Remember when their Android app would open a local TCP port, and they would have websites connect to localhost:PORT so they could deanonymize you? That was only like 1 year ago.