https://brave.com/privacy-updates/27-localhost-permission/ [piwik] ||| [ ] [close-icon] * Browser [chevron-ri] [chevron-ri]Main menu Downloads + + Desktop + Android + iOS + Features + + Shields + VPN + Wallet + Rewards + Playlist + News + Talk + Advanced privacy + All features + * Brave Search [chevron-ri] [chevron-ri]Main menu + + Try Brave Search + About Brave Search + Web Discovery Project + Search API + * Why Brave [chevron-ri] [chevron-ri]Main menu + + Browser & search guides [chevron-ri] [chevron-ri]Why Brave o What's the fastest browser for surfing the Web? What's the fastest browser for surfing the Web? In this article, we look at the fastest web browser and discuss some of the factors that affect browser speed, including the browser engine and javascript engine. o What are the best private browsers to protect your online privacy? What are the best private browsers to protect your online privacy? Many users rely on private browsers to keep their Internet habits away from prying eyes. But with so many options out there, what's the best private browser for you? In this article we examine the choices. o What's the most secure browser? What's the most secure browser? In this article, we'll define what makes a secure browser, and look at some of the best secure browsers available today. See all Articles [chevron-ri] + Web3 guides [chevron-ri] [chevron-ri]Why Brave o What is Web3? What is Web3? Web3 is a whole new philosophy for how the Web should be managed and how users should access it. It's based on a version of the Internet that is decentralized and uses public blockchains to function. In this article, a primer on the fundamentals of Web3. o What kinds of DApps are being built on Web3? What kinds of DApps are being built on Web3? Web3 relies on new technologies. You may have started to hear a lot more about blockchains, nodes, cryptocurrency and wallets recently? In this article, we'll explain what these core terms have to do with DApps, the decentralized applications that are core to Web3. o An intro to blockchain and the technology that's powering Web3 An intro to blockchain and the technology that's powering Web3 Blockchains, Nodes, Cryptocurrency, Wallets... In this article, we'll define some core Web3 terms, and scratch the surface of decentralized technologies. See all Articles [chevron-ri] + Privacy glossary [chevron-ri] [chevron-ri]Why Brave o Privacy Privacy In the context of computing, privacy means that your personal data isn't seen by anyone whom you don't want to see it, and isn't used by ... o Security Security Computer security is the protection of computing devices, networks, and data from external threats. o Browser Browser A browser (or Web browser) is an app for your computer, tablet, or smartphone that lets you look at and interact with websites. The browser ... See all Terms [chevron-ri] + Compare + Blogs + + Brave blog [chevron-ri] [chevron-ri]Why Brave o Brave browser now features vertical tabs for desktop users, maximizing on-screen space Brave browser now features vertical tabs for desktop users, maximizing on-screen space o Brave releases its Search API, bringing independence and competition to the search landscape Brave releases its Search API, bringing independence and competition to the search landscape o Brave Talk adds token-gating with NFTs to enable Web3 calls Brave Talk adds token-gating with NFTs to enable Web3 calls See all Articles [chevron-ri] + Privacy updates [chevron-ri] [chevron-ri]Why Brave o Localhost Resource Permission Starting in version 1.54, Brave for desktop and Android will include more powerful features for controlling which sites can access local ... o Request "Off the Record" Request OTR is another in Brave's suite of features that support the privacy needs of individual users, protecting far beyond the "standard" ... o Forgetful Browsing Forgetful Browsing is similar to, but more powerful and protective than, popular browsing extensions and private browsing modes. It's ... See all Articles [chevron-ri] + Web standards [chevron-ri] [chevron-ri]Why Brave o First-Party Sets: Tearing Down Privacy Defenses Just as They're Being Built Google is proposing a feature called "First-Party Sets," which would have browsers reduce privacy barriers between sites. This is both ... o Google's Topics API: Rebranding FLoC Without Addressing Key Privacy Issues The Topics API does not address the core harmfulness of FLoC: that it's arrogant and dangerous for Google to be the arbiter of what users ... o Privacy And Competition Concerns with Google's Privacy Sandbox The UK CMA (along with other regulators and web activists) are largely evaluating Google's Privacy Sandbox as an isolated, independent set ... See all Articles [chevron-ri] + Research [chevron-ri] [chevron-ri]Why Brave o FrodoPIR: Simple, Scalable, Single-Server Private Information Retrieval We design FrodoPIR -- a highly configurable, stateful, single-server Private Information Retrieval (PIR) scheme that involves an offline ... o Pool-Party: Exploiting Browser Resource Pools for Web Tracking We identify class of covert channels in browsers