Habr•August 17, 2026•🇷🇺Translated from Russian

Browser Extension Anonymizes Sensitive Data Before Sending to AI Chatbots

A new browser extension has been developed to solve the growing problem of sensitive data leaking into AI chat services through everyday work tasks.

HR specialists, lawyers, accountants, and IT staff routinely paste resumes, contracts, payroll tables, and configuration files containing personal data, bank details, and passwords directly into AI prompts. Once sent, this information remains on third-party servers with no reliable way to delete it from logs or training datasets.

The extension intercepts messages and file uploads at the moment of sending, replaces detected sensitive values with unique pseudonyms such as [user_qhb6tm] or [card_348zsg], and forwards only the masked text to the AI. When the AI replies using the same placeholders, the extension instantly restores the original values on the user's screen while the server sees only the anonymized version.

Earlier approaches proved insufficient. Manual replacement quickly failed due to user fatigue. Simple regex scripts struggled with Russian grammar, false positives on invoice numbers, and inconsistent name formats. External anonymization services merely shifted the trust problem to another third party.

The final solution meets three strict requirements: fully automatic operation without user intervention, completely local processing with no internet required after installation, and seamless integration that does not change how people interact with their preferred AI chat interface.

Inside the engine, 33 data categories are defined declaratively with patterns, validators, and priorities. INN numbers are verified using FNS checksum algorithms, cards use the Luhn check, and passwords are filtered by entropy and stop-word lists. Russian names are normalized to nominative case so that declined forms receive the same pseudonym. The response parser tolerates case changes, spaces, markdown, and homoglyphs to ensure reliable decoding even when models alter labels.

File support includes more than 70 formats. Office documents are processed by creating anonymized copies that preserve formatting, tables, and headers. Scanned PDFs and photos are handled by a local offline OCR engine that runs in a single worker thread, keeping memory usage low and the system responsive.

A free version covering all text categories and custom rules is available in the Chrome Web Store. Advanced features for files, scans, and enterprise policy distribution are provided upon request.

Related articles

Habr•Privacy & Surveillance

CookieTin Extension Manages Partitioned Cookies Across Firefox, Chrome and Edge

Developer Perruer2 has released CookieTin, an open-source browser extension that fully supports partitioned cookies under Firefox Total Cookie Protection and Chrome CHIPS. The tool addresses limitations in older managers like Cookie Quick Manager by correctly retrieving and deleting cookies stored with partitionKey values. It works across Firefox, Chrome and Edge using a single Manifest V3 codebase written in TypeScript and Preact. Key features include accurate cookies.txt export compatible with curl and yt-dlp, protected cookies that survive explicit deletion, and pre-save validation of browser rules for __Host- prefixes and SameSite attributes. E2E tests using Puppeteer verify handling of HttpOnly, partitioned and container cookies in all three browsers.

AntiMalware•Privacy & Surveillance

Kaspersky Premium for macOS Gains App Uninstall Feature to Remove Residual Files

Kaspersky Premium now includes an App Uninstall tool for macOS that locates and deletes leftover files such as caches, cookies, settings, and logs after applications are removed. The feature also identifies duplicate copies of programs and lets users remove all instances or select specific ones while preserving shared components used by other software. Survey data from Kaspersky shows that only 44 percent of macOS users delete unused applications, even though 56 percent regularly clear browser data and 54 percent remove unwanted media files. Residual files can contain sensitive information including account tokens, passwords, IP addresses, event logs, and personal documents, creating privacy risks especially when a device is sold or accessed by unauthorized parties. Deleted files can be restored from the trash or directly within Kaspersky Premium before the application session ends. The company also warns that malicious programs are frequently disguised as legitimate macOS cleaning utilities.

Securitylab•Privacy & Surveillance

Bypassing VPN Detection on iPhone: Detailed Methods to Avoid App Blocks

Many iPhone users encounter apps that detect and block active VPN connections even after switching servers or protocols. The detection often occurs locally on the device by inspecting network interfaces rather than relying solely on external IP addresses. This guide explains how apps identify VPN tunnels through iOS network data and provides practical workarounds including moving the VPN to a router, configuring per-app exclusions, and using web versions of services. It also covers why protocol obfuscation and port changes fail to hide local VPN activity from applications. Additional troubleshooting addresses automatic VPN profiles, ad blockers, and iCloud Private Relay interference. The article emphasizes that no universal toggle exists in iOS to hide an active VPN from all apps.

Habr•Privacy & Surveillance

New Obfuscation Method Dissolves Personal Data Records in Layer of Plausible Variants

A Russian information security researcher has proposed a data protection technique that renders stolen personal records unusable even after full compromise. The approach mixes real data such as phone numbers, emails, passports, addresses, INN and SNILS with vast numbers of semantically valid alternatives. Attackers receive nearly complete information including a 361-character message containing PIN codes and word order, yet lack the secret vector space and reconstruction algorithm required to identify the correct record. Without these components, brute-force attempts produce millions of plausible results with no architectural method to verify accuracy. The method is presented as an alternative to traditional encryption when data must remain accessible yet protected against extraction. A public sandbox is available for testing the approach.