https://brave.com/privacy-updates/17-language-fingerprinting/ ||| [ ] [close-icon] * Browser [chevron-ri] [chevron-ri]Main menu Downloads + + Desktop + Android + iOS + Linux + Beta release + Nightly release + All downloads + Compare + + Brave vs. Chrome + * Products [chevron-ri] [chevron-ri]Main menu + + Search + Rewards + Wallet + Firewall + VPN + Talk + News + Playlist + All browser features + Basic Attention Token + * Privacy [chevron-ri] [chevron-ri]Main menu + + Why Brave? + Learn [chevron-ri] [chevron-ri]Privacy o [secure-bro] What's the most secure browser? In this article, we'll define what makes a secure browser, and look at some of the best secure browsers available today. o [private-br] What's the best private browser? Many users rely on private browsers to keep their Internet habits away from prying eyes. But with so many options out there, what's the best private browser for you? In this article we examine the choices. o [fastest-br] What's the fastest browser for surfing the Web? In this article, we look at the fastest web browser and discuss some of the factors that affect browser speed, including the browser engine and javascript engine. See all Articles [chevron-ri] + Brave Shields + Advanced privacy + Privacy updates [chevron-ri] [chevron-ri]Privacy o De-AMP: Cutting Out Google and Enhancing Privacy Brave is rolling out a new feature called De-AMP, which allows Brave users to bypass Google-hosted AMP pages, and instead visit the ... o Protecting Against Browser-Language Fingerprinting Brave has further strengthened its fingerprinting protections by preventing users from being identified based on preferred browser language. ... o "Unlinkable Bouncing" for More Protection Against Bounce Tracking Brave is shipping a new, powerful privacy-protecting feature called Unlinkable Bouncing. This feature protects your privacy by noticing when ... See all Articles [chevron-ri] + Web standards + Brave's privacy policy + * Resources [chevron-ri] [chevron-ri]Main menu Blog + + Latest news [chevron-ri] [chevron-ri]Resources o [featured] NEAR Foundation and Brave announce partnership to integrate Aurora, an Ethereum Virtual Machine (EVM) on the NEAR protocol, into Brave Wallet o [featured] Brave Welcomes 6 Leading DApps to its new Wallet Partner Program o [featured] Brave's use of Direct Mailers See all Articles [chevron-ri] + Our research + Help center + + Help center home + Browser support + Rewards support + Community + + Community home + Feature requests + Release notes + + Desktop + iOS + Android + * Business [chevron-ri] [chevron-ri]Main menu + + Overview + Ads media kit + Case studies [chevron-ri] [chevron-ri]Business o [logo-veriz] Verizon R/GA Achieved 23.8 million ad views, 8% blended CTR, 57% 10+ second landing visits, and over 1000 Tweets. o [logo-dents] Dentsu Engaging the New 'Ad Chooser': A co-authored whitepaper from Brave Software and dentsu international o [logo-etoro] eToro Realized 230% increase in new customer registrations and achieved a CTR of 13.8% See all Case studies [chevron-ri] + Podcast [chevron-ri] [chevron-ri]Business o [logo-Cega] Understanding Exotic Options and Marketing Tactics for a Mainnet Launch Winston Zhang, Co-founder at Cega, shares how they're preparing for their ... o [Logo-AvaLa] Experiential Marketing and Making Crypto Events More Memorable Jay Kurahashi-Sofue, VP of Marketing at Ava Labs, discusses how his team ... o [logo-eToro] How eToro is Making Crypto Trading More Social Brad Michelson, Head of US Marketing team at eToro, discusses the unique social ... See all Episodes [chevron-ri] + Advertiser resources [chevron-ri] [chevron-ri]Business o Sales One-Sheet Available ad units and high-level information about the Brave Ads platform. o Sponsored Image Guidelines Sponsored Image ad unit specifications, dimensions, and requirements. o Brave Ads Gallery A gallery of high impact Sponsored Images from top brands using Brave. See all Resources [chevron-ri] + Creators + + Overview + Creators media kit + Download Brave Try Brave Search Brave Software home Download Brave Try Brave Search Privacy Updates Protecting Against Browser-Language Fingerprinting By the Brave Privacy Team [icon-arrow] See all articles Table of Contents * Summary * How trackers use your language preferences to violate your privacy * How Brave defends against Accept-Language fingerprinting * How Brave defends against font fingerprinting * What to do if you need to share more language preferences with sites * Comparison With Other Browsers Last updated Apr 1, 2022 This is the seventeenth post in an ongoing series describing new and upcoming privacy features in Brave. This post describes work done by Senior Software Engineer Mark Pilgrim, with help from Principal Engineer Brian Johnson, and was written by Senior Privacy Director Peter Snyder. Summary Brave has further strengthened its fingerprinting protections by preventing users from being identified based on preferred browser language. Starting with version 1.39, Brave randomizes how your browser informs sites of what language(s) you've set as default, and what fonts you have installed on your system. This expands Brave's existing fingerprinting protections, already the strongest of any popular browser. How trackers use your language preferences to violate your privacy When you visit a website, your browser needs to tell that site your default language(s). This helps the site present content in a language you can understand. Browsers do this both explicitly (for example, with the Accept-Language