Hacker News new | past | comments | ask | show | jobs | submit login
Brave’s use of direct mailers (brave.com)
102 points by open-paren on June 4, 2022 | hide | past | favorite | 152 comments



To me these little things are what turned me away from using the browser. Every time you install it somewhere you have to manually turn all the crypto ads off, it's the only thing that doesn't sync across devices.

These little nudges and 'growth hacks' if you will including that mailing campaign is exactly what I don't want in software that allegedly puts the user first. It doesn't seem like there is genuine innovation in Brave, they still rely on ads, and sending people physical spam in the mail or showing you 'privacy respecting' ones online obfuscated with a bunch of attention tokens doesn't really change anything.


> including that mailing campaign is exactly what I don't want in software that allegedly puts the user first

I don’t get what the issue is with the mailers. The names being present or not isn’t really important as they just bought distribution lists and mailed stuff to them. Whether they print the name or not, they know them. This seems pretty normal and reasonable for a “growth hack” and still preserved privacy.


>The names being present or not isn’t really important as they just bought distribution lists and mailed stuff to them

Based on my understanding they didn't even buy distribution lists. They just told USPS to deliver their ad to every house in a given zip code.


[flagged]


The tracking beacons the mailshot was sent to tell people they should be worried about don't even need throwing in the trash...

Brave is using a USPS commercial mailshot service which openly encourages the use of personally identifiable information to target unsolicited marketing (name, age, income(!) and other demographic info) to promote the idea it respects privacy and opposes collecting data to run ad campaigns for third parties. That's not a great look, and explaining that actually this shouldn't have been a problem because (like the customers of Facebook, Google and most display ad networks) the service they're paying keeps the targeting data to itself is probably even worse.


The EDDM demographic filtering works on the postal route level. You aren't filtering by households with $X income, you're filtering by routes where the households have an average income of $X income. For what it's worth. [ED - also worth mentioning this is just using census data.]

Similarly, you can't use the tool to send mail to 40 year olds, you can just see that the route you selected is 40% over age 40, or whatever.


Junk mail affects my life.


Junk mail has a massive ecological footprint.


Compared to crypto?


Brave has that too lol.

https://brave.com/brave-rewards/


Back of the envelope, they're roughly the same, CO2-wise.


I doubt that


US junk mail volume is something in the 6 million ton range, and paper production releases 3-10 pounds of CO2 / pound of paper, depending on whether it is virgin or recycled.

(Regoogling that second figure returns some ranges as low as 1-2 lb/lb, which would put junk mail at like 0.2-0.4 crypto.)


Your co2 from crypto number seems low. Is that perhaps just bitcoin?


Possibly but the error bars on all of the numbers I'm using are also large, and the age of the numbers matters as well. I find numbers for Bitcoin -- in the same window -- of 30-90 megatons of CO2, for Ethereum of 15-50 megatons, and the figures for junk mail range from 6 to 60 megatons.

The error bars all overlap, so the closest I can do with the level of work I'm willing to put in is that junk mail might be a little bit more CO2 than cryptocurrency (or twice as much as Bitcoin), or like 5% of cryptocurrency at the other extreme.


Junk mail is sequestered carbon that's been removed from the atmosphere.


Only if it's using recycled paper or wood from sustainably managed forest. Otherwise you're only moving the carbon around and not increasing the 'sequestered' carbon.


That's a given. Nobody's making paper by clearing old growth forests. 98% of virgin paper fiber is from fast growing softwoods in managed forests. The paper industry plants 1.7 million trees per day in the US. Increasing consumption of paper and lumber products from managed forests was one of IPCC's recommendations to the UN on climate change.


Where I live there is a community mailbox for the 60 units in the complex. At the mailbox is a recycling bin where we can put the junk mail. My neighbour takes care of the recycling bin and empties it every week. Based on the volume I get and the volume in the bin, I estimate that about half of the units dump the junk mail straight into the bin. I'm sure the rest eventually makes its way into recycling bags at each unit.

Personally, I'm convinced that the recycling system as a whole requires a certain base amount of input material to even function and that junk mail serves a useful purpose by providing a good portion of that base amount of input material.


I thought everyone knew by now that paper recycling is a scam? It doesn’t happen. Not cost effective.


As someone who works in the recycling industry (toilet paper & wet wipes). That's just not true for paper. It it plastic that is hardly recycled...

Wood pulp and recycled pulp are both in incredibly high demand at the moment and both incredibly cheap to use.

I can't speak for global stats, but here in England, as of 2018, we were importing over $600 million of just recycled paper to use from abroad! [ https://www.statista.com/statistics/490038/eu27-import-value... ]


I thought paper had to be clean to be recycled, causing a lot of it to be discarded (like used pizza boxes). TIL, thank you.


