080, 116K)

Just use Brave, they said.
Respects your privacy, they said.
M-MUH SJWZILLA, they cried.

If you aren't using any of these:
>GNU IceCat
>Firefox + Librefox
>Ungoogled Chromium
you might as well kill yourself

im a normie and use brave mobile and Desktop. what does that mean (without exaggerating)?

It means that the browser that promised privacy is injecting HTTP header X-Brave-Partner to your requests so certain websites you visit can easily identify you. It's a breach of trust.

yikes

>Respects your privacy, they said.
Only a couple of brave shills actually spread fake news about Brave giving a fuck about privacy. It never did.

>browser that promised privacy
They never promised privacy, you fucking idiot. Brave shills are the ones who promised privacy. Brave devs only said they want to change ad monetization and slightly improve the default security of chromium.

Pasta:
Fingerprint protection doesn't work at all. Your Canvas, screen size, plugins (as of Chromium), time zone, WebGL fingerprint (as of Chromium), OS/Platform are revealed and the user agent isn't spoofed.

Tor tabs lack any additional anti-fingerprint methods, making them completely useless as your privacy is trivial to breach. You can be effortlessly uniquely identified and tracked.

The Brave adblocker is trash compared to uBlock Origin. The performance is difference is massive if you enable any additional block lists in Brave's blocker. Which you have to because Brave's adblocker is not only inefficient, but also lacks a ton of filters by default and a lot of ads will still be displayed. uBlock Origin blocks domains instead of just hiding ads, plus it has a script blocker and an element picker.

(((PIA))) partnership.
Has (had?) proprietary addons.
Google is the default search engine.

Chromium build has a terrible UI (especially settings UI) and is missing gestures like long press on new tab to choose to open a private/tor tab.

Attached: brave.png (1900x1322, 91K)

well I don't use that piece of shit anyway, but thanks for the wall of text I guess

BRAVE TODDLERS BTFO

Attached: 1504652802508.gif (355x201, 2.99M)

I hope no one took Brave shills seriously.

Never use a Blink engine browser.

Im still going to use Brave because it is simply the best browser

BRAVITCHES BTFO BY THEIR OWN DEVS

Attached: 1521161302773.png (719x642, 22K)

Honestly, not surprised.
I saw this coming the second they started shilling their BAT shitcoin.

how to tweak firefox like that?

I second that question, most of the custom settings makes the browser leak more entropy not less, at least according to panopticlick

Attached: 1546539463686.jpg (487x495, 52K)

nigger please

Attached: Screenshot_20190210_145613.png (1366x768, 681K)

Looks likes time to murder everybody and burn everything bringing about the next dark age humanity deserves.

Is this on by default? I don't use bravebotnet, just wondering.

>Ungoogled Chromium
Indeed, firecuck shills can kys.

Anytime blockchain/cryptocoin is involved at all, its bad to me. That's what makes me weary of librem phone, muh native botnet.

Attached: deusvult.jpg (881x905, 179K)

I guess Brave were lion to us when they spoke of privacy.

Attached: Naamloos-2.jpg (600x600, 35K)

yeah buddy, way to go.. just not today tho, right? One more fap afternoon and we are doin it

Why would anyone use it in the first place? Fucking retards.

enable resistFingerprinting and disable webgl. Do not resize the browser window ever. If you watch videos inside your browser instantly stop that and use mpv+youtube dl

what about Vivaldi?

nobody with half a brain ever thought Brave was a solution to privacy or ads

having said that Jow Forums was caught completely off guard by this news

Attached: 1474163637514.gif (500x375, 161K)

how to make palemoon do that?

Librefox forces resistFingerprinting and it still shows up as unique fingerprint in panopticlick

> Ungoogled Chromium patches applied to a QtWebEngine-based browser
Feels good man

I'm no expert, but it probably applies "privacy enhancing" tweaks that make your browser stand out even more.

>Do not resize the browser window ever.
Kind of obnoxious that this aspect of resistFingerprinting doesn't get along well with the use of a sidebar (i.e Tree Style Tabs). Is there a way around this, knowing that manually resizing the window until I get exactly that 1000x1000 content window is basically impossible?

yeah, I suspect so

Are you the anti-tracking guy from the recent v3 Google Captcha thread?
Also is there a trick to hiding your system fonts?

>Made by a jew who was caught selling people's data in the past

IMAGINE MY SHOCK

It's not so much hiding as much as offering a really average set of fonts. With that being said, I have no idea on how to do it.

Already found the mistake. Under advanced font settings I allowed websites to choose their own fonts. After disabling this option it now only shows Windings 2+3 as available system fonts, just like in your Tor/FF example.

Based and redpilled

nice botnet

Attached: 469771.jpg (500x375, 36K)

>Why would anyone use it in the first place?

Because on Android, Chrome can't block ads and Firefox is slow as fuck.

Goddamit I use Brave on android. Back to Chrome again then.

>The Brave adblocker is trash compared to uBlock Origin. The performance is difference is massive
Do you have numbers. And do you mean the raw lookup into the block list or the effect on browsing experience? I'm going off of github.com/qutebrowser/qutebrowser/issues/29#issuecomment-460024217 and since brave adblock is compiled and ubo is in JS I'm sure your input on performance would be appreciated.

