Brave browser adds email aliases to help users evade tracking

The Brave browser 1.94 release adds an 'Email Aliases' feature that allows users to create disposable email addresses for signing up on websites, thereby hiding their real email addresses and reducing tracking and phishing risks. This feature complements Brave's existing data isolation techniques by addressing privacy gaps related to email address exposure on websites. Users must register a primary email with a free Brave Account to enable message forwarding from aliases. Brave employs OPAQUE (RFC 9807) for secure user authentication without transmitting passwords or hashes. Email addresses are stored encrypted, and forwarded messages are deleted from Brave servers within seconds after delivery. The system currently supports up to five aliases for free, with plans for a paid premium tier. Initial forwarded messages may be flagged as spam due to reputation building. This feature is designed to improve user privacy and reduce spam and phishing threats stemming from data breaches.

This feature reduces the risk of user tracking and phishing attacks by preventing websites from linking users' real email addresses across services. It mitigates privacy risks associated with email address exposure in data breaches and subsequent phishing campaigns. The use of OPAQUE enhances authentication security by protecting user passwords from server exposure. However, it does not protect against phishing or weak passwords. The feature may cause initial inconvenience due to forwarded messages potentially landing in spam folders. Overall, it improves user privacy and security posture related to email usage but does not introduce new vulnerabilities.

This is a privacy-enhancing feature rather than a vulnerability; no remediation is required. Users interested in reducing email-based tracking and phishing risks should consider enabling the Email Aliases feature by creating a free Brave Account and registering their primary email. Users should be aware that forwarded messages may initially be marked as spam until the service establishes reputation. No known exploits or vulnerabilities are associated with this feature at this time.