There's a local company that, at least back when this article[0] was written, made insulation out of recycled paper. So some people are at least trying to do something recycle paper. Of course, in this case the collection system is so flawed that it's worthless as an input material.

This is a four year old article and Edmonton hasn't changed the recycling system at all. It's still blue bags that get tossed into a truck, compacted, and presumably nothing useful happens.

On the garbage side, we now have bins that can be emptied by an arm on a truck and we separate garbage from organics. The organic material apparently gets composted, but I'm not sure what happens after that.

[0] https://edmontonjournal.com/news/local-news/its-not-worth-it...


I thought that's plastic?


64.7% of the paper you put in the recycling bin is indeed recycled.


Used pizza boxes?


Yes, those too. According to the American Forest & Paper Association, pizza boxes are almost universally accepted by cardboard recyclers. The small amount of cheese and grease in the cardboard bails they buy from recycling programs do not impact the quality of the paper and cardboard manufactured at mills that use recycled inputs.

> AF&PA and Industry Partners Aim to Set the Record Straight – Pizza Boxes Are Recyclable, Grease and Cheese Not an Issue

https://www.afandpa.org/news/2020/afpa-and-industry-partners...


This little stunt by Brave was clearly not the right move. Marketing is a necessity but if you sacrifice one of the core principals of your product i.e. privacy & security, what's the point?

The scenario is something like this:

Random person: recieves a physical mail right after installing Brave.

Brave: we are so so private and don't ever sell or use your data.

Random person: how did you get my address then right after I literally installed Brave?

Brave: you see, it's very private because we can't see the address or who the mail is going to go to. We just contracted a mailer who sent this marketing newsletter to everyone in their database.

Random person: ...

Brave: maybe you didn't understand but we, the brave company, didn't see who the mail would go to. That's privacy right?

Random person: deletes Brave

The problem here is that a privacy oriented company is accepting and making use of a very non-private method to spread privacy and Brave. Contradictory in it's core.

I still like Brave and what they represent. I am a fan. They do a lot of things right but this was baffling. I don't know how they could allow something like this to pass through the filter...


From the second paragraph:

> Since 2020, Brave has been experimenting with direct mail via the United States Postal Service’s Every Door Direct Mail (EDDM) program. EDDM allows businesses in the US to create and distribute mailers to addresses across one or more ZIP Codes.

I'm not sure where you got "tracking" from, but they're just sending mail to every address in a zip code.


While this is true, it doesn’t help the optics from a customer point of view. Granted the number of people in a zip code who just download Brave will be small, but those are your new customers and will be freaked out. They will tell their friends. People who are learning about Brave from the mailing will question how Brave got their info to mail them (even if that isn’t reality) and see the mailing as not respecting their privacy, thus killing their message.

This whole idea was simply bad. Billboards, TV, and stadium advertisements would have gone over much better if they wanted some old-school methods. It gets in front of a lot of people with no questions about privacy or targeting involved.


> Marketing is a necessity but if you sacrifice one of the core principals of your product i.e. privacy & security, what's the point?

Because that is not even remotely the case as is clearly stated in the article in the first few sentences.


The fact that they have to explain themselves with an article speaks a lot. Was this specific method necessary? I am sure it cost them quite a bit and were the results worth it?

How many people would read the article? How many people would simply run away from Brave due to this? How many people would care to research it a bit more?

Privacy is such a sensitive topic for privacy-respecting people that most of the time even a little doubt blows up the ship. This was a huge risk taken by Brave and unnecessarily so because they didn't do anything extraordinary by sending people mail.

Moreover, can this one article stop the negative sentiment from spreading? I don't think so.


> sacrifice one of the core principals

One of the more amusing principle/principal mixups I've seen. (Their principals must indeed be brave if this is a potential outcome).


Haha. Auto correct working its magic. Unfortunately, can't edit it out since its too late.


>Random person: recieves a physical mail right after installing Brave.

>Brave: we are so so private and don't ever sell or use your data.

>Random person: how did you get my address then right after I literally installed Brave?

Can't you make the argument for any sort of ad? eg.

>Random person: sees a static banner ad[1] right after installing Brave.

>Brave: we are so so private and don't ever sell or use your data.

>Random person: how did you know to show me a brave ad right after I literally installed Brave?

Are you basically arguing that brave shouldn't advertise at all?

[1] static in the sense it's placed there by the publisher for all visitors, rather than through some sort of ad network


Brave is basically arguing that third party marketing-distribution networks which use personally identifiable information to target ads are bad.

I think it's pretty reasonable to suggest that exposing that they do so via a third party marketing distribution network which uses personally identifiable information to target ads may have been a misstep without arguing that means they can't advertise at all

Particularly when the "but we don't see the personally identifiable information that the third party we paid used to advertise to you" applies to everyone paying Facebook or Google to show ads too...


