Brave has fixed a privacy issue in its browser that sent queries for .onion domains to public internet DNS resolvers rather than routing them through Tor nodes, thus exposing users’ visits to dark web websites.
The bug was addressed in a hotfix release (V1.20.108) made available yesterday.
Brave ships with a built-in feature called “Private Window with Tor” that integrates the Tor anonymity network into the browser, allowing users to access .onion websites, which are hosted on the darknet, without revealing the IP address information to internet service providers (ISPs), Wi-Fi network providers, and the websites themselves. The feature was added in June 2018.
This is achieved by relaying users’ requests for an onion URL through a network of volunteer-run Tor nodes. At the same time, it’s worth noting that the feature uses Tor just as a proxy and does not implement most of the privacy protections offered by Tor Browser.
But according to a report first disclosed on Ramble, the privacy-defeating bug in the Tor mode of the browser made it possible to leak all the .onion addresses visited by a user to public DNS resolvers.
“Your ISP or DNS provider will know that a request made…
http://feedproxy.google.com/~r/TheHackersNews/~3/4nxjoDPfRn8/privacy-bug-in-brave-browser-exposes.html