anoni.net NEWS 新聞導讀

anoni.netCyber intrusions and disputed information ahead of Taiwan's local electionsAccording to a report Taiwan's National Security Bureau sent to the legislature in October, the bureau collected more than 2.5 million items of disputed information from January to September 2026, about 48% more than a year earlier, and that government networks faced about 2.58 million intrusions a day. The bureau assesses that China is expanding its use of AI to influence the 28 November local elections. How the figures were counted is not explained in the news reports.

Cyber intrusions and disputed information ahead of Taiwan's local elections

anoni.net台灣地方選舉前的網路侵擾與爭議訊息台灣國家安全局 10 月送交立法院的報告提到，2026 年 1 到 9 月蒐報的爭議訊息超過 250 萬則，比 2025 年同期增加約 48%。報告也提到政府機關的網路每天平均遭侵擾約 258 萬次。國安局判斷中國擴大運用 AI 操弄資訊，意圖影響 11 月 28 日的地方選舉。報導沒有交代這些數字的統計方式。讀者看到可疑的訊息，可以送事實查核組織查證，或撥打地檢署的專線檢舉。

台灣地方選舉前的網路侵擾與爭議訊息台灣國家安全局 10 月送交立法院的報告提到，2026 年 1 到 9 月蒐報的爭議訊息超過 250 萬則，比 2025 年同期增加約 48%。報告也提到政府機關的網路每天平均遭侵擾約 258 萬次。國安局判斷中國擴大運用 AI 操弄資訊，意圖影響 11 月 28 日的地方選舉。報導沒有交代這些數字的統計方式。讀者看到可疑的訊息，可以送事實查核組織查證，或撥打地檢署的專線檢舉。

anoni.netDisputed matching of protest footage by Baden-Württemberg police and Berlin's behaviour-recognition camerasAccording to court testimony reported by netzpolitik.org, an officer at the State Criminal Police Office of Baden-Württemberg in Germany ran footage of a registered demonstration through a computer after the event and identified four participants who, to date, have no connection to the case. In October, Berlin police began testing cameras that analyse behaviour at high-crime locations, and the police law rules out automated facial recognition on that footage. The EU AI Act in principle prohibits real-time identification by law enforcement in publicly accessible spaces, while post-event identification is classed as high-risk and becomes subject to authorisation and other rules from December 2027.

Disputed matching of protest footage by Baden-Württemberg police and Berlin's behaviour-recognition cameras

anoni.net巴登－符騰堡警方比對示威影像的爭議與柏林的行為辨識監視器依 netzpolitik.org 轉述的庭審內容，德國巴登－符騰堡邦刑事局一名警員事後用電腦比對一場已登記示威的影像，另外識別出四名至今與案件無關的參與者。10 月，柏林警方在犯罪高發地點開始測試分析行為的監視器，警察法排除這些影像的自動化臉部辨識。歐盟 AI 法原則禁止執法機關在公眾可進入的場所即時辨識，事後辨識列為高風險，2027 年 12 月起須遵守授權等規定。

巴登－符騰堡警方比對示威影像的爭議與柏林的行為辨識監視器依 netzpolitik.org 轉述的庭審內容，德國巴登－符騰堡邦刑事局一名警員事後用電腦比對一場已登記示威的影像，另外識別出四名至今與案件無關的參與者。10 月，柏林警方在犯罪高發地點開始測試分析行為的監視器，警察法排除這些影像的自動化臉部辨識。歐盟 AI 法原則禁止執法機關在公眾可進入的場所即時辨識，事後辨識列為高風險，2027 年 12 月起須遵守授權等規定。

anoni.netLawsuit and criminal investigations over Telenor's Myanmar user dataTelenor's Myanmar subsidiary handed user data to the military after the 2021 coup, and its Norwegian parent now faces a class action, which a court allowed to proceed on 17 September. Norwegian police have also opened two criminal investigations into the parent company. According to Telenor, local law required it to provide the data, and employees who refused risked imprisonment, torture or the death penalty. The case also raises how user data and surveillance equipment are handled when a telecom operator leaves a country.