> Brave is basically arguing that third party marketing-distribution networks which use personally identifiable information to target ads are bad.

>I think it's pretty reasonable to suggest that exposing that they do so via a third party marketing distribution network which uses personally identifiable information to target ads may have been a misstep without arguing that means they can't advertise at all

But in this case there's no targeting involved? They just told the "third party marketing-distribution network" to send ads to every household within a given zip code.


This is a very interesting situation for privacy respecting products.

Say you want to advertise to your potential audience, what do you do? You have very few privacy respecting methods.

1. You go with passive advertising like billboards, TV ads, blog ads etc. Not particularly effective since you can't do it across the world.

2. You go with something like Google with a huge ad network. But if you go with Google...you are tapping into and making use of personal data of your very own privacy respecting people. In a way, you are feeding the beast.

Which method should such a product go with? Which method would conform with their privacy respecting model best? Which would bring in a lot of users?

Not all ads are bad. Not all ad networks are bad. Some, very few, do it ethically. I think Brave itself is one of those. But these networks are very, very small compared to Google.

At all time the temptation is there to go with targeted ads because it's the most effective & affordable way to get potential users. The moment you do, are you still privacy respecting?

Edit: as to your question about banner ads. It depends. If you are using Google's banner ads they aren't static by any means. Google targets and rotates based on their huge database of user data. But if you just put a banner ad somewhere on a blog etc, that comes under the category of passive/non-targeted marketing.


Lol the problem here is assuming privacy is one of braves main strengths or even goals. When it's not lol. Brave makes money off tracking you and exposing your data, not in keeping it private.


I work at Brave. We don't track you, or expose any data (we don't even have your data to begin with). Reputable researchers have found Brave to exist in a class of its own as the "most private" popular browser tested: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf.


Do they actually? I would be interested in reading some literature about this. How have they used/exposed/sold user's data?


I got one of these yesterday. I'm uninstalling Brave and going back to Firefox


Firefox, by default and out of the box, sends your keystrokes to Google. Brave asked the USPS to deliver a printed JPEG to people who live within your Zip Code (and you happened to get one as well). These two things are quite different in terms of privacy, security, and trust.


Why does this process involve printing addresses at all?

In Germany "you" (probably needs to be a company of some size) go to "the post office" (actual delivery probably directly to a distribution center), give them a stack of flyers, and say "one of these into each mailbox in this ZIP code, please".

The mailman then takes a stack of said flyers and starts stuffing mailboxes as he goes along his route (excluding those mailboxes that have "no ads" stickers).

This avoids the need to treat the spam as addressed mail, because you don't really care which person gets which of the (identical) flyer. This makes handling much easier and as a result, cheaper.


You're right, you don't need addresses to deliver ads to every household. However, addressed mail probably gets better engagement than unaddressed mail, so USPS/EDDM vendors allow you to insert the name/address of the recipient, based on whatever is in their database. Brave didn't intend for this option to be enabled, but due to some oversight it was enabled, hence why the ads had addresses on them.


Probably to enable opt-out which most people don’t use but is available at dmachoice.org


It seems like a weird mia culpa. If I’m understanding right, they’re not sorry for sending the mailers, or working with a data broker to get the addresses, just for the fact that names were printed on the envelopes? I wonder who is concerned about the last one that isn’t more concerned about the first two.


They didn't work with a data broker. You can pay the post office in the US to send your mailer to every single address in a given zip code. This sort of bulk mailing represents the majority of your junk mail.


Having worked in marketing, they absolutely worked with a data broker. You don't blindly send out mailers. You use data brokers to zone in on a target market. "This zip code is more like to buy X while this zip code is more like to buy Y."


All direct mail marketers do this, because it allows better targeting (& re-targeting old prospects & previous customers) but Brave explicitly said they didn't, and only went through the USPS's service.


The USPS didn’t mess up. They are clearly using some sort of vendor to send out the mail.


The USPS sells all the addresses themselves.


> data broker

If I'm understanding the EDDM tool correctly, the data broker appears to be the USPS.


Even if we accept that it's just about the names, it's a weird mea culpa. Obviously they knew the names, because they accidentally printed them. So what they're apologising for is making it so obvious that they knew the names, or, to put it another way, they're apologising for failing to provide the illusion of anonymity to people who were not anonymous at all.

For a privacy-focused browser, that is definitely odd.


Brave didn't do the printing; that is (and has been since 2020) handled by the EDDM vendor. Brave doesn't want any user data; we prefer that information to stay with the United States Postal Service, which has legitimate claim over such information.


Yeah, I don't get it either. Is there anybody who doesn't get this kind of mail at home addressed to them by name all the time?


Not from companies I've never interacted with, no.