that are not mitigated by current defenses, which we call "pool-party" attacks. Pool-party ... o Tango or Square Dance? How Tightly Should we Integrate Network Functionality in Browsers? The question at which layer network functionality is presented or abstracted remains a research challenge. Traditionally, network ... See all Papers [chevron-ri] + * Get help [chevron-ri] [chevron-ri]Main menu + + Help center [chevron-ri] [chevron-ri]Get help o Browser support Get help with the Brave browser. o Help center home Find quick help with anything related to Brave or its products and features. o Rewards support Find answers for common Brave Rewards issues, including earnings and payout questions. See all Help articles [chevron-ri] + Community [chevron-ri] [chevron-ri]Get help o Community home Get help with Brave features, and connect with other Brave users. o Feature requests Request new features or changes to existing ones, and get community up-votes. + Release notes [chevron-ri] [chevron-ri]Get help o Android See what's new in the latest version of the Brave app for Android. o Desktop See the latest desktop changes for macOS and Windows. o iOS See what's new in the latest version of the Brave app for iOS. See all Release notes [chevron-ri] + What's new in Brave? + App status + * Private advertising [chevron-ri] [chevron-ri]Main menu + + Overview + Self-serve ads + Audience + Ad formats [chevron-ri] [chevron-ri]Private advertising o Newsfeed ads Build consideration for products or services through content-adjacent ads in Brave News, a fully private news reader in every Brave Browser. ... o Search ads Brave Search is the fastest-growing search engine since Bing, with over 6.5 billion annualized searches. Redefine your search marketing ... o New tab takeover New tab takeovers are like a digital billboard: Big. Eye catching. And effective. They reach large audiences in a short time, and drive real ... o Notification ads Notification ads feature a title and short CTA; clicks drive users to the advertiser's desired landing page. Ads are served over content at ... See all Ad formats [chevron-ri] + Case studies [chevron-ri] [chevron-ri]Private advertising o Verizon R/GA Verizon R/GA Achieved 23.8 million ad views, 8% blended CTR, 57% 10+ second landing visits, and over 1000 Tweets o Dentsu Dentsu Engaging the New 'Ad Chooser': A co-authored whitepaper from Brave Software and dentsu international o eToro eToro Realized 230% increase in new customer registrations and achieved a CTR of 13.8% See all Case studies [chevron-ri] + Podcast [chevron-ri] [chevron-ri]Private advertising o Live from Consensus! Gamifying your Identity and Next Gen Privacy Implications Live from Consensus! Gamifying your Identity and Next Gen Privacy Implications Danny Wright (Chief Brand Officer) and Eddie Satterly (Chief Technology Officer) ... o Ways that Cannabis and Web3 Can Come Together Ways that Cannabis and Web3 Can Come Together Robert Lund, Co-Founder and Chief Creative Officer at Studio TBD, discusses ... o Increasing Ad Efficiency and Performance of Your Advertising Strategy Increasing Ad Efficiency and Performance of Your Advertising Strategy Will Haire, Co-Founder of BellaVix, shares the tactics they're currently ... See all Episodes [chevron-ri] + Advertiser resources [chevron-ri] [chevron-ri]Private advertising o Sales One-Sheet Available ad units and high-level information about the Brave Ads platform. o Brave Ads Gallery A gallery of high impact New tab takeovers from top brands using Brave. See all Resources [chevron-ri] + Download Brave Try Brave Search Brave Software home Download Brave Try Brave Search Privacy updates Localhost Resource Permission By the Brave Privacy Team Last updated Jun 27, 2023 [icon-arrow] See all articles Table of Contents * What are localhost resources, and why might sites want to access them? * How does this change affect how websites can access localhost resources in Brave? * How do other browsers handle connections to localhost resources? * What's next for localhost resource handling in Brave? This is the 25th post in an ongoing, series describing new privacy features in Brave browsers. This post describes work done by Sr. Research and Privacy Engineer Shivan Sahib. This post was written by Peter Snyder. A browser prompt asking the user if they would like to grant access to localhost resources Starting in version 1.54, Brave for desktop and Android will include more powerful features for controlling which sites can access local network resources, and for how long. Most popular browsers allow websites to access local network resources without protection or restriction, which puts users' privacy and security at risk. Many popular websites query your local network, often as a fingerprinting technique; others do so to observe and possibly exploit information from other software running on your machine. Brave is the first popular browser to extend the Web's permission API to control when sites can access localhost resources. Brave's implementation allows advanced users to give any site access to localhost resources, while also avoiding the