anoni.net News

Two tiers of iCloud Advanced Data Protection in the UK

anoni.net community — Sun, 27 Sep 2026 07:28:00 +0800

Based on 10 sources, including Apple, MacAnorak, EFF

Since February 2025, Apple has not let new UK users turn on Advanced Data Protection (ADP) for iCloud, while people who turned it on earlier keep it. A UK writer pointed out on 21 September that two people in the UK with the same iPhone can therefore have different levels of iCloud encryption. ADP remains available everywhere else.

The Washington Post reported in February 2025 that the UK had issued a technical capability notice under the Investigatory Powers Act, requiring Apple to be able to access encrypted iCloud data worldwide. On 21 February Apple withdrew ADP for new UK users, and its support page states that it has never built a backdoor or master key and never will.

The 15 categories end-to-end encrypted by default, such as iCloud Keychain and Health data, are unaffected, as are iMessage and FaceTime. For UK users without ADP, 10 categories including iCloud Backup, iCloud Drive, Photos and Notes fall back to standard data protection, with keys held in Apple's data centres. Apple cannot switch ADP off for existing UK users, because only their trusted devices can change the setting, and as of 21 September it had published no deadline for them to do it themselves.

EFF wrote in October 2025 that the UK had reportedly narrowed the notice to UK users. Apple filed a new complaint with the Investigatory Powers Tribunal in July 2026, and the dispute is unresolved.

Perspective

All iCloud data is encrypted. What differs is who holds the keys. Under standard data protection Apple holds them and can decrypt data in response to a lawful demand. With ADP the keys stay on the user's trusted devices, so the only way to reach the content would be to change the system's design, and that is the point on which the UK notice and Apple are stuck.

The same legal instrument exists elsewhere in the region with a different limit. Australia's Assistance and Access Act 2018 also created technical capability notices, issued jointly by the Attorney-General and the Minister for Communications. The Department of Home Affairs states that such a notice is expressly prohibited from requiring a provider to build a capability to decrypt information or remove electronic protection. The UK notice, as reported, asks for the kind of capability that the Australian version rules out.

In mainland China, iCloud is operated by GCBD (AIPO Cloud (Guizhou) Technology Co. Ltd), and data stored there is subject to GCBD's terms. Apple's page adds that people who are not Chinese citizens living in mainland China can change their Apple Account country or region to where they are now and keep using iCloud under Apple's terms.

In Hong Kong, Taiwan, Japan, Singapore and the rest of Asia, ADP is available but optional, so it protects only people who switch it on. When the UK moved, the only people who stayed covered were those who had already done so.

Without ADP, Apple's page says that if iCloud Backup and Messages in iCloud are both on, the backup includes the Messages key. Turning off iCloud Backup makes the device generate a new key that keeps future messages end-to-end encrypted. An encrypted local backup on a computer, off by default and enabled in Finder or the Apple Devices app, keeps backups in your own hands.

The cost of ADP is that Apple cannot help you recover end-to-end encrypted data if you lose every recovery method. Web access at iCloud.com is also turned off until you approve it from a trusted device.

To turn it on, open Settings, tap your name, then iCloud > Advanced Data Protection; Apple's support page also has the steps in Chinese. The Apple Account needs two-factor authentication and you will be asked to set up a recovery contact or recovery key first. Every device signed in to the account needs iOS 16.2, macOS 13.1 or the equivalent version. Managed Apple Accounts and child accounts are not eligible.

Data access settings for Siri AI in iOS 27

anoni.net community — Sun, 27 Sep 2026 03:21:00 +0800

Based on 4 sources from EFF, Apple

iOS 27 brings a new Siri, Siri AI, merged with Spotlight into one interface, so swiping down on the Home Screen to search also opens Siri. It runs on the iPhone 15 Pro, 15 Pro Max and iPhone 16 or later. Siri AI is in beta, supports only English, and is not yet available in every region.

By default Siri AI can read Apple's own apps such as Notes, Messages and Mail, and third-party apps once their developers add support. A request may be handled on the phone or sent to Apple's Private Cloud Compute servers, and nothing on screen says which. For people using Advanced Data Protection, whose iCloud data is end-to-end encrypted, EFF's post says cloud processing changes the risk assessment.

On-screen awareness lets you ask Siri about whatever is on screen. EFF's example is summarising an encrypted Signal group chat, whose content may then go to Private Cloud Compute. Neither users nor app developers can currently block it.