Lawsuit and criminal investigations over Telenor's Myanmar user data

anoni.netTelenor 緬甸用戶資料案的訴訟與偵查Telenor 的緬甸子公司在 2021 年政變後把用戶資料交給軍方，挪威母公司因此面對集體訴訟，法院 9 月 17 日允許訴訟繼續進行。挪威警方另對母公司展開兩項刑事偵查。Telenor 表示依當地法律必須提供資料，員工拒絕可能面臨監禁、酷刑或死刑。案件也牽涉電信業者撤出一國時，用戶資料與監控設備如何處理。

Telenor 緬甸用戶資料案的訴訟與偵查 Telenor 的緬甸子公司在 2021 年政變後把用戶資料交給軍方，挪威母公司因此面對集體訴訟，法院 9 月 17 日允許訴訟繼續進行。挪威警方另對母公司展開兩項刑事偵查。Telenor 表示依當地法律必須提供資料，員工拒絕可能面臨監禁、酷刑或死刑。案件也牽涉電信業者撤出一國時，用戶資料與監控設備如何處理。

anoni.netQuad9's exit from France and French DNS blocking ordersPublic DNS resolver Quad9 announced on 22 October that from 24 November it will stop serving users located in France. According to Quad9, a French court applying anti-piracy rules for sports broadcasts ordered it to block a list of domains for users in France. We compare how Taiwan, India and Japan handle site blocking.

Quad9's exit from France and French DNS blocking orders

anoni.netQuad9 退出法國與法國的 DNS 封鎖命令公共 DNS 解析服務 Quad9 10 月 22 日宣布，11 月 24 日起不再為位於法國的使用者提供服務。依 Quad9 的公告，起因是法國法院依體育轉播的反盜版規定，要求它替法國使用者封鎖一批網域。台灣也有 DNS 層的停止解析程序，對象不包括使用者自行設定的公共解析服務。

Quad9 退出法國與法國的 DNS 封鎖命令公共 DNS 解析服務 Quad9 10 月 22 日宣布，11 月 24 日起不再為位於法國的使用者提供服務。依 Quad9 的公告，起因是法國法院依體育轉播的反盜版規定，要求它替法國使用者封鎖一批網域。台灣也有 DNS 層的停止解析程序，對象不包括使用者自行設定的公共解析服務。

anoni.netCCTV at Hong Kong malls and the police SmartView programmeHong Kong's Secretary for Security said in an interview on 18 October that some CCTV cameras at private shopping malls will be connected to the police SmartView programme, with talks in their final stage. He also said the public may not need to be told separately, and in February said that third-party connections are one-way and that footage on the government system is generally kept for 31 days. People travelling to Hong Kong for leisure or business may be caught on camera in public areas of malls, and places outside Hong Kong are not affected. According to Hong Kong media reports, facial recognition is being piloted in parts of the system.

CCTV at Hong Kong malls and the police SmartView programme

anoni.net香港商場的閉路電視與警方的銳眼計劃香港保安局局長 10 月 18 日受訪時表示，私人商場的部分閉路電視將接入警方的「銳眼計劃」，商討已進入最後階段。局長也表示未必需要另外告知市民，2 月則說明第三方接入屬於單向傳送、政府系統的影像一般保存 31 日。到香港旅遊或出差的人經過商場的公共區域時可能入鏡，香港以外的地方不受影響。依香港媒體的報導，臉部辨識已在局部範圍試驗。

香港商場的閉路電視與警方的銳眼計劃香港保安局局長 10 月 18 日受訪時表示，私人商場的部分閉路電視將接入警方的「銳眼計劃」，商討已進入最後階段。局長也表示未必需要另外告知市民，2 月則說明第三方接入屬於單向傳送、政府系統的影像一般保存 31 日。到香港旅遊或出差的人經過商場的公共區域時可能入鏡，香港以外的地方不受影響。依香港媒體的報導，臉部辨識已在局部範圍試驗。

anoni.netAI training and cookie rules in the EU Digital OmnibusOn 21 October, EU member states agreed the Council of the EU's position on the draft Digital Omnibus, under which the GDPR would state that personal data may be processed on the basis of "legitimate interest" to develop and operate AI, and cookies would need no consent in more cases. It is the Council's position for negotiating with the European Parliament, which had not formed its own as of 23 October. The GDPR applies to personal data processed by businesses established in the EU, and also protects people in the EU who are offered services or whose behaviour is monitored by businesses outside it; otherwise, readers outside the EU are not directly affected.

AI training and cookie rules in the EU Digital Omnibus

anoni.net歐盟數位綜合法案裡的 AI 訓練與 Cookie 規定歐盟成員國 10 月 21 日議定數位綜合法案（Digital Omnibus）草案的理事會立場，要在 GDPR 寫明開發與運作 AI 時可以用「正當利益」處理個人資料，Cookie 不需同意的情形也要擴大。這是跟歐洲議會談判用的立場，到 10 月 23 日議會還沒有形成立場。GDPR 適用於設在歐盟的企業處理的個人資料，也保護位於歐盟境內、被非歐盟企業提供服務或監控行為的人，其他情況下歐盟以外的讀者不直接受影響。

