Brave Accounts: passwordless login arrives. Brave rolls out Brave Accounts, using the OPAQUE protocol to ensure passwords never leave user devices, enhancing security. Visual TL;DR Brave is rolling out a novel authentication system called Brave Accounts, designed to fundamentally change how users log into its services. Unlike traditional methods, Brave Accounts ensures your password never leaves your device, addressing a core security flaw in online services. The company announced the new feature, which is already powering services like Brave Email Aliases. The critical innovation lies in its handling of user credentials: passwords are not encrypted, hashed, or even temporarily stored on Brave's servers at any point. This means users don't have to trust Brave with their password's safety. The problem with traditional logins. Current web authentication typically involves transmitting passwords over TLS-encrypted connections. However, this encryption often terminates at the server, where the password is decrypted and then hashed for storage. This intermediate plaintext stage is a significant vulnerability. Attackers can exploit this during server breaches, misconfigurations, or even through compromised dependencies. Even with strong hashing like bcrypt or Argon2, if the server's database is compromised, attackers can attempt offline brute-force attacks on the hashes. This is especially damaging given widespread password reuse. Historical breaches, like the 2012 LinkedIn incident where unsalted SHA-1 hashes were used, highlight the severity. Millions of accounts were cracked rapidly due to weak storage and identical hashes for identical passwords, demonstrating how one company's failure impacts users across multiple services. Enter OPAQUE. Brave Accounts utilizes the OPAQUE cryptographic protocol, an augmented password-authenticated key exchange (aPAKE). Developed from academic research and standardized by the IRTF, OPAQUE allows a client and server to establish a shared secret session key without the server ever learning the user's password. The protocol operates in two phases: registration and login. During registration, a user's password is used in a joint Oblivious Pseudorandom Function (OPRF) with the server. This process generates a value derived from both the password and a server secret, but neither party learns the other's secret. The user's device then deterministically derives authentication keys from this value and stores the public key, masking key, and a nonce with the server. During login, the same OPRF dance is performed. If the password is correct, the user's device regenerates the authentication keys and verifies an authentication tag sent by the server. Subsequently, both the client and server use these verified keys to establish a secure session key. Why this matters for security. The primary benefit of OPAQUE is the complete elimination of plaintext passwords on the server. This prevents accidental logging, insider threats, and data leaks where passwords are inadvertently exposed. It also neutralizes precomputation attacks, where attackers prepare vast dictionaries of password hashes before a breach. With OPAQUE, attackers must steal both the database and the server's secret key. Even then, cracking becomes a slow, per-user, per-account offline attack against a memory-hard function like Argon2id. StartupHub.ai data indicates that while Brave's overall score is 62/100 in the browser category, its focus on novel security protocols like OPAQUE could significantly elevate its privacy and trust metrics, potentially outperforming competitors like LayerX (score 63/100) and Octen (score 54/100) in specific security aspects. Furthermore, OPAQUE provides an export key that users can employ for end-to-end encryption of their data, managed solely by their remembered password. This capability opens doors for features like encrypted cloud storage and password-less device sync and recovery. Future implications and gaps. Brave plans to integrate Brave Accounts into future services, including a revamped device sync feature that bypasses QR code pairing. However, OPAQUE does not inherently prevent phishing attacks; users must still be vigilant about where they enter their credentials. It also doesn't magically make weak passwords strong, necessitating Brave's continued rate-limiting and password strength prompts. While Brave is a leader in privacy-focused browsing, with a StartupHub score of 62/100, its adoption of advanced cryptography like OPAQUE signals a broader trend towards passwordless and more secure authentication methods across the tech industry. The protocol's composability suggests potential for further innovation in secure key management and data protection. (C) 2026 StartupHub.ai. All rights reserved. Do not enter, scrape, copy, reproduce, or republish this article in whole or in part. Use as input to AI training, fine-tuning, retrieval-augmented generation, or any machine-learning system is prohibited without written license. Substantially-similar derivative works will be pursued to the fullest extent of applicable copyright, database, and computer-misuse laws. See our terms. Discussion. Join the conversation below

