Brave has become Malware

[Grimeton]

You know, when I install a browser I expect a nice UI, an up to date engine, some privacy and a few additional features that a vanilla browser doesn’t come with.

What I don’t expect is an eco system of binaries and services that is slowly creeping into my system while it updates itself in the background without my knowledge.

Not using Brave very much and being alerted by the taskbar icon of “Brave VPN” I checked what’s going on:

There are SIX SERVICES running with local system privileges.

• Brave Elevation Service (Local System) For What? I’m using a browser.
• Brave Update-Service “brave” (Local System) For what? I’m using a browser.
• Brave Update-Service “bravem” (Local System) For what? I’m using a browser.
• Brave VPN Service (Local System) For what? I’m using a browser.
• Brave VPN Wireguard Service (Local System) For what? I’m using a browser.

I don’t want to know how many bugs and potential backdoors exist in those services and don’t tell me there aren’t any. We all know software isn’t perfect.

There are two tasks in the task planer that run with highest privileges when exectued that have one and only one thing to do:

Check if the services are still activated and if not, reactivate them and then run them. With highest privliges (local system) of course.

The way all of this is implemented reminds me more of some sort of malware than of a browser. Why network services need to be run with highest privileges is a mistery to me and is known to cause all kinds of security implications. That’s why people don’t do it. But I guess implementing new features was “importanter” than looking out for security and privacy.

The way all kinds of sh1t gets implemented into the browser and tons of services are getting installed through background updates on my system without even asking me leaves one of the worst tastes in my mouth I have ever had. Especially when we’re talking about a product that advertises with security and privacy.

In my opinion you have become your own worst enemy and your software has turned into the biggest malware that is out there. I never really trusted your browser because I had to disable way too many features from the start, but this takes the cake.

For your own sake I can only hope you fix this and if you want to sell a VPN, make it an addon but don’t sneak it in through the backdoor of automatic updates.

Seriously: WTF?

EDIT:

I just uninstalled your malware of a browser:

Update services are still there:

Tasks are still there:

Binaries are still there:

No words…

[enesha]

Nothing really helpful here to add, other than a Here! Here!
Brave started as a good concept. Then BAT and VPN and crypto wallet, etc, etc.
Horrible example of mission creep.

[DavyP]

Hello,
I thought you might be interested in this free application that does a good job of uninstalling software and any reminants that might be left behind. I previously used to utilize a different software application but I seemingly like this one better: https://www.bcuninstaller.com/

[marko30]

I love Brave as a concept of simple web browser that protects your privacy and blocks ads. But, unfortunately, it’s turning into bloatware. Why?

1. They started to heavily promote crypto, which I’m not fan of. Personally, I think it’s a scam.
2. They constantly add new “features” without giving us ability to disable it completely (you can’t completely disable Brave News, Brave VPN, Brave Wallet, Brave Rewards, Brave Search; they are always present somewhere in the UI)
3. Web3 part is completely unnecessary.

I don’t see why they couldn’t give us an option to disable everything we don’t want. I do get that they are a company and have to earn money after all. But not giving me option to disable things won’t suddenly change my mind and make me buy their stuff and use it.

There are other legit ways they could use to earn money. Abandon crypto and sell Brave VPN, they could make private e-mail service, or cloud servise, and sell that. They could make a merch and sell it. They can keep Brave Rewards (and give us option to completely disable it), but instead of using crypto-scam, they could pay users REAL money.

[ArunROG87Razer]

you can always disable services which you dont like from brave using Task Scheduler

[marko30]

True, but I can’t disable Brave VPN inside the browser, otherwise it crashes when I try to open settings.

I can’t disable Brave Rewards and Brave Wallet completely, it’s always there in the browser’s internal pages (Downloads, Bookmarks, Settings, etc.):

And menu…

I can’t disable Brave Search from the incognito tab (it stays there after changing default search engine in the settings):

[ArunROG87Razer]

Brave Rewards and Brave Wallet seems to be the core and DNA of the company…i doubt if whether they will allow option to hide it in browser ui… personally i also dont use crypto, brave wallet…etc but brave search could be useful.

[marko30]

The advertising is the core of Google, yet, they didn’t include ads in the Chrome browser. They even allowed ad blocking extensions in their Chrome WebStore.

Brave Search is worse than Bing. They don’t offer their services in many languages. May only be useful to those in the US, UK, Canada, France and Germany. Anywhere else it’s useless.

[Grimeton]

This is plain wrong. With the next update that you install, all this stuff is being reset to the company’s defaults. So I would have to go over all of this over and over again when an update occured.

And I don’t even know when that happened…

[lflucena]

All the features you mentioned, some are useful if you use them, like we 3, I use this so it’s not “unnecessary”.

Don’t judge a feature unnecessary because you don’t use it.

[marko30]

At least, Web3 can be disabled though.