I haven't done any of the extreme privacy things, but I do use a PO box for almost everything, and thus I really don't ever get anything addressed to my name sent to my actual residence.


Really? Because every time a new dentist office, grocery store, etc. opens up I get unsolicited mail from them to let me know they're now a thing in my neighborhood.

Does it bother me? Not in the slightest. It's a community notice, and the Brave thing would only annoy me if it hit the levels that AOL CDs were at in the 90s.


This is probably a very location-dependent experience. I had literal stacks of spam mail every single mail day when I lived in Springfield and Kansas City, almost zero spam mail over entire years when I lived in smaller Missouri cities, and nowadays get maybe ~1-2 spam pamphlets per month at most here in Portland.

Probably based on a mix of local laws and/or how profitable each city is to market to.


I get plenty of things like this addressed to the current resident of my house.

None of them are addressed to me personally by name.


Addresses are not secret. Printing the name with the address might seem like a privacy faux pas, but in actuality it's a mailing faux pas. If USPS knows you don't live there anymore, they return to sender. That's a lot of expensive postcards going around for nothing. If however, it is addressed to "current resident" it's not a problem.

The story seems like trying to make lemons into lemonade. "Well, we wasted money, but maybe we can get a bit of privacy protecting glow from this cock-up anyway."


I work at Brave. We don't get addresses; we don't want that type of data (we don't want any of your data). The addresses are printed after Brave's QA process has completed. We asked that names NOT be printed on the mailers, but have no way to verify that they were excluded, since that would expose sensitive user data to us (which we do not want). We didn't work with any data broker; we simply provided mailers and desired zip codes (for 7 cities) via the EDDM service.


Yip. The whole story is weird.


I have a cynical take on the prevalence of marketing in our society. This may not apply to Brave specifically, but while we're on the topic of marketing:

I wonder if growing wealthy inequality means that consumers simply don't have enough wealth to make honest exchanges worth while. The powers-that-be look for ways to "grow" and consider making an honest product and simply selling it, but the common people don't have enough wealth to give in exchange for an honest product, so instead they put their money into advertising and other "growth" efforts.

Brave may be an example of this, what if consumers simply don't have enough wealth to finance the development of an honest consumer focused browser? In that case you would expect to see companies like Brave, even if their intentions are good, turning to less honest sources of income.

Consumer focused software seems to be on the decline, and for the first time I'm wondering if this is due to large scale economic reasons.


Marketing is very profitable. Sadly word of mouth is a painfully slow way to sell even a good product.


Marketing isn't the only example. Marketing does have an important purpose to play, as you say.

Take for example Diablo Immortal. Blizzard and Diablo have tons of fans. People want an old school Diablo, a game that puts the player first, a game they can buy for a flat fee and then have and enjoy for decades like they have the others in the series. But Blizzard doesn't care, consumers can't pay enough to make it worth their while, so instead they'll deliver a thin veil over gambling and exploitation and call it Diablo Immortal.


I would take quite a bit of tracking in exchange for no more junk mailers like this. They seem to be missing the forest for the trees: sure tracking is problematic, but Annoying Ads, however you define them, have always been the biggest pain point. Whether it’s popups, popunders, interstitials, autoplaying, made to look like news, or killing trees to fill your mailbox: we’ve always been at war with annoying ads.

This seems like an indication Brave is actually out of touch with what consumers want: less obnoxious ads. They’re so focused on tracking they’re willing to annoy people with junk mail.


dmachoice.org and optoutprescreen.com allows you to get rid of 99% of junk mail.

If you want to go deeper: https://optout.lexisnexis.com/ https://risk.lexisnexis.com/prescreened-offers-optout


I trust that Brave doesn't have a database with residents' names and addresses, but the problem with the marketing stunt, is that the moment they have to explain that it's not actually nefarious, they've already lost.

It's like making a misleading advertisement, but instead of misleading the users to trust them, it shocked the potential user base into a false sense of insecurity.


I like Brave.

But they always seem to be "asking forgiveness rather than permission".


Not the best vibe from a company whose livelihood is dependent on convincing more and more people to trust them with more and more data.


Brave doesn't ask you to trust it with more and more data; we explicitly do not want any of your data. This issue did not impact user data or privacy in any way either.


It's nice of you to stop by HN when your keywords are hit so you can rebut each comment, but it will stand in the record as PR.

Simply put, Brave takes calculated risks to expand its revenue/marketshare. I only hear about it when things go wrong. It must be worth it, because it keeps happening.


There are many facets to the Brave browser and the server-side Brave services it uses that would allow the Brave company to covertly collect all kinds of data from its users; Brave simply asks users to just trust that they don't want or aren't collecting that data.

If one wouldn't trust a particular company with their data, I don't see why one would be any more likely to trust a company simply claiming they're not collecting said data.