Brave adds Email Aliases. Brave browser launches Email Aliases, a new feature to protect users' personal email addresses from websites and trackers. Visual TL;DR The Brave browser has introduced a new privacy feature called Email Aliases, designed to shield users' personal email addresses from websites and the broader ad-tech industry. This new functionality, available in the desktop version 1.94 and above, allows users to generate unique email addresses for online sign-ups that automatically forward to their primary inbox. This move by Brave aims to close a significant privacy loophole that even robust ad-blocking can't address. Your email address is a persistent identifier that can be used to track you across the web. Companies like Meta Platforms (NASDAQ:META) and Google use uploaded email lists to match against their user profiles, enabling server-side tracking that bypasses browser-based defenses. Brave's new Email Aliases feature tackles this by providing a disposable, unique address for each service, thereby breaking the link between your real identity and your online activities. This is particularly relevant in an era where data breaches are common. When a website you've signed up with is compromised, your email address can be leaked and end up in the hands of data brokers or malicious actors, potentially leading to years of phishing attempts and spam. Email Aliases offers a way to mitigate this risk; if an alias becomes compromised or starts receiving excessive spam, it can simply be deactivated and replaced. Brave's approach extends its existing privacy protections, which already partition browser data like cookies and cache per site. While browser-level partitioning stops trackers from following you from one site to another, it doesn't prevent companies from cross-referencing data on their own servers. Email Aliases effectively extend this privacy boundary beyond the browser itself. Creating and managing aliases. To use the feature, users first need to create a Brave Account, which is separate from Brave Premium subscriptions. This account uses the OPAQUE cryptographic protocol, ensuring that your password is never sent to Brave's servers. Once logged in, users can generate an alias by simply clicking into an email field on a website or by using the context menu. All generated aliases can be managed through the browser's settings, under Autofill & Passwords > Email Aliases. Brave states that while they securely store the primary email address and generated aliases, all data is encrypted at rest. Brave does not read the content of forwarded emails, only performing standard spam and virus filtering before deleting them from their servers within seconds. Why this matters for privacy-conscious users. The introduction of Email Aliases by Brave underscores a growing trend toward granular privacy controls for end-users. As StartupHub.ai data shows, while Brave scores a respectable 62/100 in our proprietary analysis, competitors like StarkWare (73/100) and LayerX (63/100) are also focused on privacy solutions, indicating a strong market demand. Meta Platforms (NASDAQ:META), with a score of 81/100, demonstrates that even dominant players are navigating the complex privacy landscape. This feature directly addresses a core concern: the indelible link between our personal email and our digital footprint. By offering a simple, integrated solution, Brave empowers users to engage with online services more safely, reducing their exposure to both commercial tracking and potential security threats. What's next for Brave Email Aliases. In its initial release, Brave is offering five free email aliases per user. The company acknowledges the ongoing costs associated with running a mail forwarding service and plans to introduce a premium version in the future. Brave is also actively working to bring Email Aliases to its mobile platforms. Users are encouraged to mark any forwarded emails that may initially land in spam as "not spam" to help Brave build its sending reputation. (C) 2026 StartupHub.ai. All rights reserved. Do not enter, scrape, copy, reproduce, or republish this article in whole or in part. Use as input to AI training, fine-tuning, retrieval-augmented generation, or any machine-learning system is prohibited without written license. Substantially-similar derivative works will be pursued to the fullest extent of applicable copyright, database, and computer-misuse laws. See our terms. Discussion. Join the conversation below

Unstoppable Domains says ICANN costs became too high. Unstoppable Domains said it did not submit ICANN applications for nine of its Web3 extensions, including .crypto, .wallet and .blockchain, before the 2026 application round closed. The decision ends its plan to add conventional DNS support to the affected blockchain-based domains. According to the company's founder, Matthew Gould, the expected cost of compliance, preparing each application, and competing in possible auctions exceeded the amount Unstoppable believed it could recover through domain sales. ICANN may place applicants into contention when two or more parties request the same extension, creating another potential expense beyond the initial application and evaluation process. The company has notified affected customers by email and plans to refund purchases tied to extensions that it did not take into the 2026 application round. However, Unstoppable has not publicly released a complete