> For some partners, Brave will set a custom header to identify the browser. We use the Chrome user-agent string, so accounting for traffic coming from Brave is otherwise hard. [...] As an example, if you navigate to https://www.marketwatch.com/ you will notice a custom header. [image of header listing containing X-Brave-Partner: dowjones]
[1] https://twitter.com/BraveSampson/status/1094713424452505601
His explanation as to whether this might make a user more prone to fingerprinting was a total cop-out too. It does make you more prone to fingerprinting "but only to their audience" isn't a good enough answer. Customers/partners which users have no control over and are expected to trust Brave executives as acting in their best interest. Where is the foundation that justifies this trust?
Brave plans to do all machine learning for their ad tech locally in the browser. Can you imagine Google ever doing that to protect their user's privacy?
I don't think it's the browser's role to police such things, it should be a dumb agent only requesting content, displaying it and not leaking any sensitive stuff.
I believe the way forward is to have another 3rd party where you can manage those things. Want to create one persona per category of website you visit?
Even go as far as one per website? Doesn't matter, your metadata, you own it and more importantly your browser stays out of that business.
It shouldn't. It should use Brave since it's not Chrome.
A more descript UA here ("Brave but built on Chromium") seems magnitudes better than imitating a native Chrome UA to avoid bad code that specifically looks for Chrome/ium, no?