Trezor Connect does not load in Brave when cookies are blocked

[john-light]

I was having an issue connecting Trezor wallet to https://live.sovryn.app, https://live.sovryn.app/zero, and https://safe.gnosis.io

The URL would open but just show a loading spinner forever:

Since each app uses different wallet connection modules, I figured the issue must be Trezor Connect and worked with a colleague to investigate further.

After some troublshooting we narrowed it down. There is a setting in Brave browser called "Block cookies".

When the issue was happening, I had this set to "Only cross-site":

After changing this setting to "Disabled", the issue stopped happening:

Edit: For some apps, "Block fingerprinting" must also be disabled.

I am opening this issue because it'd be great if there was a way to use Brave while keeping this "Block cookies" setting enabled, for privacy reasons. It would be annoying to want to use this feature and have to disable it every time I wanted to use Trezor in the browser.

[sime]

Thanks for your report.

Tricky thing is that by definition, connect.trezor.io is cross site.

[john-light]

Tricky thing is that by definition, connect.trezor.io is cross site.

This may be out of scope for this issue, but it has always been a bit weird to me that Trezor has to phone home every time I want to use it on the web. Ledger doesn't do that (as far as I can tell). Maybe Trezor can somehow get rid of this requirement and work the same way as Ledger where it doesn't need to phone home to trezor.io just to connect to a web app?

Edit: I checked, and in Brave and Firefox cross-site cookies are blocked by default, and confirmed connect.trezor.io does not load with the default settings. So by default Trezor users are going to have problems with Trezor in these web browsers. Could the website they're trying to connect their Trezor to run Connect or is there something else web apps can do to make direct Trezor connections work smoothly with these default browser settings? Wondering because with the power of defaults we can expect it to be an issue, and also it is an unfortunate decision to have to make as a user between convenient privacy protection or having to manually turn this setting on and off whenever using Trezor on a site.

Brave default:

Firefox default:

[matejcik]

this also applies in Chrome when I disable 3rd party cookies.

error seen in the mother page console:

Uncaught (in promise) DOMException: Failed to read the 'localStorage' property from 'Window': Access is denied for this document.
    at s (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:1:88359)
    at t.load (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:1:88599)
    at No (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:65:346651)
    at bo.Ro (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:65:345908)
    at u.emit (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:61:10434)
    at eo (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:65:333828)
    at jt.<anonymous> (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:65:341444)
    at u.emit (https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:61:10434)
    at https://connect.trezor.io/9/js/iframe.43c34566e2d5515592c5.js:65:153015
    at Array.forEach (<anonymous>)

curiously enough, when I enable cookies, use Connect, then disable again, it works from then on.

[resetko-zeal]

This may be out of scope for this issue, but it has always been a bit weird to me that Trezor has to phone home every time I want to use it on the web. Ledger doesn't do that (as far as I can tell). Maybe Trezor can somehow get rid of this requirement and work the same way as Ledger where it doesn't need to phone home to trezor.io just to connect to a web app?

Considering that, can we really treat Trezor as self custody wallet? If trezor.io is down I will never get access to my assets, right?

When ledger has direct access to device, so let's say if leder's site is suddenly going down, it won't affect me, because I can even use old version of the app locally to have access to my devices, but same is not possible with Trezor

[mroz22]

Considering that, can we really treat Trezor as self custody wallet?

you can always run TrezorConnect locally. and it is totally stateless, you aren't locked-in in anyway.

[Hannsek]

I think this is solved by now. We can reopen this if the issue reappears.