block domains on the tracking protection list until user consents

In app/trackingProtection.js:

// Temporary whitelist until we find a better solution
const whitelistHosts = ['connect.facebook.net', 'connect.facebook.com', 'staticxx.facebook.com', 'www.facebook.com']

Currently hosts that are on the Tracking Protection list but cause some important functionality (like fb login) to break are added to this whitelist so they don’t get blocked. My preferred long-term solution is to block by default but detect when a site is likely to break and pop up a dialog asking the user if they’d like to allow the domains to potentially track them.

Concrete example:

1. user loads coolsite.com
2. Brave sees a request to connect.facebook.net to download sdk.js or all.js and infers that coolsite.com is going to use a Facebook feature
3. Brave shows a dialog that says, “Allow connections to connect.facebook.net and www.facebook.com so that you can use Facebook features (such as login and like buttons) on this page?”

[markwylde]

This came up on hackernews today, although it’s been flagged: https://news.ycombinator.com/item?id=19129309

Maybe I’m missing something, but this is a pretty big issue for a browser that claims to be privacy focused. Can we not escalate this a little. We’re whitelisting one of the most controversial companies at the minute. This can’t be good for PR.

[BrendanEich]

@markwylde please see https://www.reddit.com/r/privacy/comments/ap9149/brave_privacy_browser_has_a_backdoor_to_remotely/eg6vckb/.

@diracdeltas had a better idea noted here: https://twitter.com/brendaneich/status/1094752832790552577?s=21