I do appreciate the few features designed to make it technically impossible for Brave to collect some/most of that feature's user data from, though.


Data-harvesting would be quite difficult to hide given our source code is open to the public (i.e. https://code.brave.com and https://github.com/brave), and that we encourage web-proxy evaluation of network activity (a la https://brave.com/popular-browsers-first-run/). In fact, reputable researchers in the privacy space have reviewed Brave, finding it to be the "most private" browser, in a class of its own: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf. But does not collect user data--we don't want your data.


Seems like their business model is at odds with their privacy goals.


Not at all. EDDM doesn't impact user privacy. Brave never sees any user data during this process.


EDDM, the no opt-out mail service.


Given that EDDM is an official offering from USPS, and that USPS is a government agency, it's reasonable to conclude that this activity is state sanctioned. In that case what permission do they need to ask for?


USPS EDDM requires that you only put the area information (city, state, and zip code) and the EDDM label. The fact that this included actual addresses, much less names, is off. The only actual addresses that should be included are Do Not Deliver addresses.

Something is fishy here. This doesn't seem to actually be through EDDM, but through some mailer vendor.


It's EDDM, and previous mailers lacked printed names. Our request to exclude printed names, while honored in the past, was not honored with a recent batch. Rather than brushing this off, we chose instead to investigate where the break-down in communication occurred, and share our findings in the blog post. Thankfully, this issue has no impact on user-data, privacy, or security. But it is definitely frustrating for us when we expect names to NOT be printed, only to learn that a batch of mailers contained them after all.


I don't understand why addresses are being used to begin with. They're not needed. You simply choose the route/zip code and the mailer will be dropped off at every mailbox on the route, hence the name "Every Door Direct Mailer". It's specifically to avoid using addresses.

This sounds more like a traditional direct mailer through a vendor rather than EDDM.


You're absolutely right; no-addresses is the ideal, and what we would have preferred over no-names from the beginning. We have a call this week to investigate further why addresses were included in the first place, and why our request to exclude any personalization was not respected.


Or they are just addressing the hyped up outrage generated by certain people.


I would be very suspicious of mail coming from a company that touted privacy that had my name on it. Especially if I've never done business with them.

Brave is in a weird market. Unless you pay for it, you're still the product.

The best thing Brave or Mozilla could do would be to legislatively kill Chrome (and perhaps the iOS Safari-only policy).

With control of browsers out of the hands of advertising agencies (Google), these companies could then raise their rates on an acceptable ads program sans the tracking. More revenue, sustainable market, and better for the world.


Safari is the most private mainstream browser IMO. Private relay, third party tracking blockers, good enough support for 1Blocker to keep my laptop fan down. I use brave for work though since it’s closest to chrome and the dev tools are better. Their slightly annoying shenanigans every few months still seem better than Google having a high quality data stream directly from the browser itself


So physical spam is their scaling plan?


Yeah, seems pretty desperate to me. "We couldn't get enough people to install our app, so we started sending them junk mail urging them to do so."


Clearly someone from AOL has slipped into management.


I don’t know if it was coincidence but I got two mailers the same week after I downloaded brave into my laptop, It freaked me out to think they already knew my address by just installing the browser. I hope everyone learns from this and use other methods of marketing for companies that market themselves as privacy first.


> It freaked me out to think they already knew my address by just installing the browser

Did you really think that? I would have considered it to more likely be a coincidence.


I don't envy the job of Brave marketers. Brave's "champion customers" are often people that hate any form of marketing, so every experiment risks alienating these key early adopters.


Hm, what would motivate people who hate any form of marketing to use a browser that mainly depends on ads for revenue?


What I don’t understand is how their vendor even got the names of the recipients. That is the violation of privacy, the mailed letters are only the symptom of a poorly designed system.


It seems conceivable that the vendor doesn't have the address/name list, but USPS.


I feel like the criticism towards Brave ITT is unjustified. This is a USPS service which is available to businesses. If you're a privacy conscious person in the US, you've likely opted out of this list.

Brave is reaching the people who may not have done this, to the end of getting regular folks to know their alternatives against big tech companies.

I guess don't get the ire, or what the expectation is for them to grow. Would you rather them take out Google or Facebook ads? /s


Here's the fun thing: I have opted out of blind mailers from the USPS, yet I got one of these Brave mailers last week with my name on it (I'm in the Atlanta area). Just one more reason of many for me to never, ever let Brave near any of my devices.


That sounds like an unhealthy paranoia.

Which seems more likely? The USPS is delivering spam mail against the wishes of the recipient (I still get spam mail weekly despite opting out) or a privacy-focused company is snooping on your devices to steal your personal info (so they can send you mailers?).


