Description of the issue:
The Brave Sync code can be revealed without prompting for a password. This is a major security concern because anyone with local access to the device can extract the sync code and use it to gain access to synced data. I was recently hacked due to this vulnerability, the attacker was able to access my sync code without authentication. They used the Sync code on their own device and put their own local password to reveal everything that is locked under password.
Edit: This also allowed them to Export Passwords > Download File because their local password cleared the authentication
Steps to Reproduce (add as many as necessary):
-
Open Brave on a device that is part of a Sync chain.
-
Navigate to Sync settings.
-
View or reveal the sync code, it displays without requiring the system password or Brave profile password.
Reproduces how often:
Always (100%).
Brave Version (See the About Brave page in the main menu):
Version 1.81.136 Chromium: 139.0.7258.143 (Official Build) (64-bit)]
Type of devices currently running on the Sync chain in question:
Windows 10, Android
Additional Information:
This is a critical vulnerability because the sync code is the master key to a user’s encrypted sync chain. It should never be exposed without requiring authentication. Please address this immediately- ideally by requiring the OS login password, Brave profile password, or other secure method before displaying the sync code.