A bug in the ad blocking component of Brave’s Tor feature caused the browser to leak users’ DNS queries

1. Brave Browser Tor Ios
2. Brave Browser Tor Mode
3. Brave Browser Tor Status Disconnected
4. Brave Browser Tor Not Working

Brave lets you use Tor right in a tab. Tor not only hides your history, it masks your location from the sites you visit by routing your browsing through several servers before it reaches your destination. Jun 28, 2018 The integration of Tor into the Brave browser makes enhanced privacy protection conveniently accessible to any Brave user directly within the browser. At any point in time, a user can have one or more regular tabs, session tabs, private tabs, and Private Tabs with Tor open. How To use Tor in the Brave Browser (easy).

The Brave browser, which emphasizes privacy and security, has been leaking data for months, according to security researchers. On Friday, Reddit user “py4YQFdYkKhBK690mZql” posted on a forum that Brave’s Tor mode, introduced in 2018, was sending requests for.onion domains to DNS resolvers, rather than private Tor nodes. A DNS resolver is a server that converts domain names into IP. The Brave browser is a fast, private and secure web browser for PC, Mac and mobile. Download now to enjoy a faster ad-free browsing experience that saves data and battery life by blocking tracking software. The Brave browser is known to protect the privacy of its users through its privacy-focused features. But lately, it has been found that the Tor developers had to rush in the bid to fix a bug that has initially been leaking the users’ darknet activity in the DNS traffic.

Brave, one of the top-rated browsers for privacy, has fixed a bug in its Private Windows with Tor feature that leaked the .onion URLs for websites visited by users. According to a report by an anonymous researcher, the browser’s built-in Tor mode – which takes private browsing to a new level by allowing users to navigate to .onion websites on the dark web without having to install Tor – was leaking Domain Name System (DNS) requests for the websites.

“If you’re using Brave you probably use it because you expect a certain level of privacy/anonymity. Piping .onion requests through DNS where your ISP or DNS provider can see that you made a request for an .onion site defeats that purpose,” reads the post.

RELATED READING: 3 ways to browse the web anonymously

The researcher found that when a request is made for a .onion domain while using Private Window with Tor, the request makes its way to the DNS server and is tagged with the Internet Protocol (IP) address of the requester.

“This shouldn’t happen. There isn’t any reason for Brave to attempt to resolve a .onion domain through traditional means as it would with a regular clearnet site,” said the researcher. As a result, if you used Tor with Brave and accessed a Tor website, your internet service provider (ISP) or DNS provider might be able to tell that the request for that specific website was made from your IP address.

According to a tweet by Brave’s Chief Information Security Officer Yan Zhu, Brave was already aware of the issue since it was previously reported on HackerOne. It has since pushed out a hotfix to resolve the issue, which was traced to the browser’s adblocking component that used a separate DNS query.

for security researchers looking at Tor windows in Brave, note this feature is presented to users as regular private windows which use a Tor proxy for improved network privacy, NOT an equivalent to Tor Browser in terms of anonymity or leakproofing. https://t.co/xYUwsFhXbtpic.twitter.com/H6VuRYsArg

— yan (@bcrypt) February 19, 2021

The Chromium-based browser first released the Beta of Private tabs with Tor in June 2018 in a bid to protect the privacy of users not only on their devices but over the network as well. “Private Tabs with Tor help protect Brave users from ISPs (Internet Service Providers), guest Wi-Fi providers, and visited sites that may be watching their Internet connection or even tracking and collecting IP addresses, a device’s Internet identifier,” reads its blog touting the new feature. In 2020 it also launched its own Tor Onion Service.

Search engines and other websites collect user data to provide a better user experience. Sometimes, that data gets abused too. Whether you respect your privacy or it is the nature of your work, more people are turning to privacy-focused browsers of late to protect their identity and what they do online.

Tor has made a name for itself when it comes to anonymous browsing, and Brave is looking to grab a piece of that market.

Tor (The Onion Router), also popularly called the Onion browser, was initially developed by the US Navy but is now a non-profit organization that works towards the goal of providing private access to the uncensored web through the concept of onion routing. That means it moves your Internet data (encrypted) across many servers run by volunteers across the world.

Get Tor

Brave browser is a free and open source browser which blocks ads and trackers. Brave also proposes a future browser with a ‘pay to surf’ business model with roots in blockchain and cryptocurrency. You have an option to enable ads allowing trackers, and if you do share your data and view ads, you get paid in BAT, Brave’s native cryptocurrency. Recently, they released a new feature called New private window with TOR leaving users perplexed as to which browser is more secure and how they differ.

Get Brave Browser

So which one should you use to ensure a more private browser experience? Let’s find out.