> or a privacy-focused company is snooping on your devices to steal your personal info (so they can send you mailers?)

I never said that. I don't want Brave on my devices due to their past bad behavior: lying, stealing money from creators in their affiliate program, redirecting legitimate links to shady crypto sites, running a crypto pyramid scheme, and so on. This is just the latest in a long list of reasons not to use their software.


Brave doesn't harvest or collect any user data; we explicitly requested that no names be printed on these mailers (which was the case prior to this recent batch). You're mistaken about the other issues as well (they are every bit as overblown and misrepresented as this present issue).

"Stealing money from creators" is quite misleading. When Brave held its token sale in 2017, we allocated 300M tokens to the User Growth Pool. Shortly thereafter we began staking Brave users with tokens to identify creators for whom they would like to offer support. Brave's UI showed a check-mark for verified creators, and nothing for unverified creators (we naively followed the Twitter model).

Some users took the BAT they received from Brave, and attempted to tip it to unverified creators (which landed those tokens in an omnibus settlement wallet). The UI/UX caused a great deal of confusion towards the end of 2018, leading to monumental feedback from several content creators, including Tom Scott of YouTube. Tom's insights gave us the direction we needed to overhaul the Rewards (called 'Payments' at the time) system in major ways. Ultimately, Tom approved of the changes. But note, no money was ever stolen from any creator. Additional details are provided in our 2018 blog post at https://brave.com/rewards-update/.

It was also never the case that Brave was "redirecting legitimate links to shady crypto sites," either. You're referring to our Partner and Affiliate Links in Suggested Sites. That is, if you typed "bitcoin" into the address bar, prior to any network activity, Brave could list (among other options) an affiliate link to binance.us. The user could then decide to visit the bitcoin-related property using Brave's affiliate link, or disregard the suggestion entirely. This feature is off by default in Brave today, but you can read more about it on our blog at https://brave.com/referral-codes-in-suggested-sites/.


I appreciate the attempt to explain your company's bad behavior, but I'm not convinced. And to be fair, you're not alone in making mistakes in the arena of privacy and security; all the major browsers have privacy-averse settings and "anti-features". The difference with your company is that you falsely advertise yourself as the one true private browser, while simultaneously profiting from your users' personal data. It's a lie, it's a scam, and it's morally reprehensible. You only fixed the issues I brought up after being caught and publicly shamed over them; if you hadn't been caught out you'd likely still be doing those things today. Shame on you.


You've mischaracterized features of Brave. Our code is open-source, it's not difficult to literally "go to the source," (https://code.brave.com and https://github.com/brave) and test the claims of others. You claim that Brave profits off of user data--show me where that is the case. Brave does not collect any user data; we were found to be the "most private" popular browser by reputable researchers in this regard: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

Brave has never been "caught" collecting user data, or abusing user data. Not a single instance of this exists. We believe in "Can't be evil" over "Don't be evil," which means we aim to preclude the potential for abuse at the design stage of ever major effort tied to Brave, and our services/offerings. On the other end, the harvesting and leaking of user data is [standard] in all other major browsers.


This is disingenuous at best. The browser itself is open source but show me the source for your data collection servers and crypto scheme servers. What's that? It's not open source? Imagine that!


If any data is being collected and stored on servers, it would first need to be transferred off the installed client (the instance of Brave running on the user's device). Network analysis would capture this (as it does with Google, Bing, Firefox, and other browsers). But you don't see this with Brave, because it does not take place. Again, please consider the review of a reputable source: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf


You can't opt out. After multiple calls and complaints to USPS and speaking to the Postmaster General I was given two options. Either I could STFU and keep getting them along with my other mail, or I could opt to not have any mail delivered anymore. And... People wonder why the USPS shouldn't be a bank.


That doesn't seem right. https://consumer.ftc.gov/articles/how-stop-junk-mail

Which Postmaster General did you speak to again?


If you look at what posted that has nothing to do with USPS Direct Mail. I also can't tell you how bad of an idea it is to pay money and register with advertisers who are already sending you unsolicited mail.

> Which Postmaster General did you speak to again?

I filed a complaint here:

https://www.uspsoig.gov/form/file-online-complaint

And got a call back around 2015.


One of the foundations of privacy is that data sharing in any form should be opt-in, not opt-out.


This was not an example of data-sharing; the data in question (names and addresses) resides with the United States Postal Service. That data is never accessed or viewed by Brave.


Google never shares user data when it sells ad spaces, and this is still viewed as something you need to give consent for.


Wait what?

I'm really confused about what was going on here, what was the nature of the alleged mistake, and why it was a mistake or bad.


Brave used an official USPS mass market program to distribute mailers.

The USPS allows these mailers to be mailed to every address (by route) in a zip code. The USPS also allows you to filter by such things as "age, household size, and income" (again the route is the granular level), but there's no indication Brave used this filtering.

