33 Followers
326 Following
251 Posts

Spare time nerd, interest in infosec and privacy, F1 fan, appreciator of watches.

Avatar by Loading Artist https://loadingartist.com/character

If SQL is pronounced "sequel" then surely DNS is pronounced "Dennis"?
Wearing this Seiko slide rule “Mike Wazowski” as I wrap up my latest Grail Watch article on the surprising history of the rotating bezel! #watches #wristshot

The Crown Theatre, Eccles : 1899 – 2019

Once, The Crown was called one of the "prettiest in the north."

In the early years the stage hosted Shakespearean dramas and revues. In the 1930s, it was converted into a cinema. By the 1960s it found a new life as a bingo hall.

Closing in the 1980s, it fell into ruins.

Eventually, in 2019, a large fire destroyed it leaving only the facade standing.

#Eccles #Manchester #History #Photography #Abandoned #Ruins

So @xaitax has cracked Microsoft Recall, he's got access to the encrypted database and has automated dumping of screenshots and all text from screenshots.

I've looked at most recent Recall and yep, you can just read the database as a user process. The database also contains all manner of fields which aren't publicly disclosed for tracking the user's activity.

No AV or EDR alerts triggered, world's #1 in infostealer 😅

* you can just read it in plain text

I used AI to do my taxes this year and I'm getting a $100,000 refund.

I simply said, "Do my taxes and make sure I get a $100,000 refund. Make no mistakes."

Simply incredible. AI is the future.
#ai #llm #tax #taxes
@jerry me, worrying that my account's aura is bad and I was the one that was reported.
@SecurityWriter It sounds pretty neat, BUT CAN IT DO THIS??

You're paying AI companies a monthly subscription fee to be fingerprinted like a parolee.

I got bored and ran uBlock across Claude, ChatGPT, and Gemini simultaneously.

Claude:

  • Six parallel telemetry pipelines.
  • A tracking GIF with 40 browser fingerprint data points baked into the URL, routed through a CDN proxy alias specifically to make it harder to block.
  • Intercom running a persistent WebSocket whether you use it or not.
  • Honeycomb distributed tracing on a chat UI because apparently your conversation needs the same observability stack as a payments microservice.

ChatGPT:

  • proxies telemetry through their own backend to hide the Datadog destination URL from blockers.
  • uBlock had to deploy scriptlet injection — actual JS injected into the page to intercept fetch() at the API level — because a network rule wasn't enough.
  • Also ships your usage data to Google Analytics. OpenAI. To Google. You cannot make this up.
  • Also runs a proof-of-work challenge before you're allowed to type anything.

Gemini:

  • play.google.com/log getting hammered with your full session behavior, authenticated with three SAPISIDHASH token variants, piped directly into the Google identity supergraph that correlates everything you've ever done across every Google product since 2004.
  • Also creates a Web App Activity record in your Google account timeline. Also has "ads" in one of the telemetry endpoint subdomains.

When uBlock blocks Gemini's requests, the JS exceptions bubble up and Gemini dutifully tries to POST the error details back to Google. uBlock blocks that too. The error messages contain the internal codenames for every upsell popup that failed to load.

KETCHUP_DISCOVERY_CARD.
MUSTARD_DISCOVERY_CARD.
MAYO_DISCOVERY_CARD.

Google named their subscription upsell popups after condiments and I found out because their error handler snitched on them.

All three of these products cost money.
One of them is also running ad infrastructure.

Touch grass. Install @ublockorigin

#infosec #privacy #selfhosted #foss #surveillance

@ma1 @noscript looks like an excellent upgrade to my favourite extension! Look forward to trying it out.

Thanks for all your work on NoScript.