MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found
A Habra user Slava_B tested the desktop client of the MAX messenger on Windows to check whether it could recognize or bypass a VPN when traffic routing occurred at the router level rather than inside the operating system.
The experiment took place on 8 September 2026. A Windows computer was connected to a Keenetic router configured to send Russian resources directly while routing selected foreign connections through an OpenConnect tunnel to a European VPS. No VPN client, virtual adapter, or special routes existed inside Windows itself.
Researchers monitored the client using Process Monitor, Wireshark, and TCPView, while traffic on the remote server was captured with tcpdump. The application launched two processes, MAX.exe and MAX-service.exe, which communicated over a local port.
The client established connections to MAX/ONEME infrastructure, the AppTracer service, and systems used for calls. It repeatedly read the MachineGuid identifier, computer name, proxy and PAC settings, its own device IDs, and information about microphones and cameras.
These reads may serve legitimate purposes such as diagnostics, anti-fraud measures, corporate proxy support, and call functionality. Importantly, no connections from MAX appeared on the VPN interface of the VPS, and the application did not contact external IP detection services, Telegram, or WhatsApp.
The researcher stressed that TLS traffic content was not decrypted, so it remains unproven whether identifiers were actually sent to servers. The findings apply only to the tested router-based configuration and do not cover scenarios where a VPN client runs directly inside Windows.
Related articles
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.
PII-Guard: Open-Source Detector for Personal Data in Russian Text
Andrey Ivanov, an NLP researcher at red_mad_robot, has released PII-Guard, an open-source system that detects and masks personal data in Russian text before it reaches language models. The tool combines rule-based checks with a fine-tuned ruBert-base NER model to handle names, addresses, phones, passports, INN, SNILS, bank cards and other entities. It replaces detected PII with structured XML-like tags that preserve grammatical information such as gender and entity ID, allowing models to generate coherent responses that are later restored with real values. The hybrid pipeline first applies normalization, pattern matching, Luhn and weighted checksum validation, and context windows with positive and negative keywords, then merges results with model predictions via an arbitration module. Evaluation on four public datasets, including Hivetrace, alexen2 and alrosait, shows PII-Guard outperforming other open solutions on both strict span matching and type-overlap micro-F1 metrics. The project, including datasets and code, is available on GitHub and aims to reduce leakage risks while maintaining downstream model utility.
Google to Add Explicit Content Warnings in Android System Photo Picker
Google is preparing a new safety feature for the system photo picker in Android that will scan images and videos for explicit or nude content. The tool is designed to warn users before they share intimate photographs, whether accidentally or due to a momentary lapse in judgment. This functionality will operate at the system level, meaning it applies across multiple apps that use the built-in photo selector. The feature aims to reduce the risk of unintended distribution of private images that could lead to embarrassment or privacy violations. By integrating the check directly into Android, Google seeks to provide a consistent layer of protection without requiring third-party applications to implement similar logic themselves.