>It means that the browser that promised privacy is injecting HTTP header X-Brave-Partner to your requests so certain websites you visit can easily identify you. It's a breach of trust.
But how and on which websites specifically? Is it with or without BAT being enabled? Not everyone understands:
>[{"domains":["coinbase.com","api.coinbase.com"],"headers":{"X-Brave-Partner":"coinbase"},"cookieNames":[],"expiration":31536000000},{"domains":["marketwatch.com","barrons.com"],"headers":{"X-Brave-Partner":"dowjones"},"cookieNames":[],"expiration":31536000000},{"domains":["townsquareblogs.com","tasteofcountry.com","ultimateclassicrock.com","xxlmag.com","popcrush.com"],"headers":{"X-Brave-Partner":"townsquare"},"cookieNames":[],"expiration":31536000000},{"domains":["cheddar.com"],"headers":{"X-Brave-Partner":"cheddar"},"cookieNames":[],"expiration":31536000000}]

the list of domains on which it does that varies, right now is the one you've pasted. I don't know if BAT affects it, doesn't seem to from glancing at the code

as for how, the browser caches the mapping from the address I pasted and if it matches the domain it automatically adds the header to HTTP request

top pleb. root+adaway master race

Attached: 1548004558755.jpg (657x527, 38K)

1. about:preferences#privacy
-Choose what to block
--All Detected Trackers (disable) [keep DNT header disabled, you'll use uBO anyway]
--Third-Party Cookies (enable), set to All
2. about:preferences#general
-Language and Appearance
--Fonts and Colours
---Advanced
----Allow pages to choose their own fonts (disable)
3. about:config
privacy.resistFingerprinting > true
webgl.disabled > false
privacy.firstparty.isolate > true
4. about:addons
install "uBlock Origin"
install "user-agent switcher" (optional)
5. user-agent switcher
set your user agent to "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
6. Set your current resolution to 1000x700.

uBlock Origin is optional and shouldn't affect panopticlick results. But it's recommended since DNT does affect them and Tor Browser has it disabled.
1000x700 is the Tor Browser resolution so you need it to mimic TB. It's optional though since if you're outside of Tor your resolution is irrelevant as you're fingerprinted through your IP anyways. Same applies to user-agent switcher as default anti-fingerprinting masks you as a generic Firefox ESR user anyways, and picking windows as an OS just helps you blend in with Tor.
I'd still recommend setting your browser resolution to a constant 1000x700 if your screen resolution is below 900p. If you're on 1600x900 or 1080p then set it to 1366x768. Hiding your actual monitor resolution is important, but not a reason to kill your browser screen size completely since you're not on Tor anyways. Just don't maximize the window since your panel size actually affects the window size and could help fingerprinting.

What about it? It's closed source, proprietary bullshit. Who knows what it's doing.

toptenreviews.com/software/internet/best-internet-browser-software/

Attached: 1549848375418.png (2934x1672, 259K)

But Samsung Browser can

>imagine living like this outside of Tor
>imagine not just blocking javascript on Tor so you can resize as you please
Seriously though outside of blocking trackers and third party cookies all the meme you guys go through to avoid fingerprinting makes no sense as pointed out yourself
YOU'RE BEING TRACKED BY YOUR IP

>implying this is some huge news that will out Brave as sketchy and ad-whoring
we knew from the beginning this PoS was built to inject ads and replace ones already on sites you visit. simple solution: don't use it, don't give it PR, and carry on as usual

Based

Underrated

Welp. What Android browser do I use now

twitter.com/BrendanEich/status/1094766068554379265

imagine using anything but ff

>enable resistFingerprinting
and then you maximise the window
literally pointless because you're retards

newsflash faggets - the ONLY way for anti fingerprinting to werk is for ALL of us to use the SAME user.js but then there's the static ip

thank you based user

reddit.com/r/privacy/comments/ap9149/brave_privacy_browser_has_a_backdoor_to_remotely/

wow, a hyped up piece of "privacy" software that was in a bunch of news articles turns out to be dishonest and/or a state run operation

IMAGINE THAT

Window size is a dumb meme. If I maximise firefox on my 1080p screen on windows, my firefox window size is going to be exactly the same as every other person running firefox on windows @ 1080p.

If you're running some exotic resolution, whatever.

except if you have your taskbar smaller or you use another theme

>5. user-agent switcher
>set your user agent to "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
>6. Set your current resolution to 1000x700.
that's done by
>privacy.resistFingerprinting > true

It doesn't matter whether you opted into BAT.
Eich needs a way to artificially push the. value of his shitcoin. Anyone thinking Brave would be used for anything but monetary gains is a retard

>tracked by your ip
life's nice being inside the European Union

If you enable resistFingerprinting then this is wrong. You will stand out heavily (check the values yourself). If you don't have resistFingerprinting enabled you lost anyway.

Especially on 1080p there is no need to maximize anyway. Most websites make better use of space at 1000x900. If you watch videos inside your browser you're a brainlet anyway.

