Hacker News Reader

Comment by derefr | Hacker News Reader

Some users — possibly Brave's core target audience — might complain that there's no way to remain anonymous in this flow: either you allow Brave to leak your info to advertisers, or you allow Brave to leak your info to Stripe in the payment flow. There's (currently) no way to pay for a Brave Premium account with crypto or through any other anonymous mechanism.

View on HN

> either you allow Brave to leak your info to advertisers

Can you expand on this? According to the article the ads are privacy-preserving but I'm open to hearing otherwise. There's not a lot of detail in the article.

Assuming we can trust Brave, the article clearly states: "Brave Search only uses your search query, country, and device type to show you ads, and does not keep any kind of profile of your searches."

My question to somebody who understands this more than me, by collecting query, country, device type, is that enough info to identify users?

Doesn't Brave automatically get User Agent strings, too?

Even if that is enough to identify users, you'd have to show evidence that that information is being handed to advertisers, which is what GP accused them of.

Because this is the entire internet model, it is not at all a reach to assume there is a privacy issue.

Rather, I think you should have to prove that sending your search data OR having your credentials tied to your credit card are privacy preserving.

The burden of proof is on Brave. Not skeptical or cautious users.

Unless they mean something non-conventional, a search query, country, and device type are not enough to do any fingerprinting reliably. Some would argue that if you live in a very small country (like Vatican City) and you are the only user who searches for some obscure query on a daily basis then that's enough to identify you. But on a global scale of a search engine - no, not enough.

> My question to somebody who understands this more than me, by collecting query, country, device type, is that enough info to identify users?

Collecting search queries alone is enough to identify users. see: https://www.nytimes.com/2006/08/09/technology/09aol.html

Reply on news.ycombinator.com