[lflucena]

[quote]I can’t disable Brave Search from the incognito tab (it stays there after changing default search engine in the settings):

[/quote]

We can define which search engine to be used in either private mode or regular mode through the settings, have you tried that?

[marko30]

That’s on mobile. There you don’t have search engine when you open private tab; on mobile version you only have address bar. I’d like to have the same on desktop.

Because, on desktop version, even if you choose any other search engine for private tab, you’re still greeted with big Brave logo and Brave Search bar (shown in the picture you quoted).

[enesha]

This is true. However disabling services is notreally for the faint of heart, and being consumer focused, tiy shouldn’t be pushing bloat at you, then saying well i you don’t want it…go learn about task manager and services starting and you can “easily” disable what you don’t want. How about giving us an option TO allow something BEFORE it’s installed. Brave doesn’t even give you a heads up when it does this business. You just have to sense the imbalance in the force and set out to discover what is wrong. In the mean itime, what are those services doing? Pinging home, perhaps? Gathering usage telemetry so the company can know what sort of data usage an average user might have over a VPN? HOw do you know when you weren’t even told it was there. I mean something installing itself and doing stuff without your permission…isn’t that really the lowest level definition of a virus?

Please don’t anyone say that the other guys do that, or it’s standard in the industry. You can either bill yourself as the Browser that is not like the others and has your back, or they can say your broswer is middlin in the pack and just doing what everyone else does.

Then there’s the debate over BAT - removing advertising from a website to be replaced with in house ads, that then, if they ask nicely, some websites might be able to get a small taste of that money.

[lflucena]

Even on Desktop you CAN CHOOSE what Search service to use.
This is standard IN ANY browser by the way.

[marko30]

Sure, go ahead. Change the search engine in private window to any other than Brave Search. Then open private window and see the first thing that opens and what the search bar says.

[sampson]

There are quite a few different topics in this thread, but I’d like to focus on the main one (i.e., the introduction of the Brave VPN service). This was a recent development, impacting only a subset of Windows users. The Brave VPN service doesn’t auto-run. In fact, it won’t run unless and until the user signs up for the VPN service, and manually connects.

This update, like all others, went through an arduous security review process by our team before reaching users. Those details aside, we do think there’s a better approach. We’ve been communicating with the community at /brave/brave-browser/issues/33726, and have made progress towards componentizing the services.

[another_user_acount]

@Grimeton

• Brave Elevation Service (Local System) For What? I’m using a browser.
• Brave Update-Service “brave” (Local System) For what? I’m using a browser.
• Brave Update-Service “bravem” (Local System) For what? I’m using a browser.
• Brave VPN Service (Local System) For what? I’m using a browser.
• Brave VPN Wireguard Service (Local System) For what? I’m using a browser.

This is REALLY scary… Why would a web client NEED to install system services with elevated privileges to render web pages? O_O

Spoiler: It doesn’t… There is no need, no point, no necessity, no consent and no logical reason to make a system inherently less secure and increase the attack surface area of your user’s systems.

Security and functionality have finally become forgotten, mythical arts, rife with complacency and ego.

This lack of self-awareness from the devs is just off-putting

[another_user_acount]

@sampson

There are quite a few different topics in this thread

Summarise them all with a list of bullet points, maybe? O_o

@sampson

…an arduous security review process by our team…

Tip: Have an independent feedback panel comprised of informed volunteers from the community who can give you proper user feedback from outside of your echo chamber.

I remember when I used to write code, I always gave it to the person who was least technically proficient to see the things they could get wrong. It’s never good idea to test your own software. The programmer always knows HOW to use the software so give it to someone who doesn’t know how to use it and watch your list of fixes explode. Only when you test your code outside of the circle of ‘those who know’ will you have a properly tested piece of software.

Alternatively, LISTEN to the forum posts that your users are posting for your attention.

Let a web browser be a web browser and a networking utility be a networking utility.

Regardless of current testing, future changes may turn these ‘features’ into liabilities.

If you can’t see how this works, I am sorry for you, but it isn’t good enough for many potential Brave users, or many members of this community.

Giving your users as many choices as you can is just respectful. Anything less is manipulation and lies and what you’re doing is bordering on dictating to your users.

I think you’re avoiding the point… It’s NOT that you’re ‘simply’ making this (inactive, by your own admission) feature available, it’s that it is removing time spent on developing the actual web browser itself, the actual piece of software people are downloading Brave for. Adding other, non-browser functionality, is a liability and a time and trust cost to your users.

Have we not learned ANYTHING about writing decent software in the last 50 years?? Feature creep is a thing and it’s creeping your users out. Simples.

Make the other Brave non-browser ‘features’ separate programs or ‘official’ add-ons.

Do you honestly not see how you’re compromising the web client by shifting focus away to lesser-utilised side projects?

Projects of vanity rarely end well.