long-term solution to tracking protection whitelist

[diracdeltas]

in app/trackingProtection.js:

// Temporary whitelist until we find a better solution
const whitelistHosts = ['connect.facebook.net', 'connect.facebook.com', 'staticxx.facebook.com', 'www.facebook.com']

Currently hosts that are on the Tracking Protection list but cause some important functionality (like fb login) to break are added to this whitelist so they don't get blocked. My preferred long-term solution is to block by default but detect when a site is likely to break and pop up a dialog asking the user if they'd like to allow the domains to potentially track them.

Concrete example:

1. user loads coolsite.com
2. Brave sees a request to connect.facebook.net to download sdk.js or all.js and infers that coolsite.com is going to use a Facebook feature
3. Brave shows a dialog that says, "Allow connections to connect.facebook.net and www.facebook.com so that you can use Facebook features (such as login and like buttons) on this page?"

[FrancisTurner]

If you do this may I suggest adding a question about whether to remember the choices for this site or not.

(I.e. a "Don't ask again?" check box)

[ConorIA]

Not sure which issue this comment best applies to, but I will add it here and move it if necessary.

There likely needs to be more fine-grained control over what sites to block. For example, on Reddit gallery sites such as redditp.com or imgaoid.com, the functionality is broken because their calls to Reddit are blocked by Brave. e.g. http://www.imagoid.com/r/pics / http://redditp.com/r/pics

A 'medium-skill' end user should be able to click on the Bravery icon, click on the number of sites blocked, and copy the relevant url to a whitelist somewhere user-accessible.

[tildelowengrimm]

Moved to brave/brave-browser#1108