歐盟數位綜合法案裡的 AI 訓練與 Cookie 規定歐盟成員國 10 月 21 日議定數位綜合法案（Digital Omnibus）草案的理事會立場，要在 GDPR 寫明開發與運作 AI 時可以用「正當利益」處理個人資料，Cookie 不需同意的情形也要擴大。這是跟歐洲議會談判用的立場，到 10 月 23 日議會還沒有形成立場。GDPR 適用於設在歐盟的企業處理的個人資料，也保護位於歐盟境內、被非歐盟企業提供服務或監控行為的人，其他情況下歐盟以外的讀者不直接受影響。

anoni.netWeekly brief, 2026 week 43Five stories and follow-ups from 1 to 22 October: progress on Session's Protocol v2, the development of Thunderbird for iOS, CryptPad 2026.10.0, PipePipe 5.5.0, and docket activity in a civil rights suit against two Florida state troopers in the US.

Weekly brief, 2026 week 43 Five stories and follow-ups from 1 to 22 October: progress on Session's Protocol v2, the development of Thunderbird for iOS, CryptPad 2026.10.0, PipePipe 5.5.0, and docket activity in a civil rights suit against two Florida state troopers in the US.

anoni.net每週短訊 2026 第 43 週10 月 1 日到 10 月 22 日的 5 則新聞與後續，包括 Session 通訊協定 v2 的進度、Thunderbird for iOS 的開發進度、CryptPad 2026.10.0、PipePipe 5.5.0，以及美國佛州州警遭訴的民權訴訟的案卷動態。

每週短訊 2026 第 43 週 10 月 1 日到 10 月 22 日的 5 則新聞與後續，包括 Session 通訊協定 v2 的進度、Thunderbird for iOS 的開發進度、CryptPad 2026.10.0、PipePipe 5.5.0，以及美國佛州州警遭訴的民權訴訟的案卷動態。

anoni.netThe per-app clipboard read toggle in GrapheneOSGrapheneOS, a privacy-hardened mobile operating system officially supported only on Pixel phones, added Secure Paste in a release announced on 18 September, letting users set app by app which apps cannot read content copied in other apps. As of 23 October the feature is off by default and has to be turned on in settings, and the settings GrapheneOS adds are in English only. Stock Android notifies users after an app has read the clipboard, while iPhone asks for permission before an app reads it programmatically. Having a password manager clear the clipboard after copying a password is a step available on both.

The per-app clipboard read toggle in GrapheneOS

anoni.netGrapheneOS 的剪貼簿讀取開關官方只支援 Pixel 的隱私強化手機系統 GrapheneOS，9 月 18 日公告的版本加入 Secure Paste，可以逐一設定哪些 App 不能讀取其他 App 複製的內容。到 10 月 23 日功能預設沒有開啟，要自己到設定調整，GrapheneOS 自己新增的設定也只有英文。一般 Android 手機在 App 讀取剪貼簿之後才通知，iPhone 則在 App 用程式讀取前請使用者同意。複製密碼之後讓密碼管理器自動清除剪貼簿，是兩邊都能做的一步。

GrapheneOS 的剪貼簿讀取開關官方只支援 Pixel 的隱私強化手機系統 GrapheneOS，9 月 18 日公告的版本加入 Secure Paste，可以逐一設定哪些 App 不能讀取其他 App 複製的內容。到 10 月 23 日功能預設沒有開啟，要自己到設定調整，GrapheneOS 自己新增的設定也只有英文。一般 Android 手機在 App 讀取剪貼簿之後才通知，iPhone 則在 App 用程式讀取前請使用者同意。複製密碼之後讓密碼管理器自動清除剪貼簿，是兩邊都能做的一步。

anoni.netBrowser fingerprinting and how browsers defend against itA browser fingerprint combines traits a website can read, such as window size, fonts and small differences in rendering, into an identifier that recognises the same browser again, and clearing cookies or using a VPN does not stop it. According to the UK Information Commissioner's Office, Google stopped prohibiting its advertising customers from using fingerprinting in February 2025. How much gets blocked depends on the browser, with Firefox, Safari, Brave and Tor Browser each taking their own approach. The only fingerprinting-related item on Chrome's official status page, as we checked it on 23 October, limits the data the browser attaches to every request automatically.