This is partly wrong. You are correct and this is the reason why people should stop using shit like Librefox, Icecat or pulling random user.js from online.

You are wrong if you just enable resistFingerprinting disable webgl and disallow fonts you are pretty much as non unique as possible as long as you keep FF either on ESR(preferable since lower entropy) or updated properly.

you make no sense

Cant we use this for firefox github.com/ghacksuserjs/ghacks-user.js

If you check every single value it changes and then compare it to your fingerprint every single time then yes. Those user.js found online and Firefox forks often change behaviour which a website can guess. Your best bet is to make your own most minimalistic user.js possible.

>It doesn't matter whether you opted into BAT.
Source? No one ever actually bothered to explain the steps necessary to reproduce these results.

If you don't want to check yourself (shill) or if you can't check yourself (brainlet) you should not care about privacy. I guarantee you you are being tracked by a billion companies you have never even heard of.

Either accept you fell for a very bad meme or lie to yourself and stay with it just to make yourself feel better. Unironically you have better privacy using Chrome itself than Brave.

>I guarantee you you are being tracked by a billion companies you have never even heard of
>Unironically you have better privacy using Chrome itself than Brave.
>you're being tracked bro
>recommends Chrome
For anyone not just shitposting, compare the results with Ungoogled-chromium. It's the same output, but with BAT disabled and with UBlock Origin, etc. Ungoogled-chromium is of course one version behind (v71).
manytools.org/http-html-text/http-request-headers/

>privacy.resistFingerprinting > true
That sets it to 1000x900 for me.

why would you make it uniq

as soon as i saw youtubers advertising this I knew it was piece of shit.

You can always trust jewtubers to do their part. Sort of.

Brave is the most disgusting company I've ever seen in my entire life and I am dead serious, their entire product is made by another compnany and their entire marketing is built on bashing that company while hijacking their product and make it even worse when it comes to the very same marketing bashing points

Firefox fucks up now and then with stupid shit but I still don't get why Jow Forums and other people shill Brave. It's definitly worse lol.
Is it literally just the "muh SJW muh Branden Eich!" angle?

Literal brainlets btfo and don't know how to toggle the fingerprinting function on in settings to beat panoptic fingerprinting. You can also just spoof any other browser you want which is all the firefox user is doing.

Imagine using a browser which literally installed extensions remotely on their users machines.

>For anyone not just shitposting, compare the results with Ungoogled-chromium. It's the same output, but with BAT disabled and with UBlock Origin, etc. Ungoogled-chromium is of course one version behind (v71).
>manytools.org/http-html-text/http-request-headers/
So, no one actually cares to do anything other than talk out of their asses? Seems like business as usual on Jow Forums to me. But we sure got those muh jews, muh youtube, muh ad company bullshits in.

Post your results.

What are the benefits of using Firefox over Ungoogled Chromium, Brave or Vivaldi?

Firefox has been consistently getting worse over time and the SJW shit coupled with remotely forcefully installing extentions on users machines was unforgivable

>consistently getting worse over time
How?
> the SJW shit
Who fucking cares?

>ignoring the point about them remotely installing extentions

They shut down the test pilot program in the meantime.

It's not. It still tells when you're running Linux. Also doesn't affect your resolution.

Those ARE results with brave's """anti-fingerprinting""". It leaks your resolution, addons and a few other things. Can you not fucking read?

irrelevant, trust is not gained by them going "our bad we wont do it again!", it wasnt an accident it was an intentional decision

Guess that leaves just Bromite and Kiwi for chromium android browsers
and yes Kiwi is foss
github.com/kiwibrowser/android

I've been using brave cause it let me use searx, but now I'm disappointed

Attached: 1541353641714.gif (251x511, 80K)

>Also doesn't affect your resolution.
it does
>It's not. It still tells when you're running Linux.
it says linux esr

different user but brave randomises some values so it wont ever show as unique on that site despite not being identifiable also look at all this configuration you have to do to get firefox to pass and it includes permanently changing your browser resolution do you think you can't make chromium based browsers unique with similar changes/addons?

see
this thread was nothing but falseflagging autism posters once again

Literally a non-issue people don't understand once again, the fact Brave is completely open-source so people can see and question things like this should be evidence enough that it's above the big two already.

Must suck for the developers having to explain to brainlets everytime they see something they don't understand.

Finally someone with a brain.

>says linux esr
The point is Tor says windows on Firefox ESR.
>it does
It doesn't take sidebars into account. I always have those open so I never noticed it actually does try to set the resolution to 1000x700.

>do you think you can't make chromium based browsers unique with similar changes/addons?
This is irrelevant. Brave should do this by default. Read the fucking conversation they fail to make THEIR TOR TABS non-unique and hide their user's tabs and addons. This kills the whole point of using Tor tabs and makes them useless. And you can't install addons in their Tor profile.

there are thousands of people with the same ip as mine

Attached: 1469556309405.jpg (447x386, 59K)

>use 1000p on 1080p
>now you stand out even more

Attached: 5198767497349.png (1000x642, 194K)

The sites don't know what your screen size is. The browser tells them it's equal to the window size.