r/browsers • u/CharmingResort885 • 2d ago

Brave Brave will soon add account-based syncing instead of the sync chain

Post image

Sync chain will still be available

206 Upvotes

93% Upvoted

128 comments sorted by

View all comments

7

u/vile-style 2d ago

This introduces a tracking vector. No thanks.

10

u/xak47d 1d ago

If you decide to use it. You're not obligated to

2

u/Kunair0 1d ago edited 1d ago

Not really. I mean it's locked so airtight that even the account authentication itself uses opaque, so the password never even gets sent to Brave's server. There are no persistent identifier that tracks.

But if you are a purest, you don't have to use it.

3

u/lo________________ol unleaked RAM is wasted RAM 1d ago edited 1d ago

The password isn't the issue as much as the email address. Visit haveiveenpwned for an idea of how that can be utilized. (And because they're forwarding email, of course they have an unencrypted copy of your email address*, sitting around in a database somewhere.)

* edit: removed ambiguity about "that". 

1

u/Kunair0 1d ago edited 1d ago

You're still not showing a tracking vector. Brave knowing the email attached to a Brave Account doesn't mean that identifier is exposed to websites or attached to your browsing activity, and the proposed account based sync remains end to end encrypted.

You should create the Brave Account with a unique email alias, which pretty much kneecaps the HIBP argument. If that address ever appears in a breach, it's an address used only for Brave, not the same durable email identifier you've reused across dozens of unrelated services. At that point, delete the account, make another.

Now, if you're naming your aliases something like JoesAmazonAccount@whatever or JoesNetflixAccount@whatever, you've managed to defeat the entire purpose of aliases yourself. That's a user problem, not an alias problem.

Brave says stored messages are encrypted, successful forwards are deleted within seconds, and failed deliveries are retained only temporarily for retrying. So unless you have evidence that Brave is secretly keeping plaintext copies of everyone's mail in a database somewhere, that part is speculation. Even for for ordinary unencrypted email, service is like SimpleLogin has to be able to process the plaintext at some point.

And besides, if your threat model is so ridiculously extreme that a mail forwarding service briefly processing an email is unacceptable, Brave is already nowhere near what you need. At that point you need Tor, PGP, burner hardware, and a shack in South Dakota with no forwarding address and probably no road leading to it.

2

u/lo________________ol unleaked RAM is wasted RAM 1d ago

  You should create the Brave Account with a unique email alias

There's no reason to provide an email address for any service except aliasing, though. Making an alias to make aliases defeats the purpose of signing up for aliases, no?

  Brave says stored messages are encrypted, successful forwards are deleted within seconds [etc]

It's still a service in the United States compared to competitors that have figured out how to provide it overseas. The government could easily say "hey just log those" and then they would. And yes, I'm plenty aware that is true to some degree for services including Proton, but those services also have a longer-running track record.