Brave browser’s Tor mode exposed users’ dark web activity

Brave, one of the top-rated browsers for privacy, has fixed a bug in its Private Windows with Tor feature that leaked the .onion URLs for websites visited by users. According to a report by an anonymous researcher, the browser’s built-in Tor mode – which takes private browsing to a new level by allowing users to navigate to .onion websites on the dark web without having to install Tor – was leaking Domain Name System (DNS) requests for the websites.

“If you're using Brave you probably use it because you expect a certain level of privacy/anonymity. Piping .onion requests through DNS where your ISP or DNS provider can see that you made a request for an .onion site defeats that purpose,” reads the post.

RELATED READING: 3 ways to browse the web anonymously

The researcher found that when a request is made for a .onion domain while using Private Window with Tor, the request makes its way to the DNS server and is tagged with the Internet Protocol (IP) address of the requester.

“This shouldn't happen. There isn't any reason for Brave to attempt to resolve a .onion domain through traditional means as it would with a regular clearnet site,” said the researcher. As a result, if you used Tor with Brave and accessed a Tor website, your internet service provider (ISP) or DNS provider might be able to tell that the request for that specific website was made from your IP address.

According to a tweet by Brave’s Chief Information Security Officer Yan Zhu, Brave was already aware of the issue since it was previously reported on HackerOne. It has since pushed out a hotfix to resolve the issue, which was traced to the browser’s adblocking component that used a separate DNS query.

The Chromium-based browser first released the Beta of Private tabs with Tor in June 2018 in a bid to protect the privacy of users not only on their devices but over the network as well. “Private Tabs with Tor help protect Brave users from ISPs (Internet Service Providers), guest Wi-Fi providers, and visited sites that may be watching their Internet connection or even tracking and collecting IP addresses, a device’s Internet identifier,” reads its blog touting the new feature. In 2020 it also launched its own Tor Onion Service.