Privacy, anonymity and censorship news, read from a tech and open-source angle, with a view from Asia.
Since mid-September, a string of Japanese companies have disclosed breaches of their websites and apps. Car-sharing service Times Car said data from about 6.6 million accounts was taken, including ID images such as driver's licences for about 1.6 million. As of 9 October we found no official attribution, and the Chief Cabinet Secretary said on 6 October it was unclear whether the incidents were related. Readers outside Japan are affected only if they hold accounts with these services.
Google announced on 6 October that the .gh, .sl and .as country-code top-level domains were hijacked and attackers obtained HTTPS certificates for Google and other organizations. Chrome has blocked the certificates it found; domain owners can monitor Certificate Transparency logs.
Based on 15 sources, including Google, Let's Encrypt Community Forum, Ars Technica
According to its developers, the open-source BentoPDF toolkit merges, compresses, OCRs and strips metadata from PDFs inside the browser, without uploading files to an online converter. It works straight from its website, and some features download code from the third-party jsDelivr service when used.
Based on 15 sources, including BentoPDF, GitHub, It's FOSS
Your phone depends on system updates to fix weaknesses in the encryption it uses on Wi-Fi. On this day, a researcher disclosed KRACK, a weakness in WPA2 Wi-Fi encryption.
Let's Encrypt will cut its default certificate lifetime from 90 to 64 days from 10 February 2027. Anyone running a site or self-hosted service on its certificates should check that automatic renewal is not tied to a fixed number of days. The announcement says nothing to ordinary visitors.
Based on 13 sources, including Let's Encrypt, CA/Browser Forum, Ars Technica
Apple said on 2 October that it will require very explicit user action before a Mac app can be granted Full Disk Access, citing some developers' use of the permission and the growing risk from AI agents. Apple gave no version or date, and as of 12 October its release notes do not mention the control.
Based on 18 sources, including Apple, TechCrunch, Decrypt
Your personal data in Taiwan falls under amendments that would require companies to report leaks to a Personal Data Protection Commission, but the amendments have no effective date yet. On this day, Singapore's Parliament passed the Personal Data Protection Act, which provides for a Personal Data Protection Commission.
Brave's desktop browser offers email aliases from version 1.94, letting you sign up with a forwarding address instead of your real one. Everyone gets five free, with a Brave account required. As of 12 October there is no mobile version, and Brave does not say whether you can reply from an alias.
Based on 14 sources, including Brave, GitHub, Apple
After a political donation by a co-founder of VPN provider Mullvad drew criticism, the Tor Project said on 9 October that it would keep working with Mullvad but pause co-branding and revise how it describes Mullvad Browser. Neither browser has announced a halt in maintenance, and comments on the statement are divided.
Based on 13 sources, including Tor Project, Tor Project Forum, Mullvad
Your Zoom meetings are not end-to-end encrypted by default, and the host has to turn the option on. On this day, Zoom announced a technical preview of end-to-end encryption.
Firefox on iPhone and iPad now has a built-in ad blocker, first listed in the 156 release notes in mid-September. It is off by default. On Android, the system-level options surveyed in a personal blog post mostly mean trusting whoever runs the service or app.
Based on 9 sources, including Mozilla, Kevin Boone, Google
Russian carrier Beeline said on 6 October that it has routed 19.1 million scam calls to AI voice personas since the start of 2026, according to its own figures. The service runs only on Beeline's network in Russia. In South Korea, Singapore and Taiwan, the examples we found are call warnings, filtering and on-device detection.
Based on 12 sources, including Beeline, ict-online, 動區動趨
Your iPhone's Safari fraudulent website warning may use Tencent's Safe Browsing service when the region is set to mainland China or Hong Kong. On this day, a researcher wrote on a blog that Safari's feature appeared to pass part of users' browsing information to Tencent.
Since mid-September, a string of Japanese companies have disclosed breaches of their websites and apps. Car-sharing service Times Car said data from about 6.6 million accounts was taken, including ID images such as driver's licences for about 1.6 million. As of 9 October we found no official attribution, and the Chief Cabinet Secretary said on 6 October it was unclear whether the incidents were related. Readers outside Japan are affected only if they hold accounts with these services.
Based on 43 sources, including JPCERT/CC, Metabase, 内閣官房国家サイバー統括室
Firefox 157 for desktop, released on 29 September, shows a warning when the computer is set up to record encryption keys. Mozilla's support page says antivirus or security software is the most likely cause and the warning does not mean the computer is infected. If sites fail to load, check that software's HTTPS scanning first.
Based on 5 sources, including Mozilla, Mozilla Bugzilla, RFC Editor
You can open the BBC website normally from Taiwan, while OONI's measurements of BBC Chinese from mainland China are nearly all anomalies or failures. On this day, the BBC reported that an internet provider in Beijing appeared to be blocking its website.
