1

Description

When using private window Tor mode I was surprised to see that Brave passes a browser identifier in the url of the search.

It seems having &t=brave in the url makes identifying the user easier.

Since any tor nodes monitoring the URL address can tell which browser you're using (and Brave currently only has around 5 million active monthly users, of which only a small percentage use Tor).

Steps to Reproduce

  1. Open private browsing window with tor
  2. Right click on highlighted text
  3. Click on "Search DuckDuckGo for"
  4. View url and see &t=brave

enter image description here

enter image description here

Alternatively you can search using the URL bar which will also append &t=brave to the DuckDuckGo URL.

Question

Should this be considered a privacy issue? Could Tor exit nodes use this information to narrow down the possible identity of a user based on knowing they are using Brave?

Improve this question
5
  • what does brave have to do with Tor?
    – DJCrashdummy
    Dec 20, 2018 at 0:25
  • a general advise: don't use brave at all!
    – DJCrashdummy
    Dec 20, 2018 at 0:25
  • @DJCrashdummy it ships with Tor browser built in. Also the lead of security is Yan Zhu who was a contributor to the Tor Project.
    – Philip Kirkbride
    Dec 20, 2018 at 4:13
  • well... a part of the privacy-concept is to sink in the sea of not distinguishable Tor-users (that's a reason why Tails does not use different addons, settings etc.), so splitting the user base by using a different browser isn't a good idea. - and not to mention, that they are still a company and want resp. must sell their "product"... whether it is their software or their users. the last time i reviewed Brave, their business plan was to locally replace ads and inject their own, which is IMHO questionable.
    – DJCrashdummy
    Dec 20, 2018 at 11:22
  • 1
    btw: i saw that they are using code of Privacy Badger, whose concept is suspected to result in distinguishable profiles of users. - don't get me wrong: Privacy Badger is really nice and definitely better to use than browsing with a plain browser, but i wouldn't advise it in conjunction with Tor!
    – DJCrashdummy
    Dec 20, 2018 at 11:24

1 Answer 1

Reset to default
1

I found that Tor exit nodes can't see the full path of a URL, only the domain (and subdomain if one is used).

The full path including the referrer URL in this case is encrypted.

See this answer on stackoverflow for more details.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .