Chrome Adds On-Device Gemini Nano While Ask Gemini Sends Page Content to Google Cloud
Google has added an AI on device toggle in Chrome settings that activates models running directly on the user's computer. The change supports several use cases, including detection of fraudulent websites. Several gigabytes of Gemini Nano weights now reside in the browser profile directory and execute on CPU or GPU.
Users might expect the downloaded model to power local features such as reading and summarizing the current page without cloud calls. However, Google chose a different approach. The company operates two separate systems under the single name Gemini.
Two Gemini Systems
Ask Gemini / Gemini in Chrome is a cloud service. When a user requests a summary or answers based on open tabs, the page content is sent to Google infrastructure. Gemini Nano is the local model downloaded by Chrome and invoked only through specialized browser APIs by websites, extensions, or the browser itself for initial checks.
- Ask Gemini / Gemini in Chrome – runs in Google cloud, invoked by the user
- Gemini Nano via built-in APIs – runs on the computer, invoked by sites and extensions
- Gemini Nano in Safe Browsing – performs primary analysis locally, invoked by Chrome
In the last case the model itself operates locally, yet with Enhanced Protection enabled its analysis results may be forwarded to Google Safe Browsing.
The Ask Gemini button in the interface triggers the cloud service. Page content and URLs are temporarily stored in the user's Google account, and with history saving enabled they appear in Gemini activity logs. Up to ten additional tabs shared by the user may also be processed in the cloud.
Related articles
Step-by-Step Guide to Removing Personal Data from Search Engines, Databases and Social Networks
The guide provides a practical seven-step checklist for individuals seeking to reduce their digital footprint by removing personal information from websites, search engines, and social platforms. It emphasizes starting with a 20-minute audit to compile exact URLs rather than vague requests, followed by direct contact with site owners under Russia's 152-FZ personal data law. Subsequent steps cover submissions to Yandex and Google for de-indexing, manual cleanup of old social media accounts, handling of phone numbers in caller ID services, and removal from directories and review sites. The process includes templates for formal requests, timelines for responses, and escalation paths to Roskomnadzor when operators fail to comply. Special attention is given to leaked databases, where technical removal is impossible, and to web archives such as Internet Archive that require specific legal justifications. The full cycle is estimated at two months, with quarterly maintenance recommended to sustain results.
telEgo Combines MTProxy and WEB Proxy on Single Port 443 with TLS Fronting
telEgo, a Go-based Telegram MTProxy implementation using the gnet network engine, now supports all four WEB proxy transport modes alongside traditional MTProxy connections on the same public port 443. The solution allows FakeTLS with ee secrets, Obfuscated2 with dd secrets, and WEB carriers including https, https-lanes, websocket, and websocket-lanes without requiring separate ports or secret changes. telEgo performs handshake detection, forwards ordinary TLS traffic to Nginx on a private port using PROXY protocol v2, and routes authenticated WEB streams back to the internal MTProxy backend. The setup uses Docker Compose with separate containers for telEgo, Nginx, and certificate management via Certbot, keeping ports 8080, 8443, and 8444 internal. Existing MTProxy links continue to function while new WEB proxy links become available for Telegram Desktop. The configuration supports Prometheus metrics, connection limits, and automatic certificate renewal through systemd timers.
From HAProxy to VLESS+Reality: Overcoming DPI Blocks for MTProto Telegram Proxies
A detailed case study describes the challenges of running an MTProto proxy for Telegram on Russian servers facing ISP-level DPI. Initial attempts using HAProxy TCP relays and SOCKS5 tunnels failed because modern DPI systems detect MTProto and fake-TLS signatures regardless of transparent forwarding. The author eventually succeeded by layering mtg with an Xray VLESS+Reality tunnel that performs genuine TLS 1.3 handshakes to legitimate domains. Key configuration pitfalls included the xtls-rprx-vision flow breaking non-TLS payloads, missing mux causing handshake timeouts on short-lived connections, and provider-specific network policies. Final architecture places mtg and an Xray client on the Russian entry server while the foreign exit server runs Xray in VLESS+Reality inbound mode. The guide supplies complete docker-compose examples, key generation commands, and a checklist of common misconfigurations to avoid.
TLS MITM and Throttling to 10 Mbps: Two Distinct Network Degradation Patterns Observed in Russia
Russian users have reported sudden slowdowns and instability on international connections over the past several days. Analysis of Tunnel Cat logs revealed two separate issues that produce similar user symptoms but require different diagnostic approaches. The first pattern involves successful TCP and TLS handshakes followed by sharp drops in throughput, often from 80 Mbps to 8-12 Mbps, consistent with DPI-based throttling of international traffic. The second pattern shows TLS certificate substitution on Windows systems, indicating active man-in-the-middle interception. Tunnel Cat now detects invalid certificates and terminates such sessions, yet the underlying network phenomena persist. The observations highlight the need to examine both bandwidth dynamics and certificate chains when troubleshooting connectivity problems from Russia.