They introduced a COM-based gatekeeper, usually an elevation_service.exe, that's supposed to ensure only the real browser gets to decrypt the master app_bound_key. My own ...

Phone number (mask the last 7 digits, optionally leave country code) Physical address (mask everything below city) Date of birth (mask the year, optionally the month) Government IDs (SSN, passport — ...