Windows should not install VPN services until VPN is purchased/enabled #33726
Comments
|
Coming from #33592 which was closed as a duplicate of this. I also had a similarly named task appear in Task Manager as a startup application, enabled by default. I have since disabled it due to not needing it. The full filepath is C:\Program Files\BraveSoftware\Brave-Browser\Application\118.1.59.117\BraveVpnWireguardService which differs from the service listed in services.msc(Brave Vpn Wireguard service) which has a path of C:\Program Files\BraveSoftware\Brave-Browser\Application\118.1.59.117\BraveVpnWireguardService\brave_vpn_wireguard_service.exe |
|
do you guys know when the beta will get this fix so my computer does not have the brave vpn anymore |
|
It is terribly disappointing that a security-branded browser is doing something blatantly insecure. At least you are rolling back the change... but how did this get approved in the first place? I sing Brave's praises to family and friends, please don't give me a reason to change that. |
|
Now I wonder if they do that on Android. Because inside the Brave Browser, there is an entry in the browser menu Brave VPN, to which when touched, part is open where it asks for subscription. |
|
@Marko-98 no, there is no service on Android. @joshwenke I can understand the concerns by folks about bloat (ex: services or files put in place which will never be used) - but I'm a bit puzzled at how adding a service equates to Brave being insecure? We wrote the code ourselves and applied our same review process to it. The services are off by default... but even if turned on, there's no action taken by the service unless you 1) have purchased VPN and 2) are connecting. Our security team has worked to review the code thoroughly to make sure having these doesn't increase the attack surface for Brave. Code is included in Brave for features even if people don't use them. For example, if you choose not to use vertical tabs, the code for vertical tabs is still there. We're actively making changes so that no services will be registered / no dependencies downloaded until you purchase Brave VPN and turn it on. Thanks for your patience. When I have more information (link to pull request, link to code branch) I'll share here |
This new client will register with component updater and get a CRX package with the service binaries (including wireguard) and can perform the service registration (TBD). Next step would be to register this in BraveVPNOSConnectionAPI for WireGuard codepath (on first connect) and unregister when switching to system VPN. Component will only be used on Windows at the moment. Linux doesn't have VPN support and macOS only uses the system VPN. See brave/brave-browser#33726 for more information
You're joking right? Vertical tabs doesn't install a windows service without telling people... For a privacy based browser you guys certainly have a blatant disregard for people's privacy and consent. How many more fiasco's will you guys continue to have before you knock it off or people completely lose trust? Don't think some of us haven't forgotten about the whole referral code issue a couple years ago. Personally my patience is growing thin.
This should have been done at the start. There's zero excuses.
I'm expecting you guys to do better and put clear policies in place to avoid these types of things. Privacy and consent need to be at the front and center of Brave itself. Controversial features like this should always have an opt-in or at the very least a way to disable/uninstall it from the start. |
|
OK folks - have an update. I'm doing some experimenting and we should be able to have a nice and clean solution soon. We'll have to iron out some details about the experience (talking with the team on that), but you can see my prototype branch here: I'll continue to work through this and will share updates as they happen. @Dskobra fair point on setting a boundary on installing a service. We have a privacy policy here: I reviewed and we do have VPN captured in the privacy policy - but these recent changes on Windows (installation of service) are not covered there. I've already pinged the appropriate folks to get that updated. And we can revisit once the planned changes are completed and released. We have already made changes to processes within the company to help prevent future issues from happening. This is a learning experience and I'm trying to be as transparent as possible. Thanks |
I appreciate you working towards a solution and trying to be as transparent as possible. However, this situation was definitely not transparent. Personally I was more unnerved to find a system tray icon and auto start entry for something I never used. I don't know if this was rushed or what happened, but I think a way to disable the feature and remove it should have been included when being pushed to the user. Anyway hopefully this is a lesson learned and I don't see any future surprises. |
|
having a browser that auto-updates itself in the background, and in that process it installs an application as a Windows service that autoruns at startup... |
