The Brave Browser with Kyle Den Hartog

Have you heard of Brave? Today we are joined by Kyle Den Hartog, a security engineer at *the* privacy browser. His path runs from penetration testing to self-sovereign identity to Web3, and that bridge between the Web2 and Web3 worlds runs through the whole conversation. They start with how Brave made privacy mainstream: sane defaults and treating privacy as an emergent property that has to be fought for at every layer, with surveillance capitalism as the threat model rather than Tor-style maximalism. From there, why the biggest problems are no longer smart-contract bugs but browser and interface attacks, and a sharp point about domain expertise: crypto wallet teams often don't realise the browser already solves their problems (MetaMask's phishing list vs Safe Browsing, Rabby leaking browsing history vs hash-prefixing). It's also why Brave built its wallet into the browser rather than as an extension. The most provocative stretch is Kyle's argument that Web3 is accidentally reintroducing cross-origin tracking. A wallet address is just a cookie: shared across sites on "connect," and far more revealing than any third-party cookie because it exposes where, when, and how much you spend. His fix is the thick client, moving transaction-building into the wallet so untrusted sites never receive the address. The conversation then ranges across why zero-knowledge proofs aren't the panacea they're treated as (the "20 questions" problem), how ZK-gated compliance can recreate the gatekeeping Web3 set out to escape, why the early internet's lack of an identity layer was a feature, and a thoughtful take on age verification. Kyle closes on what Web2 and Web3 get wrong about each other, and his practical privacy advice beyond switching to Brave: a reputable audited VPN, then moving off the platforms that track you most. Key Topics How Brave made privacy mainstream, and the browser as the real attack surface Why a wallet address is the new tracking cookie, and the "thick client" fix The limits of zero-knowledge proofs, identity, and getting age verification right Chapters 00:00 Introduction 00:35 From Penetration Testing to Self-Sovereign Identity to Brave 01:49 Making Privacy Mainstream: Sane Defaults and Emergent Privacy 04:34 The Brave Wallet, BAT, and Rethinking What the Infrastructure Is For 07:07 The Browser as Attack Surface: What Browsers Can Actually Do 10:06 Why Crypto Wallet Teams Miss What the Browser Already Solves 13:55 Why the Brave Wallet Is Built In, Not an Extension 16:02 Web2 Guy or Web3 Guy? Why Brave Over a Pure Web3 Protocol 19:05 How the Brave Wallet Compares, and the Pivot to Payments 21:56 How Web3 Is Reintroducing Cross-Origin Tracking 24:55 The Wallet as Cookie: Leaking Where You Spend Your Money 26:59 The "Thick Client" Fix 29:47 Are Zero-Knowledge Proofs a Silver Bullet? The 20 Questions Problem 34:20 Recreating Centralised Gatekeeping and the KYC Tension 38:27 Why the Early Internet Had No Identity Layer 42:00 Getting Age Verification Right: Moderation vs Who Decides 49:02 AI at Brave, and AI as a Tool 50:36 What Web2 and Web3 Get Wrong About Each Other 52:31 Practical Privacy Advice Beyond Switching to Brave 54:12 Where to Find Kyle, and What's Next for the Wallet Resources and Links Kyle on X: https://x.com/PryvitKyle Kyle's website and blog: https://kyledenhartog.com Brave: https://brave.com Oak Security's Research: https://research.oaksecurity.io/