ashitlerferad

https://news.ycombinator.com/item?id=11439568

re Debian: your best bet is one of the chroot on Android apps. With some more skills you can get closer to just Debian on a phone that shipped with Android. Unfortunately with the way mobile devices a…

What about getting someone's key? What about distributing your key? What about backing up your secret keys on paper? What about binding your primary secure key that is usually stored in a safe on…

Expiring and revoking keys is a core part of how OpenPGP is meant to work. Export just the valid self-sigs: --export-options parameters export-minimal Export the smallest key possible.…

What about signing and verification?

moxie's stuff is, but it is designed for the always-online mobile world: https://whispersystems.org/

I thought the GP comment was talking about reviewing the code changes rather than verifying the hash chain.

Also, please don't display keyids, always fingerprints: https://help.riseup.net/en/security/message-security/openpgp... …

Can you implement OpenPGP-signed pushes?

Hmm, actually it isn't as good as I thought. I guess I was remembering IRC discussions. IIRC, the Replicant folks found Qualcomm based devices pretty commonly have this issue.

The Replicant wiki is a good place for devices that have evaluated, click the links on here: https://redmine.replicant.us/projects/replicant/wiki/Replica... …

Another response to this issue: https://mjg59.dreamwidth.org/41085.html

https://twitter.com/mathewi/status/716771686482202625

Don't forget turning on both of the cameras and streaming the video to 911.

What about capacitors?

Could this apply to software like iOS as well?

serial attached basebands are much rarer than basebands with full or partial control of the CPU or RAM.

In practice, TrustZone is for DRM.

Security issues in ROM are still security issues. Even if it is in ROM, it still needs to be auditable.