|
and it even re-enabled the Services on its own... congratulations |
|
@bsdinis1 I deleted your first comment above because it's not adding anything and was abusive. Let's keep things constructive and respectful here please. Your second comment above captured the problem. Services were re-registered after Brave updated. Until we solve this issue (which we are actively working on), the services will fix themselves on upgrade if you installed as Administrator. That is due to how Omaha and the mini-installer work. All of the logic for the mini-installer will run on each update. We're working through a few different proposals for how to solve this entire issue. As shared, there have been some prototypes happening. Will update once we have more to share. |
|
Like I said in my other comment, in the 'old issue' that was closed as being a Duplicated of this, If any of you don't want to see 'VPN installed', in any new update, which is obvious it is going to do that, then uninstall Brave and Install it WITHOUT admin rights. There is NO reason why 99% of people have to install a browser, unless you share your computer with someone, and you want all users to have the most up-to-date version and don't re-use disk space, then Per-User installation should be what users do. The problem is doing a Per-User install is not obvious, but it is easy. So first, since you already installed Brave with admin rights is to Uninstall Brave and wait, go to Task Scheduler or taskschd.msc and make sure the two tasks are gone and the updater is uninstalled in Then download the installer from Silent will install automatically without admin rights, so it might be better, although you won't get any confirmation or anything or nothing when it is finished installing, you might see Brave gets added to desktop and taskbar but that's it. You can also use Winget, which uses the silent installer.
benefits of user Per-User install? no services installed, including updater. The updater will run as a startup process which can be easily disabled if you desire. Task Scheduler tasks are still added, which you can also disable if you desire for the people who 'don't want automatic updates'. It is simple as that, if people want to avoid services to be installed, then don't give admin rights. if you installed Brave with admin rights, you already allowed Brave to install VPN. Brave will fix this someday eventually, but people can help but stop complaining when they can easily 'fix it' by doing what they had to do from the beginning, Per-User installs, because I am sure you are not sharing your device with other users, that have their own Windows accounts, so giving admin rights to a browser is just nonsense even if it is the Default behavior. |
@Emi-HoloGhostRevisionist88 this is actually not necessarily true if you use vpn and want the best privacy protection on Windows. System-wide protection against the Windows multi-homed DNS leak https://support.brave.com/hc/en-us/articles/11973307463181-What-is-the-Brave-VPN-and-the-Windows-Smart-Multi-Homed-Name-Resolution-Feature- require admin to temporarily set firewall rules that prevent DNS resolution on the non-vpn interface (the source of the dns leak). Without admin, only Brave itself is protected by using DoH instead of the system DNS resolver. Brave browser does not run with elevated priviledges, but a small helper service that is only enabled with Brave VPN does run with the necessary priviledges and it automatically enables the firewall rules whenever the VPN is running. It runs as a background service because the vpn itself can continue to run even if Brave is closed and we want to make sure the firewall rules are always removed when the vpn is not connected. However, this is only a problem if the dns server for the local interface is on the same network. Many routers proxy dns requests and set themselves as the DNS server in DHCP. |
@Dskobra this is definitely a bug and should not have happened. Something that is actually running by default is definitely in a completely different category from registering services that are not running by default. We will address both issues, but the tray icon running without enabling the vpn is not intended behavior afaik and if it was, that was a judgment error that will be corrected. |
