Alain Meier

Building something new for preventing fraud from AI agents. Co-founder of @getcognito, acquired by @Plaid.

[Alain Meier @alain]

Discovered a new method for detecting if someone is using Incognito in Chrome:

Write 512 tiny 1-byte responses into a scratch Cache API cache, then read:

https://t.co/gsVNLl57y6.estimate().usageDetails.caches

Normal Chrome: ~393kb
Incognito: ~85kb

Why? When you're in incognito, Chrome writes to memory instead of disk, which leaves less metadata residue

[Alain Meier @alain]

@ilyagordey @BrightData @browser_use @browserbase @nottecore Do you use any novel techniques for anti-detect / stealth?

[Alain Meier @alain]

What are your favorite scraping, anti-detect, and AI agent browser services? Eg: @brightdata, @browser_use, @browserbase, @nottecore

Working on a report

[Alain Meier @alain]

@ilyagordey @BrightData @browser_use @browserbase @nottecore I’ve made a stealth benchmark that I’d like to run them against

[Alain Meier @alain]

@Medaiseo 1) if you’re an iCloud Relay user it’s helpful to know that depending on your country, it may be less randomizing than you think it is relative to other VPNs

2) if you’re in risk, it’s helpful to have another data point to key anonymous traffic on. In this case, lowering risk

[Alain Meier @alain]

You can detect if someone is using iCloud Private Relay super easily

Apple publishes a database of their egress IP addresses and the entire world's iCloud Private Relay traffic exits through ~105K IPv4 addresses.

I analyzed it and found some surprising stuff. Let's dig in:

[Alain Meier @alain]

@Medaiseo Does anything matter?

[Alain Meier @alain]

@james_raftery Extremely cool idea. Love the concept of tying revenue to fraud rules directly and modeling it as protecting-the-upside rather than just the downside

Did you do it with anything other than ASNs?

[Alain Meier @alain]

@SanthProject Sounds interesting, any more details?

[Alain Meier @alain]

You can find the raw data, straight from Apple, here:

https://t.co/cA24MZO6yy

Follow me @alain for more opsec, browser security, and privacy/fingerprinting explorations

[Alain Meier @alain]

You can detect if someone is using iCloud Private Relay super easily

Apple publishes a database of their egress IP addresses and the entire world's iCloud Private Relay traffic exits through ~105K IPv4 addresses.

I analyzed it and found some surprising stuff. Let's dig in:

[Alain Meier @alain]

But iCloud Private Relay users can rejoice: its traffic is typically associated with *lower* levels of fraud because it requires having a valid Apple ID with a working credit card.

So (good) fraud models treat this as a risk reducer, despite it being a VPN

[Alain Meier @alain]

Nice find! This is different though - the link you have is about:

(await https://t.co/gsVNLl57y6.estimate()).quota

Try it yourself in devtools, it reports the same across incognito and not incognito

The finding in the parent post is still active and survives quota normalization because it leaks through per-storage-type usage accounting

[Alain Meier @alain]

Discovered a new method for detecting if someone is using Incognito in Chrome:

Write 512 tiny 1-byte responses into a scratch Cache API cache, then read:

https://t.co/gsVNLl57y6.estimate().usageDetails.caches

Normal Chrome: ~393kb
Incognito: ~85kb

Why? When you're in incognito, Chrome writes to memory instead of disk, which leaves less metadata residue

[Alain Meier @alain]

@filipens00 Mozilla has different ones that I have found, but not this specific one

[Alain Meier @alain]

@chrisbward Yep - this can also work. Some of the privacy browsers mitigate this one, though

[Alain Meier @alain]

@pa1nark Just sharing my research. I think it's helpful for people to be aware that these things are possible

It's structurally difficult for the browsers to fix issues like this because the memory-based write is advantageous for other reasons

[Alain Meier @alain]

@Le_happy_can @brave I just checked - it's not mitigated in Brave

[Alain Meier @alain]

@quasa0 @uwukko @heliumbrowser Helps with:

1) backend scoring for fingerprinting because you can tune thresholds [browsers change multiple readings in incognito mode]

2) feed it into risk models - it's a small indicator, but more often associated with low-tier fraud activity

[Alain Meier @alain]

@quasa0 @uwukko @heliumbrowser Looks like the one in the tweet works on Helium btw - different/tighter threshold than Chrome though