Browser fingerprinting and how browsers defend against it

anoni.net瀏覽器指紋與各家瀏覽器的防護瀏覽器指紋是網站讀取視窗大小、字型與繪圖的細微差異這類特徵，組合出可以重複認出同一個瀏覽器的識別，清除 cookie 或連 VPN 都擋不住。依英國資訊專員辦公室的說明，Google 從 2025 年 2 月起不再禁止廣告客戶使用指紋技術。能擋下多少取決於用哪個瀏覽器，Firefox、Safari、Brave 與 Tor Browser 各有做法。本文 10 月 23 日查看的 Chrome 官方狀態頁，列出的指紋相關項目只有限縮瀏覽器隨每個請求自動附帶的資料。

瀏覽器指紋與各家瀏覽器的防護瀏覽器指紋是網站讀取視窗大小、字型與繪圖的細微差異這類特徵，組合出可以重複認出同一個瀏覽器的識別，清除 cookie 或連 VPN 都擋不住。依英國資訊專員辦公室的說明，Google 從 2025 年 2 月起不再禁止廣告客戶使用指紋技術。能擋下多少取決於用哪個瀏覽器，Firefox、Safari、Brave 與 Tor Browser 各有做法。本文 10 月 23 日查看的 Chrome 官方狀態頁，列出的指紋相關項目只有限縮瀏覽器隨每個請求自動附帶的資料。

anoni.netA static website hosted as a Tor onion serviceHosting an onion service needs no fixed IP address, domain name or open port, and tor plus an ordinary web server is enough to put a static site on the Tor network. tor shipped four security updates between June and October, three with fixes involving onion services, and as of 20 October the latest is 0.4.9.14. Visitors need to connect through Tor, for example with Tor Browser.

A static website hosted as a Tor onion service

anoni.netTor 洋蔥服務的靜態網站架設架設洋蔥服務不需要固定 IP、網域或開放連接埠，用 tor 加上一般的網頁伺服器就能把靜態網站放上 Tor 網路。tor 6 月到 10 月連續發布四個安全更新，其中三個的修補涉及洋蔥服務，到 10 月 20 日為止最新版是 0.4.9.14。網站的訪客要透過 Tor 連線，例如用 Tor Browser。

Tor 洋蔥服務的靜態網站架設架設洋蔥服務不需要固定 IP、網域或開放連接埠，用 tor 加上一般的網頁伺服器就能把靜態網站放上 Tor 網路。tor 6 月到 10 月連續發布四個安全更新，其中三個的修補涉及洋蔥服務，到 10 月 20 日為止最新版是 0.4.9.14。網站的訪客要透過 Tor 連線，例如用 Tor Browser。

anoni.netAISeal, the isolated environment for on-device AI in Android 17On 7 October Google described AISeal in Android 17, which keeps the personal data used by on-device AI in a protected virtual machine isolated from the operating system. According to the announcement, the first phase covers storing personal data, with model inference and AI agents to follow. As of 20 October, Google had not said which devices or regions have it enabled, and there is nothing in Google's announcement or help pages about settings that users need to change.

AISeal, the isolated environment for on-device AI in Android 17

anoni.netAndroid 17 裝置端 AI 的隔離執行環境 AISealGoogle 10 月 7 日說明 Android 17 的 AISeal，把裝置端 AI 使用的個人資料放進跟作業系統隔離的受保護虛擬機器。依公告，第一階段推出的是個人資料的儲存，模型推論與 AI 代理程式要等之後。到 10 月 20 日為止，Google 沒有公布哪些機型、哪些地區已經啟用，Google 的公告與說明頁沒有提到使用者需要調整的設定。

Android 17 裝置端 AI 的隔離執行環境 AISeal Google 10 月 7 日說明 Android 17 的 AISeal，把裝置端 AI 使用的個人資料放進跟作業系統隔離的受保護虛擬機器。依公告，第一階段推出的是個人資料的儲存，模型推論與 AI 代理程式要等之後。到 10 月 20 日為止，Google 沒有公布哪些機型、哪些地區已經啟用，Google 的公告與說明頁沒有提到使用者需要調整的設定。

anoni.netCoordinated disclosure of the PHP vulnerabilities and publication before the fixNews of two PHP vulnerabilities leaked during coordinated disclosure. Before the fix came out on 21 October, a researcher published what were claimed to be full technical details, and a distributor released images containing the fix early. Security firms also deployed protections for their customers ahead of time. This piece sets out the different views on embargoes and early publication, the relevant guidance and rules in the US, the EU and mainland China, and how Japan and Taiwan handle disclosure timing.

Coordinated disclosure of the PHP vulnerabilities and publication before the fix

anoni.net NEWS 新聞導讀@news.anoni.net

PHP remote code execution vulnerabilities and the early leak of their IDs

anoni.netPHP remote code execution vulnerabilities and the early leak of their IDsOn 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two vulnerabilities that may let an attacker who is not logged in run code on a web server. The vulnerability IDs leaked two days before the planned disclosure, and PHP moved the release forward by a day. The flaws are in PHP itself, so the PHP on the server is what needs updating, and people on hosted plans can check with their provider.