To use the program, you have to print your own mailers. Naturally, the mailers have to be addressed, or they cannot be mailed. The vendor Brave used to print the mailers included the resident's name, which is typical but not mandatory.

Some people saw this and got freaked out, thinking that Brave was tracking them or had bought their data, the implicit thought being it was from some company dedicated to that. Instead, the USPS just used the USPS EDDM program that anyone can use. Brave apologized, destroyed the unsent mailers, and reprinted new ones without names.

Basically, it looked bad to some people, but it's not clear to me that Brave did anything bad except from a publicity perspective. Most people regularly get such mailers through the same program. (Someone else says in this thread that they don't get them, but they also mention having a PO Box, which is a filter in the EDDM tool most people are going to use.)

The EDDM program website is here, and it walks you through the process: https://www.usps.com/business/every-door-direct-mail.htm

You choose a vendor to print your mailers: https://printerdirectory.usps.com/listing/#/

Likely Brave did not communicate to their printer vendor the necessity of not printing names. But the vendor has them anyway. It's possible through the EDDM program to see your physical mail pieces (if you're doing the drop off), so hypothetically I suppose Brave could have collected this information.


We did communicate our desire to exclude names from mailers; you can see an example from last month at https://twitter.com/TravelTechGuy/status/1513965348177219588. Because we wish not to be exposed to any user data, our QA process ends prior to the stage where names would be printed. Once we learned names had been printed on a recent batch (a deviation from previous batches), we took prompt action to "halt and catch fire," so to speak.


Thanks for trying to be on stop of this. It is appreciated.

Personally I think people are making a mountain out of a molehill - but I guess we such people are the demographic you signed up for. ;)


Since the outside of all US mail is imaged and stored by the USPS and shared with other government agencies, [1] Brave just gave its user list to the US Government.

[1] https://www.newsweek.com/postal-service-photographs-every-pi...


The names and addresses are with the USPS. Brave (hello, I'm a team engineer) used the EDDM offering of the United States Postal Service. We were attracted to this method of advertising in part because it never exposes sensitive information to us at Brave. User data, instead, is with the USPS, which has legitimate claim over such information. As stated in our blog post, we sent only the artwork (for the mailer itself), and the Zip Codes we aimed to reach. That's it. We also asked that names NOT be printed, which was the case for earlier batches (e.g. https://twitter.com/TravelTechGuy/status/1513965348177219588). I hope this helps!


No it didn’t. Read the article. They sent this to entire zip codes. It’s not targeted at users. If you are a user and you also got it, that’s a coincidence. All your neighbors in the same zip code also got it whether they are users or not,


Then why does their mailing piece say "New Brave User"?

Their spin control says they sent it to entire zip codes. Is there independent confirmation of that?


> Then why does their mailing piece say "New Brave User"?

You're reading too much into this. If you look at the other elements of the ad, it's clear that the purpose of the ad is to get you to install brave, which makes you a "new brave user".


So you think their plan was to send this to people who already signed up for…retention? Seems very unlikely. I’d imagine awareness is a much bigger problem vs retention for them at this stage. Also the rest of the copy doesn’t make much sense if this was the case. You clearly want it to be true that something nefarious is happening but all evidence points away from that.


Brave is Chrome with more hypocrisy.


Crikey brave really come across like the telemarketing products of yesteryear. Kinda looks useful from the outside, but doesn't actually do anything better mostly just worse than all the optio a you had before.

Lol the only people I've encountered in the wild who had brave on their systems were folks here in Aus who were deep down the rabbit hole of American Christian right wing nut job conspiracy theories, like full maga supporting fruit loops.


Wait until they start sending CDs…


Once again reinforcing my initial vibe of Brave being sketchy as shit.


They used a gov run mailer and they don't have access to the database.

Would you like to expand on your "initial vibe" and Brave being "sketchy as shit"?


[flagged]


Creating paper waste is making the world a better place?


Direct mail is a very effective means of marketing.

The recipient has to actively deal with it, and is almost always the “head of household.” If you want to send ads that are interacted with by someone capable of making a purchase - mailing works.

I don’t know if “waste” is quote right.



Maybe you closely analyse mailers/junk mail/etc but most people ignore it. If it's not an envelope it goes into my recycling bin directly as a stack.

It is waste, especially for people who don't recycle.


What? The article is apologizing for a mistake (with questionable implications, as pointed out by other comments).


Sorry missed the /s on my comment.


Ah, my bad. Can't delete the original reply anymore, sorry.


[flagged]


They say they're using the USPS's EDDM tool, and they link to it in the post. I clicked, and skimmed until I found this:

> Choose the neighborhoods in the EDDM Online Tool where your customers live. Use the tool to target customers by specific demographics such as age, household size, and income.