EFF's settings: to keep Siri AI out of an app, turn off Show Content in Search for that app in Settings. To return to the old Siri, set Allowed Siri Version to Siri Classic under Screen Time, Content & Privacy Restrictions. Siri AI does not train on your interactions by default, and consent given during setup can be withdrawn by turning off Improve Siri & Dictation under Privacy & Security, Analytics & Improvements. Apple's help page covers the Mac, where macOS 27 offers Siri Classic after Siri is turned off and each summary feature has its own switch.

Perspective

According to EFF, the "Private" in Private Cloud Compute means the system is designed so that Apple cannot see or keep the data. It does not promise that the data stays encrypted or stays on the device. Using it means trusting that Apple's servers behave as designed, whereas end-to-end encryption only needs the keys to stay on your own devices.

Where you are in Asia decides whether any of this applies yet. Apple's support page says Siri AI does not currently work when the Apple Account region is mainland China, and Apple Intelligence features do not work on supported devices bought in mainland China. Apple Intelligence itself supports Chinese (simplified and traditional), Japanese, Korean and Vietnamese, but Siri AI needs both the device language and the Siri language set to a supported language, which today means English. For the iPhone, Apple's page names only two exclusions, the EU and Apple Accounts in mainland China, and adds that availability varies by region. Elsewhere in Asia, the practical requirement is running the iPhone and Siri in English. The per-app search settings exist on every iPhone and can be changed now, without waiting for Siri AI to support your language.

On-screen awareness cannot be blocked, so whether an encrypted conversation stays on devices depends on everyone in it. If any member of a group calls up Siri over the chat, the content may leave from that person's phone, and end-to-end encryption does not cover that step. People who discuss sensitive matters in group chats can agree with the other members not to use on-screen awareness on the conversation, and can consider switching back to Siri Classic themselves.

Because you cannot tell which requests left the phone, the only lever is limiting which apps Siri AI can read. Siri AI currently needs an iPhone 15 Pro or later with the device and Siri language set to English. If that describes your phone, turn off Show Content in Search for apps that hold work material or personal records, such as Notes and Mail, especially if you use Advanced Data Protection.

The cross-site identifier behind ChatGPT's ad pixel

anoni.net community — Sat, 26 Sep 2026 01:24:00 +0800

Based on 5 sources, including Buchodi's Threat Intel, OpenAI, Google Chrome 說明

A security researcher found that while you use ChatGPT, OpenAI's ad collector bzr.openai.com sets a cookie called __obi that is linked to your account, lasts a year and can be sent along with requests on other sites. So far it has only been observed in Chrome on Android. Browsers on iOS block it. On 23 September OpenAI began rolling out ChatGPT ads in seven more Asian markets, shown only on the Free and Go plans.

Advertisers install OpenAI's pixel on their own sites. When you visit one, the pixel returns __obi to OpenAI with the URL path, form fields and text on the page. Email addresses, phone numbers and names are hashed with SHA-256, while country, region, city and postcode are sent in the clear. Query strings were stripped, but a path alone can reveal something like a medical condition.

The cookie is set even when you are logged out. Every sync token examined was filed under the consent category "analytics", so allowing analytics while refusing marketing still delivers __obi.

The researcher reproduced this on their own phone, captured traffic in two ways and analysed 936 advertiser pixels on more than a thousand domains. The write-up states its limits: sync tokens appeared in about one in five sessions, desktop Chrome was not tested, and the server-side mapping back to accounts is inferred from the design rather than observed. OpenAI's support team received the researcher's questions on 14 September without answering them.

Perspective

Pixels on advertisers' sites that report visits back to an ad platform are not new, and the researcher compares this one to the Meta and Google tracking code retailers have installed for years. What differs is the account on the other end. A ChatGPT account also holds conversations with an AI, where many people discuss health, work and personal problems, and those conversations could end up linked to browsing on unrelated sites.

The timing matters for readers in Asia. OpenAI's announcement names Indonesia, Malaysia, the Philippines, Singapore, Thailand, Vietnam and Taiwan, after earlier Asia-Pacific launches in Australia, New Zealand, Japan, South Korea and India, and puts the total at more than 60 countries. OpenAI's list of supported countries leaves out mainland China, Hong Kong and Macau, so people there are outside ChatGPT's official service altogether. Elsewhere in the region, people on the Free and Go plans now see ads, while Plus, Pro and Enterprise stay ad-free.

__obi travels as a third-party cookie. Safari blocks cross-site tracking by default, and every browser on iOS is built on Safari's WebKit engine, which is why the researcher saw nothing on iOS. On Android and desktop you can block third-party cookies in the browser settings. Firefox isolates third-party cookies per site by default, and Brave blocks them.