1. Open Source Base

The Tor browser consists of technologies that include a modified Mozilla’s Firefox browser, specific Tor proxy, script blocking extension, and HTTPS Everywhere Firefox extension. In short, it is built using several open source technologies.

On the other hand, Brave browser is based on the Chromium web browser which is an open source project by search engine giant Google. Chrome and Microsoft’s new Edge browser are built on the Chromium web browser.

While users continue to debate over which one is better when it comes to blocking ads, scripts, and devtools, the consensus is that Firefox is more private of the two and gives you more control over which scripts are allowed.

Also on Guiding Tech

4 Important Tips to Maximize Privacy and Security with DuckDuckGo

Read More

2. Security & Privacy

The crux of the debate is how secure and private the Brave browser is compared to Tor, especially after the Tor integration into the former. Tor uses onion routing, its proprietary technology, where your Internet data is first encrypted and then bounced around a network of relays that are run by volunteers. Tor implements multi-layer encryption which means data is encrypted before relayed to the next server in the network. See how onions have multiple layers too? Hence the name.

Tor also blocks all ads, scripts, and recommends users not to install any browser plugins. It also deploys NoScript and HTTPS Everywhere by default.

NoScript prevents javascript code snippets from loading and executing, thus protecting the users from prying eyes as well as nefarious malware hidden in ads. HTTPS Everywhere forces the websites to use the more secure HTTPS connection. It was developed in collaboration with Tor.

Brave browser blocks all ads, requests, and third-party cookies by default too and uses both NoScript (not on by default upon installation) and HTTPS Everywhere. For a browser that sells privacy and security, Brave dev team caused quite a controversy when they decided to whitelist certain domains including Facebook ad tracking URLs.

Following a Twitter uproar, they were forced to release a statement yet the update was not reversed. In fact, they went on to add a Twitter URL to the whitelist. The whitelist is hard coded and users cannot edit it.

Firefox does a better job and offers more privacy and security options to users, and hence more control. For one, Firefox uses its certificate trust chain instead of the OS you are using and two, you can configure the proxy settings. Brave Browser could have done something similar. On the plus side, Brave disables Google account and sync services disallowing them to track you.

3. New Private Window with Tor

To win the trust back, Brave Browser introduced ‘New private window with Tor’ feature with Tor integration as an option for privacy and security savvy users. The Tor integration is available for desktop browsers only for now so mobile users are left out.

When a user asked what the fundamental difference between Tor browser and Brave Browser’s Tor integration is on Reddit, the company admitted that Tor is more secure while Brave is suitable for hiding from ‘ISP, work or school.’ On the plus side, the default search engine is set to DuckDuckGo in the Tor mode.

Brave with Tor does not provide the same level of privacy as the Tor browser

To me, that sounds like a proxy or a VPN, but Tor is much more than that. Where Tor hides your fingerprint more effectively, Brave Browser has a ‘slightly more unique fingerprint.’

Finally, any new security vulnerability and a subsequent patch will be available to Tor users first and then browsers that are using Tor’s services.

Also on Guiding Tech

Firefox Focus vs DuckDuckGo: Which Is the Best Browser for Privacy

Read More

4. Revenue Model and Platforms

Brave Browser Tor Ios

The company behind Tor browser is a non-profit organization, and they depend on donations for research and development. Tor is available on Windows, macOS, Android, and iOS platforms.

Brave browser has a system called Brave Rewards that will show targeted ads to users selected by the team. In return, users will receive BAT token that they can then distribute to their favorite YouTuber, Twitch channels and other content creators. Or, users may decide to keep the tokens to cash out at a cryptocurrency exchange like Binance.

The idea is to create a win-win situation where the browser rewards the users for allowing ads and sharing data willingly for a piece of the pie. While it is voluntary and users will have to opt-in, that does raise questions about data. Brave is available on all popular desktop and mobile OS, but Tor integration was released for Windows and macOS only with a promise to bring it to Android and iOS soon.

Onion Has More Layers

Here is the summary. Brave browser is safe and secure, and rewarding for viewing ads voluntarily. A nice concept. Brave is trying to do the right thing by bringing Tor in to the fold which makes it more private than say, Chrome's Incognito Mode.

However, Tor is still the go-to browser when it comes to staying anonymous on the web, protecting your identity and data from prying eyes. It's like Brave Browser team says, if your life depends on it, use Tor.

Next up: Do you use Google Chrome? Can't replace it completely? Here are 7 tips for maintaining privacy and security in Chrome.

Brave Browser Tor Mode

The above article may contain affiliate links which help support Guiding Tech. However, it does not affect our editorial integrity. The content remains unbiased and authentic.

Read Next

Brave Browser Tor Status Disconnected

Brave iOS vs Firefox Focus: Comparison of Privacy Browsers on iPhone

Brave Browser Tor Not Working

Both Brave and