Allow users to disable APIs that intentionally identify the browser as Brave

brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.

https://brave.com

Mozilla Public License 2.0

17.65k stars 2.3k forks source link

Allow users to disable APIs that intentionally identify the browser as Brave #8757

Open pes10k opened 4 years ago

pes10k commented 4 years ago

Currently brave allows sites to determine if its brave by querying a Brave-specific API (navigator.brave.*). This was done in https://github.com/brave/brave-browser/issues/8216 to:

1) make easy whats already possible for sites (by looking for Brave unique modifications), and 2) make explicit that keeping brave indistinguishable from chrome is not part of brave's privacy threat model

However, it would be nice to have a way for users to disable this if needed, either per site in shields, or globally through a flag.

Johann999 commented 4 years ago

The whole thing is paradoxical, unclear and contradictory. On the one hand, Brave does not appear in the user agent, supposedly because of fingerprinting. On the other hand, Brave can query using the DuckDuckGo API and more recently using navigator.brave.

pes10k commented 4 years ago

On the one hand, Brave does not appear in the user agent, supposedly because of fingerprinting.

This is not correct. Brave doesn't appear in the UA for web compat reasons. Brave makes many changes in the browser that it already looks / behaves very different from chromium, so reporting brave in the UA would not have any change in the browser's fingerprintability (e.g. the other changes brave makes are consistent across all brave instances per platform, so changing the UA in a way that was also consistent across all brave instances per platform would not affect the anonymity sets at all).

arpitjindal97 commented 3 years ago

You should have implement previous backlog by giving an option to change it. The whole purpose of using Brave seems worthless now. Some websites have started blocking Brave intentionally.

dlecan commented 3 years ago

Some websites have started blocking Brave intentionally.

Which ones?

arpitjindal97 commented 3 years ago

KodeKloud Labs

pes10k commented 3 years ago

@ryanbr can you add a fix for the above, with another remove isBrave for the above?

ryanbr commented 3 years ago

KodeKloud Labs

Does this error message come from kodekloud.com domain? @arpitjindal97

arpitjindal97 commented 3 years ago

When you try open Labs session on kodekloud.com then you will see this error

ryanbr commented 3 years ago

If you add kodekloud.com##+js(aopw, navigator.brave) into brave://adblock, clear the cookies and relogin.

Does that help? @arpitjindal97

ryanbr commented 3 years ago

Apologies for the delay, managed to recreate the issue, @arpitjindal97 give it 24-48hrs the update will fix this issue with shields up.

arpitjindal97 commented 3 years ago

Thanks @ryanbr , new update fixed the kodekloud issue. Waiting for a full fledged solution.

ryanbr commented 3 years ago

Yeah, tried reaching out to them via twitter, got no response @arpitjindal97