Consent banners let each company define its own categories. Here, "analytics" also covered syncing an advertising identifier, so refusing only "marketing" does not keep you out of ad tracking.

The behaviour was observed with ChatGPT logged in through Chrome on Android, so iPhone users need not change anything. Android users of Chrome can go to Settings > Site settings > Third-party cookies and choose Block third-party cookies; Google's help page gives the steps in Chinese as well as English. Some sites may stop working as expected once third-party cookies are blocked, and adding them to the exception list fixes that. Anyone who would rather not change Chrome's settings can instead use ChatGPT in a separate browser from the one used for everything else.

Phone-number-free registration in the Signal Android beta

anoni.net community — Sat, 26 Sep 2026 01:23:00 +0800

Based on 12 sources, including Signal Support, Signal Community, CyberInsider

Signal's Android 8.28 beta adds a way to register without a phone number, called Signal Login. The 8.29 beta announcement on 23 September says the feature will stay in beta for another week. The iPhone version is still in development, and accounts already registered with a number cannot remove it yet.

Registering this way takes a one-time payment of US$2.99 through Google Play, and prices can differ by country. Devices without Google Play services cannot use it yet. Signal's announcement on its community forum says the payment uses the same zero-knowledge proofs as its donation system, so there is no link between the payment and the account. The fee is there because free accounts would be registered in bulk by spammers.

Registration gives you an Account ID and a Recovery Key, which work like a username and password. There is no PIN and no other recovery mechanism, so losing either one loses the account. A username is optional. Without one, nobody can find the account, and it can only join chats it starts. TOTP two-factor authentication can be added after registration, and Signal plans to add passkeys and hardware keys later.

Perspective

Signal's end-to-end encryption has always protected message content, but every account started from a phone number. In much of Asia a phone number is itself an identity record. Mainland China has required real-name registration for every phone line since 2013, when the Ministry of Industry and Information Technology obliged carriers to check a valid ID before connecting a user. Hong Kong extended registration to every SIM card, prepaid ones included, and unregistered prepaid cards stopped working after 23 February 2023. In Taiwan, carriers must record a name, an address and the numbers of two identity documents before activating any mobile number, prepaid or not. In all three places, a Signal account registered with a number leads back, through the carrier, to a named person.

The paid route breaks that chain in two places. The account is not tied to a SIM card, and the zero-knowledge payment is not tied to the account. People who want to keep a work identity apart from a personal one no longer need a second SIM card registered in their own name. Signal's Android app is open source under AGPL-3.0, and its interface is available in both Traditional and Simplified Chinese.

Reaching Signal at all is a separate question in mainland China. OONI measurements from April to September 2021 show Signal blocked there, so people inside need a circumvention tool first.

Without a number, a username becomes the only way to be found. According to the Freedom of the Press Foundation, a username you have shared publicly should be kept, because once it is released someone else can claim it and impersonate you. That risk is highest for people who publish a username so that sources can contact them.

According to a separate essay on passkeys, an account is only as secure as its weakest recovery method. Signal's numberless accounts have no recovery method at all. Attackers lose a weak entry point, and users carry the entire risk of loss.

Trying it means subscribing to Signal's beta channel on Google Play and paying the one-time fee there, US$2.99 or a local equivalent. For now the option suits people outside the mainland whose phones run Google Play services. After registering, store the Account ID and Recovery Key in a password manager with an offline backup, and if you add TOTP, set up more than one second factor.

Sources (12)

Phone Numberless Registration for Android

Publisher: Signal Support

Beta feedback for the upcoming Android 8.28 release

Publisher: Signal Community
Published: 16 September 2026

Beta feedback for the upcoming Android 8.29 release

Publisher: Signal Community
Published: 23 September 2026

Signal tests account registration without phone number on Android

Publisher: CyberInsider
Published: 18 September 2026

Signal Will Let You Sign Up Without a Phone Number — For $3

Publisher: It's FOSS
Published: 22 September 2026

Signal introduces registration without a phone number

Publisher: Freedom of the Press Foundation
Published: 23 September 2026

I don't like passkeys

Published: 18 September 2026

电话用户真实身份信息登记规定

Publisher: Ministry of Industry and Information Technology, China
Published: 16 July 2013

OFCA steps up publicity and assistance for forthcoming full implementation of real-name registration programme for SIM cards (with photos)

Publisher: Commerce and Economic Development Bureau, Hong Kong
Published: 19 January 2023

行動寬頻業務管理規則

Publisher: Laws & Regulations Database of Taiwan

How countries attempt to block Signal Private Messenger App around the world

Publisher: OONI
Published: 21 October 2021

Signal Beta

Publisher: Signal Support