So it seems like the database belongs to the government rather than the startup. It doesn't appear that this had any actual privacy impact, beyond the perception that Brave is targeting folks by name.


No privacy impact. Brave doesn't have any names or addresses; those are with the United States Postal Service (never exposed to Brave). We asked that names NOT be printed on these mailers. Previous batches went out without names, as intended. You can see an example of this from a Tweet last month: https://twitter.com/TravelTechGuy/status/1513965348177219588.


As far as I know, the database is owned by the USPS, and they can't do their job _without_ that information. You can dislike Brave for buying access to the information, or dislike USPS for selling said information. But the information is already collected by USPS so they can do their job.


Even if the database contains banding by household income for example? Why does the USPS need that to do their job? Brave doesn’t show what targeting was used…


The US Census is public record and breaks down all kinds of demographic information by zip code. The USPS is almost certainly just using census data. Even if they didn't provide the convenience, a marketer could easily replicate what they currently do.

If you have a problem with the US Census Bureau collecting demographic data or making it public, those are certainly valid positions to hold. However, point your ire at the right target.


You haven’t answered my point as to why the USPS needs this extra info to do their job?


Because I thought that was self-explanatory: part of their job is selling advertising. Cash is tight enough at the post office as is. Why let third party marketers sell advertisers public census data instead of just providing it directly?


Why can't they do their job without that information?

You can send a letter to an address without the USPS

a.) Having the address in their database

b.) Knowing who is living there

So Brave, the privacy company, is using a service that collects data about people.


Brave never has access to your information. We didn't use "a service that collects data about people," we used the EDDM offering of the United States Postal Service, which has legitimate claim to names and addresses. This service is attractive in part because it exposes no data to Brave in the process.


"We don't use a service that collects data about people, we use a service (USPS) which collects data (names, addresses) about people".

Glad I switched back to Firefox quite some time ago, a company which thinks paying others to collect data about you is fine as long as they "don't have access".

If you pay Google for ads, you also don't have access to their data. Still they collect it, you pay them for using the data they've collected.

Google, USPS? I'm not a socialist, so I don't care if a state owned corporation or a privately owned one is paid to collect the data.


The United States Postal Service handles mail for the United States. Them having my name and address is quite a bit different than Google having the same data (in addition to the mountains of other data-types Google tends to harvest).

Switching back to Firefox means your keystrokes are literally handed off to Google in real-time. Please take some time to review the privacy practices of your preferred browser: https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf


"Them having my name and address is quite a bit different than Google having the same data"

As stated above, they don't need that data. Instead of "me" think of your customers.

"Switching back to Firefox means your keystrokes are literally handed off to Google in real-time."

This is not about me, but about Brave.


That’s not nuanced enough. Information isn’t just information to a user, it’s information combined with purpose. A user would expect the USPS to use address data to deliver them mail. They would expect the USPS to sell their address data for the purpose of (gratuitous hyperbole) targeting a drone strike. In this case, I would doubt the user would expect their address data to be sold by the USPS for direct mail shots.

This is the essence of GDPR really. The legal basis of “legitimate interest” means you don’t have to seek consent because of course a user would expect you to process that data in the course of the provided service. To go outside of that service you need to get explicit and informed opt-in consent.


Be careful with the right wording here: this USPS service is not selling any data.

It is just delivering snail mail.

The only data flow here is from Brave to USPS: please send our mailing to this definition of the target group.

USPS does not send Brave a list of addresses or even names. Brave does not give USPS a list of addresses or names.


This is exactly how Google operates yet many folks seem to define / consider that as “selling the data”.

It’s really about “leveraging access to / monetizing the data”.

The point is that by paying for EDDM, Brave is funding and supporting that financial model (targeted advertising) which many folks who use Brave want to eliminate.

So some amount of annoyance expressed by their users makes sense to me.


"our EDDM vendor" seems to imply a third party getting the addresses to print (because there's no need to keep the vendor name secret if it's the USPS), but maybe they just thought it sounds better than saying "the USPS".


Someone has to print the mailers. The USPS lists the EDDM vendors on its website and they work through the USPS.

https://printerdirectory.usps.com/listing/#/results


The mailer itself and the address can be printed separately. I didn't dive deep enough to confirm it, but I think these companies print the mailer and USPS prints the addresses.


[flagged]


[flagged]


He didn't donate to the wrong religion he donated to Prop 8 a proposal in California to ban same-sex marriage. Acting like same-sex marriage is a religion is bigoted and should not be tolerated here.


Prop 8 was the Mormons. I agree wrong religion is maybe confusing but that’s both who was behind it and why he donated.


So he didn't give money to support Prop 8 and only gave it to the mormon church?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: