Started getting these on various betting sites, including Betfair Exchange. I've never seen them before this week.
What are they up to?
Betfair wants to access other apps and services on this device
-
jamesedwards
- Posts: 6122
- Joined: Wed Nov 21, 2018 6:16 pm
You do not have the required permissions to view the files attached to this post.
Are these messages on desktop or mobile sites?jamesedwards wrote: ↑Sun Aug 23, 2026 9:39 amStarted getting these on various betting sites, including Betfair Exchange. I've never seen them before this week.
What are they up to?
z313.jpg
I get the distinct impression that could be highly illegal ,wanting access to other apps is a massive invasion of privacy ,tell um to Fu** off.jamesedwards wrote: ↑Sun Aug 23, 2026 9:39 amStarted getting these on various betting sites, including Betfair Exchange. I've never seen them before this week.
What are they up to?
z313.jpg
Tico
ChatGPT wrote:That is a newish Chrome or Edge security permission. The wording is rather alarming, but it does not mean Betfair is asking for general access to all your applications.
It means the Betfair website has attempted to communicate with something running locally on your computer, or potentially another device/service on your local network. Recent Chromium browsers now require websites to ask permission before doing that. The permission is called “Apps on device” or local network access, depending on the browser/version.
For example, websites can use this type of connection to communicate with a locally installed application, authentication software, hardware integration or a service listening on localhost.
In Betfair's case, unless you're using some Betfair feature that specifically needs to communicate with software installed on that PC, I'd press Block for the moment. The normal Betfair Exchange website should not ordinarily need broad local device access just for betting.
I asked it to check specifically what it was doing: -
I dug into this, and the wording in your screenshot actually tells us considerably more than I first realised.
Since Chrome 145, Google has split its Local Network Access permission into two separate permissions:
1. `local-network` for devices elsewhere on your LAN
2. `loopback-network` for services running on the **same computer** as the browser
The wording you are seeing, **“Access other apps and services on the device”**, corresponds to the second category. So Betfair is almost certainly trying to make a connection to something on **your own PC**, typically via `127.0.0.1`, `localhost` or `::1`. It is not simply asking to browse your home network. ([Chrome for Developers][1])
### Why would Betfair do that?
The evidence points quite strongly towards **device fingerprinting and fraud detection**.
Betfair's current UK privacy statement explicitly says that it collects device information including your browser, operating system, hardware information, **software**, device identifiers and connection information. It also says that it uses third party fraud prevention services and monitors devices to detect account takeover, fraud, multiple accounts and prohibited software. ([Betfair Support][2])
There is also a long history of Betfair using sophisticated device fingerprinting systems. Betfair has previously been identified as using **Iovation** and **ThreatMetrix**, now part of LexisNexis Risk Solutions. ([Justice for Punters][3])
This is particularly interesting because ThreatMetrix is known to probe services running on `localhost`.
Academic research into ThreatMetrix found it checking ports associated with things such as:
| Port | Software/service |
| -------: | ------------------------ |
| 3389 | Windows Remote Desktop |
| 5900 etc | VNC |
| 5939 | TeamViewer |
| 7070 | AnyDesk |
| 17556 | Microsoft Edge WebDriver |
The researchers categorised much of this as **fraud detection and bot detection**. ([Georgia Tech Repository][4])
That fits Betfair remarkably well. They could potentially use the results as signals that a machine is being remotely controlled, automated, virtualised or otherwise differs from an ordinary consumer PC.
ThreatMetrix itself describes its technology as analysing device attributes and identifying returning users, even after cookies are removed or browser parameters change. Its current processing notice confirms that device fingerprinting information forms part of the identity information it processes. ([LexisNexis Risk Solutions][5])
### So my interpretation of that Betfair prompt is now:
**Betfair, or more likely a fraud detection script embedded within Betfair, is attempting to communicate with or probe services running on your computer.**
It is probably not attempting to "use" those applications in the everyday sense. It is much more likely determining **what is listening locally** and incorporating that into a device or fraud fingerprint.
I cannot yet prove from publicly accessible material that the particular request you saw is being generated by ThreatMetrix. Betfair doesn't publicly identify its current fraud detection provider in the privacy statement. But the combination of the new loopback permission, Betfair's declared collection of device/software information and the known behaviour of ThreatMetrix makes that a strong candidate.
### We can actually identify it definitively
On that machine, open Betfair again and press **F12** to open Developer Tools.
Go to **Network**, then reload the Betfair Exchange page. When the permission box appears, don't press Allow immediately.
In the Network search/filter box try:
`127.0.0.1`
then
`localhost`
then
`::1`
Also look for failed requests containing something similar to:
`ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS`
If you click one of those requests, the **Initiator** tab should show us the JavaScript file that caused it. If it traces back to something such as `online-metrix.net`, a Betfair CNAME pointing at it, Iovation or another fingerprinting service, we'll have the culprit.
**I'd still choose Block.** For an ordinary Betfair Exchange session I see no compelling reason to grant a gambling website permission to probe services running locally on the PC.
If you send me a screenshot of the **Network** panel after the prompt appears, I'll trace the request and tell you exactly what Betfair is probing.
[1]: https://developer.chrome.com/release-no ... hatgpt.com "Chrome 145 | Release notes | Chrome for Developers"
[2]: https://support.betfair.com/app/answers ... hatgpt.com "Betfair UKI Privacy Statement"
[3]: https://justiceforpunters.org/restricti ... hatgpt.com "Bookmakers are watching you: Time to fight back – Justice for Punters"
[4]: https://repository.gatech.edu/server/ap ... hatgpt.com "BUILDING TRUST IN THE ONLINE ECOSYSTEM THROUGH EMPIRICAL"
[5]: https://risk.lexisnexis.com/corporate/p ... hatgpt.com "ThreatMetrix Processing Notice"
I dug into this, and the wording in your screenshot actually tells us considerably more than I first realised.
Since Chrome 145, Google has split its Local Network Access permission into two separate permissions:
1. `local-network` for devices elsewhere on your LAN
2. `loopback-network` for services running on the **same computer** as the browser
The wording you are seeing, **“Access other apps and services on the device”**, corresponds to the second category. So Betfair is almost certainly trying to make a connection to something on **your own PC**, typically via `127.0.0.1`, `localhost` or `::1`. It is not simply asking to browse your home network. ([Chrome for Developers][1])
### Why would Betfair do that?
The evidence points quite strongly towards **device fingerprinting and fraud detection**.
Betfair's current UK privacy statement explicitly says that it collects device information including your browser, operating system, hardware information, **software**, device identifiers and connection information. It also says that it uses third party fraud prevention services and monitors devices to detect account takeover, fraud, multiple accounts and prohibited software. ([Betfair Support][2])
There is also a long history of Betfair using sophisticated device fingerprinting systems. Betfair has previously been identified as using **Iovation** and **ThreatMetrix**, now part of LexisNexis Risk Solutions. ([Justice for Punters][3])
This is particularly interesting because ThreatMetrix is known to probe services running on `localhost`.
Academic research into ThreatMetrix found it checking ports associated with things such as:
| Port | Software/service |
| -------: | ------------------------ |
| 3389 | Windows Remote Desktop |
| 5900 etc | VNC |
| 5939 | TeamViewer |
| 7070 | AnyDesk |
| 17556 | Microsoft Edge WebDriver |
The researchers categorised much of this as **fraud detection and bot detection**. ([Georgia Tech Repository][4])
That fits Betfair remarkably well. They could potentially use the results as signals that a machine is being remotely controlled, automated, virtualised or otherwise differs from an ordinary consumer PC.
ThreatMetrix itself describes its technology as analysing device attributes and identifying returning users, even after cookies are removed or browser parameters change. Its current processing notice confirms that device fingerprinting information forms part of the identity information it processes. ([LexisNexis Risk Solutions][5])
### So my interpretation of that Betfair prompt is now:
**Betfair, or more likely a fraud detection script embedded within Betfair, is attempting to communicate with or probe services running on your computer.**
It is probably not attempting to "use" those applications in the everyday sense. It is much more likely determining **what is listening locally** and incorporating that into a device or fraud fingerprint.
I cannot yet prove from publicly accessible material that the particular request you saw is being generated by ThreatMetrix. Betfair doesn't publicly identify its current fraud detection provider in the privacy statement. But the combination of the new loopback permission, Betfair's declared collection of device/software information and the known behaviour of ThreatMetrix makes that a strong candidate.
### We can actually identify it definitively
On that machine, open Betfair again and press **F12** to open Developer Tools.
Go to **Network**, then reload the Betfair Exchange page. When the permission box appears, don't press Allow immediately.
In the Network search/filter box try:
`127.0.0.1`
then
`localhost`
then
`::1`
Also look for failed requests containing something similar to:
`ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS`
If you click one of those requests, the **Initiator** tab should show us the JavaScript file that caused it. If it traces back to something such as `online-metrix.net`, a Betfair CNAME pointing at it, Iovation or another fingerprinting service, we'll have the culprit.
**I'd still choose Block.** For an ordinary Betfair Exchange session I see no compelling reason to grant a gambling website permission to probe services running locally on the PC.
If you send me a screenshot of the **Network** panel after the prompt appears, I'll trace the request and tell you exactly what Betfair is probing.
[1]: https://developer.chrome.com/release-no ... hatgpt.com "Chrome 145 | Release notes | Chrome for Developers"
[2]: https://support.betfair.com/app/answers ... hatgpt.com "Betfair UKI Privacy Statement"
[3]: https://justiceforpunters.org/restricti ... hatgpt.com "Bookmakers are watching you: Time to fight back – Justice for Punters"
[4]: https://repository.gatech.edu/server/ap ... hatgpt.com "BUILDING TRUST IN THE ONLINE ECOSYSTEM THROUGH EMPIRICAL"
[5]: https://risk.lexisnexis.com/corporate/p ... hatgpt.com "ThreatMetrix Processing Notice"