>Smartphones in their current form cannot have secure messaging.
What about self-hosted matrix/element, used from the browser?
What about self-hosted matrix/element, used from the browser?
Unless you also ensure proper certificate pining, if someone can get a court order for any accepted CA to give them a valid certificate for your domain you won't notice a thing while that someone gets your browser to run any code and e.g. dump keys, certificates or messages.
There is a clever way of doing this, using a bookmarklet, a dataURI, and SRI, but the UX isn't great.[0] If something like Hashlinks[1] were supported by browsers, though, this could work quite nicely.
Certificate transparency logs make it possible to notice. I'm not 100% sure, but I think all major browsers require certificates to be logged at this point; and there are several services that you can list your domain and get notified when a certificate is issued.
You (or your users) may still be MITMed with the rogue cert without notice in the browser, though.
None of the browsers require by policy that certificates be logged. What this means is that the existence of a certificate which wasn't logged is not by itself a misissuance. Whereas for example the Apple 398 day rule is a policy rule, so a certificate which breaks the rule not only won't work in Safari, but it is also a misissuance and your whole CA might get distrusted by Apple.
However, all the major browsers except Firefox require that certificates they are shown which purport to have been issued after a mandate are presented with SCTs. We'll discuss what that means below. For Chrome that mandate begins after 30 April 2018, which means it doesn't catch certificates issued in a small window of time when certificate lifetimes up to 39 months were still allowed at the start of 2018, the last of these certificates would expire at the end of next month, May 2021.
In practice no public CA was selling unlogged certificates intended for web servers by the point the mandate triggers, it would have been a needless business risk to sail so close to the wind, so chances are no certificates in this category exist today.
Signed Certificate Timestamps are issued by the log, they are like "proof of posting" when you send a letter. The log warrants that any certificates for which it has issued SCTs will appear within the Maximum Merge Delay (for public CT logs this is 24 hours).
That might seem like a long time, but it's a do-or-die promise. Logs which experience a problem making them unable to show a consistent log with the corresponding certificate within 24 hours are disqualified and you need to start over, because without such a rule obviously you can smuggle anything into an outage.
Google and Safari's policy (I don't know the Edge policy) dictates two or more SCTs, at least one to be from a log controlled by Google. So this gives Google the handy property that they don't need to trust any combination of third parties, you must show all certificates to Google itself.
https://developer.sony.com/develop/open-devices/
furthermore Sony provides blobs to enable full feature sets of the cameras and even the 120Hz refresh options that Sony doesn't enable with stock firmware / Android. This gets you notch free real UHD (but not DCI) 4K 120HZ HDR screens and the same performance as a Galaxy S10 for ~$150 | XZ Premium / the XZ Premium 2 model adds a 12MP monochrome camera and wireless charging for a bit more... up to the first Xperia 1 models are supported including dual SIM SKUs. I'm seriously thinking of going back to either of these from the iPhone 11 Pro Max 512GB I'm typing this on, because the PDF reading experience (even in 2K standard resolution) of the Sony was a unique experience of being able to read full page papers set Euro A4 and 8pt and less text and no problems for my 6th decade eyes.
if you're in the UK, www.aaisp.net is a isp that hasn't reached the statutory customer base numbers to require keeping the extensive and extremely detailed records of communications UK laws require. The company is privately owned by a PhD and Reverend and the people recognise you by voice if you establish a relationship needing the contact. Andrews and Arnold they can fulfil our compliance with encrypted call recordings by email and ability to configure your landline numbering plan over cellular for PBX equivalence. (I dunno if it's helpful but if you do speak with Phil Boddy I think he'll be willing to confirm that John K isn't a commission agent only a impressed customer about to resurface with new business because there's nobody else short of starting your own MVNO..
Incidentally in Europe only Andorra has cellular operators who don't spill location metadata with every SMS.
this story involves Vodafone Greece deleting potentially vital call records evidence of a assassin of a minister : https://en.m.wikipedia.org/wiki/Greek_wiretapping_case_2004%...
I can't find it (on my phone) but the fuller story is that due to high licensing costs of traditional (not vRAN) basestation equipment features, common practice in Europe retains virtually no call records evidence / data and overwrites everything on cycles only long enough for billing.
if anyone is interested in the public spectrum of 5G applications and the acquisition of test sites in London, my lock down research got as far as only needing to be formalised and pursued. I have put much more interesting details in my profile concerning this because I am as serious as I'm probably crazy but at the lowest utility I'm trying to find London interest in getting quality time with some installed, legal, vRAN systems and possess the necessary means and certifiability.
what gets me about the Huawei affair is how much straightforward argument there is to drop this monoclonal monopoly supplier in preference for massively more flexible and capable equipment from a plethora of suppliers who need to be made to do bake offs again like we used to (I remember reading 3Com white papers proudly reporting successful bake offs and recognising that that company was going places..) I mean Joe Public understands the arguments that matter to common sense and national security simply follows with unavoidable obviousness. Microsoft and Huawei were the only phone manufacturers who provided user defeat switches to 2G and hence the stingray intercept vulns. Both also made surprisingly good hardware, or could do. I'm old enough to worry about reds under the bed but I think it is positively the most amazing thing how given today's sensitivity to ecological impact of industry waste that we cannot require the reuse of the tools and process equipment created for closed product lines. Of course I understand the tax write off and the trade secrets concerns. But the incredible cost of manufacturing today surely has to force us to deliver mothballed factories to people who have ability to use them. At the very least I would use my day to be dictator to enforce the auction of all such manufacturing facilities.
I just decided against cutting my diversion into factory and product design recycling because I think far too much of the irresponsible attitude towards security comes out of the assumption that everything is going to be forklift upgraded every 2 years. This is precisely what is happening with cellular networking. The very same thing is opening the door to China to try and drive through standards and protocols that suit China for 6G and next generation Internet. Samsung basically just ignore the existence of every phone after 2 years from launch. Not from the day you purchase your Samsung phone. From the product launch date you have 2 years of maybe possibly a few updates and patches. There is no way that anyone would have tolerated this 40 years ago. Why now? I'm concerned that there's a more serious systematic failure of the human cognitive capability.
Now I'm wondering what it takes to get a phone contract in Andorra.
1) You don't get push notifications on most mobile OSes
2) Mobile users have poor control over their browser (if any.)
And I'm not sure what you're referring to by "control", but Firefox on Android allows you to install addons and use about:config (Chromium can't do the former and doesn't have an equivalent for the latter, even on desktop).