anoni.netPHP 漏洞的協調揭露與修補前的提前公開PHP 兩個漏洞在協調揭露期間消息外流。10 月 21 日修補發布之前，有研究者公開據稱完整的技術細節，發行業者提前推出含修補的映像檔。資安業者也替客戶提前部署了防護，這篇整理各方對禁令與提前公開的看法，以及美國、歐盟與中國大陸的相關說明與法規。

PHP 漏洞的協調揭露與修補前的提前公開 PHP 兩個漏洞在協調揭露期間消息外流。10 月 21 日修補發布之前，有研究者公開據稱完整的技術細節，發行業者提前推出含修補的映像檔。資安業者也替客戶提前部署了防護，這篇整理各方對禁令與提前公開的看法，以及美國、歐盟與中國大陸的相關說明與法規。

anoni.net NEWS 新聞導讀@news.anoni.net

修補前消息外流的 PHP 遠端執行程式碼漏洞 PHP 10 月 21 日發布 8.5.12、8.4.27、8.3.36、8.2.35，修補兩個可能讓未登入的攻擊者在網站伺服器上執行程式碼的漏洞。漏洞編號在預定揭露前兩天外流，PHP 把發布提前一天。漏洞在 PHP 本身，要更新的是伺服器上的 PHP，租用主機的人可以向業者確認。

anoni.net修補前消息外流的 PHP 遠端執行程式碼漏洞PHP 10 月 21 日發布 8.5.12、8.4.27、8.3.36、8.2.35，修補兩個可能讓未登入的攻擊者在網站伺服器上執行程式碼的漏洞。漏洞編號在預定揭露前兩天外流，PHP 把發布提前一天。漏洞在 PHP 本身，要更新的是伺服器上的 PHP，租用主機的人可以向業者確認。

anoni.netWeak private keys in eight eMudhra intermediate certificatesEight intermediate certificates from the Indian certificate authority eMudhra had private keys smaller than 256, which anyone could compute at once and use to issue HTTPS certificates for other people's websites. After a researcher reported it on 17 October, Chrome and Firefox blocked them automatically within hours, with nothing for ordinary browser users to set up. Programs that do not go through a browser carry their own trust lists, and Node.js, Python's certifi, Go, Java and Linux distributions have been shipping updates since 19 October (not all complete as of 22 October), so people who write their own code or run servers need to update each one.

PHP remote code execution vulnerabilities and the early leak of their IDs

Weak private keys in eight eMudhra intermediate certificates

anoni.neteMudhra 八張中繼憑證的弱私鑰事件印度憑證機構 eMudhra 有八張中繼憑證的私鑰小於 256，任何人都能立刻算出來，再用來替別人的網站簽發 HTTPS 憑證。研究者 10 月 17 日通報後，Chrome 與 Firefox 在幾個小時內自動封鎖，一般使用者的瀏覽器不必另外設定。不經過瀏覽器的程式各自帶著信任清單，Node.js、Python 的 certifi、Go、Java 與 Linux 發行版從 10 月 19 日起陸續推出更新（到 10 月 22 日還沒全部完成），自行寫程式或維護伺服器的人要逐一更新。

eMudhra 八張中繼憑證的弱私鑰事件印度憑證機構 eMudhra 有八張中繼憑證的私鑰小於 256，任何人都能立刻算出來，再用來替別人的網站簽發 HTTPS 憑證。研究者 10 月 17 日通報後，Chrome 與 Firefox 在幾個小時內自動封鎖，一般使用者的瀏覽器不必另外設定。不經過瀏覽器的程式各自帶著信任清單，Node.js、Python 的 certifi、Go、Java 與 Linux 發行版從 10 月 19 日起陸續推出更新（到 10 月 22 日還沒全部完成），自行寫程式或維護伺服器的人要逐一更新。

anoni.netUser data Telegram handed over to US law enforcementA newly filed US federal court record includes a letter in which Telegram provided a user's phone number, user ID and IP address under a court order. Since September 2024, Telegram's privacy policy has allowed it to hand over IP addresses and phone numbers in criminal cases involving violations of its Terms of Service, no longer only for terror suspects, and the clause has no regional limit. As of 20 October, we had not seen a public response from Telegram to the filing.

