Brave PDF file handling question

Topic

New Reply

I have asked this question on the Brave community forum but no response there to thought I would ask it here.

I am new to Brave, previously using Vivaldi.  I like pdf docs to be displayed in the browser and found the setting in Brave that but I’m wondering how Brave handles local storage of the file. In Vivaldi, the pdf file is downloaded to a temp directory (that can be user specified) and that file content is then it is displayed in Vivaldi.  This works well but Vivaldi leaves the pdf file in the temporary location requiring manual deletion.  I do not see a configuration option in Brave where I can specify a temporary directory nor can I find the location of pdf files displayed in Brave (I don’t see them in C:\Users\<user>\AppData\Local\BraveSoftware).  Does anyone know…

…where Brave writes these files?

…whether Brave leaves them orphaned like Vivaldi does?

Reply | Quote

Replies

I am a Brave user. I think the downloaded PDF is stored, encrypted, at:

c:\Users\[user name]\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\

To test this, I looked at the contents of that directory, then immediately downloaded a PDF of about 17mb, then looked in that directory again. There was a new encrypted file of about 17mb.

Dell XPS17, 11th Gen Intel I7, 64gb RAM, Windows 11 Home 23H2

Reply | Quote

Thanks Paul, that helped.  In my test, a file named “f_00576e” was created.  It was not encrypted though.  Opening it with my pdf viewer displayed the document.  The file remained in place after closing Brave which is disappointing.  IMO, these so-called “secure” browsers should not leave that kind of data behind, or at least provide an easy way to remove it without having to clear the entire cache.  I think I best disable the “display in browser” option and change to manual download, view it, and then delete when done as desired.

Reply | Quote

Here is a partial list of the files in the Cache_Data\ folder.  Like yours, they all begin F_:

And here is a sample of the content in one of my F_ files.  All similar.  Isn’t this encrypted?

The F_ files have no extension.  I added a .pdf extension to one, but it doesn’t open as a pdf.

 

 

Dell XPS17, 11th Gen Intel I7, 64gb RAM, Windows 11 Home 23H2

Reply | Quote

No this is not an encrypted file however it is compressed data. ‘wOF2’ is the Web Font file header which is how modern site pages look fancy this days, because browsers can render fonts locally without all of them being installed on your computer.

Cursory research suggests that Web Fonts can possibly be embedded into Portable Document Files.

Edit: Saw you latest reply, Perhaps Brave is saving Web Font to your temporary directory instead of the cache.

Reply | Quote

I wouldn’t expect the file to be encrypted, but the filename will probably be random.
If you want it encrypted, encrypt C: with Bitlocker or Veracrypt.

cheers, Paul

Reply | Quote

Paul wrote:

The F_ files have no extension.  I added a .pdf extension to one, but it doesn’t open as a pdf.

Not all of them are .pdf files.  My test was to open an online pdf and then check the cache directory for the new f_* file.  I then right clicked on it and directed it to be opened with my pdf viewer.  That worked.

When opened with Notepad, the first line is “%PDF-1.4” as expected.  The rest of of the file looks to be gibberish but that’s because Notepad can’t read .pdf content.  A search of files in the Cache_Data directory for the text “%PDF-1.4” located the file.  This is the disturbing part for me because these files often contain personal and/or financial information.

Edit: Mia culpa for expressing my thinking that the handling if pdf files viewed internally by Vivaldi and Brave is different.  It is not.  Vivaldi records the files in Cache_Data as f_* files just like Brave does.  The difference with Vivaldi is that you can specify a download directory.  So, what I figured out that I had been doing in Vivaldi was downloading the document and then viewing it with my pdf viewer.  For easy disposal, I have a shortcut to the Vivaldi downloads folder on my desktop.  Invoke it > Ctrl+A > Delete and they’re gone after emptying the recycle bin (notwithstanding the use of a file recovery tool).  Obviously you can do the same in Brave but you must be sure to place the downloaded file in the same place every time.  Vivaldi makes that easy by allowing you to specify the default download directory.

1 user thanked author for this post.

Paul

Reply | Quote

I’m wondering how Brave handles local storage of the file.

I use Brave & Firefox and I wipe all Cache data from all my browsers before shutting down my computer, but I do it as “house cleaning” before updating my Macrium Reflect image backups.

However, IMO there is no way to know if the content of any PDF file viewed in any browser is purely local, or visible to various servers browsers use. The same goes for Adobe Acrobat and other PDF readers and editors. I’ve used them all over the years without consequence and never thought about “phoning home” while I’m viewing bank and credit card statements. With the global rise of malicious hacking and malware I’ve gotten more paranoid.

For that reason, I use the clean and simple Sumatra PDF viewer and block it in my firewall. It works fine as truly local software. For editing I use an older version PDFsam and it’s also blocked and works well.

Comments? Agree/Disagree?

Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

Reply | Quote

Viewing a PDF document with a locally installed specific app usually means that you have the PDF file stored locally; you know where it is and can easily manipulate it.  Any sensitive document is a risk but if you have control of it, you can minimize any risk.  My concern is with PDF documents that are viewed with the internal pdf viewer of a browser.  They are unknowingly (to most people I think) left on the hard drive, buried in the browser cache, unidentifiable as PDF documents.  For example, if I login to my bank website and view a PDF of my statement with the Brave or Vivaldi internal PDF viewer, that document remains in the cache until deleted.  AFAIK, had I logged in and only viewed my bank activity, nothing resembling back statement information would be retrievable from the cache.  I don’t believe that clearing a browser’s cache should be required to protect sensitive information nor should such information be stored in the cache unbeknown to users.  It’s worse when done by browsers that tout “privacy”.

1 user thanked author for this post.

Paul

Reply | Quote