annoyance of prompts that a localhost request is likely malicious. Brave's implementation also takes advantage of existing improvements Brave has made to Web permissions. What are localhost resources, and why might sites want to access them? "Localhost resources" is a broad term that refers to resources (images, web pages, etc.) that websites can access, but which don't come from the "Web." Instead, these resources are hosted (often unknowingly) by other software on your computer. Surprising though it may be, most browsers allow websites to access these local resources just as easily as they can access other resources on the Web. Browsers allow websites to access localhost resources for a range of reasons, but the main two reasons are historical legacy (i.e. it's always been done this way) and backwards compatibility. Browsers used to be less concerned about user privacy, and so didn't enforce distinctions between first-party resources (those hosted by the site you're visiting), third-party resources (those hosted on other public websites), and localhost resources. Thanks to this historical "accident," a small but important amount of software has been built expecting to be freely accessible by websites, often in ways invisible to users. And many of these uses are benign. Examples include some wallets for cryptocurrencies, security software provided by banks or security companies, and hardware devices that use certain Web interfaces for configuration. In some situations, browsers also allow public websites to access localhost resources to help developers test their software. Unfortunately, a wide range of malicious, user-harming software on the Web uses access to localhost resources for malicious reasons. For example, fingerprinting scripts try to detect unique patterns in the other software you have running on your device to re-identify you, and other scripts try to identify insecure and vulnerable software on the machine and try to exploit it. How does this change affect how websites can access localhost resources in Brave? Brave is the only popular browser to ship multiple protections against sites maliciously accessing localhost resources. Brave currently uses filter list rules to: * Block scripts known to maliciously scan localhost resources * Block requests from public sites to localhost resources This is in contrast to other browsers, which generally ship no protections against sites accessing localhost resources (see the next section for some caveats). Brave will soon start rolling out a new approach for protecting users against sites abusing local network resources. This new system will have the following parts: * Requests to localhost resources, from a localhost context are allowed automatically; Brave does not block a locally hosted page from accessing other locally hosted resources. ^1 * Brave will continue to use filter list rules to block scripts and sites known to abuse localhost resources. * Brave will include a new permission called the "localhost" permission. Only sites with this permission will be able to make sub-resource requests to localhost resources. By default, no sites have this permission and, importantly, most sites have no way to prompt users for this permission. However, advanced users can use the existing site settings interface to grant sites this permission. ^2 * Brave will also include a list of trusted sites, or sites known to access localhost resources for user-benefiting reasons. The first time a site on this list initiates a sub-request to a localhost resource, it will trigger a permission prompt of the previously mentioned localhost permission. This list is publicly available, and will be maintained by Brave. Brave has chosen to implement the localhost permission in this multistep way for several reasons. Most importantly, we expect that abuse of localhost resources is far more common than user-benefiting cases, and we want to avoid presenting users with permission dialogs for requests we expect will only cause harm. Additionally, we're purposely inserting a permission prompt into a situation where sites won't expect it (or even realize third-party scripts are trying to access localhost resources), and so we want to further limit the permission prompt to situations where we expect it's beneficial to users and sites alike. How do other browsers handle connections to localhost resources? As mentioned, most other browsers do not significantly prevent websites from accessing localhost resources. The desktop versions of Firefox and Chrome allow both secure and insecure public sites to access localhost resources, and seem to intend to allow public secure sites to access localhost resources indefinitely. As a side-effect of security restrictions, Safari currently blocks requests to localhost resources (as do other WebKit browsers) from secure public websites. But to the best of our understanding, Safari does not explicitly intend to block these requests from public websites. As far as we can tell, Brave is the only browser that will block requests to localhost resources from both secure and insecure public