Skip to content

Update

What Tor VPN Beta's first year looks like across seven Asia-Pacific regions

This post builds on the Tor Project announcement below. We also publish full translations of it:

Tor VPN beta promotional image showing availability on download.torproject.org with F-Droid and Google Play badges, and a phone displaying the connected screen with upload and download counters

The Tor Project's retrospective on the first year of Tor VPN Beta contains one finding that reframes the whole product. The team expected to learn from real-world use, and what they learned was that the primary use case is unblocking the internet — not the privacy features a commercial VPN would lead with. Early adoption concentrated in heavily censored regions, and that shaped what got built next.

That finding is the interesting part for us, a community based in Taiwan, because the regions we cover sit at very different points on that spectrum. This post checks the announcement against measurement data for seven Asia-Pacific regions, and sets out what the regulatory picture looks like in each.

Snowflake gets a dedicated app, and the volunteer pool grew 29% in a month

This post is based on the Tor Project announcement:

Snowflake Volunteer promotional graphic showing several phone mockups of the app's enable toggle, settings screen, and statistics screen
Image source: Tor Project Blog.

We've written before that Snowflake is the lowest-barrier way to help people reach Tor: open a browser tab, leave it running, and you're relaying anonymous traffic. On 3 August, Tor Project lowered that barrier again with Snowflake Volunteer, a standalone Android app whose only job is being a Snowflake bridge.

Section 702 Has Expired: A Sinophone Asia-Pacific Read on Warrantless US Surveillance

EFF's NSA eagle graphic, reworking the NSA seal into an eagle plugging its talons into telecom lines, representing warrantless mass surveillance
Image: EFF designer Hugh D'Andrade's "NSA eagle," which reworks the NSA seal into an eagle plugging its talons into the nation's telecom lines. From EFF's NSA spying work, licensed under CC BY 4.010.

This post is an anoni.net reading based on the EFF Deeplinks article:

At midnight on 12 June 2026, Section 702 of the Foreign Intelligence Surveillance Act lapsed1. EFF, which spent years arguing the program should require a warrant before the FBI reaches Americans' communications — or else expire — calls the lapse a victory1.

It is a real victory, and a narrow one. Section 702 was always built to collect the communications of non-US persons located abroad. That means everyone outside America — including readers in Taiwan, Hong Kong, mainland China, Macau, Singapore, and Malaysia — has always been a lawful target of this authority. The fight that just lapsed it was overwhelmingly a fight about protecting Americans. For the rest of us, the lapse changes much less than the headline suggests.

Android 17 ships: the real GrapheneOS story is who decides what runs on your phone

Android 17 and GrapheneOS: who decides what runs on the phone you bought
Image: a smartphone wrapped in a chain and padlock, standing in for a device locked down by outside rules. Photo by Towfiqu barbhuiya, via Pexels (Pexels License).

You paid for the phone, but what it can run and what it can install is increasingly not yours to decide. That question stays invisible until an app refuses to open because it "detected a non-stock OS," or an open-source OS you rely on gets harder to maintain because the hardware data behind it stops being public. Android 17 landed on 2026-06-16, and it pushed that question one step further.

For privacy-minded users, the OS in the middle of this is GrapheneOS: a hardened, de-Googled Android built on AOSP. It runs almost exclusively on Google Pixel hardware, and Google has spent the past year adjusting how open Android and the Pixel actually are.

Why this matters (especially in APAC)

This reads like a US/EU story about Google and Brussels, but it is close to home for readers across East and Southeast Asia and the Chinese-speaking world. Android 17's new sideloading "developer verification" flow is rolling out first in Brazil, Indonesia, Singapore and Thailand in 2026, expanding from there. Banking, payment and government apps across the region increasingly check whether a device is in "stock" state, and in mainland China that posture — device attestation plus real-name requirements — is already the norm. The losers are the same everywhere: people who want a phone they actually control.

What the Tor VPN security audit means for Taiwan's privacy community

This post is based on the Tor Project announcement:

TorVPN Cure53 Audit

In June 2025, Cure53 completed a penetration test and source code review of TorVPN for Android and its underlying Rust networking layer, Onionmasq. The Tor Project published the results in April 2026. The headline finding: Tor's core tunnel establishment and routing logic held up well. But there are specific technical issues worth understanding if you're recommending or deploying this tool in Taiwan's context.

Arti 2.2.0: better network fit now, stronger Tor plumbing later

This post is based on the Tor Project announcement:

Tor

Arti is Tor’s next-generation Rust implementation. The 2.2.0 release is notable because it pushes a previously experimental access path into day-to-day usability: HTTP CONNECT is now included in full builds and enabled by default, sharing the same port as SOCKS.

For teams operating in filtered enterprise, campus, or public networks, that matters immediately. For developers embedding Arti, this release also expands RPC ergonomics with non-blocking requests, event-loop integration, and a new superuser administration path. In one version, Arti improves both network practicality and operational controllability.

Tails 7.6: bridges you can actually find, and a quieter password manager swap

Tails

We follow Tails releases because they ship the same building blocks many of us recommend in real life: Tor, a hardened desktop, and tools for people who cannot assume a “normal” network path. 7.6, dated 2026-03-26, is worth translating not for one killer feature, but for two changes that affect how people get online and how they store secrets on a live system.

Why this one matters (especially in regional context)

Tor bridges are not exotic; they are often the difference between “Tor works” and “Tor never connects.” In places where Tor traffic is filtered or throttled, users learn to hunt for bridges through side channels—paste sites, trusted contacts, or ad‑hoc instructions. Tails 7.6 brings that guidance into the Tor Connection assistant: pick Connect to Tor automatically, and if the network blocks Tor outright, the bridge screen can Ask for a Tor bridge based on your region, pulling candidates via the Tor Project’s Moat service—the same family of tech Tor Browser has used since 11.5—with the fetch disguised using domain fronting.

For readers in Taiwan and across East/Southeast Asia: censorship models differ, but the pattern is familiar—TLS interception, routing games, or “soft” blocking that fails open only for some apps. A Tails image that surfaces bridge acquisition in-product lowers the bar for journalists, lawyers, and civil‑society volunteers who already juggle operational risk; they should not also have to memorize bridge workflows from blog posts.

The second headline is Secrets replacing KeePassXC. That is a product decision, not a security downgrade by default: Secrets is tighter with GNOME, which matters on Tails because accessibility regressions (on‑screen keyboard, cursor sizing) are real blockers for some users. KeePassXC power users can still add it via Additional Software; the database format overlaps, so migration is meant to be frictionless.