A bug in the ad blocking component of Brave’s Tor feature caused the browser to leak users’ DNS queries
Brave, one of the top-rated browsers for privacy, has fixed a bug in its Private Windows with Tor feature that leaked the .onion URLs for websites visited by users. According to a report by an anonymous researcher, the browser’s built-in Tor mode – which takes private browsing to a new level by allowing users to navigate to .onion websites on the dark web without having to install Tor – was leaking Domain Name System (DNS) requests for the websites.
“If you’re using Brave you probably use it because you expect a certain level of privacy/anonymity. Piping .onion requests through DNS where your ISP or DNS provider can see that you made a request for an .onion site defeats that purpose,” reads the post.
- Brave is a privacy-focused browser that aims to prevent its users from being tracked online. That largely means preventing advertisers from tracking you, which disrupts the main way many websites.
- Brave lets you use Tor right in a tab. Tor not only hides your history, it masks your location from the sites you visit by routing your browsing through several servers before it reaches your destination.
- When you are inside a Private Window with Tor, Brave doesn’t connect directly to a website like normal. Instead, you connect to a chain of three different computers in the volunteer-run Tor networ.
RELATED READING: 3 ways to browse the web anonymously
Some people say that Brave would block your ISP from seeing you run Tor, but I never trust my ISP not to try and know everything about what I do on general principle. There is money in the knowledge of knowing what you do, search for, where you go, and ISPs are all about the money.
The researcher found that when a request is made for a .onion domain while using Private Window with Tor, the request makes its way to the DNS server and is tagged with the Internet Protocol (IP) address of the requester.
“This shouldn’t happen. There isn’t any reason for Brave to attempt to resolve a .onion domain through traditional means as it would with a regular clearnet site,” said the researcher. As a result, if you used Tor with Brave and accessed a Tor website, your internet service provider (ISP) or DNS provider might be able to tell that the request for that specific website was made from your IP address.
According to a tweet by Brave’s Chief Information Security Officer Yan Zhu, Brave was already aware of the issue since it was previously reported on HackerOne. It has since pushed out a hotfix to resolve the issue, which was traced to the browser’s adblocking component that used a separate DNS query.
Brave Tor Browser
for security researchers looking at Tor windows in Brave, note this feature is presented to users as regular private windows which use a Tor proxy for improved network privacy, NOT an equivalent to Tor Browser in terms of anonymity or leakproofing. https://t.co/xYUwsFhXbtpic.twitter.com/H6VuRYsArg
— yan (@bcrypt) February 19, 2021
Brave Tor Ios
The Chromium-based browser first released the Beta of Private tabs with Tor in June 2018 in a bid to protect the privacy of users not only on their devices but over the network as well. “Private Tabs with Tor help protect Brave users from ISPs (Internet Service Providers), guest Wi-Fi providers, and visited sites that may be watching their Internet connection or even tracking and collecting IP addresses, a device’s Internet identifier,” reads its blog touting the new feature. In 2020 it also launched its own Tor Onion Service.
Brave Tor Mode
Discussion