You're paying AI companies a monthly subscription fee to be fingerprinted like a parolee.

I got bored and ran uBlock across Claude, ChatGPT, and Gemini simultaneously.

Claude:

  • Six parallel telemetry pipelines.
  • A tracking GIF with 40 browser fingerprint data points baked into the URL, routed through a CDN proxy alias specifically to make it harder to block.
  • Intercom running a persistent WebSocket whether you use it or not.
  • Honeycomb distributed tracing on a chat UI because apparently your conversation needs the same observability stack as a payments microservice.

ChatGPT:

  • proxies telemetry through their own backend to hide the Datadog destination URL from blockers.
  • uBlock had to deploy scriptlet injection — actual JS injected into the page to intercept fetch() at the API level — because a network rule wasn't enough.
  • Also ships your usage data to Google Analytics. OpenAI. To Google. You cannot make this up.
  • Also runs a proof-of-work challenge before you're allowed to type anything.

Gemini:

  • play.google.com/log getting hammered with your full session behavior, authenticated with three SAPISIDHASH token variants, piped directly into the Google identity supergraph that correlates everything you've ever done across every Google product since 2004.
  • Also creates a Web App Activity record in your Google account timeline. Also has "ads" in one of the telemetry endpoint subdomains.

When uBlock blocks Gemini's requests, the JS exceptions bubble up and Gemini dutifully tries to POST the error details back to Google. uBlock blocks that too. The error messages contain the internal codenames for every upsell popup that failed to load.

KETCHUP_DISCOVERY_CARD.
MUSTARD_DISCOVERY_CARD.
MAYO_DISCOVERY_CARD.

Google named their subscription upsell popups after condiments and I found out because their error handler snitched on them.

All three of these products cost money.
One of them is also running ad infrastructure.

Touch grass. Install @ublockorigin

#infosec #privacy #selfhosted #foss #surveillance

@k3ym0 @ublockorigin Fascinating and worrisome. For the less technically adept… would uMatrix be as effective? Or are these specific capabilities of uBO?

@QuercusMacrocarpa @ublockorigin uMatrix is unfortunately abandoned — development ended in 2021, same developer as uBlock Origin, he just stopped. there's also an unpatched vulnerability in it so I'd avoid it at this point.

uBlock Origin in medium mode covers most of what uMatrix used to do for this specific threat — it blocks third party scripts and XHR requests by default which is exactly what catches the telemetry pipelines I documented.

one important caveat though: if you're on Chrome, uBlock Origin was gutted by Google in late 2024 as part of their Manifest V3 changes. the full version no longer works on Chrome. for real protection you need Firefox or Brave with uBlock Origin installed. which, honestly, is probably worth a separate post.

@k3ym0 @ublockorigin

This is really helpful information - thank you!

From Firefox + uMatrix on Windows, currently in process of becoming a Windows refugee on MacOS; had started with Safari, but leaning toward shifting to Firefox (more privacy protections?)… and apparently with uBlock Origin based on what you mention.

Might also be worth a separate post to explore the “why” of the devious telemetry obfuscation - e.g. no ads for ChatGPT Plus, so why hide Datadog etc…?

@QuercusMacrocarpa @k3ym0 @ublockorigin

but leaning toward shifting to Firefox (more privacy protections?)…

No, pls consider LibreWolf, it is latest firefox but does not fleece the user.

Use a privacy respecting DNS provider, never cloudflare or google 8.8.8.8 that signifies Heil h twice for nazis.

@Kerplunk @k3ym0 @ublockorigin

Thank you for mentioning LibreWolf… had not been on my radar. Took a look and it is appealing that it apparently has uBO bundled in!

The only downside of uBO I’ve run across since installing is that something (am presuming blocking of Google Fonts) causes odd characters in the menuing for some sites (like Google Maps but also non-google sites that must use their fonts).

And thanks for the reminder about DNS, have been meaning to switch to Quad9…