Brave Browser leaks your Tor / Onion service requests through DNS | Hacker News Reader

Brave Browser leaks your Tor / Onion service requests through DNS

ramble.pw

27 pointsinput_sh14 comments

While I do think this is a problem ... One should always remember this Brave Help Article https://support.brave.com/hc/en-us/articles/360018121491-Wha...

In which they, themselves, say (and always have been saying): " If your personal safety depends on remaining anonymous, we highly recommend using Tor Browser instead of Brave Tor windows. "

Also this is a known issue, see https://github.com/brave/brave-core/pull/7909

Apparently ramble.pw is a parler/reddit bastard marriage. I'm probably on a list now.

Better change your name to Bobby Tables now ;-)

The absolute irony-immunity of the rambling brownshirt in there complaining about about "fascists" and "kikes" on other sites.

Yeah, you don't have to look very far down the front page to find a racist meme. Hope this domain is blocklisted from HN.

~This is interesting if it can be verified by someone else.~

But this source is pretty bad. I'd prefer to see a source that doesn't devolve into fascist-racist-conspiracy theories and slurs for Jews within a single page.

Why would someone use the Brave browser instead of the Tor browser?

I don't think it's useless. You have to consider the difference between privacy and anonymity but also the situation of other Browsers (Firefox/Chrome/Edge/Safari...).

Brave is mainly about Privacy in which this is a good added measure compared to other Mainstream browsers. It's certainly a bigger issue when it comes to anonymity.

It's still much better than any other (non Tor Browser) private/incognito Window/Tab.

Brave is meant to be used as a daily Browser and as an alternative to Mainstream browsers. It's not meant IMHO to compete against Tor Browser for anonymity. Using Tor Browser for mundane non-sensitive activities seems a bit overkill to me.

There are quite a few ways to use Brave safely over Tor without using Tor Tabs and while keeping both Privacy/Anonymity (without DNS leaks).

This is a matter of threat modeling, performance and usability.

Brave has some benefits over Tor Browser in terms of usability/performance/fingerprinting resistance and acceptance by various online obstacles (such as Captchas).

For example:

Open Tor Browser and go to https://coveryourtracks.eff.org/ and check. You'll see it "fail" the fingerprinting test (nearly unique).

Open a Brave Tor Tab (or even a Private Tab) and go to https://coveryourtracks.eff.org/ and check. You'll see it pass the fingerprinting test (fully randomized).

Open a Private Tab with any other mainstream browser in their default settings and enjoy the results ...

So my take on it? Even for some sensitive activities, I do use Brave Browser within Whonix Workstation rather than Tor Browser (without Tor Tabs). This solves the issue while enjoying an overall better persistent browsing experience and less hurdles with the various services targeting and harassing Tor Browser just because they're using Tor Browser. But of course you could also use Firefox with various extensions in place of Brave. In this case and IMHO, this is a usability/performance choice.

Different threat model?

Please explain, I’m not sure I understand. When a person loads Tor, are they not just using the Tor browser? Why open another browser?

Basically Brave has a 'New Tab with Tor' feature. It's intended to be a bit more private than a private tab, but for people who are super concerned about their privacy they actually recommend Tor Browser (it's in their Help section).

In any case hopefully this gets filed as a bug on Github and things get a bit better.

Because its easier. I can just "Ctrl+Shift+N" on Brave to load Tor within seconds in Brave. Opening Tor takes time and this feature is very useful when trying to quickly access a blocked site.

Another reason I use Tor in Brave is to bypass mega.nz's IP limit on downloads.

I can only speak for myself, but for me it is convenience. If all your browsing is done in Brave, why fire up Tor browser if you don’t need to? Brave has shown they care about privacy and security, so they have earned the benefit of the doubt with me.

The Tor Browser uses the Tor network, but it is certainly not the only application that uses the Tor network. The Tor network existed long before the Tor Browser did.

Reply on news.ycombinator.com