Buccia

@lorenzofb There's https://www.dfsec.com though I don't think they sell spyware but "only" exploits.

@mysk@mastodon.social > Lockdown Mode hasn't proven effective against unknown vulnerabilities

It did for the features where it applies.

hijacking an HTTP connection and then feeding the Password app a malicious payload or icon

In that case, it could have an impact because Lockdown Mode disables almost all ImageIO parsers.

@GrapheneOS@grapheneos.social What's the point of scheduling patches so far into the future? If they are made aware of the vulnerabilities now, why not scheduling them on the next month?

@GrapheneOS@grapheneos.social @beistanbul@mastodon.social @eteryu@infosec.exchange

Apps not yet targeting Android 17 can now have it taken away after installation.

Is it possible to take away from all apps by default? Also now enabling local network requires granting nearby devices which would allow bluetooth beacons too right?

@rmondello@hachyderm.io @brandonbutler@mastodon.social If you have 2FA on Amazon and setup the passkey (only one), it asks the 2FA code after the passkey

@rmondello@hachyderm.io Unpopular opinion: A TOTP provides very little value on top of a randomly generated password stored in a password manager. In the meanwhile, if you have 2FA on Amazon, they ask for TOTP/SMS after the passkey.

@rallias@hax.social @raymaccarthy@mastodon.ie @sarahjamielewis@mastodon.social > would be sufficiently satisfied with a plug-in such as https everywhere You can just enable HTTPS-only mode.

@mysk@mastodon.social Lockdown Mode doesn’t affect the password app and that vulnerability wasn’t used to install spyware, nor i think it could be.

@mbootsman@toot.re @signalapp@mastodon.world You have been able to do this for a while now