@Dskobra Brave is run by people and people make mistakes and sometimes they only register as mistakes in hindsight. If people feel like Brave is trying to do something sneaky then they should just use a different browser. If I thought Brave was trying to do something sneaky, I would find a different job. I see some people calling this bloatware, but I have a hard time seeing how a very good privacy feature that is integrated into a privacy focused browser qualifies as bloatware. Should the services have been installed by default even if they are not enabled by deafult? No. Should the tray icon be enabled by default? Definitely not (this is a bug). Should we have shipped the actual binaries separately from Brave? Personally I don't see a problem with shipping code that only runs when enabled. As @bsclifton said, we ship all kinds of code that not all users enable. Maybe some explanation would help. The primary reason for registering the services by default in the "manual" state (and by extension shipping the binaries for those services) is that some functions (like the fix for the windows mutlti-homed DNS leak mentioned in a post above) require admin to run and the browser does not run with admin privileges. The updater can run with admin privileges because that is necessary to update a system install of Brave so we used the updater to register the services, but did not set them to start automatically. If you are an admin user, you could say this is not necessary because we can prompt for admin when needed and you can accept or deny that. However, if you are a regular user with a system install of Brave you have no way to allow this and you would not get the benefits of things like system-wide protection from the windows multi-homed DNS leak. Was this the right trade-off? In retrospect no because we don't want to upset our users or make them think we're doing anything sneaky. We hear that you feel this was not the right decision and we're going to change it. I can't guarantee that we're never going to make a decision you don't agree with again (or make a mistake), but I can tell you that we will never intentionally do that or try to be sneaky about it, at least not as long as I'm working here because I would quit if we started doing that. |
|
@bridiver The whole admin vs non-admin rights is a big issue in software in Windows, like Windows giving users full admin rights to anyone was always problematic, this is why malware and virus get installed, so while it is necessary for some stuff, it should also be planned better. So installing per-user creates less security issues, but you are right, sometimes is a most to have a service. But talking about Brave VPN, for example, since I never got VPN installed, I never noticed VPN installing like this, so I never reported and raised the concern about it, I wonder why other Nightly users who install with admin rights didn't report it.... but speaking about me, I have reported 3000 million other issues since I am Brave user, so I would have reported this as well. Now since I never got installed VPN, this raise the question, what about per-user installed Brave users? people who used Winget or the silentinstaller? if per-user Brave users want to use VPN, do they have to install Brave with admin rights to get full protection? or are you going to implement a way so users can get the same The good thing is most people already just give admin rights when installing Chromium browsers already, so this situation will not apply to most people, but I think it has to be done in a way benefits all brave users, like, even if I didn't install Brave with admin rights, I should be able to get VPN installed as a service to make it work better, but also, even if I installed with admin rights, I should be able to run the VPN only while the browser is running, not just running 24/7 if people desire. The option of 'system-wide all the time' is nice, but some people don't want or need VPN to run as service 24/7. But anyway, this 'switch to per-user installation' guide for anyone who cares, was for people who aren't going to get VPN ever anyway, you know, if it is not free, they will not pay for it therefore it is useless for them, like you say, some people will wrongly call 'bloat' to anything, and sometimes people gotta do something about it if they can If people aren't patient until your fix, then, like in this case, they can use Brave without admin rights or just switch browsers or whatever they want to do, but this is about if people don't want to bother with automatic updates, with VPN, and all, services are going to always be an obstacle that can be avoided if they desire. |
That's fair and is generally good advice in most situations, I just wanted to point out that we're using admin specifically to increase user privacy in this case. |
This code runs when mini-installer executes for system level installs. The install worker is executed for new users but also runs on each upgrade. This is the first part of the fix, helping solve brave/brave-browser#33726 The second part of the fix will be to install the services when needed (and is a bit tricky).
|
Happy to share that this is FINALLY merged. Thanks for all of you that have been patient! This change touched a lot of places in the code. We had to find a good solution, refine it, and then go through testing with it. The fix will be in the next Nightly we have publicly. From there, I'll be working with the QA team to uplift this into Beta first and then Release next. If you're on Nightly and you don't have Brave VPN purchased, you'll see the services disappear tomorrow morning after updating 🎉 Some of our next upcoming release dates - the fix should be in one of these. It may also be in a hotfix in between them.
