No, you shouldn't use Brave.

Last edited 21 Jan 2024 - TheRedSpecial

The Brave browser is a fork of Chromium with a built-in adblocker and some other neat privacy-friendly features. From a quick glance, it looks amazing, right? Chrome but pro-privacy! Sadly, you'd be wrong. Brave's history is full of controversies, many of which are deal-breakers for people.

Brave's Beginnings

Brave Software was founded by Brendan Eich (creator of Javascript and disgraced former CEO of Mozilla) and Brian Bondy in May 2015.

Less than a year later, on January 20th 2016, they launched the first version of the Brave Browser. They integrated something very similar to the often ignored "Acceptable Ads" policy - allowing trackerless ads by default, and outlining plans to insert their own trackerless ads into webpages. [1]

Two years later, in June 2018, a pay-to-surf test version of the Brave browser was released. It was pre-loaded with 250 ads, and sent a detailed log of the user's browsing activity to Brave, although they pinky-promised not to share it and only use it for research for their "machine learning"-based ad insertion system. [2]

Oh yeah, they were using a supposedly hardened Electron fork called "Muon" until December 2018, then they switched to just being a Chromium fork. [3]

Brave Bravely Rips Off Tom Scott

Shortly before Christmas in 2018, Tom Scott, a youtuber who makes rather interesting and educational videos, was asked if any of the money being donated through Brave's "BAT" system (some cryptocurrency blockchain BS), he realized that the browser was fooling people into thinking they were supporting him, when in reality he didn't see a single penny. Eventually, this whole fiasco ended with Brave adding a warning to "unverified" creators, and with Tom sending Brave Software a formal GDPR "right to be forgotten" request. [4]

Refer Me Back To Firefox, Please

In June 2020, twitter user @cryptonator1337 noted that Brave was automatically injecting referral codes into URLs for the cryptocurrency exchange site Binance. If you typed "binance.us" into the URL bar and pressed enter, Brave would instead take you to "binance.us/?ref=35089877".[6]

Brave disabled this in the code several hours later, in a typical "we're sorry we got caught" fashion, and a Brave employee saying it was simply a "clean way to support brave".

A proper way to do this would have been simply a one-time popup when visiting this site, asking if you were okay with it or not. Most of the time, explicitly opt-in things are perfectly okay.

They know they're wrong, because all it took to revert this "feature" was a tweet exposing them

And Another Thing

Remember when I said Brendan Eich was the disgraced former CEO of Mozilla? Yeah. He lasted a grand total of 11 days as CEO before he realized that nobody wanted him to be CEO. Why would that be? I mean, he invented JavaScript, one of the greatest inventions since the wheel /s, what could he have possibly done wrong?

It's simple. In 2008, he had donated $1,000 to support passing California Proposition 8 (which was a ban on same-sex marriage)[7], and $2,100 to Tom McClintock.[8], a Prop 8 supporter. It's no secret that Mozilla is a progressive company (a good thing), and as a result, half of Mozilla's board stepped down [9].

Eich publically apologized and promised to help LGBTQ+ people[8], but he still resigned and severed ties from Mozilla on April 3rd, 2014.

Cryptoshit 2: Electric Treeburnaloo

Now, Brave has announced an partnership with Solana, a blockchain wallet thingy, into Brave.[11] They're promising support for "Web 3.0", which is basically a bunch of "the internet of the future is built on blockchain!" baloney. You won't find a definition that actually makes sense if you google it.

"Web 3.0" goes together with shitty cryptocurrency scams and NFTs (gross). Integrating this crap into their already shitty browser isn't going to convince any normal people to join their scam - the main problem with cryptoshit is that it's way too complex for the average person. So this is just going to empower cryptobros, which is honestly something nobody should want happening. Even if it is a "proof of stake" blockchain, it's a waste of energy for no real gain.

But what about...

Many people still prefer to use Brave over a more private browser such as Firefox for numerous reasons, many of which are based on flawed reasoning.

Brave has a built-in adblocker!

uBlock Origin is one of the best and most respectable adblocking extensions currently, and it works best on Firefox.

It's best for extensions to remain separate from the core browser anyhow, as they often do not follow each other's update cycles (imagine needing to update your entire browser to fix a bug in the adblocker!)