User data Telegram handed over to US law enforcement

anoni.netTelegram 交給美國執法單位的使用者資料美國聯邦法院新歸檔的文件裡，有一封 Telegram 依法院命令提供使用者電話號碼、使用者 ID 與 IP 位址的信。Telegram 的隱私政策 2024 年 9 月起，把可以提供 IP 位址與電話號碼的範圍從恐怖活動嫌疑人擴大到違反服務條款的犯罪案件，條文沒有限定適用地區。到 10 月 20 日為止，沒有看到 Telegram 對這批文件的公開回應。

Telegram 交給美國執法單位的使用者資料美國聯邦法院新歸檔的文件裡，有一封 Telegram 依法院命令提供使用者電話號碼、使用者 ID 與 IP 位址的信。Telegram 的隱私政策 2024 年 9 月起，把可以提供 IP 位址與電話號碼的範圍從恐怖活動嫌疑人擴大到違反服務條款的犯罪案件，條文沒有限定適用地區。到 10 月 20 日為止，沒有看到 Telegram 對這批文件的公開回應。

anoni.netCustomer-list matching and conversation context in ChatGPT adsAdvertisers on ChatGPT can upload lists of email addresses, phone numbers or mobile advertising IDs so that their ads reach only the people on those lists. Ads appear only on the Free and Go plans and began rolling out in Taiwan on 23 September. According to OpenAI's help page as of 20 October, ChatGPT still picks ads based on the current conversation after ad personalisation is turned off.

Customer-list matching and conversation context in ChatGPT ads

anoni.netChatGPT 廣告的客戶名單比對與對話內容ChatGPT 的廣告主可以上傳電子郵件、電話號碼或手機廣告識別碼的名單，讓廣告只出現在名單上的使用者面前。廣告只顯示給 Free 與 Go 方案，台灣 9 月 23 日起陸續推出。依 OpenAI 到 10 月 20 日的說明頁，關閉廣告個人化之後，ChatGPT 仍會依目前的對話內容挑選廣告。

ChatGPT 廣告的客戶名單比對與對話內容 ChatGPT 的廣告主可以上傳電子郵件、電話號碼或手機廣告識別碼的名單，讓廣告只出現在名單上的使用者面前。廣告只顯示給 Free 與 Go 方案，台灣 9 月 23 日起陸續推出。依 OpenAI 到 10 月 20 日的說明頁，關閉廣告個人化之後，ChatGPT 仍會依目前的對話內容挑選廣告。

anoni.netImplanted chips in Ledger hardware walletsOn 15 October Ledger confirmed that a criminal group had fitted genuine hardware wallets with parts that capture the recovery phrase during setup, then put them on the market through resellers in Southeast Asia. As of 13 October, the thefts Ledger had confirmed were all tied to devices sold by authorised reseller CryptoBilis, and reports of implants from other channels were unconfirmed. Ledger's Genuine Check cannot detect these implants, and Ledger advises anyone who bought and set up a device from CryptoBilis to move their assets to a new device and a new recovery phrase.

Implanted chips in Ledger hardware wallets

anoni.netLedger 硬體錢包的植入晶片事件Ledger 10 月 15 日確認，犯罪集團在正品硬體錢包裡加裝設定時擷取復原詞的零件，再經東南亞的經銷商流入市面。到 10 月 13 日為止，Ledger 確認的盜領都跟授權經銷商 CryptoBilis 售出的裝置有關，其他管道的植入物回報還沒有證實。Ledger 的真品驗證偵測不到這類植入物，在 CryptoBilis 買過裝置且已經設定的人，Ledger 建議把資產轉到新裝置與新的復原詞。

Ledger 硬體錢包的植入晶片事件 Ledger 10 月 15 日確認，犯罪集團在正品硬體錢包裡加裝設定時擷取復原詞的零件，再經東南亞的經銷商流入市面。到 10 月 13 日為止，Ledger 確認的盜領都跟授權經銷商 CryptoBilis 售出的裝置有關，其他管道的植入物回報還沒有證實。Ledger 的真品驗證偵測不到這類植入物，在 CryptoBilis 買過裝置且已經設定的人，Ledger 建議把資產轉到新裝置與新的復原詞。

anoni.netEnd-to-end Encrypted Chats and Confidential Computing in Brave LeoFrom 15 October, Brave's AI assistant Leo encrypts chats with the GLM 5.3 Flash model in the browser and decrypts them only inside hardware-isolated enclaves. Other models are not covered. As of 20 October, Brave's servers still check the enclaves' attestations for the browser, and we found no statement of iOS support.

End-to-end Encrypted Chats and Confidential Computing in Brave Leo

anoni.netBrave Leo 的端對端加密對話與機密運算Brave 的 AI 助理 Leo 10 月 15 日起，選用 GLM 5.3 Flash 模型的對話會在瀏覽器端加密，只在硬體隔離的運算區裡解密處理。其他模型不在範圍內，運算區的證明到 10 月 20 日為止仍由 Brave 的伺服器代為檢查，iOS 版查不到支援的說明。

Brave Leo 的端對端加密對話與機密運算 Brave 的 AI 助理 Leo 10 月 15 日起，選用 GLM 5.3 Flash 模型的對話會在瀏覽器端加密，只在硬體隔離的運算區裡解密處理。其他模型不在範圍內，運算區的證明到 10 月 20 日為止仍由 Brave 的伺服器代為檢查，iOS 版查不到支援的說明。

anoni.netSenate second reading of Canada's Bill C-22 and providers' responsesCanada's Bill C-22 on lawful access went to second reading debate in the Senate on 8 October and, as of 18 October, had not passed second reading. A Signal vice president said at a panel that Signal would have to leave Canada if ordered to collect more metadata, while the public safety minister's office said the bill does not require decrypting end-to-end encrypted information. Readers outside Canada do not need to change any settings now.

