Norwegian police have provisionally charged Norwegian telecom group Telenor with complicity in crimes against humanity. The charges cover only its former Myanmar unit in 2021 and 2022, which repeatedly gave customers' historical traffic data to the military regime.

挪威警方對挪威電信業者 Telenor 提出協助違反人道罪的正式指控，只涉及 2021 至 2022 年的緬甸業務，當時的緬甸子公司多次把歷史通聯資料交給軍政府。

The Markup and Consumer Reports obtained data broker files on US residents showing more than a thousand inferences and over a hundred buyers. The Freedom of the Press Foundation lists two phone settings that cut the location data a phone leaks, in any country.

美國的 The Markup 與 Consumer Reports 取得資料仲介的個人檔案，裡面有上千項推測與上百個買家。Freedom of the Press Foundation 整理了兩個減少手機洩漏位置資料的設定，美國以外也能照做。

InterSecLab finds that Max, the messaging app Russia requires on new devices, has no end-to-end encryption. VPN detection, network probing and voice transcription can be switched per account from the server with nothing shown in the app. The mandate applies only to devices sold in Russia.

InterSecLab 分析俄羅斯規定預裝的通訊 App Max，發現它沒有端對端加密。VPN 偵測、網路探測與語音轉文字都能從伺服器針對個別帳號切換，介面上沒有任何提示。預裝規定只在俄羅斯實施。

A flaw lets any Android app send traffic around a VPN and reveal the real IP, even with "Block connections without VPN" on. Mullvad is also shutting down its public encrypted DNS on 2 November, so anyone who set it up by hand needs to switch.

Android 的一個漏洞讓任何 App 繞過 VPN、洩漏真實 IP，開啟「封鎖沒有 VPN 的連線」也無法阻擋。Mullvad 的公開加密 DNS 將在 11 月 2 日停止服務，手動設定過的人需要更換。

A commission under Spain's Ministry of Culture has ordered ISPs to block the archive.today web archive and its mirror domains without any court ruling, and OONI measurements show the effect.

西班牙文化部的智慧財產委員會以行政決定封鎖網頁封存服務 archive.today 與它的鏡像網域，沒有經過法院，OONI 的量測也看得到異常。

The EU wants member states to launch an age verification app by the end of the year. According to EDRi's technical analysis, unlinkability has been weakened, credentials can still be traced back to users, and people without ID are shut out.

歐盟推動各國在年底前推出年齡驗證 App。依 EDRi 的技術分析，不可連結性被放寬、憑證仍能追溯到使用者，沒有證件的人也會被排除在外。

Android 17 QPR1 adds new APIs for app developers without releasing the source to AOSP, so non-Pixel phones and systems such as GrapheneOS wait until QPR2 in December.

Android 17 QPR1 新增了給 App 開發者的 API，原始碼卻沒有釋出到 AOSP，非 Pixel 的手機與 GrapheneOS 這類系統要等到 12 月的 QPR2。

ZuckOff matches Bluetooth broadcasts to warn that camera glasses such as Ray-Ban Meta are nearby. It cannot tell whether anyone is recording, and the app itself is closed source.

ZuckOff 比對藍牙廣播，提醒附近有 Ray-Ban Meta 這類帶鏡頭的智慧眼鏡，但無法判斷對方是否正在錄影，App 本身也沒有公開原始碼。