Post #2041252
2026-03-03 23:48 UTC
@k3ym0 @Kerplunk @QuercusMacrocarpa @ublockorigin
Exactly. It sets up a local MITM proxy, inspects the request/response flow, blocks or modifies requests, and also injects custom CSS and JS into pages to emulate features that would normally require browser extension APIs.
To preempt the question - all proxying is local. The app has to install a root CA, but it's generated on-device and doesn't leave it.
Replies (1)
-
@k3ym0@infosec.exchange 2026-03-04 06:52
@anfragment @Kerplunk @QuercusMacrocarpa @ublockorigin looks like you’re allow-listing OpenAI in zen-https-exclusions/common.txt (line 117/118)? Wouldn’t that mean that it wouldn’t provide protection while using ChatGPT via browser? Don’t get me wrong, I think it’s a wonderful idea, and your implementation actually looks very solid, but it doesn’t look like it would protect privacy within the context of my original post (unless I’m misunderstanding something, in which case please do correct me and tell me to RTFM or GTFO).