Senate second reading of Canada's Bill C-22 and providers' responses

anoni.net NEWS 新聞導讀@news.anoni.net

Canada's Bill C-22, lawful access and encryption

anoni.netCanada's Bill C-22, lawful access and encryptionCanada's Bill C-22 has passed the House of Commons. It would let the government require communications and internet services, including some outside Canada, to build capabilities for law enforcement access and to retain metadata. Readers outside Canada do not need to change any settings now.

anoni.net加拿大 C-22 法案的參議院二讀與業者的表態加拿大的 C-22 合法存取法案 10 月 8 日在參議院進行二讀辯論，到 10 月 18 日為止還沒有二讀通過。Signal 的副總裁在座談上表示，若被命令蒐集更多詮釋資料就只能撤出加拿大，公共安全部長辦公室則表示法案不要求解密端對端加密的資訊。加拿大以外的讀者現在不需要調整設定。

加拿大 C-22 法案的參議院二讀與業者的表態加拿大的 C-22 合法存取法案 10 月 8 日在參議院進行二讀辯論，到 10 月 18 日為止還沒有二讀通過。Signal 的副總裁在座談上表示，若被命令蒐集更多詮釋資料就只能撤出加拿大，公共安全部長辦公室則表示法案不要求解密端對端加密的資訊。加拿大以外的讀者現在不需要調整設定。

anoni.net NEWS 新聞導讀@news.anoni.net

加拿大 C-22 合法存取法案與加密加拿大的 C-22 法案已在眾議院三讀通過，政府能要求通訊與網路服務業者建立協助執法的技術能力、保存詮釋資料，部分加拿大以外的業者也在範圍內。加拿大以外的讀者現在不需要調整設定。

anoni.net加拿大 C-22 合法存取法案與加密加拿大的 C-22 法案已在眾議院三讀通過，政府能要求通訊與網路服務業者建立協助執法的技術能力、保存詮釋資料，部分加拿大以外的業者也在範圍內。加拿大以外的讀者現在不需要調整設定。

anoni.netAutomatic phone number verification on Android and the linking of Google accountsAndroid phones verify phone numbers automatically by default and add them to every Google Account signed in on the phone, including work and secondary accounts. Verification can be turned off in settings, but according to Android Authority, numbers already added have to be removed from each account one by one. As of 18 October, we had not seen a public response from Google.

Automatic phone number verification on Android and the linking of Google accounts

anoni.netAndroid 的自動電話號碼驗證與多帳號連結Android 手機預設會自動驗證電話號碼，並把號碼加到這支手機登入的每一個 Google 帳號，包括工作帳號與次要帳號。可以在設定裡關閉驗證，依 Android Authority 的報導，已加入的號碼仍要到各個帳號逐一移除。到 10 月 18 日為止，沒有看到 Google 的公開回應。

Android 的自動電話號碼驗證與多帳號連結 Android 手機預設會自動驗證電話號碼，並把號碼加到這支手機登入的每一個 Google 帳號，包括工作帳號與次要帳號。可以在設定裡關閉驗證，依 Android Authority 的報導，已加入的號碼仍要到各個帳號逐一移除。到 10 月 18 日為止，沒有看到 Google 的公開回應。

anoni.netThe passkey attestation debateOn 10 October a commentary argued against using passkeys because sites can use attestation to restrict which devices and software people may use, and on 14 October an author published a response. Both agree that passkeys are, in most cases, bound to a domain and resist phishing; they disagree on whether attestation will become a restriction, and on whether to keep using passkeys or switch to something else.