|
stephendonner
added
the
QA/In-Progress
|
Going to do some clean up here as discussion here got a bit off topic. If there are some specific grievances, let's please create a new issue 😄 Thanks! |
|
OK one last follow up - after the code fixing this issue has been merged to 1.64 (Nightly), there have been two more follow ups: Those are merged into 1.64 (Nightly) also. There is one outstanding change which is under review now. This last change is necessary to prevent a regression. We have the 1.63 release coming up soon (next week) and I don't think we'll be able to uplift the changes there due to time limitation. But tomorrow, we're planning on moving 1.64 (where the change is) to Beta. If you're a Beta user, you should see the services get removed tomorrow when 1.64 ships and you receive the update. This means we can expect the change on RELEASE channel (stable) on March 19th with the 1.64 release 🙂 |
|
Will we get ability to remove VPN part on Android as well? I mean, it just sits there and has no use to users that aren't subscribed to VPN service. Many times mistakenly entered the VPN ad because it's location is on match where other web browsers have desktop site feature. 
|
what a disingenuous comment. the install process tries to adhere to the windows standard of Everything Gets Admin. don't turn the blame away from disrespectful behaviour |
Verification
|
| step 7 | step 8 | step 11 | step 12 | step 13a | step 13b | step 14 | step 15 | step 16 | step 17 | step 18 | step 19 |
|---|---|---|---|---|---|---|---|---|---|---|---|
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
Upgrade - removal of VPN service - PASSED
Steps:
- installed
1.64.3(build WITHOUT fix) - launched Brave
- opened
services.msc - confirmed
BraveNightlyVpnService,BraveNightlyVpnWireguardService, andBraveNightlyElevationServiceprocesses - right-clicked on
BraveNightlyElevationServiceand choseStart - confirmed error message
- installed
1.64.94 - launched Brave
- opened
services.msc - confirmed all
BraveNightly...services are gone - right-clicked on
BraveBetaElevationServiceand choseStart
Confirmed BraveBetaElevationService was successfully Running
| steps 3-4 | step 6 | step 11/result |
|---|---|---|
 |
 |
 |
Upgrade - pre-existing Brave VPN user - PASSED
Steps:
- Have a profile which already has a Brave VPN subscription
- Run steps from
Upgrade scenario - removal of VPN service - The
VPNbutton will still be visible in the browser. Click it to bring up the server connection screen - At this point and time, the services should be installed.
- Verify
Brave VPNworks - Open
services.mscand search for the VPN services. - Verify both VPN services are shown. Name will be like:
Brave Beta Vpn Service(BraveBetaVpnService)
Brave Beta Vpn Wireguard Service (BraveBetaVpnWireguardService)
Confirmed BraveBetaVPNService and BraveBetaVpnWireguardService were running
| example | example | example |
|---|---|---|
 |
 |
 |
Upgrade - user purchases Brave VPN after upgrade - PASSED
Steps:
- Have a profile which does NOT have
Brave VPN - Run steps from
Upgrade scenario - removal of VPN service - Logged in to
account.bravesoftware.comwith a new account - Clicked
Buy VPN - Completed
Stripecheckout - At this point and time, the services should be installed.
- Verify
Brave VPNworks - Open
services.mscand search for the VPN services. - Verify both VPN services are shown. Name will be like:
Brave Beta Vpn Service(BraveBetaVpnService)
Brave Beta Vpn Wireguard Service(BraveBetaVpnWireguardService)
Confirmed BraveBetaVPNService and BraveBetaVpnWireguardService were running
| example | example | example | example |
|---|---|---|---|
 |
 |
 |
 |
|
@Marko-98 you should already be able to remove VPN using group policy, which I admit is not very straight-forward at the moment (I've never tried to do it before on Android). There might be something special we need to do for Android We have the group policy (as it related to Desktop) documented at https://support.brave.com/hc/en-us/articles/360039248271-Group-Policy - when |
|
@bsclifton I just disabled the VPN through the In my comment, I was asking specifically about the Android version of Brave. Because there isn't a flag that would allow me to do the same. Thanks for your work guys! I really appreciate it. 😉 |
|
Verification Clean install - PASSED
Upgrade - removal of VPN service -
|
| step 1 | steps 3- 6 | step 7 | step 10/result |
|---|---|---|---|
 |
 |
 |
 |
Upgrade - pre-existing Brave VPN user - PASSED
Steps:
- Have a profile which already has a Brave VPN subscription
- Run steps from
Upgrade scenario - removal of VPN service - The
VPNbutton will still be visible in the browser. Click it to bring up the server connection screen - At this point and time, the services should be installed.
