News

News

Privacy, anonymity and censorship news, read from a tech and open-source angle, with a view from Asia.

Last updated

Featured

Security & Scams

Website and app breaches in Japan since September 2026

Since mid-September, a string of Japanese companies have disclosed breaches of their websites and apps. Car-sharing service Times Car said data from about 6.6 million accounts was taken, including ID images such as driver's licences for about 1.6 million. As of 9 October we found no official attribution, and the Chief Cabinet Secretary said on 6 October it was unclear whether the incidents were related. Readers outside Japan are affected only if they hold accounts with these services.

Based on 43 sources, including JPCERT/CC, Metabase, 内閣官房国家サイバー統括室

Security & Scams

Implanted chips in Ledger hardware wallets

On 15 October Ledger confirmed that a criminal group had fitted genuine hardware wallets with parts that capture the recovery phrase during setup, then put them on the market through resellers in Southeast Asia. As of 13 October, the thefts Ledger had confirmed were all tied to devices sold by authorised reseller CryptoBilis, and reports of implants from other channels were unconfirmed. Ledger's Genuine Check cannot detect these implants, and Ledger advises anyone who bought and set up a device from CryptoBilis to move their assets to a new device and a new recovery phrase.

Based on 20 sources, including Ledger, Ledger Support, Ledger Academy

Encryption & Messaging

End-to-end Encrypted Chats and Confidential Computing in Brave Leo

From 15 October, Brave's AI assistant Leo encrypts chats with the GLM 5.3 Flash model in the browser and decrypts them only inside hardware-isolated enclaves. Other models are not covered. As of 20 October, Brave's servers still check the enclaves' attestations for the browser, and we found no statement of iOS support.

Based on 19 sources, including Brave, GitHub, Hugging Face

Encryption & Messaging

Senate second reading of Canada's Bill C-22 and providers' responses

Canada's Bill C-22 on lawful access went to second reading debate in the Senate on 8 October and, as of 18 October, had not passed second reading. A Signal vice president said at a panel that Signal would have to leave Canada if ordered to collect more metadata, while the public safety minister's office said the bill does not require decrypting end-to-end encrypted information. Readers outside Canada do not need to change any settings now.

Based on 10 sources, including Parliament of Canada, Senate of Canada, Public Safety Canada

Tracking & Personal Data

Automatic phone number verification on Android and the linking of Google accounts

Android phones verify phone numbers automatically by default and add them to every Google Account signed in on the phone, including work and secondary accounts. Verification can be turned off in settings, but according to Android Authority, numbers already added have to be removed from each account one by one. As of 18 October, we had not seen a public response from Google.

Based on 13 sources, including Android Help, Android 說明, Android Authority

Security & Scams

The passkey attestation debate

On 10 October a commentary argued against using passkeys because sites can use attestation to restrict which devices and software people may use, and on 14 October an author published a response. Both agree that passkeys are, in most cases, bound to a domain and resist phishing; they disagree on whether attestation will become a restriction, and on whether to keep using passkeys or switch to something else.

Based on 23 sources, including Non-Functional, scotthelme.co.uk, W3C

Surveillance & Spyware

Zero-click spyware delivered through targeted ads

Citizen Lab published a report on 15 October linking, with high confidence, attacks on at least 45 Al Jazeera devices between 2024 and 2025 to targeted ads from the Israeli ad firm Discover-Tech and spyware from Candiru. Al Jazeera is the only confirmed target, and the exploited vulnerabilities are not described. The advice for general readers is to block ads and limit advertising IDs, which according to the report lowers only part of the risk.

Based on 18 sources, including Citizen Lab, IAB Europe, Adtimizer

Encryption & Messaging

Tuta encrypted email and its Nextcloud integration

Tuta and Nextcloud launched an integration on 1 October that lets you use Tuta inside Nextcloud, save received attachments to Nextcloud and create Nextcloud Talk meeting links from Tuta Calendar. A Nextcloud administrator has to install the app, and as of 18 October neither announcement explains how attachments are protected once they are in Nextcloud.

Based on 16 sources, including Tuta, Nextcloud, CyberInsider

Phones & Apps

Signal's cross-platform encrypted backups and password manager transfers on Android

Signal released iOS 8.30 on 28 September, and its encrypted Signal Secure Backups can now be restored between Android and iPhone, so chats can follow you to a new platform. In September Google added a way on Android to move passwords and passkeys between password managers without exporting a file, starting with four apps.

