Brave

Note: This article is outdated. I will try to update it soon.

Brave Browser is a Chromium fork with many interesting features not found elsewhere, such as built-in Adblock and other extensions, fingerprinting protection, cleaner Preferences menu than other Chrome forks, and the (opt-in) ability to automatically support (pay) the websites you visit. The developers describe it as "A browser with your interests at heart."^[1] With the built-in privacy protections, some would seem to agree with that. Let's see how it stacks up when we take everything into account.

Spyware Level: High

Auto-updates that can be turned off only by hacky workarounds. Google as default search engine. Analytics on Brave's home page. Two other requests made at each start of Brave. Whitelisting spyware from Facebook and Twitter.^[5] Has some decent privacy protections built in, but uMatrix is still better. Some privacy features are there by default, but, it's still trying to work with advertisers (same as Mozilla did with their Sponsored Tiles). Despite claiming to be "A browser with your interests at heart."^[1], it has Google as default search engine, as well as shitty forced updates. Anyway, despite the privacy protections, you should stay away from this browser — it seems to have a "mission" to switch the internet to its version of "user-respecting" ads, (we know how that turned out for Mozilla), and that's slimy and suspicious. Beyond that it has repeatedly shown itself to be dishonest and disingenuous about what it's mission and goals and operations are.

Whitelisting spyware from Facebook and Twitter

On its website, Brave claims that "Brave fights malware and prevents tracking, keeping your information safe and secure. It’s our top priority."^[6]. Yet despite this claim, Brave actually disables its tracking protections for Facebook and Twitter's spyware scripts that allow them to track people across the web.^[5] Brave's spyware protections, and any claims that it makes to work in the interests of its users, cannot be taken seriously. Brave is actively working against its users while lying to them about supposed privacy protections that it offers. This problem becomes even more serious when you take into account Brave's response to this situation:

"Loading a script from an edge-cache does not track a user without third-party cookies or equivalent browser-local storage, which Brave always blocks and always will block. In other words, sending requests and receiving responses without cookies or other means of identifying users does not necessarily create a tracking threat." ^[7]

This statement is just completely wrong. Just because a website isn't able to store cookies, does not mean that it cannot uniquely identify you. Executing JavaScript spyware from Facebook and Twitter is more than enough. Blocking cookies is not going to stop them from tracking you. This isn't even information that is difficult to verify. There are many websites that you can visit right now, to see just how much information a JavaScript program designed to track you can get.

Here are a few:
https://browserleaks.com/
https://panopticlick.eff.org/

Auto-updates

Brave will check for updates every time you run it, and you CANNOT turn it off (except through fiddling with DNS and such) ! What is the devs' answer? From their GitHub page ^[2]:

"We don't plan on adding in UI to disable updates, but users can easily adjust environment variables if they really want to put themselves at risk."

and

"i feel that being able to figure out how to do this is a sufficiently high bar for users who want to turn off autoupdating (to prove they know what they're doing and understand the security implications)"

So according to the devs, you have to hunt down random internet comments to be able to disable auto-updating. Brave will also update what looks like the list of its "partners" every time you run it. Extensions are also updated often.

Anti-privacy search engine by default

Google is the default search engine of Brave, and the issues with it are well known and would take a book to describe them all.

Brave's start page contains analytics

Brave will connect to its home page, https://brave.com, automatically on the first run of Brave, and that page contains Piwik's analytics scripts. This is the full request: It will also make a connection to Google to download some fonts. You can disable these on subsequent runs by changing the start page.

Crash reports

Enabled by default, but can be disabled from the preferences menu.

Other requests

Brave will make a connection to this site every time it is started up: It probably has something to do with their project of working with advertisers to provide more relevant targeted ads, which sounds pretty disgusting, but can be turned off ("Notify me about token promotions"). You can read more about it here ^[3] .It will also make this request which downloads the rulesets for HTTPS Everywhere:

Brave's privacy protections

Brave Browser also contains in-built privacy protections such as HTTPS Everywhere, AdBlock, cookie blocking, script blocking, and fingerprinting protections — that are configurable site by site. This is commendable of course, but in the end, uMatrix outclasses them. Trackers, for example, easily avoid pure AdBlock (so you will be tracked by Facebook and such), and binary script blocking breaks sites. Nice effort on Brave's part though, and the fingerprinting protection I don't think is found in any other browser (but I didn't confirm if it actually works).