- Verify
Brave VPNworks - Open
services.mscand search for the VPN services. - Verify both VPN services are shown. Name will be like:
Brave Beta Vpn Service(BraveBetaVpnService)
Brave Beta Vpn Wireguard Service (BraveBetaVpnWireguardService)
Confirmed BraveBetaVPNService and BraveBetaVpnWireguardService were running
| example | example | example | example | example | example | example | example |
|---|---|---|---|---|---|---|---|
 |
 |
 |
 |
 |
 |
 |
 |
Upgrade - user purchases Brave VPN after upgrade - PASSED
Steps:
- Have a profile which does NOT have
Brave VPN - Run steps from
Upgrade scenario - removal of VPN service - Logged in to
account.bravesoftware.comwith a new account - Clicked
Buy VPN - Completed
Stripecheckout - At this point and time, the services should be installed.
- Verify
Brave VPNworks - Open
services.mscand search for the VPN services. - Verify both VPN services are shown. Name will be like:
Brave Beta Vpn Service(BraveBetaVpnService)
Brave Beta Vpn Wireguard Service(BraveBetaVpnWireguardService) - Disconnected VPN and Wireguard toggle off in brave://settings/system
- Confirmed
BraveBetaVPNServiceandBraveBetaVpnWireguardServiceshown - Confirmed
BraveBetaVPNServicestatus shown running in IKEv2 mode - Confirmed
BraveVPNBetaWireguardTunnelServicestatus shown running in Wireguard mode
| example | example | example | example | example | example | example |
|---|---|---|---|---|---|---|
 |
 |
 |
 |
 |
 |
 |
MadhaviSeelam
added
QA Pass-Win64
and removed
QA/In-Progress
Background
Starting with product version 1.59.117 on Windows, WireGuard is used as the default for Brave VPN.
With product version 1.57.47, Brave will install a service
Brave Vpn Wireguard Serviceif a user has admin privileges. This service is marked asManualstart and is not started. The binary is also installed on disk in the directory the the browser binaries are installed.This change was introduced here:
brave/brave-core#18565
The pull request links to the devops issue where we compile the binary and also to the privacy/security review where this was vetted. Originally, this work was all behind a feature flag exposed via
brave://flags.There is also a
Brave Vpn Servicethat is installed (also set toManualstart, not started) which has been there for a longer time. This service was added here:brave/brave-core#15915
That change went live with Brave product version 1.50.114 on Windows. This service was added to provide an OS level way to stop leaking of DNS due to a Windows feature called
Smart Multi-Homed Name Resolutionand is only used when a customer has purchased VPN and the VPN is connected. More information about Smart Multi-Homed Name Resolution and why this service was created can be found here:#25489
Here is a picture from
services.msccourtesy of ghacks.netThese services will only be used when the person buys Brave VPN (via account.brave.com) and engages with the UI in the product.
Description
On Windows only, there are two VPN related services (
Brave Vpn ServiceandBrave Vpn Wireguard Service) registered with Windows when Brave is freshly installed. They can be viewed inservices.msc. They are both set toManualstart and are not used until a person 1) uses Brave and 2) purchases Brave VPN and then 3) connects to Brave VPN.At that point, a config (with the VPN details) is written to disk and the service is started.
These services are installed at install time - since the installer is already doing a UAC prompt (admin escalation). The ideal situation would be to move these services to be installed when VPN is first USED (post purchase) and not at install time.
What does the fix look like
As we solve this issue, here's what we plan to do
Brave Vpn ServiceandBrave Vpn Wireguard Service). This will prevent new users from having the service installed.Brave Vpn Services (Windows).The text was updated successfully, but these errors were encountered: