Description
When using private window Tor mode I was surprised to see that Brave passes a browser identifier in the url of the search.
It seems having &t=brave
in the url makes identifying the user easier.
Since any tor nodes monitoring the URL address can tell which browser you're using (and Brave currently only has around 5 million active monthly users, of which only a small percentage use Tor).
Steps to Reproduce
- Open private browsing window with tor
- Right click on highlighted text
- Click on "Search DuckDuckGo for"
- View url and see
&t=brave
Alternatively you can search using the URL bar which will also append &t=brave
to the DuckDuckGo URL.
Question
Should this be considered a privacy issue? Could Tor exit nodes use this information to narrow down the possible identity of a user based on knowing they are using Brave?