Google Develops Public Android API for On-Device Content Safety Classification
Google is developing a new public Android API that will enable third-party applications to scan images and other files stored on the device and classify them according to their safety level.
The mechanism is built around the existing SafetyCore system component, which already blurs intimate images inside Google Messages. The new ContentSafetyManager will accept images, raw files, and other multimedia types for analysis.
After processing, the system will assign one of four statuses to the content: allowed, requires warning, blocked, or unclassified. The calling application will then decide whether to display the item, blur it, or hide it completely.
All analysis is designed to run locally on the device without sending any photographs or files to Google servers. The API itself does not grant access to the entire photo gallery; separate permissions must still be requested by the application.
Security researchers have raised concerns that malicious applications granted excessive permissions could route large volumes of user files through the classifier, construct detailed user profiles, or repurpose the results for unintended purposes. Google advises developers to request only the minimum necessary permissions.
SafetyCore previously drew criticism after being installed automatically without explicit user consent and without displaying a standard app icon. The component has been downloaded more than one billion times, prompting some Android users to install dedicated blockers that prevent the Play Store from reinstalling it after removal.
Google maintains that processing remains local and privacy-preserving, yet users continue to question why the component appeared on devices before any detailed explanations were provided.
Related articles
HTTPS Lock Icon Present but List of Visited Sites Remains Visible
Even when HTTPS is active and passwords stay protected, DNS queries and the SNI field in TLS handshakes expose the exact domains a user visits over public Wi-Fi. Classic unencrypted DNS over UDP sends domain names in plaintext, allowing anyone on the same network to observe them with simple packet captures. The SNI extension reveals the target hostname before encryption is negotiated, enabling domain-based filtering without decrypting traffic. DNS over HTTPS moves queries inside encrypted channels but shifts visibility to the chosen resolver instead of the local network. Encrypted Client Hello offers partial protection for SNI yet requires support from both browsers and server infrastructure. The practical takeaway is that metadata about services used, timing, and frequency leaks more readily than credentials in modern public networks.
Russian TSPU Begins Intercepting UDP DNS Queries to Cloudflare and Google Public Resolvers
Starting on the evening of August 26, Russia's TSPU DPI system began actively intercepting plaintext DNS queries sent over UDP to public resolvers operated by Cloudflare and Google. Queries to 1.1.1.1 and 8.8.8.8 now return NXDOMAIN responses for blocked domains instead of the real IP addresses. The interception works exclusively on UDP; TCP-based DNS queries continue to receive legitimate answers from the original resolvers. Technical analysis shows the system performs targeted DNAT, rewriting the destination IP to the NSDI server at 195.208.5.1 only when a DNS query is detected inside the packet. Experiments with varying TTL values confirm that the redirection occurs after the traffic passes the TSPU node, and rapid successive queries can sometimes bypass the filter and return genuine records. The change affects netflow statistics visible to network operators, as traffic previously destined for foreign resolvers is now redirected domestically.
WhatsApp Adds Support for Multiple Passkeys on Single Account
WhatsApp has expanded its account protection features by allowing users to register more than one passkey on the same profile. The update particularly benefits users who switch between Android and iOS devices while maintaining phishing-resistant login methods. Passkeys replace traditional codes and passwords with biometric authentication, facial recognition, or device lock mechanisms. Meta reports that more than one billion people already use the feature on WhatsApp, with Android support introduced in 2023 and iOS support added in 2024. The change reduces reliance on a single device during authentication by associating multiple keys with one account. Users can manage keys through Settings > Account > Passkeys. WhatsApp has also strengthened two-factor verification by allowing replacement of the six-digit PIN with longer passwords containing letters, numbers, and special characters.
Russian ISPs Begin Disrupting Encrypted DNS Services from Google and Cloudflare
Users of several major Russian internet providers have reported widespread issues accessing encrypted DNS protocols offered by Google and Cloudflare. The affected services include DNS over HTTPS (DoH) and DNS over TLS (DoT), which are designed to prevent providers from inspecting domain queries. Measurements show that connections to Cloudflare addresses 1.1.1.1 and 1.0.0.1 on port 853 establish TCP handshakes but are then reset with ECONNRESET errors before TLS authentication completes. Google Public DNS endpoints experience different interference, with sessions stalling after the TLS ClientHello or terminating with unexpected EOF errors. The disruptions have been observed across Rostelecom, Dom.ru, Tattelecom, and SkyNet subscribers, with varying impact depending on region and operator. Tattelecom support reportedly advised one customer to disable both protocols to restore connectivity. No official confirmation of centralized blocking has been issued, yet the coordinated pattern across multiple providers suggests deliberate interference rather than random failure.