Brave is detectable

[ghost]

Brave can be detected. There are 7 possible ways to easily identify brave, without canvas and shields off. Will be disclosed on hacker one, if bounty eligible. Else solution will be released commercially,

[luixxiul]

cc @diracdeltas

[luixxiul]

@diracdeltas will this be closed in favor of #10655?

[ghost]

@luixxiul At that time there were 3 ways. Now I've found 7 ways. Even with the latest update there were no fixes.

[diracdeltas]

Although our HackerOne bounty program lists detecting Brave as out-of-scope, I would accept this as eligible if you found an attack that sets the User-Agent (or some other commonly-logged browser property) to Brave instead of Chrome OR if the attack worked with scripts disabled.

[ghost]

1 method of the attack can detect without JavaScript enabled. Most reliable one uses JS. Easy Fixes are not easily possible for 1 way(JS way). So its eligible? I will submit after clarification here otherwise I can just give it away to Admiral, they'll be happy, and would reward.

[luixxiul]

@diracdeltas please close this if this will be also triaged through hackerone.

https://github.com/AhsanE/BraveBrowserDetection

[ghost]

@diracdeltas Will wait for 1 business day for the reply. Otherwise response will be assumed as negative.

[diracdeltas]

closing this and waiting on the hackerone report, thanks