Chromium, and therefore Brave, is more secure than Firefox.

Update: Fission is out of beta and enabled by default on Firefox!
It is true that Chromium already has stabilized process isolation (separaing different tabs into different processes), but Firefox is in the process of doing so too, via Project Fission. In fact, you can enable it now via fission.autostart in Firefox Nightly!

There is not much that can be done for security (which is separate from privacy) other than process isolation, ASLR, or DEP. Most security issues are, of course, as a result of exploits, and whaddya know, Mozilla has a programming language intended to help prevent entire classes of bugs (memory unsafety, data races, etc). Sure, Rust isn't a magic bullet, but to say that it's nigh-useless for preventing vulnerabilities is not only wrong, it is utterly stupid.

But My Benchmarks!

Inevitably, someone will mention benchmarks if the discussion is about competing browsers. Guess what? Synthetic benchmarks are not representative of user experience, and most people will notice little to no speed difference between modern browsers.

Userbenchmark, while they don't benchmark browsers, are a really good example of why benchmarks are a dumb way to measure whether one thing is better than another. According to them, an i9-9900K is 7% better than a Ryzen 9 5900X, even though the supposed "differences" they mention would never be noticed by even a power user (In addition, it's quite well-known that UBM is biased towards Intel and Nvidia)

Benchmarks are funky. They're helpful for developers. They shouldn't mean jack-shit to an end-user in most cases.

But I don't want to use Firefox...

Fine. Use Ungoogled Chromium.

It's stock Chromium with a deep "de-Googling" script applied; removing any and all integration with Google services, telemetry, etc.

WARNING: Do be aware that Ungoogled Chromium is a volunteer project, be wary when using pre-compiled binaries. They're probably safe, but no guarantees. If you're on Arch Linux, doing paru -S ungoogled-chromium will compile it yourself.

Windows VPN malware

Since 2022, installing Brave on a Windows PC meant you were also installing the company’s VPN services (not one, but two of them), whether you use it or not.[12]
The Brave Firewall + VPN is an extra paid subscription costing $10 per month. All of this are installed on the user's computer without consent.
A post on GitHub from the company’s VP of engineering apologises for the current behavior and includes a plan to change it.

Brave services installed without user permission

...to promote their premium search engine. [article]
Yes, they block ads on Google, Bing and DuckDuckGo but when you use Brave Search and don't pay, they show you ads.

Brave as... Spyware?

"A browser with your interests at heart." [13]

Thanks to Spyware Watchdog for this section. (link)

Auto-updates: Brave will check for updates every time you run it, and you can't turn it off from the browser. Athough, it's on Brave's low priority list to add an option to do so. The reason why it's low priority would be because it's been over a year and there hasn't been an implementation of it yet.

Brave has built-in telemetry: While running, Brave will make lots of requests to the domain p3a.brave.com as telemetry. They claim they store the collected data for several days. This feature is an opt-out that can be disabled. This opt-out can be disabled here.
For a privacy-oriented browser, telemetry should be opt-in.

Brave Today: Brave now has new feature similar to Firefox Pocket called Brave Today. If you don't know what Firefox Pocket is, it's basically an rss-like news feed that's shown in every blank tab. This feature Brave has is sadly an opt-out rather than an opt-in and sends lots of requests to Brave's servers. It can't seem to be disabled it in and of itself, but setting the tabs to blank seems to stop the requests.

SafeBrowsing: Brave uses SafeBrowsing. It's a feature that tries to "protect" the user from potentially unsafe websites and extensions. However, it sends requests to fetch the information required. Brave's SafeBrowsing is powered by google. This opt-out can be disabled here.

Brave Rewards: At first glance it looks like Brave's rewards program is an opt-in, but the browser makes requests to these domains regardless if you sign up or not:

rewards.brave.com

api.rewards.brave.com

grant.rewards.brave.com

A quick update: These requests have been reported as a bug and for the most part have been fixed (with a couple exceptions). I'll remove this section once the bug has been completely fixed.

