OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com. The value is while you are on ChatGPT and tied to your ChatGPT account. __obi is then sent to OpenAI from ord...

Posted by alberto-m with a score of 152

ChatGPT Won't Let You Type Until Cloudflare Reads Your React State

Un investigador desmonta el script que impide escribir en ChatGPT hasta que Cloudflare termine de escanear el estado interno de React. El análisis revela cómo se interceptan eventos de teclado y se ralentiza la UI para cumplir con la detección de bots. La comunidad debate el impacto en la privacidad y la experiencia de usuario.

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU,...

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

Posted by alberto-m with a score of 48

Every ChatGPT message triggers a Cloudflare Turnstile program that runs silently in your browser. I decrypted 377 of these programs from network traffic and found something that goes beyond standard browser fingerprinting. The program checks 55 properties spanning three layers: your browser (GPU, screen, fonts), the Cloudflare network (your city,

The BIGO Ads SDK ships with an encrypted configuration file that maps out a global network of ad-serving domains, backup hosts, and failover infrastructure. The file is AES-encrypted with a hardcoded ...

How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weat...

How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weat...

How a one-character configuration mistake turns feature flags into a competitive intelligence feed The Twitch iOS application initializes the Eppo feature flagging SDK (now a Datadog product) using server-side SDK Keys instead of Client Tokens. This means every flag configuration is returned to the device in plaintext: flag names, variation

How a one-character configuration mistake turns feature flags into a competitive intelligence feed The Twitch iOS application initializes the Eppo feature flagging SDK (now a Datadog product) using s...

The BIGO Ads SDK ships with an encrypted configuration file that maps out a global network of ad-serving domains, backup hosts, and failover infrastructure. The file is AES-encrypted with a hardcoded key, served from Alibaba Cloud, and designed to make the ad network resilient to domain blocking. The SDK source

How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weather Company's API (api.weather.com) at fixed intervals. Each request includes a placeid parameter - a 64-character hexadecimal string, consistent with

A study of 9,211 weather API requests from 42 Samsung devices found that the pre-installed Samsung Weather app generates a unique, persistent device fingerprint using saved location IDs (placeid values). This fingerprint remains consistent across IP changes, VPNs, and network roaming, with 96.4% uniqueness among users. The app transmits these identifiers to api.weather.com (The Weather Company/IBM) via hardcoded API keys, along with redundant GPS coordinates. Previous legal actions have targeted weather apps for similar location-tracking practices.

How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weather Company's API (api.weather.com) at fixed intervals. Each request includes a placeid parameter - a 64-character hexadecimal string, consistent with

How a pre-installed system app turns saved locations into a persistent cross-session tracking identifier Samsung devices ship with a weather application that issues periodic HTTP requests to The Weather...

When you open Duolingo to practice Spanish, BeReal to share a photo, or Character.AI to chat with a bot, you probably don't expect your battery level, storage capacity, and internal IP address to be sent to ByteDance, the company behind TikTok. But that's exactly what's happening. And the encryption

When you open Duolingo to practice Spanish, BeReal to share a photo, or Character.AI to chat with a bot, you probably don't expect your battery level, storage capacity, and internal IP address to be sent to ByteDance, the company behind TikTok. But that's exactly what's happening. And the encryption

This is Part 2 of my Pangle SDK research. Part 1 covered how I broke the encryption. This post covers what I found when I started comparing the decrypted data across apps. In Part 1, I decrypted 694 Pangle SDK payloads and documented what ByteDance collects: battery level, storage capacity,

When you open Duolingo to practice Spanish, BeReal to share a photo, or Character.AI to chat with a bot, you probably don't expect your battery level, storage capacity, and internal IP address to be sent to ByteDance, the company behind TikTok. But that's exactly what's happening. And the encryption

When you open Duolingo to practice Spanish, BeReal to share a photo, or Character.AI to chat with a bot, you probably don't expect your battery level, storage capacity, and internal IP address to be sent to ByteDance, the company behind TikTok. But that's exactly what's happening. And the encrypt...

The post references an article detailing how Duolingo continues to communicate with ByteDance’s Pangle advertising network despite user opt-outs. It describes how Pangle uses fingerprinting techniques to track users across multiple apps. The article highlights that this behavior persists even after users decline tracking permissions.