Yeah, seeing how every cop looks like an ekeko (starting with a bullet proof vest), I think it’s safe to assume they’re all lethaly dangerous.

How does the Kontrolleur detect the difference? Could you cook up a PNG which looks like google wallet’s screen?

That people voted against it is no evidence that it’s a horrible idea. The article to which you reply at least tries to provide a bit of evidence for its argument. Also, I don’t need a parliament that’s “efficient” (whatever that can mean. Do you measure that in number of pages of new laws passed per months?), I need one that’s fair and democratic. Wht has been happening sine the “liberals” got the majority is evidence enough for me that we should avoid non-coalitions as much as we can.

Actually, “is it encrypted” is just the tip of the iceberg: it’s all too easy to encrypt in a way that does not provide security against the threats the users want to defend. E.g. maybe the answer to this question is “yes” because the connection is over https, yet the server sees and stores the data in the clear

I don’t think it’s a question of willingness to understand, but one of disagreement about the seriousness of the problem. Not to mention the implict idea that a “verified boot” is the only way to get that result. E.g. it’s very easy to get to a “safe factory state” without that kind of locking, for example with an immutable boot loader, as is typically present in many ARM SoCs (Allwinner, Rockchip, …). In that case you can revert to a safe state by downloading a known good OS image (using a trusted machine) and installing that image using only the immutable bootloader.

So AFAICT, in practice a locked bootloader makes no difference to the most common attacks I’ve seen on my devices and that of friends&family. Seems like a far cry from your original claim that “This means that the most essential feature for your safety, the metaphorical lock on the front door of your house, is left broken and loose.”

But my point is that a remote attacker using privilege escalation can already do all of that even with a locked bootloader. “rootkits” don’t need an unlocked bootloader.

Sorry, but that page does not seem to say what you wrote. E.g. I can’t see how a remote attacker (such as a malign webpage, email, application, …) could take advantage of an unlocked bootloader without being able to see (and modify) all the data on your phone. IOW I think what you write applies only to an attacker who has physically taken your phone (temporarily).

Your links are all broken (because of “…” elision)

Can someone point me at technical info about the risks of having an unlocked bootloader? From where I stand, the risks seem completely irrelevant (to take advantage of an unlocked bootloader, the attacker would need to have full access to your OS already). AFAIK, locking of bootloaders was never designed to protect the user, but only to let cell-phone providers restrict what phone users can do.

I don’t understand why “the app is now built reproducibly” implies “you need to uninstall it and then reinstall”. What am I missing?