Brave advances browser privacy with Tor-powered tabs

Onion routing is the way to go. It's all about the layers of encryption.

Stephen Shankland principal writer
Stephen Shankland has been a reporter at CNET since 1998 and writes about processors, digital photography, AI, quantum computing, computer science, materials science, supercomputers, drones, browsers, 3D printing, USB, and new computing technology in general. He has a soft spot in his heart for standards groups and I/O interfaces. His first big scoop was about radioactive cat poop.
Expertise processors, semiconductors, web browsers, quantum computing, supercomputers, AI, 3D printing, drones, computer science, physics, programming, materials science, USB, UWB, Android, digital photography, science Credentials
  • I've been covering the technology industry for 24 years and was a science writer for five years before that. I've got deep expertise in microprocessors, digital photography, computer hardware and software, internet standards, web technology, and other dee
Stephen Shankland
5 min read
Tor is an "onion-routing"network that protects your privacy online.

Tor is an "onion-routing"network that protects your privacy online.

Tor Project

Want more online privacy? Brave, the ad-blocking browser, has a new way to get it on the web.

A new version of the browser released Thursday adds technology called onion routing from the Tor Project as an option to its private tabs. Tor helps keep you anonymous by shuttling your internet communications a network of computers that obscures your true address on the internet, making it much harder for a website to know you visited.

Watch this: Brave browser gets more private with Tor

You might think the Tor Project is the kind of thing that appeals mostly to criminals, tinfoil-hat paranoids and spies. Indeed, the US Naval Research Laboratory came up with the onion-routing technology,  and the project says, "A branch of the US Navy uses Tor for open-source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently."

But as the Facebook scandal over Cambridge Analytica's data harvesting has shown, privacy is something ordinary people are concerned about, too.

"This is not a blip. You're seeing a rising consciousness about privacy," said Brave Chief Executive Brendan Eich. "We're playing a long game here. We're putting energy on the side of privacy, and part of that involves energy on the hard case. Tor is the hard case."

The feature, first reported by CNET a year ago and officially called private tabs with Tor, is built into Brave 0.23. The official Brave 1.0 is due to ship this year, but 2.8 million people already use the browser monthly, Eich said. To use the new feature, you can either select "New Private Tab with Tor" from the file menu or flip on the Tor switch once you've opened a new private tab. Using Tor on one tab doesn't affect other ordinary or private tabs.

Tor has downsides. It's significantly slower, some websites won't work properly and others will present themselves to you in a foreign language because of how Tor disguises your true location. And some network-monitoring software mistakes Tor traffic for an automated attack, periodically requiring Tor users to prove they're human with a Captcha. And of course if you need to log into a website to use it, as with Facebook or Twitter, the site of course will know who you are.

Brave private tabs powered by Tor can be invoked from the file menu, the new-tab "+" menu or a switch on the page of a new private tab.

Brave private tabs powered by Tor can be invoked from the file menu, the new-tab "+" menu or a switch on the page of a new private tab.


But Tor can be worth it. Among those potentially interested -- along with intelligence agents -- are activists fearing surveillance by oppressive governments, people trying to bypass censors, anyone wishing to give law enforcement or journalists a truly anonymous tip, businesspeople trying to avoid revealing details about their company's computer systems while traveling, shoppers trying not to reveal indications of what they might want to buy, and people who just don't their internet service provider to know and potentially sell information about what websites you visit.

More Tor-powered browser choices

Tor offers its own browser, a product based on Mozilla's open-source Firefox, but Brave is the first conventional browser to have Tor abilities built in. It won't be the last, though. Mozilla tightened its alliance with Tor in 2016 through a project called Tor Uplift, and now it's also begun headed down a similar path as Brave with Project Fusion.

A 1997 paper from the US Naval Research Laboratory describes how onion routing protects data with multiple layers of encryption as it's sent over a network.

A 1997 paper from the US Naval Research Laboratory describes how onion routing protects data with multiple layers of encryption as it's sent over a network.

Screenshot by Stephen Shankland/CNET

"We decided to strengthen our collaboration by integrating Tor functionality directly into Firefox," said Peter Dolanjski, a Firefox product manager. "This collaboration brings two benefits: it speeds up development for Tor and also allows Firefox to bring cutting-edge privacy enhancing technology to more users."

Mozilla says it's too early to know when the project will bear fruit. But Brave's Tor support is here now -- although in a testing stage to try  to find problems and patch known privacy leaks compared to Tor's better-tested browser.

"We're honest about the fact that we're not the Tor browser. It has a much higher level of security testing," said Brave Chief Information Security Officer Yan Zhu. "If you're using it because your life depends on it, you should be using Tor and not Brave with Tor tabs."

The Tor-augmented private tabs in Brave are available only in the versions for Windows, MacOS and Windows personal computers, but Brave plans to bring it to its browsers for Apple iPhones and for phones powered by Google's Android software.

Building a better private tab

You may think from the icons some browsers use for private tabs -- a mask for Mozilla's Firefox, a spy hat and sunglasses for Google's Chrome -- that browsers keep your identity secret with their private-browsing modes.

Thousands of relay servers constitute the Tor network.
Enlarge Image
Thousands of relay servers constitute the Tor network.

Thousands of relay servers constitute the Tor network.

Tor Project

But websites can still track you to some degree, most notably by logging your Internet Protocol address, the number your computer uses to send and receive data. That reveals a lot of information to prying eyes.

"Studies show that users expect private tabs prevent things like ISPs tracking them or other people on Wi-Fi tracking them," but in fact ordinary private tabs don't, Zhu said. "Tor private tabs bring private tabs much closer to what the user expects private tabs to do."

Tor, which originally stood for The Onion Router, is named for a way to protect information being sent over a network. When your browser makes a request to download a webpage with Tor, the request is encrypted multiple times for a journey that detours through three servers called relays.

Each relay strips away a layer of onion skin, so to speak, to get further instructions about where to send the data. Each relay knows the addresses of the computers only one step to either side along the communication path. That means the final relay -- called an exit relay -- doesn't know your original internet address as it communicates with the website.

Not only that, but Tor changes the pathway every 10 minutes.

New traffic jams on the Tor network?

Tor is already somewhat sluggish, though Eich says it's improved dramatically over the last year. There's a risk, though, that new traffic from Brave will slow it further.

Brave browser logo
Brave Software

Brave, though, has added four of its own Tor relays to the network and plans to add more, Zhu said.

"Tor doesn't want us to run a lot of relays. They want to have network diversity," she said. But Brave also could donate to an organization that runs a pool of Tor relays. "Ideally we would contribute more than enough bandwidth."

The Tor Project itself welcomes the company.

Private tabs with the Tor technology "will provide better protections to Brave users against network surveillance, making it more difficult for ISPs, employers or guest Wi-Fi providers to track and subsequently sell user data," the project said in a statement. "It's good to see more mainstream browsers taking an interest in trying to meet people's privacy expectations."

Tech Enabled: CNET chronicles tech's role in providing new kinds of accessibility.

Follow the Money: This is how digital cash is changing the way we save, shop and work.