Brave CISO Yan Zhu on privacy-first browsing: data you never collect can't leak
gnukeith · x · 2026-10-12
Episode 39 of the Brave Technologist podcast features Yan Zhu, CISO at Brave since 2015 (formerly Yahoo security engineer and EFF staff technologist on HTTPS Everywhere and Let's Encrypt).
- Brave's core principle since day one: if they don't need it, they don't collect it. Data that never exists can't be compromised, which she calls the strongest security decision a company can make
- Because Brave doesn't collect payments data, it isn't subject to PCI compliance, and personal data is kept to the bare minimum with clear user disclosure
- Topics include browser-specific security challenges, reducing your risk of getting compromised online, the evolution of Passkeys and 2FA, and SIM swapping
- She also explains how security and policy teams work together to shape company culture that protects both users and the company
More from Safety
- Is Slowing AI Still Responsible If Rivals Reach AGI First? — whoislucian · 2026-10-12
- 4 edge cases that break AI agent data sanitization, from schema drift to composite PII — avant-gate-7758 · 2026-10-12
- Do not install Zod 4.6.6 – version may be infected, warns HN thread — luggage_bazooka · 2026-10-12
- Yglesias urges OpenAI employees to collectively act against anti-regulation super PAC — AaronBergman18 · 2026-10-12
- Password "123456" on admin accounts breached data of 8.8M people in Denmark — AIFlow_ML · 2026-10-12
- Analyst finds Ohio Lindner call likely authentic, not AI-generated — kevinnbass · 2026-10-12