MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found
A Habra user Slava_B tested the desktop client of the MAX messenger on Windows to check whether it could recognize or bypass a VPN when traffic routing occurred at the router level rather than inside the operating system.
The experiment took place on 8 September 2026. A Windows computer was connected to a Keenetic router configured to send Russian resources directly while routing selected foreign connections through an OpenConnect tunnel to a European VPS. No VPN client, virtual adapter, or special routes existed inside Windows itself.
Researchers monitored the client using Process Monitor, Wireshark, and TCPView, while traffic on the remote server was captured with tcpdump. The application launched two processes, MAX.exe and MAX-service.exe, which communicated over a local port.
The client established connections to MAX/ONEME infrastructure, the AppTracer service, and systems used for calls. It repeatedly read the MachineGuid identifier, computer name, proxy and PAC settings, its own device IDs, and information about microphones and cameras.
These reads may serve legitimate purposes such as diagnostics, anti-fraud measures, corporate proxy support, and call functionality. Importantly, no connections from MAX appeared on the VPN interface of the VPS, and the application did not contact external IP detection services, Telegram, or WhatsApp.
The researcher stressed that TLS traffic content was not decrypted, so it remains unproven whether identifiers were actually sent to servers. The findings apply only to the tested router-based configuration and do not cover scenarios where a VPN client runs directly inside Windows.
Related articles
Can Wi-Fi Owners See Your Google Search History? HTTPS, DNS, SNI and ECH Explained
A viral social media video sparked widespread concern that Wi-Fi owners could view users' search history and visited sites simply by knowing the router password. Security experts from Cybernews and Surfshark clarified that modern HTTPS encryption prevents reading of actual search queries or page content. However, metadata such as DNS requests, SNI fields in TLS handshakes, and device MAC addresses remain visible to the network administrator. The introduction of Encrypted Client Hello (ECH) under RFC 9849 aims to hide domain names, yet Russian authorities have blocked many ECH-enabled connections since November 2024. Corporate or school-managed devices with installed root certificates represent the main real-world exception where full traffic inspection is possible. VPNs hide destinations from the local router but transfer visibility to the VPN provider. The article emphasizes that password-protected Wi-Fi grants access only to connection metadata, not browser history.
Yandex Deploys OPRF Protocol to Protect Phone Numbers in Mandatory Audience Measurement Data Sharing
Yandex has detailed a cryptographic scheme using Oblivious Pseudorandom Function (OPRF) to help Russian audiovisual services comply with new legislation requiring transmission of user identifiers linked to phone numbers. The approach replaces a naive shared-secret hashing method that created a single point of compromise across dozens of competing companies. Instead, two independent third parties each hold separate secret keys and process blinded elliptic-curve points derived from normalized E.164 phone numbers. Services obtain deterministic identifiers without learning the third-party keys and without exposing raw numbers to the authorized research organization. The design distributes trust, limits offline brute-force attacks to scenarios requiring both keys plus final identifiers, and adds rate limits plus key-rotation capabilities to deter abuse. Yandex positions the solution as a practical compromise between regulatory demands, competitive secrecy, and user privacy.
CookieTin Extension Manages Partitioned Cookies Across Firefox, Chrome and Edge
Developer Perruer2 has released CookieTin, an open-source browser extension that fully supports partitioned cookies under Firefox Total Cookie Protection and Chrome CHIPS. The tool addresses limitations in older managers like Cookie Quick Manager by correctly retrieving and deleting cookies stored with partitionKey values. It works across Firefox, Chrome and Edge using a single Manifest V3 codebase written in TypeScript and Preact. Key features include accurate cookies.txt export compatible with curl and yt-dlp, protected cookies that survive explicit deletion, and pre-save validation of browser rules for __Host- prefixes and SameSite attributes. E2E tests using Puppeteer verify handling of HttpOnly, partitioned and container cookies in all three browsers.
Kaspersky Premium for macOS Gains App Uninstall Feature to Remove Residual Files
Kaspersky Premium now includes an App Uninstall tool for macOS that locates and deletes leftover files such as caches, cookies, settings, and logs after applications are removed. The feature also identifies duplicate copies of programs and lets users remove all instances or select specific ones while preserving shared components used by other software. Survey data from Kaspersky shows that only 44 percent of macOS users delete unused applications, even though 56 percent regularly clear browser data and 54 percent remove unwanted media files. Residual files can contain sensitive information including account tokens, passwords, IP addresses, event logs, and personal documents, creating privacy risks especially when a device is sold or accessed by unauthorized parties. Deleted files can be restored from the trash or directly within Kaspersky Premium before the application session ends. The company also warns that malicious programs are frequently disguised as legitimate macOS cleaning utilities.