Brave New Privacy Feature Limit Access to Local Resources

Brave version of 1.54 for desktop and Android will include more powerful features for controlling which sites can access local network resources and for how long.

Malicious requests from websites to access local host resources act as a fingerprinting technique which concerns users’ privacy and security at risk.

The conventional desktop version of web browsers like Chrome, safari, firefox, Mozilla, etc., allows secure and nonsecure public sites to access your local host resources.

Local host resources are nothing but images and web pages that are hosted by other software on your local machine.

Reason to Access Local Host Resources:

Browsers allow websites to access localhost resources for various reasons, but the main two reasons are historical legacy and backward compatibility.

Generally, browsers did not strictly enforce the distinctions between first-party resources (those hosted by the website you’re visiting), third-party resources (those hosted on other public websites), and local-host resources due to a decreased concern for user privacy.

Due to this vulnerability, a significant amount of software has been created to be freely accessible via websites that are invisible to users.

And many of these uses are acceptable. Examples include specific cryptocurrency wallets, security software offered by banks or security firms, and gear whose configuration uses specific Web interfaces.

Unfortunately, a large variety of harmful, user-harming software on the Internet makes use of access to local-host resources for illicit purposes. 

To re-identify you, for instance, fingerprinting scripts look for specific patterns in the other software you have operating on your device. 

Other scripts look for weak or susceptible software on the system and attempt to attack.

About Brave:

Unlike other browsers, Brave puts you in control of your data. The secure browser automatically blocks trackers and unwanted ads while also providing anti-phishing and anti-malware protection.

Brave is the only popular browser to ship multiple protections against sites maliciously accessing localhost resources. Brave currently uses filter list rules to:

• Block scripts are known to maliciously scan localhost resources
• Block requests from public sites to localhost resources

Brave has developed a new approach for protecting users against sites abusing local network resources. This new system will have the following parts:

• Requests to localhost resources from a localhost context are allowed automatically; Brave does not block a locally hosted page from accessing other locally hosted resources.
• Brave will continue to use filter list rules to block scripts and sites known to abuse localhost resources.
• Brave will include a new permission called the “localhost” permission. Only sites with this permission will be able to make sub-resource requests to local-host resources. By default, no sites have this permission, and, importantly, most sites have no way to prompt users for this permission. However, advanced users can use the existing site settings interface to grant sites this permission. 
• Brave will also include a list of trusted sites, or sites known to access localhost resources for user-benefiting reasons. The first time a site on this list initiates a sub-request to a localhost resource, it will trigger a permission prompt of the previously mentioned localhost permission. This list is publicly available and will be maintained by Brave.

Furthermore, Brave enhances its protections deeper in the network stack, so that Brave can protect users against additional, less common methods of sites making localhost requests (including DNS records that refer to localhost).

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.