header, and the navigator.language and navigator.languages Web APIs) and implicitly (for example with the fonts you have installed on your system). However, as with so much online, features meant to improve your experience often just expose you to more risk. In this case, trackers can use your language preferences (both implicit and explicit) to fingerprint you, identifying you across sites and browsing sessions. Brave's unique "farbling" features already provide the best fingerprinting protections of any popular browser. These add small amounts of randomization into identifying browser features--enough to confuse and defeat trackers, but not so much that they break sites. With this latest release, Brave has expanded "farbling" protections to language preferences, too. How Brave defends against Accept-Language fingerprinting The Accept-Language HTTP header tells websites your preferred language(s). If you've configured your computer or browser to prefer multiple languages, the header typically conveys all of those preferences, in the order you've selected. The browser also includes a "weight" with each preference, which expresses how much you prefer one language over another. For example, if you've set your browser to say "I prefer to read websites in English, but if that's not available, Spanish is fine too," your browser might express this in the header as: Accept-Language: en;q=.7,es;q=.5 This information is then sent with every request your browser makes on the Web. The browser exposes similar information to JavaScript running on pages through the navigator.language and navigator.languages properties. Integration with Shields With these new protections against browser-language fingerprinting, Brave now reduces and randomizes the information available in these APIs. And we've incorporated these as default protections, via Brave Shields. By default, Brave will only report your most preferred language. So, if your language preferences are "English (United States)" first, and Korean second, the browser will only report "en-US,en."^1 Brave will also randomize the reported weight (i.e., "q") within a certain range. If fingerprinting protections have been set to Strict, Brave will instead always report the language preference as "English," which ensures the largest available anonymity set^2. And here, too, Brave will randomize the reported weight (i.e., "q") within a certain range. How Brave defends against font fingerprinting In general, fonts can be split into three categories: * Web Fonts: Fonts included by a website, for use on that website. Since they don't come from the user, web fonts aren't useful as a method of fingerprinting. * OS Fonts: Fonts installed by the operating system, and common to all users of that operating system. Since trackers can already learn what operating system you're using (e.g. user agent string, JS APIs, etc.), exposing these fonts usually doesn't impact privacy (though installing multiple sets of fonts for different languages can increase the likelihood of fingerprinting). * User Fonts: Additional fonts installed by the user, either directly (downloading and installing a font from a website) or indirectly (because other software on your computer has installed fonts, e.g. office suites, presentation editing tools, or image editing software). These are most useful for fingerprinting. Trackers also identify users by checking for uncommon fonts, or fonts that aren't commonly paired together. These distinguishing fonts may be installed because of language preference--either as something you've installed directly, or something your operating system installed. For example, if you tell Windows you prefer Hebrew and Malaysian, Windows will install additional fonts for those languages. A tracker could then use these data points to identify you, because only a fraction of Web users will have that combination of fonts. Currently Brave applies font fingerprinting protections on Android, macOS, and Windows versions. Brave does not apply these protections to iOS versions for two reasons: platform restrictions prevent us from doing so; and WKWebView already includes similar, although not quite as strong, protections^3. Brave does not apply these protections on Linux because of difficulties in determining which fonts are "OS fonts" for each distro. Note that it's also possible to have uncommon fonts installed for reasons unrelated to language preference. For example, some software packages (e.g. office suites, slide and photo editing tools, etc.) will add additional fonts to the system. And sometimes people install additional fonts on their own. Integration with Shields In both default and aggressive configurations, Brave will allow websites to access all Web fonts, OS fonts for your current top language preference, and a randomly selected (i.e. farbled) set of user fonts. As with all of Brave's fingerprint randomization protections, the set of user fonts the page can access is randomly determined for each site and for each browser session; a site will always be able to access the same fonts during the same browser session. What to do if you need to share more language preferences with sites While we expect the above protections to serve the vast majority of users, we appreciate that some users will need to share more detailed information with sites about their language preferences. For example, you may speak a language that's not well supported by standard operating systems fonts, and so may be part of a linguistic community that relies on