Is 1of10.com - Optimization Tool For Youtube safe?
1of10.com - Optimization Tool For Youtube assigns a persistent device ID and transmits it with browsing analytics to 1of10.com servers.
The extension injects a content script into YouTube pages that generates and stores a device UUID in youtube.com's localStorage, making it readable by YouTube's own page scripts. On each watch page, the device ID is sent alongside browser type, OS, screen dimensions, language, and plan tier to 1of10.com's analytics endpoint. The extension also scrapes live view counts from the YouTube DOM and forwards them to 1of10.com on page load.
Who publishes it1 of 10 Media Inc. - no other listings under this identity
1 of 10 Media Inc. - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
YouTube UUID Sent to 1of10 Analytics
Using 1of10 controls on YouTube creates a persistent oot_device_id in YouTube localStorage, sent with browser, OS, screen, language, plan, and video context to 1of10.com.
Being under the YouTube origin, page scripts can read it too.
What actually happens
You click a 1of10 panel control while using YouTube.
The extension reads or creates a persistent browser identifier and sends it with the analytics event.
The same value is stored in YouTube localStorage under the oot_device_id key.
Fields constructed for the analytics event
- Persistent extension IDext_k4m9q2v1p9lqma2x7b6
This lets repeated 1of10 activity in the same browser profile be tied together over time.
- 1of10 account contextuser_73918462, plan pro
If you are signed in, the event can be associated with your 1of10 account and plan tier.
- Browser and display contextChrome on macOS, 1920x1080, en-US, dark mode off
This describes your browser environment and makes the event easier to separate from other users.
- Clicked YouTube itemvideo dQw4w9WgXcQ, channel UC_x5XG1OV2P6uZZ5FSM9Ttw
This records which video or channel was attached to the 1of10 control you clicked.
Captured request
- Content-Type
- application/json
The code that does this
The content script creates the ID and sends it through the analytics path
Readable content-script.js creates oot_device_id and sends analytics
content-script.jsvar Z = function() { var e = localStorage.getItem("oot_device_id"); return e || (e = "ext_" + Math.random().toString(36).substring(2) + Date.now().toString(36), localStorage.setItem("oot_device_id", e)), e }, X = function() { var e = K(Y().mark((function e() { var t; return Y().wrap((function(e) { for (;;) switch (e.prev = e.next) { case 0: return e.prev = 0, e.next = 3, chrome.storage.local.get(["userId", "plan", "loggedIn"]); case 3: if (!(t = e.sent).loggedIn) { e.next = 6; break } return e.abrupt("return", { userId: t.userId || null, plan: t.plan || null }); case 6: e.next = 10; break; case 8: e.prev = 8, e.t0 = e.catch(0); case 10: return e.abrupt("return", { userId: null, plan: null }); case 11: case "end": return e.stop() } }), e, null, [ [0, 8] ]) }))); return function() { return e.apply(this, arguments) } }(), J = function() { var e, t, n = navigator.userAgent, r = "unknown"; n.includes("Chrome") ? r = "Chrome" : n.includes("Firefox") ? r = "Firefox" : n.includes("Safari") ? r = "Safari" : n.includes("Edge") && (r = "Edge"); var o = "unknown"; n.includes("Windows") ? o = "Windows" : n.includes("Mac") ? o = "macOS" : n.includes("Linux") ? o = "Linux" : n.includes("Android") ? o = "Android" : n.includes("iOS") && (o = "iOS"); var a = null === (e = window.screen) || void 0 === e ? void 0 : e.width, i = null === (t = window.screen) || void 0 === t ? void 0 : t.height, l = document.documentElement.hasAttribute("dark"); return { browser: r, os: o, screen_width: a, screen_height: i, language: navigator.language, yt_dark_mode: l } }, ee = function() { var e = K(Y().mark((function e(t) { var n, r, o, a, i, l, u, c = arguments; return Y().wrap((function(e) { for (;;) switch (e.prev = e.next) { case 0: return n = c.length > 1 && void 0 !== c[1] ? c[1] : {}, e.prev = 1, e.next = 4, W("monitoring/analytics/track"); case 4: return r = e.sent, e.next = 7, X(); case 7: return o = e.sent, a = o.userId, i = o.plan, l = Z(), u = J(), e.next = 14, U(r, { method: "POST", headers: { "Content-Type": "application/json" }, body: { event: t, user_id: a, device_id: l, properties: $($({ extension_version: chrome.runtime.getManifest().version, plan: i }, u), n) } }); case 14: e.next = 18; break; case 16: e.prev = 16, e.t0 = e.catch(1); case 18: case "end": return e.stop() } }), e, null, [ [1, 16] ]) }))); return function(t) { return e.apply(this, arguments) } }(), te = "ext_similar_thumbnails_clicked";Readable service-worker.js sends the final HTTP request
service-worker.jscase 111: if (e.prev = 111, (d = t.path) && !d.includes("://")) { e.next = 115; break } throw new Error("Invalid path - must be a relative path");case 115: return v = d.startsWith("/") ? d.slice(1) : d, m = "".concat(u, "/").concat(v), g = { method: t.method || "GET", headers: t.headers || { "Content-Type": "application/json" } }, t.body && (g.body = JSON.stringify(t.body)), t.credentials && (g.credentials = t.credentials), e.next = 122, fetch(m, g);case 122: if (w = e.sent, S = null, !(j = w.headers.get("content-type")) || !j.includes("application/json")) { e.next = 130; break } return e.next = 128, w.text();case 128: (O = e.sent) && (S = JSON.parse(O));case 130: c = { success: !0, status: w.status, data: S }, e.next = 136; break;case 133: e.prev = 133, e.t5 = e.catch(111), c = { success: !1, error: e.t5.message };case 136:case 137: return e.abrupt("break", 138);Destination reached by the analytics path
- 1of10.com
Receives monitoring analytics events from the 1of10 extension, including the persistent device_id and event properties constructed in content-script.js.
Where it sends data
Destinations our analysis observed 1of10.com - Optimization Tool For Youtube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 1of10.com
1of10.com - Optimization Tool For Youtube sends data to 1of10.com. No other extension we have analyzed sends data here.