René Mayrhofer
This is the farewell note I sent to my Google colleagues after deciding to resign from my position as Principal Engineer/Architect for Android Security (a so-called “Independent Contributor” position after my primary Director role, when I stopped having direct reports to relocate my family back to Austria). It is copied here to be transparent about me no longer being able to act as…
Vulnerability Finding and PoCs: A Defender’s Point of View — in the era of LLM coding agents This is an additional perspective to my 2019 post on PoC disclosure , taking into account recent advances in automated vulnerability finding and PoC creation through “AI” — more specifically, generative ML using Large Language Models (LLMs). Context The last two years have seen rapid…
Why For a few weeks, I have been struggling to make OPNsense perform well from a performance point of view on my low-power test box, an APU4d4 . While OPNsense is very well done from a firewall rules management point of view (alhtough I am not happy that forwarding rules cannot specify both incoming and outgoing interfaces like it is possible with Linux Netfilter…) and has many features of…
This is a public list of some of my statements concerning the issue of IEEE Security&Privacy, NDSS, and USENIX Security only being hosted in the US. My most public statement so far was in my role as IEEE S&P 2024 Research Ethics Committee chair at the opening ceremony after presenting statistics about the ethics review process, but this did not seem to have been recorded. The gist of the closing…
I gave the following statement for the debate on the thesis of “Kriminalität ist der Preis der Freiheit. Darknet, Überwachung und Anonymität” Sehr geehrte Damen und Herren, Danke für die Einladung zu dieser wichtigen Debatte. Ich möchte gleich damit eröffnen, meine Hochachtung vor der österreichischen Justiz und Exekutive auszudrücken und allen Institutionen zu danken, die zum Schutz…
Was passiert, wenn unser digitaler Schatten Form annimmt – sichtbar, befragbar, beobachtend? Digitale Identitäten begleiten uns ständig, oft unbemerkt: beim Öffnen von Türen, Bezahlen mit dem Smartphone oder Einloggen im Internet. Sie bestimmen, was wir dürfen – und was nicht. Doch wem gehören diese Daten? Wer kontrolliert sie? Und wie viel Selbstbestimmung bleibt uns? Diese Fragen werden aus…
Response to latest EU data retention initative In response to the Impact assessment on retention of data by service providers for criminal proceedings , I contributed the following statement : There are many good reasons why unspecific mass data retention of Internet traffic metadata has (again and again) been considered to be in conflict with basic human rights to privacy. While it is not…
Even more collateral damage The AI hype has been ongoing for a while now, and the ecological impact is bad. I mean, old and hazardous coal and nuclear power plants are being re-started, and new, untested nuclear power plants are planned to be constructed - just for the energy hunger of powering these large language and other models. However, there is more collateral damage than that. At the time…
Android Private Space Private space is a new feature introduced with Android 15 to add an additional lock on a subset of apps (and data/content) installed on a device. By default, the private space is locked after unlocking the main user on the device, and unlocking it requires entering the LSKF again (or a separate knowledge factor). Technically, under the hood, private space is…
Why Recently, my fiber-to-the-home (FTTH) connection changed from a slighly easier DHCP based setup to an additional required authentication step using PPPoE to connect to the Internet. The advantage is that, for IPv4, I no longer have to use double-NAT, as my own OPNsense firewall can directly get the (dynamically assigned through PPPoE, but statically allocated at the ISP end) IPv4 WAN address…
Password manager requirements Password managers are a necessary tool for keeping accounts secure. The usual recommendation is to use a unique password per site, to have it randomly generated, and to never type it manually or copy/paste using the standard clipboard (because malware watching the clipboard is a thing). The best way to solve all these with reasonable usability are password managers…
Running Linux on a Lenovo Yoga 6 Gen 8 (2023 version, specifically 13ABR8, but probably applies to others as well) works reasonably well with most hardware being supported out-of-the-box with all Linux distributions from around 2022 or later that I have tried. The touchpad works with multiple fingers and tap-to-click (although KDE can be a bit finicky with that one under Kubuntu), the touchscreen…
We (mostly) seem to have made it through the Blockchain and cryptoscam hype with only medium collateral damage to most of the population (highly profitable ransomware and burning much more dirty coal than would otherwise have happened), but unfortunately at the cost of stumbling right into the next one. I would hope that we could get that one over with with less collateral damage, but I am not…
This is an opt-out statement for the EU directive 2019/790 of the European Parliament on copyright and related rights in the Digital Single Market pertaining text and data mining for commercial use. When any copyrighted content from this website is included in the training set of machine learning models or other data mining methods, attribution and share-alike terms fully apply. Any results or…
Thoughts I have very mixed feelings about #ChatGPT and related large language models (LLMs). They are certainly a cool tool, but I also currently don’t believe that these “stochastic parrots” will easily replace search, article/paper writing, coding, and similar tasks. That is, they can be used to augment, but not replace those human activities - at least in the near future. One…
Executive summary The bird site has, after being bought by the Space Man (a.k.a. Elon Musk), become a site I no longer wish to associate with. While my account , created in 2010 and at the end spotting over 9000 tweets and over 2000 followers, was still active at the time of this writing (I don’t know if it still is, as I stopped actively using that site), I decided not to explicitly remove…
Why Since switching to OPNsense as my main home network firewall/router, I have been having intermittent issues with DNS resolution latency. This has been low priority so far, since the network still works “reasonably well”, but it is annoying when connections occasionally take a few seconds to initially connect - because of DNS latency even before the actual connection is initiated.…
It’s easy: I don’t intentionally collect any visitor data and won’t share any of the potential technical logging data the the web server collects. There are no advertisements, and I try hard for this website not to cause your browser to load external resources that might cause additional logging or data collection. In case an update has unintentionally caused external resources…
Interne Notizen und Links in Vorbereitung des Interviews (unstrukturiert, aber hier im Sinne der Transparenz angegeben als Quellen der von mir genannten Zahlen): Daten von Cambridge University Centre for Alternative Finance : Bitcoin ca. 1GW Leistung, 130 TWh jährlich, aktuell wieder stark steigend entspricht ca. 0.6% des gesamten Stromverbrauchs, Tendenz steigend, bei minimalem Anteil an…
Introduction The academic peer review process can often be frustrating — not only for junior members of the research community. This post describes the process finally leading to the publication of our article “ The Android Platform Security Model ” in ACM Transactions on Privacy and Security in April 2021. This article took a long time to reach its current form. In fact, we…