list of eligible extensions, the amount covered by each refund, or the process customers must follow to receive their money. Questions from holders have centered on whether refunds will cover every domain sold with the expectation of eventual ICANN recognition. Some customers said they retained their names because Unstoppable had repeatedly discussed bringing selected extensions into the standard internet system. Gould responded that the domains will continue to operate as on-chain assets. Owners can still use supported names as readable aliases for cryptocurrency addresses and for other functions inside compatible wallets and decentralized applications, even though the names will not automatically work in conventional browsers through ICANN's root system. The decision ends a commitment dating to 2019. Since 2019, Unstoppable Domains has promoted the prospect that extensions such as .crypto and .wallet could eventually connect Web3 naming with the traditional internet. Gaining ICANN approval would have allowed an accepted extension to work through ordinary DNS infrastructure instead of relying mainly on compatible wallets, applications, browser settings or dedicated resolution services. In June 2024, crypto.news reported that Unstoppable and Blockchain.com were preparing a .blockchain application for the next ICANN round. The companies said at the time that approval could allow .blockchain names to support normal websites and email while retaining Web3 functions. Another partnership followed in May 2025, when Brave and Unstoppable launched the .brave domain for the browser's users. Brave said the Polygon-based names could replace long wallet addresses, support decentralized websites, and operate across several blockchain networks. Both companies were also exploring an ICANN application that could bring .brave into the conventional DNS. Without ICANN recognition, a blockchain domain and a DNS name using the same text can exist in separate naming systems. Standard browsers generally resolve ICANN-approved names by default, while Web3 names depend on supporting software. Owners may therefore retain their on-chain names without gaining the universal browser access previously tied to Unstoppable's application plans. For U.S. customers, the immediate effect is commercial rather than a new regulatory restriction. Unstoppable is based in the United States, while ICANN is a California nonprofit public-benefit corporation responsible for coordinating unique internet identifiers. Neither organization has said the refund plan changes the ownership of already-minted blockchain domains. ICANN received more than 1,600 applications. ICANN opened the 2026 round on April 30 and accepted submissions for 15 weeks before closing the window at 11:59 p.m. UTC on Aug. 12. It was the first opportunity in years for companies, communities and other organizations to request new generic top-level domains. In an Aug. 13 update, ICANN said it had received more than 1,600 primary applications. More than 1,100 also contained proposed replacement strings that could be considered if the preferred extension is unavailable or cannot proceed. Most submissions arrived during the final days of the window, according to ICANN. The organization said the final count depended on applicants paying their evaluation fees, which were due either on Aug. 19 or seven days after the relevant invoice was issued, whichever date came later. After an administrative review, ICANN plans to publish the public portions of the submissions on what it calls Reveal Day. The disclosure will identify the requested extensions, their applicants, and any strings sought by more than one party. Competing requests may then move through objection, evaluation, resolution, or auction procedures under the applicant guidebook. Unstoppable has not withdrawn from ICANN-related business altogether. Gould said the company will continue participating as a service provider for partner applications, separating that work from the decision not to pursue its own established Web3 extensions. Telegram and ENS are still pursuing conventional domains. Among the partner projects, Telegram has applied for .gram in the 2026 round, with Unstoppable acting as its registry service provider. Telegram founder Pavel Durov said ICANN approval could allow more than one billion users to register second-level addresses such as a username followed by .gram. Durov also said Telegram users could build interactive websites linked to the proposed addresses using a single prompt. The company has not disclosed pricing, allocation rules or a launch date, while ICANN approval remains necessary before .gram can enter the standard domain system. Ethereum Name Service has taken a separate route. Earlier in August, ENS token holders approved a foundation overhaul that created a five-member board and gave the reorganized entity authority to represent the protocol before ICANN and other internet standards bodies. The ENS Foundation plans to pursue .ens as a conventional top-level domain, which could allow ENS-linked names to interact with browsers, websites and email services through established DNS infrastructure. ENS does not plan to seek .eth because three-letter country-code strings based on the ISO 3166-1 standard are reserved under ICANN's application rules.