Based on 21 sources, including Signal, Google, Android Developers

Weekly Brief

Weekly brief, 2026 week 42

Seven stories from 3 to 11 October: a now-patched file-reading flaw in Telegram Desktop, Bitwarden's app store builds moving to a commercial licence, LineageOS 24 based on Android 17, Nitter seeking funding and legal help, a DNS ad blocker built on an ESP32-C3, a mobile internet shutdown and a platform advisory in New Delhi, and Psiphon weighing a move out of Canada over Bill C-22.

Based on 18 sources, including beaksec, GitHub, Bitwarden Community Forums

Security & Scams

Country-code top-level domain hijacks and unauthorized HTTPS certificates

Google announced on 6 October that the .gh, .sl and .as country-code top-level domains were hijacked and attackers obtained HTTPS certificates for Google and other organizations. Chrome has blocked the certificates it found; domain owners can monitor Certificate Transparency logs.

Based on 15 sources, including Google, Let's Encrypt Community Forum, Ars Technica

Security & Scams

BentoPDF, an open-source toolkit for processing PDFs locally in the browser

According to its developers, the open-source BentoPDF toolkit merges, compresses, OCRs and strips metadata from PDFs inside the browser, without uploading files to an online converter. It works straight from its website, and some features download code from the third-party jsDelivr service when used.

Based on 15 sources, including BentoPDF, GitHub, It's FOSS

Encryption & Messaging

Let's Encrypt's 64-day default certificate lifetime

Let's Encrypt will cut its default certificate lifetime from 90 to 64 days from 10 February 2027. Anyone running a site or self-hosted service on its certificates should check that automatic renewal is not tied to a fixed number of days. The announcement says nothing to ordinary visitors.

Based on 13 sources, including Let's Encrypt, CA/Browser Forum, Ars Technica

Tracking & Personal Data

Apple's planned changes to granting Full Disk Access on the Mac

Apple said on 2 October that it will require very explicit user action before a Mac app can be granted Full Disk Access, citing some developers' use of the permission and the growing risk from AI agents. Apple gave no version or date, and as of 12 October its release notes do not mention the control.

Based on 18 sources, including Apple, TechCrunch, Decrypt

Tracking & Personal Data

Brave's Email Aliases

Brave's desktop browser offers email aliases from version 1.94, letting you sign up with a forwarding address instead of your real one. Everyone gets five free, with a Brave account required. As of 12 October there is no mobile version, and Brave does not say whether you can reply from an alias.

Based on 14 sources, including Brave, GitHub, Apple

Civil Society Tech Practice

The Tor Project's decision on its relationship with Mullvad, and the debate around it

After a political donation by a co-founder of VPN provider Mullvad drew criticism, the Tor Project said on 9 October that it would keep working with Mullvad but pause co-branding and revise how it describes Mullvad Browser. Neither browser has announced a halt in maintenance, and comments on the statement are divided.

Based on 13 sources, including Tor Project, Tor Project Forum, Mullvad

Security & Scams

Beeline's AI voice personas for scam calls

Russian carrier Beeline said on 6 October that it has routed 19.1 million scam calls to AI voice personas since the start of 2026, according to its own figures. The service runs only on Beeline's network in Russia. In South Korea, Singapore and Taiwan, the examples we found are call warnings, filtering and on-device detection.

Based on 12 sources, including Beeline, ict-online, 動區動趨

Security & Scams

Website and app breaches in Japan since September 2026

Since mid-September, a string of Japanese companies have disclosed breaches of their websites and apps. Car-sharing service Times Car said data from about 6.6 million accounts was taken, including ID images such as driver's licences for about 1.6 million. As of 9 October we found no official attribution, and the Chief Cabinet Secretary said on 6 October it was unclear whether the incidents were related. Readers outside Japan are affected only if they hold accounts with these services.

Based on 43 sources, including JPCERT/CC, Metabase, 内閣官房国家サイバー統括室

Security & Scams

Firefox 157's TLS key logging warning

Firefox 157 for desktop, released on 29 September, shows a warning when the computer is set up to record encryption keys. Mozilla's support page says antivirus or security software is the most likely cause and the warning does not mean the computer is infected. If sites fail to load, check that software's HTTPS scanning first.

Based on 5 sources, including Mozilla, Mozilla Bugzilla, RFC Editor