How messaging apps and cloud services encrypt your data, and the laws and policies that seek to have providers hand over or scan communications.
From 15 October, Brave's AI assistant Leo encrypts chats with the GLM 5.3 Flash model in the browser and decrypts them only inside hardware-isolated enclaves. Other models are not covered. As of 20 October, Brave's servers still check the enclaves' attestations for the browser, and we found no statement of iOS support.
Based on 19 sources, including Brave, GitHub, Hugging Face
Canada's Bill C-22 on lawful access went to second reading debate in the Senate on 8 October and, as of 18 October, had not passed second reading. A Signal vice president said at a panel that Signal would have to leave Canada if ordered to collect more metadata, while the public safety minister's office said the bill does not require decrypting end-to-end encrypted information. Readers outside Canada do not need to change any settings now.
Based on 10 sources, including Parliament of Canada, Senate of Canada, Public Safety Canada
Tuta and Nextcloud launched an integration on 1 October that lets you use Tuta inside Nextcloud, save received attachments to Nextcloud and create Nextcloud Talk meeting links from Tuta Calendar. A Nextcloud administrator has to install the app, and as of 18 October neither announcement explains how attachments are protected once they are in Nextcloud.
Based on 16 sources, including Tuta, Nextcloud, CyberInsider
Let's Encrypt will cut its default certificate lifetime from 90 to 64 days from 10 February 2027. Anyone running a site or self-hosted service on its certificates should check that automatic renewal is not tied to a fixed number of days. The announcement says nothing to ordinary visitors.
Based on 13 sources, including Let's Encrypt, CA/Browser Forum, Ars Technica
CryptPad, an end-to-end encrypted collaboration suite, has a new security policy that keeps vulnerability details private for at least 90 days after a fix ships. Its post-quantum experiment left some features too slow to use, and native browser support for the algorithms may change that. People on public instances need not change anything, while self-hosting administrators should keep up with releases.
Based on 21 sources, including CryptPad, GitHub, WICG
Canada's Bill C-22 has passed the House of Commons. It would let the government require communications and internet services, including some outside Canada, to build capabilities for law enforcement access and to retain metadata. Readers outside Canada do not need to change any settings now.
Based on 12 sources, including Parliament of Canada, Access Now, Citizen Lab
InterSecLab finds that Max, the messaging app Russia requires on new devices, has no end-to-end encryption. VPN detection, network probing and voice transcription can be switched per account from the server with nothing shown in the app. The mandate applies only to devices sold in Russia.
Based on 6 sources, including InterSecLab, Правительство России, CNN
Since February 2025 new UK users cannot turn on Advanced Data Protection, while those who enabled it earlier keep it, leaving two levels of iCloud encryption in the same country. Users outside the UK can still turn it on.
Based on 10 sources, including Apple, MacAnorak, EFF
Signal's Android beta lets people register without a phone number for a one-time fee. The account is tied to neither a SIM card nor the payment, and nothing can recover it if the keys are lost. The iPhone version is still in development.
Based on 12 sources, including Signal Support, Signal Community, CyberInsider