As of 8 October, Radicle had no release fixing its network protocol flaws, and people using private repositories should follow its advice. Accounts differ on whether Xray-core told users about a February fix, and Google's open source vulnerability reward programme stopped taking product vulnerability reports on 1 October.
Based on 17 sources, including Radicle, The GitHub Blog, GitHub
California's AB 1856, signed in September, amends a state law requiring operating systems to ask for a user's age at account setup. Under the amendment, a person or entity that distributes an operating system or app under a licence allowing copying, redistribution and modification is not a covered operating system provider. The rules apply from 2027 and are aimed at account holders in California.
Based on 15 sources, including California Legislative Information, CalMatters Digital Democracy, Office of the Governor of California
Your one-to-one text messages on LINE are end-to-end encrypted by default, so only the two devices involved can read them. On this day, seven countries including Japan and India issued a statement calling on technology companies to let law enforcement read encrypted content under lawful authorisation.
Seven stories from 13 September to 6 October, including a suspected customer data leak at MOS Burger in Taiwan and a member email exposure at Singapore's Bee Cheng Hiang, a breach of about 8.8 million people's records in Denmark's population register, Sequoia PGP in Ubuntu 26.10, a commentary questioning how large language models reason, a US court ruling on a licence plate reader search, US border surveillance towers, and China's deleted-content archive and a sensitive-terms list.
Based on 22 sources, including 公開資訊觀測站, Personal Data Protection Commission Singapore, iThome
On 24 September a federal court in Utah paused a state provision requiring adult websites to determine whether VPN users are in Utah. The same month, two US site-blocking bills took opposite approaches to VPN providers. As of 7 October the lawsuit continues and the bills are in committee. Neither changes how people outside the US use VPNs.
Based on 24 sources, including United States District Court, District of Utah, Utah State Legislature, Utah Office of Administrative Rules
Anthropic's report on Zhipu's open-weight model GLM-5.3, published on 29 September, says the model can write working browser exploits and that, in simulated tests, cover stories and similar techniques got past its safeguards. Zhipu's release notes say the public weights carry only the model's own safeguards and that strong defensive capability should not stay with a few organisations. What most readers can do is restart their browser promptly after updates.
Based on 14 sources, including Anthropic, Z.ai, NIST
You can read Wikipedia from Taiwan, but in mainland China every OONI measurement in the month to 10 October 2026 was an anomaly or a failure. On this day, users in mainland China reported that English Wikipedia, blocked for nearly a year, could be reached again.
Cisco Talos found phishing emails sent to Taiwan's academic, think tank and civil society policy community that use images in the message body to imitate Gmail's attachment card, starting an infection on Windows when clicked. Opened in a browser, the fake card is nearly indistinguishable from a real attachment, so people who often receive speaking invitations or institutional mail may want to watch for it.
Based on 12 sources from Cisco Talos, iThome, Google
Meta's Muse and OpenAI's Dots, both launched in September, run continuously in the cloud, read data from connected apps and turn it into memory. As of 2 October, Muse was not in the App Store in Taiwan, Hong Kong, Japan or South Korea, and Dots required ChatGPT's Pro or Business Premium plan. ChatGPT memory settings and Mac permissions can be checked today.
Based on 24 sources, including Meta, OpenAI, Freedom of the Press Foundation
F-Droid, the open-source Android app store, released 2.0, a rewrite that requires Android 7, on 24 September. From 30 September Google began requiring apps on seven stores in Brazil, Indonesia, Singapore and Thailand to be registered by identity-verified developers, with a global expansion to certified Android devices planned for 2027. As of 2 October, installing apps from F-Droid is unaffected anywhere.
Based on 18 sources, including F-Droid, Google, Conversations
Your App Store account's country or region determines which apps you can download. On this day, Apple removed a crowd-sourced map app showing Hong Kong police locations from the App Store.
Since iOS 18.1, an iPhone that stays locked for a long time restarts itself, putting its data back into a harder-to-extract state. In a forensic vendor's video, apparently made in early 2025, an employee says seized phones keep their once-unlocked state even after a restart. As of 7 October it is unclear whether this works on the latest iOS, and neither Apple nor Magnet responded to 404 Media.
Based on 21 sources, including Apple, 404 Media, Privacy Guides
APC previews research from Brazil, Kenya, Mexico and the Philippines on the disinformation, harassment and surveillance facing environmental defenders, and on how their communities respond. The full reports launch online on 8 October. Readers elsewhere can borrow the approach of protecting households and communities together.
Based on 9 sources, including APC, Human Rights Watch, EFF
If your personal details are posted online in Hong Kong, you can ask the Privacy Commissioner for Personal Data to have platforms remove them. On this day, Hong Kong's anti-doxxing provisions took effect.
