* Encryption is not enabled by default.
* They call it private, but I don't see how the metadata - who you talk to, which is as important as what you say - is private.
* "Assuming no malevolence ...": Assuming no malevolence, we don't need to encrypt anything. Though even if we assume malevolence, if we trust Brave to make the browser, they can do almost anything they want regardless, without our knowing much about it.
like automatically adding affiliate links to URLs without notifying their users
https://www.cpomagazine.com/data-privacy/brave-privacy-brows...
TLS, which is probably the most widely used form of encryption, is also more or less dependent on assuming no malevolence by the certificate authorities.
Your points about possible metadata collection, and end-to-end encryption not being the default are valid though.
It doesn't have to be. Nothing's stopping you from signing your own certificates, just like nothing is stopping you from trusting the certificate your friend gave you, whether its by printing out the certificate on paper and then "handing" it to you, or sending it in an email. You're also 100% welcome to trust that your friend isn't a moron and lost control of his private key. AT THE SAME TIME, nothing stops you and abunch of your friends from trusting one or 2 dudes to be a certificate authority for your group.
Cryptography wasn't (and never tried to be) ever an alternative to not being stupid. Any 2 people can setup maximum 100% encrypted end-to-end communication using tools older than I am (or about my age). I feel like we let security and centralization blind us to solutions that we already have because those solutions are hard to onboard too. IRC is free, GPG is free, TOR is free, Email is still free.
Video calling, with Brave privacy at its core
No tracking. No data collection. Nothing linking you (or anyone else) to a call. Period. With Brave Talk, your conversations stay private to you.
-----
Don't get me wrong, am really glad they are releasing this and I hope a lot of people use it!
I just think we need to educate the end users more about how even private / encrypted things are not tracking-proof .. the "No tracking" to you/me/brave may be 'no advertiser big fang tracking' in our mind - but that's not how it's written or read / understood by the average person I would guess.
https://arstechnica.com/information-technology/2021/09/priva...
I strongly disagree or all assertions in humanity are meaningless. Everything we do and think relies on trusting others.
For two well-known examples, Bitcoin PoW assumes the possibility that a malicious actor can spin up arbitrary amounts of malicious nodes. TLS assumes that the intermediary nodes in underlying network (e.g. ISPs) can be malicious. The assertions still hold.
We accidentally made librarians Owners of Teams associated with courses students were taking where that librarian was subject specialist, so e.g. Modern History librarian finds they are now Owner of dozens of teams full of teenage students. That's annoying, so they click Delete. Are you sure? Says Teams. Of course they're sure. And the Team is deleted.
If security prevented them doing that, they'd have complained "Why am I in all these teams?" instead of deleting the teams. No malevolence involved.