The passkey attestation debate

anoni.net通行金鑰的證明機制爭議10 月 10 日一篇評論主張不要使用通行金鑰，理由是網站可以用證明（attestation）機制限制使用者能用的裝置與軟體，10 月 14 日有作者撰文回應。雙方都同意通行金鑰在多數情況下綁定網域、能防釣魚，爭點在證明會不會成為限制，以及該繼續用通行金鑰還是改用其他方式。

通行金鑰的證明機制爭議 10 月 10 日一篇評論主張不要使用通行金鑰，理由是網站可以用證明（attestation）機制限制使用者能用的裝置與軟體，10 月 14 日有作者撰文回應。雙方都同意通行金鑰在多數情況下綁定網域、能防釣魚，爭點在證明會不會成為限制，以及該繼續用通行金鑰還是改用其他方式。

anoni.netZero-click spyware delivered through targeted adsCitizen Lab published a report on 15 October linking, with high confidence, attacks on at least 45 Al Jazeera devices between 2024 and 2025 to targeted ads from the Israeli ad firm Discover-Tech and spyware from Candiru. Al Jazeera is the only confirmed target, and the exploited vulnerabilities are not described. The advice for general readers is to block ads and limit advertising IDs, which according to the report lowers only part of the risk.

Zero-click spyware delivered through targeted ads

anoni.net定向廣告投遞的零點擊間諜軟體Citizen Lab 10 月 15 日發表報告，以高信心把半島電視台至少 45 台裝置在 2024 到 2025 年遭到的攻擊，連到以色列廣告公司 Discover-Tech 的定向廣告與 Candiru 的間諜軟體。報告確認的鎖定對象只有半島電視台，也沒有說明被利用的漏洞。給一般讀者的建議是封鎖廣告與限制廣告識別碼，報告也提到這些做法只能降低部分風險。

定向廣告投遞的零點擊間諜軟體 Citizen Lab 10 月 15 日發表報告，以高信心把半島電視台至少 45 台裝置在 2024 到 2025 年遭到的攻擊，連到以色列廣告公司 Discover-Tech 的定向廣告與 Candiru 的間諜軟體。報告確認的鎖定對象只有半島電視台，也沒有說明被利用的漏洞。給一般讀者的建議是封鎖廣告與限制廣告識別碼，報告也提到這些做法只能降低部分風險。

anoni.netTuta encrypted email and its Nextcloud integrationTuta and Nextcloud launched an integration on 1 October that lets you use Tuta inside Nextcloud, save received attachments to Nextcloud and create Nextcloud Talk meeting links from Tuta Calendar. A Nextcloud administrator has to install the app, and as of 18 October neither announcement explains how attachments are protected once they are in Nextcloud.

Tuta encrypted email and its Nextcloud integration

anoni.netTuta 加密郵件與 Nextcloud 的整合Tuta 與 Nextcloud 10 月 1 日推出整合，可以在 Nextcloud 裡使用 Tuta，把收到的附件存進 Nextcloud、在 Tuta 行事曆建立 Nextcloud Talk 會議連結。App 要由 Nextcloud 管理員安裝，到 10 月 18 日為止，兩家的公告都沒有交代附件存進 Nextcloud 之後的加密狀態。

Tuta 加密郵件與 Nextcloud 的整合 Tuta 與 Nextcloud 10 月 1 日推出整合，可以在 Nextcloud 裡使用 Tuta，把收到的附件存進 Nextcloud、在 Tuta 行事曆建立 Nextcloud Talk 會議連結。App 要由 Nextcloud 管理員安裝，到 10 月 18 日為止，兩家的公告都沒有交代附件存進 Nextcloud 之後的加密狀態。

anoni.netSignal's cross-platform encrypted backups and password manager transfers on AndroidSignal released iOS 8.30 on 28 September, and its encrypted Signal Secure Backups can now be restored between Android and iPhone, so chats can follow you to a new platform. In September Google added a way on Android to move passwords and passkeys between password managers without exporting a file, starting with four apps.

Signal's cross-platform encrypted backups and password manager transfers on Android

anoni.netSignal 的跨平台加密備份與 Android 的密碼管理器搬移Signal 9 月 28 日發布 iOS 8.30，加密備份 Signal Secure Backups 可以在 Android 與 iPhone 之間還原，換手機時能把對話帶到另一個平台。Google 9 月在 Android 推出密碼管理器之間的搬移流程，不必匯出檔案，公告列出四款支援的密碼管理器。

Signal 的跨平台加密備份與 Android 的密碼管理器搬移 Signal 9 月 28 日發布 iOS 8.30，加密備份 Signal Secure Backups 可以在 Android 與 iPhone 之間還原，換手機時能把對話帶到另一個平台。Google 9 月在 Android 推出密碼管理器之間的搬移流程，不必匯出檔案，公告列出四款支援的密碼管理器。

anoni.netWeekly brief, 2026 week 42Seven stories from 3 to 11 October: a now-patched file-reading flaw in Telegram Desktop, Bitwarden's app store builds moving to a commercial licence, LineageOS 24 based on Android 17, Nitter seeking funding and legal help, a DNS ad blocker built on an ESP32-C3, a mobile internet shutdown and a platform advisory in New Delhi, and Psiphon weighing a move out of Canada over Bill C-22.

Weekly brief, 2026 week 42