Brave Browser Introduces Email Aliases to Block Tracking

“If a website you signed up for is hacked, your information can be leaked and end up with data brokers or worse,” explains Brave in the announcement.

Brave browser 1.94 introduces Email Aliases

The Brave browser’s latest release, version 1.94, adds a feature called “Email Aliases” that lets users generate disposable email addresses when signing up for new services. An alias hides the user’s real email address from the receiving website while still forwarding messages from that service. Brave frames the capability as a response to a specific privacy gap: though the browser already uses data isolation to limit cookie‑ and cache‑based correlation across sites, email addresses remain stored on website servers and can be used to stitch identities together after breaches or leaks.

How Email Aliases work and the user flow

To create and use an alias, a user must have a free Brave Account and must register a primary email address with that account so messages can be forwarded. Brave notes this registration is separate from a Brave Premium account. The new alias system is free for up to five email aliases; Brave says it plans to introduce a paid Premium version later that will lift that restriction.

Brave stores the primary address and generated aliases in an encrypted state and forwards incoming messages to the registered primary address. Forwarded messages are processed only by automated spam and malware filters; Brave says messages are deleted from its servers within seconds after delivery. Notes attached to aliases remain local to the user or, if synced via Brave Sync, are end‑to‑end encrypted.

Brave Accounts and OPAQUE (RFC 9807)

Brave describes the authentication backing these accounts as using OPAQUE, a password‑authenticated key exchange standardized as RFC 9807. According to Brave, OPAQUE allows authentication without transmitting user passwords or password hashes to Brave’s servers. Brave asserts this reduces exposure to password logging, memory‑scraping attacks, and bulk cracking of leaked password databases. The company is explicit, however, that OPAQUE does not protect users from phishing or from weak passwords.

Privacy tradeoffs, spam reputation, and message handling

Brave’s implementation aims to block cross‑site identity matching, reduce spam, and shield users from phishing campaigns that can follow data breaches. The company warned that forwarded messages may initially land in spam folders while Brave “establishes its reputation as an email provider,” a behavioral quirk users should expect when testing the feature.

Brave also states that forwarded messages are not inspected beyond automated spam and malware filtering. That means servers perform a minimal set of automated checks before deleting delivered messages within seconds, while the mapping between aliases and the primary address is kept encrypted.

What this means for end users, technologists, and adversaries

• End users and the general public: Individuals who sign up will be able to generate disposable addresses to keep their primary address hidden and to limit the downstream circulation of their email after a breach. They should register a free Brave Account and expect up to five free aliases for now, and anticipate that some forwarded mail may initially appear in spam folders.
• Technologists and security teams: Security practitioners will note Brave’s use of OPAQUE (RFC 9807) to avoid sending passwords or hashes to servers, and the encrypted storage and rapid deletion policy for forwarded messages. At the same time, Brave’s minimal inspection of forwarded messages and the admitted spam‑folder risk are operational details network defenders must accommodate.
• Adversaries and threat actors: By design, the alias system reduces the ability to perform cross‑site identity matching using email addresses leaked from individual services. But Brave acknowledges a remaining danger: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.”

The Email Aliases feature addresses a narrow but persistent vector of identity leakage: stored email addresses that accompany account records on third‑party servers. Brave’s layered approach—data isolation in the browser, disposable aliases, encrypted storage, and OPAQUE for authentication—targets different stages of the attack surface. It does not, however, eliminate the core risk tied to credential theft or social‑engineering attacks, a limitation Brave also underscores.

Brave plans a paid Premium tier later to expand alias allowances, and the company’s immediate guidance to users — register a Brave Account, expect some messages to hit spam folders while reputation builds, and remember that OPAQUE does not replace vigilance against phishing — outlines the practical constraints built into this deployment.

Source: BleepingComputer — Brave browser adds email aliases to help users evade tracking