additional, user-installed fonts to browse the Web. In cases like this, the benefits of sharing additional language preferences with websites may outweigh the privacy risk. To support these users, and to ensure everyone can use Brave for safe, private browsing, we've also taken the following steps: * Increased User-Controls: Brave users who wish to share more information about their language preferences with websites can easily configure Brave to do so. Users can disable the font / language protections by visiting brave://settings/shields and toggling off Reduce the identifiability of my language preferences. * Flexibility: Brave will monitor the rollout of these new protections, first for Nightly, then Beta, and eventually stable users. If we learn of compatibility issues on sites, we may modify these features, to make sure Brave's protections don't break sites. Comparison With Other Browsers Though Brave has the strongest privacy protections of any popular browser, other browsers are also taking important and laudable steps to protect user privacy. Below is a brief summary of the protections other browsers provide against language-targeting fingerprinting. * Safari: Provides protections most similar to Brave's. Safari will report only a user's top language preference to websites in Accept-Language and navigator.languages, and will allow sites to access only OS provided fonts for the user's current language preference. The main differences between Brave and Safari are: Brave also slightly randomizes data sources to further confuse trackers; and Brave includes the ability to disable these protections. * Firefox: Provides some protections against browser-language fingerprinting, though these are disabled by default. If a user enables Firefox's resist fingerprinting feature, Firefox will similarly restrict the fonts a website can access. * Chrome and Edge: Provide no protections against browser-language fingerprinting, though both are considering including such fingerprinting efforts as part of the Privacy Budget proposal (a proposal about which Brave has serious concerns). --------------------------------------------------------------------- 1. Apple's Safari browser also reports only the most preferred language. -[?] 2. The Tor Browser also reports only English. -[?] 3. Brave on iOS is built on WKWebView; Apple does not permit us to use our own rendering engine. -[?] Related articles De-AMP: Cutting Out Google and Enhancing Privacy Brave is rolling out a new feature called De-AMP, which allows Brave users to bypass Google-hosted AMP pages, and instead visit the content's publisher directly. Read this article - "Unlinkable Bouncing" for More Protection Against Bounce Tracking Brave is shipping a new, powerful privacy-protecting feature called Unlinkable Bouncing. This feature protects your privacy by noticing when you're about to visit a privacy harming site, and instead routes that visit through a new, temporary browser storage. Read this article - Grab Bag 3: Fixing Pool-Party, Improving Fingerprinting Protections, More Debouncing, and Less Chromium Brave continues to ship the most aggressive and broad privacy protections available in any popular browser. Starting in Brave 1.35, Brave includes protections against all known practical forms of "pool-party" attacks. Read this article - Ready to Brave the new internet? Brave is built by a team of privacy focused, performance oriented pioneers of the web. Help us fix browsing together. Download Brave Resources * F.A.Q * Help center * Community * Status * Transparency report * Learn * Insights Privacy policy * Brave Browser * Website & email * Publishers & creators * Advertisers Product * Brave Release * Brave Beta * Brave Nightly Company * About * Research * Careers * Brand assets * Media kit * In the press * GitHub * Blog * Tor Onion address Social media * Reddit * Twitter * Facebook * YouTube Developer docs * Wallet docs Contact Support community.brave.com Advertising adsales@trybrave.com Please only use this email address if you are interested in purchasing advertising with Brave. For support, please visit community.brave.com. Business bizdev@brave.com Press press@brave.com Offices Brave San Francisco 580 Howard St. Unit 402, San Francisco, CA 94105 Choose a language [English] Brave Software home Terms of use | Report a security issue (c) 2015 - 2022 Brave Software, Inc. | All rights reserved close close Almost there... You're just 60 seconds away from the best privacy online If your download didn't start automatically, click here. 1. Download Brave Click "Save" in the window that pops up, and wait for the download to complete. Wait for the download to complete (you may need to click "Save" in a window that pops up). 2. Run the installer Click the downloaded file at the bottom left of your screen, and follow the instructions to install Brave. Click the downloaded file at the top right of your screen, and follow the instructions to install Brave. Click the downloaded file, and follow the instructions to install Brave. 3. Import settings During setup, import bookmarks, extensions, & passwords from your old browser. Need help? Get better privacy. Everywhere! Download Brave mobile for privacy on the go. Apple App Store button Play Store button Download QR code Get better privacy. Everywhere! Download Brave mobile for privacy on the go. Apple App Store button Play Store button Download QR code Brave logo Click this file to install Brave [arrow-down] [arrow-down] Click this file to install Brave Brave logo [piwik]