mobile security
6 posts
A claim, not a control
GrapheneOS rewrote its Messages app under a privacy and security claim, but the enforcing controls are not named or independently verifiable.
iPhone Duo is not a convenience feature
iPhone Duo's shared access and multi-device authentication expand who can authenticate and access, collapsing resource security to the weakest device and party.
CVE-2024-43047 hit live targets in 2024
CVE-2024-3679 maps to no Qualcomm bug. The real 2024 Snapdragon zero-day is CVE-2024-43047 - a DSP/FastRPC use-after-free, CVSS 7.8, exploited in the wild.
It measures conformity, not security
Volkswagen blocks GrapheneOS while admitting baseline devices. The gate measures configuration identity, not security posture.
Spanish police flagged GrapheneOS as suspicion
Authorities treating GrapheneOS as a targeting signal inverts threat intel logic and exposes the wrong population to scrutiny. The mechanism breakdown.
Your Phone Is Nation-State Inventory
UK confirms 100 countries hold mobile spyware. The handset trust model has failed. Identity is the boundary, not the device.