Miscellaneous requests worth noting:
Brave on first run sends a request to fetch the library used for checking spelling errors:
brave-dict

Brave on startup sends a request to variations.brave.com. Brave uses this to turn on and off features. There isn't a way to disable this as of yet.
brave-cert

Brave fetches the list of affiliates through laptop-updates.brave.com:
custom-headers

Brave makes a request to static1.brave.com every once and a while, which looks like it's used to fetch plugin information? When the url was placed into the browser, it was directed to Google's error 404 page. (Edit: Brave realised this and changed it to a blank page)
brave-static
google-404

A quick curl --head static1.brave.com shows that Brave uses Google's gstatic, which uses Cloudflare as well:
brave-gstatic

On the first run, Brave fetches five extensions from brave-core-ext.s3.brave.com and tries to install them:
brave-extensions

VPN-ad-thats-misspelled-mac
crypto-notifications
ad
survey
ad-2
android-notification-annoyance
macos-notification-abuse
VPN-ad-thats-misspelled-win32
brave-website-notificatiom
crypto-notifications-2

Credits

Citations

[1] Ha, Anthony. "With Brave Software, JavaScript’s Creator Is Building A Browser For The Ad-Blocked Future." TechCrunch, 20 Jan. 2016, techcrunch.com/2016/01/20/with-brave-software-javascripts-inventor-is-building-a-browser-for-the-ad-blocked-future. (archive.org)

[2] Lomas, Natasha. "Blockchain Browser Brave Starts Opt-in Testing of on-Device Ad Targeting." TechCrunch, 20 June 2018, techcrunch.com/2018/06/20/blockchain-browser-brave-starts-opt-in-testing-of-on-device-ad-targeting. (archive.org)

[3] Cimpanu, Catalin. "Brave Browser Moves to Chromium Codebase, Now Supports Chrome Extensions." ZDNet, 13 Dec. 2018, www.zdnet.com/article/brave-browser-moves-to-chromium-codebase-now-supports-chrome-extensions. (archive.org)

[4] Gerard, David. "Brave Web Browser No Longer Claims to Fundraise on Behalf of Others — so That’s Nice." Attack of the 50 Foot Blockchain, 7 June 2020, davidgerard.co.uk/blockchain/2019/01/13/brave-web-browser-no-longer-claims-to-fundraise-on-behalf-of-others-so-thats-nice. (archive.org)

[5] Castor, Amy. "Brave Browser Is Collecting Donations on Your Behalf — Did You Know?" The Block, 24 Dec. 2018, www.theblockcrypto.com/2018/12/24/brave-browser-is-collecting-donations-on-your-behalf-did-you-know. (link is already an archive)

[6] cryptonator1337. "CR1337 on Twitter." Twitter, 6 June 2020, twitter.com/cryptonator1337/status/1269201480105578496. (archive.org)

[7] Gray, Stephen. "JavaScript Inventor Gave $1,000 to Support California’s Gay Marriage Ban." PinkNews, 4 Apr. 2012, www.pinknews.co.uk/2012/04/04/javascript-inventor-gave-1000-to-support-californias-gay-marriage-ban. (archive.org)

[8] Machkovech, Sam. "New Mozilla CEO Issues Statement, Expresses ‘Sorrow for Causing Pain.’" Ars Technica, 26 Mar. 2014, arstechnica.com/information-technology/2014/03/new-mozilla-ceo-issues-statement-expresses-sorrow-for-causing-pain. (archive.org)

[9] Shankland, Stephen. "Mozilla under Fire: Inside the 9-Day Reign of Fallen CEO Brendan Eich." CNET, 13 June 2014, www.cnet.com/news/mozilla-under-fire-inside-the-9-day-reign-of-fallen-ceo-brendan-eich. (archive.org)

[10] Newton, Casey. "Outfoxed: How Protests Forced Mozilla's CEO to Resign in 11 Days." The Verge, 3 Apr. 2014, www.theverge.com/2014/4/3/5579516/outfoxed-how-protests-forced-mozillas-ceo-to-resign-in-11-days. (archive.org)

[11] "Brave partners with Solana to integrate it into the browser and make it the default for DApp support" Brave, 11 Nov. 2021, brave.com/solana-partnership (archive.org)

[12] "Brave browser installs a VPN service on Windows whether you want it or not" theverge.com/brave-browser-vpn-windows

[13] "A browser with your interests at heart" Brave Site Archive

Edit
Pub: 10 Dec 2023 09:34 UTC
Edit: 21 Jan 2024 08:08 UTC
Views: 1558