Brave browser simplifies its fingerprinting protections

This is the 28th post in an ongoing series describing new privacy features in the Brave browser. This post describes work done by Sr. Research and Privacy Engineer Arthur Edelstein, and was written by Edelstein and by Privacy Engineering Lead Shivan Kaul Sahib.

With desktop and Android version 1.64 in a couple of months (and in today’s Nightly release for testing), Brave will sunset Strict fingerprinting protection mode. This does not affect Brave’s industry-leading fingerprinting protection capabilities for users. Instead, it will allow us to focus on improving privacy protections in Standard mode and avoid Web compatibility issues.

Brave currently offers two levels of fingerprinting protections. which make it harder for tracking companies to identify you as you browse the Web: Standard and Strict mode. Over time, however, we have observed significant disadvantages of Strict mode:

1. In order to block fingerprintable APIs, Strict mode frequently causes certain websites to function incorrectly or not at all. This website breakage means that Strict mode has limited utility for most Web users.

2. Fewer than 0.5% of Brave users are using Strict fingerprinting protection mode, based on our privacy-preserving telemetry data.

3. This tiny cohort of users could be more vulnerable to being fingerprinted because they stand out as a result of using Strict mode. Although we have not seen issues around this, it is a valid concern given that users who select Strict fingerprinting protection might have done so because of an elevated concern about tracking.

4. Maintaining Strict mode and debugging why some websites are broken on Brave takes our engineers’ time away from focusing on default privacy protections that can benefit all of our users.

These observations have led us to the conclusion that sunsetting Strict mode in Brave will actually be beneficial to our users’ privacy.

Brave’s Standard fingerprinting protection is already very extensive and the strongest of any major browser. Brave’s innovative farbling of a number of major fingerprintable Web APIs makes it difficult for fingerprinters to get a reliable unique ID on your browser. Going forward, we will continue to strengthen and expand Brave’s Standard fingerprinting protections so that all our users have ever-improving protection against fingerprinters, while maintaining the highest possible level of compatibility with websites.