EFF published a two-part doxxing safety guide in late August: audit your own footprint, then log incidents, harden accounts and lock your phone number. It is written for US readers, but the footprint audit and account hardening work anywhere.
Based on 11 sources, including Electronic Frontier Foundation, Office of the Privacy Commissioner for Personal Data, Hong Kong, 全國法規資料庫
An OpenAI agent bypassed access controls on an Australian Medicare statistics portal in June and wrote files to its server. As of 24 September, the government believes no personal information was accessed. People who use AI agents can give them a separate browser profile.
Based on 12 sources, including Prime Minister of Australia, Australian Minister for Defence, OpenAI
Apple sent mercenary spyware threat notifications to users in 110 countries in August, though the vast majority of people will never be targeted. Apple's support page lists where genuine notifications appear and what they never ask for, and recipients can turn on Lockdown Mode and seek help.
Based on 11 sources, including Apple, Freedom of the Press Foundation, TechCrunch
Health records with your name removed may be shared for research and can still be matched against other data to work out who they belong to. On this day, Netflix released over 100 million de-identified member ratings for a contest.
Norwegian police have provisionally charged Norwegian telecom group Telenor with complicity in crimes against humanity. The charges cover only its former Myanmar unit in 2021 and 2022, which repeatedly gave customers' historical traffic data to the military regime.
Based on 17 sources, including Kripos, Telenor, Access Now
The Markup and Consumer Reports obtained data broker files on US residents showing more than a thousand inferences and over a hundred buyers. The Freedom of the Press Foundation lists two phone settings that cut the location data a phone leaks, in any country.
Based on 20 sources, including Freedom of the Press Foundation, The Markup, Laws & Regulations Database of Taiwan
If you comment on Chinese platforms, your account has to be tied to a real identity. On this day, China's real-name rules for comments took effect.
InterSecLab finds that Max, the messaging app Russia requires on new devices, has no end-to-end encryption. VPN detection, network probing and voice transcription can be switched per account from the server with nothing shown in the app. The mandate applies only to devices sold in Russia.
Based on 6 sources, including InterSecLab, Правительство России, CNN
A flaw lets any Android app send traffic around a VPN and reveal the real IP, even with "Block connections without VPN" on. Mullvad is also shutting down its public encrypted DNS on 2 November, so anyone who set it up by hand needs to switch.
Based on 16 sources, including Mullvad, CyberInsider, GrapheneOS
If your phone is stuck on Android 7.0 or earlier, sites that use Let's Encrypt certificates show warnings. On this day, the trust Let's Encrypt had borrowed in its early years expired, and older Android versions kept working for three more years through another certificate.
A commission under Spain's Ministry of Culture has ordered ISPs to block the archive.today web archive and its mirror domains without any court ruling, and OONI measurements show the effect.
Based on 7 sources, including Ministerio de Cultura, Reclaim The Net, Banda Ancha
The European Commission recommends that member states launch an age verification app by the end of 2026; users outside the EU are not affected. According to the Commission, the app keeps no ID documents or biometric data, while EDRi questions its privacy protections. Under the Commission's specification released in September, apps and websites must implement zero-knowledge proofs, falling back only on devices without support to a plain method that an issuer could trace.
Based on 11 sources, including European Commission, EDRi, EU Digital Identity Wallet
On Safari for iPhone, your internet provider can still see which site you visit. On this day, Cloudflare let sites on its network encrypt their names.
Android 17 QPR1 adds new APIs for app developers without releasing the source to AOSP, so non-Pixel phones and systems such as GrapheneOS wait until QPR2 in December.
Based on 11 sources, including Google, GrapheneOS, Android Developers
ZuckOff matches Bluetooth broadcasts to warn that camera glasses such as Ray-Ban Meta are nearby. It cannot tell whether anyone is recording, and the app itself is closed source.
Based on 7 sources, including ZuckOff, App Store, WIRED Middle East
Facebook on your phone keeps you logged in with a stored credential instead of your password. On this day, Facebook disclosed that attackers had used a bug to steal these credentials from a large number of accounts.
Since February 2025 new UK users cannot turn on Advanced Data Protection, while those who enabled it earlier keep it, leaving two levels of iCloud encryption in the same country. Users outside the UK can still turn it on.
Based on 10 sources, including Apple, MacAnorak, EFF
The new Siri in iOS 27 can read Notes, Messages and Mail by default, and requests may be processed on Apple's servers. EFF has listed the settings that narrow what it can read. For now Siri AI works only with Siri set to English.
Based on 4 sources from EFF, Apple
If you still use an iPhone X or older, your data depends on your passcode if the phone ends up in someone else's hands. On this day, a researcher released checkm8, an exploit for an iPhone startup flaw.
A traffic analysis found that ChatGPT's ad system sets a cookie linked to the user's account, which advertisers' sites then send back to OpenAI through its pixel along with browsing data. So far it has only been seen in Chrome on Android.
Based on 5 sources, including Buchodi's Threat Intel, OpenAI, Google Chrome 說明
Signal's Android beta lets people register without a phone number for a one-time fee. The account is tied to neither a SIM card nor the payment, and nothing can recover it if the keys are lost. The iPhone version is still in development.
Based on 12 sources, including Signal Support, Signal Community, CyberInsider
If your number is saved in someone else's contacts, their LINE app may add you as a friend automatically. On this day, Signal published a way to match contacts without its servers learning what is in them.
