Startups gain traction by making privacy and security a selling point

Upstart browsers and operating systems offer users greater protections against cyberattacks and data tracking on the Web. But the question is whether they will gain mainstream acceptance.

Privacy on the web has always been a Sisyphean task that requires a mix of user vigilance, complex software, and ad-blocking plugins.  

But a new crop of firms developing web browsers and operating systems have set out to make online anonymity simpler. And they are doing it at a time when consumers are increasingly worried that they can't limit how their data is tracked online.

"Privacy is becoming a buying criteria," said Jeff Pollard, principal technology analyst at Forrester Research. If firms can make products that are both easy to use and attuned to privacy and security, says Pollard, consumers will begin adopting them. 

In fact, according to a Pew Research Center poll from January, 86 percent of Internet users already take some action to erase or limit their exposure online. Additionally, according to Pew, 91 percent of Internet users say they've lost control over how their information is collected and used.

The web browser Brave is one of the newest entrants to this fledgling group of privacy-focused startups. A former chief technology officer of Mozilla Corporation, best known for its Firefox browser, launched Brave earlier this year and so far has only released beta versions of the product.

Brave promises to limit the amount of third-party tracking that occurs as users navigate from website to website. It also says it will block targeted ads that show up on website, thus making browsing faster and limiting the amount of user information collected by marketers or media companies. 

"Tracking is extremely prevalent on the web," says Yan Zhu, Brave's senior software engineer and a former digital rights advocate at the nonprofit Electronic Frontier Foundation. "You visit a typical site, there’s probably between five or several dozen third parties that your browser is making connections to. Most of them don’t have any relationship to you."

Blocking ads isn't just a matter of limiting the amount of data that companies collect about users, says Ms. Zhu, it's also about increasing online security. Over the past two years, the number of websites that serve malicious advertisements has more than tripled.

If blocking ads isn't enough for users, fledgling operating systems Subgraph and Qubes are offering an added layer of security against some of the most common types of malicious attacks.

Using a technique known as "sandboxing," Subgraph and Qubes aim to keep users' file systems separate from untrusted programs downloaded online (a common way that malware spreads on computers). That way, it restricts access to critical files in case users accidentally download malicious software. Both products offer support for the anonymizing Tor browser, and Subgraph has also added secure email and instant messaging features. 

While internet users can get many of these privacy and security enhancing features on their own, the difference with Brave, Subgraph, and Qubes is that the security and privacy options are turned on by default.

"We want to put it in seamlessly, so you can open your browser and you don’t have to change the way that you use it," said David Mirza Ahmed, president of Subgraph. "The key objective is that it needs to be usable."

Even though Brave, Subgraph, and Qubes are in their infancy, the emergence of these new technologies generating some push back from online marketers and media companies.

In particular, Brave hopes to diminish web tracking with an ad swapping mechanism that replaces third-party ads with ones that don't track users. To do this, Zhu and her team are developing their own advertising network, which will deliver general interest ads based on the broader content of the page. Users can also pay a fee to block all ads, which is divvied up among advertisers in the network. 

But that plan isn't sitting well with publishers – who depend upon ad revenue to make money. In April, the Newspaper Association of America, which represents nearly 1,200 US papers sent what they called a cease-and-desist letter to Brave on behalf of 17 news organizations, including the Washington Post and the New York Times. Specifically, the NAA alleged that posting news content without allowing media companies to collect add revenue from users amounted to a copyright violation. 

Brave quickly responded to the letter, saying the product won’t replace native ads, and will provide more revenue to publishers than third-party marketers.

"The news industry has been an active participant in violating individual readers’ privacy by benefitting from non-consensual third party tracking and ads," the company said in its response. "Make no mistake: this NAA letter is the first shot fired in a war on all ad-blockers, not just on Brave."