sites, while still maintaining a compatibility path for sites that users trust (in the form of the discussed localhost permission). What's next for localhost resource handling in Brave? We're excited to share this work with Brave users, and expect it to make the Brave browser even more powerful without harming user privacy. However, there's more work to be done to improve how browsers handle localhost resources. First, we're exploring ways to better explain to users what localhost resources are, while they're using Brave. Once we're confident we've found a way of explaining what the permission controls that non-advanced users can understand, we plan on making the permission available to all sites, and not only those on our list. Second, we're pushing these protections deeper in the network stack, so that Brave can protect users against additional, less common methods of sites making localhost requests (including DNS records that refer to localhost). We also hope to have more to share soon. Third, we're interested in unifying and expanding how we can apply permissions (or permissions-like controls) to network requests in general. Brave already applies permissions protections to Google login requests that require third-party cookies, and we're interested in seeing what other similar uses make sense. The main difficulty here is applying an asynchronous permission model to requests that are often made with synchronous expectations. Again, we're exploring several options, both within Brave and with external researchers, and hope to have more to share soon. --------------------------------------------------------------------- 1. Brave's localhost protections do not apply to aliases the user may have installed for localhost, such as in /etc/hosts. See the final section of this blog post for more details. -[?] 2. On Desktop, users can grant sites the localhost permission at brave://settings/content/localhostAccess. Android users can do the same by visiting Settings > Site settings > Localhost Access. -[?] Related articles Request "Off the Record" Request OTR is another in Brave's suite of features that support the privacy needs of individual users, protecting far beyond the "standard" threats browsers typically watch out for. Read this article - Forgetful Browsing Forgetful Browsing is similar to, but more powerful and protective than, popular browsing extensions and private browsing modes. It's another example of Brave offering the most powerful privacy features of any popular browser. Read this article - "Google Sign-In" Permission Starting in version 1.51, Brave will increase user privacy by extending the brower's permission system to cover legacy Google Sign-In... Read this article - Ready to Brave the new internet? Brave is built by a team of privacy focused, performance oriented pioneers of the web. Help us fix browsing together. Download Brave Download Brave Resources * Merch Store * F.A.Q * Help center * Community * Status * Transparency report * Learn Privacy policy * Brave Browser * Website & email * Publishers & creators * Advertisers * CCPA Browser * Desktop * Android * iOS * Linux * Beta * Nightly Company * About * Research * Careers * Brand assets * Ads audience * Ad formats * GitHub * Blog * Tor Onion address Social media * Reddit * Twitter * Mastodon * Facebook * YouTube Products * Search * Rewards * Wallet * Firewall + VPN * Talk * News * Playlist * All features * Basic Attention Token Contact Support community.brave.com Advertising adsales@brave.com Please only use this email address if you are interested in purchasing advertising with Brave. For support, please visit community.brave.com. Business bizdev@brave.com Press press@brave.com Developer docs * Wallet docs Creators * Overview * Creators media kit Offices Brave San Francisco 580 Howard St. Unit 402, San Francisco, CA 94105 Choose a language [English] Brave Software home Terms of use | Report a security issue (c) 2015 - 2023 Brave Software, Inc. | All rights reserved close close Almost there... You're just 60 seconds away from the best privacy online If your download didn't start automatically, click here. 1. Download Brave Click "Save" in the window that pops up, and wait for the download to complete. Wait for the download to complete (you may need to click "Save" in a window that pops up). 2. Run the installer Click the downloaded file at the bottom left of your screen, and follow the instructions to install Brave. Click the downloaded file at the top right of your screen, and follow the instructions to install Brave. Click the downloaded file, and follow the instructions to install Brave. 3. Import settings During setup, import bookmarks, extensions, & passwords from your old browser. Need help? Get better privacy. Everywhere! Download Brave mobile for privacy on the go. Apple App Store button Play Store button Download QR code Get better privacy. Everywhere! Download Brave mobile for privacy on the go. Apple App Store button Play Store button Download QR code Brave logo Click this file to install Brave [arrow-down] [arrow-down] Click this file to install Brave Brave logo 12345