Re: Q: What threats do we really face when our phones are not fully patched?

Path	csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	"Carlos E.R." <robin_listas@es.invalid>
Newsgroups	comp.mobile.android
Subject	Re: Q: What threats do we really face when our phones are not fully patched?
Date	Wed, 22 Apr 2026 22:50:33 +0200
Lines	42
Message-ID	<ptonbmxtd3.ln2@Telcontar.valinor> (permalink)
References	<10s31mb$17qk$1@nnrp.usenet.blueworldhosting.com> <qmqfbmx03r.ln2@Telcontar.valinor> <10s8os4$2ce3$1@nnrp.usenet.blueworldhosting.com> <4k1mbmxrtb.ln2@Telcontar.valinor> <10s9si5$1cki$1@nnrp.usenet.blueworldhosting.com> <ruhmbmxp7v.ln2@Telcontar.valinor> <10sar20$2c775$1@dont-email.me> <hdcnbmxq7d.ln2@Telcontar.valinor> <10sb173$2edfi$1@dont-email.me> <65enbmxdio.ln2@Telcontar.valinor> <10sb482$2fdqj$1@dont-email.me> <vgjnbmx66t.ln2@Telcontar.valinor> <10sb7q4$2kb8$1@nnrp.usenet.blueworldhosting.com> <4sknbmx055.ln2@Telcontar.valinor> <10sbb7l$1qaa$1@nnrp.usenet.blueworldhosting.com>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	8bit
X-Trace	individual.net 9H31nHavnxHyHFqAzkjF1Qn7ueRE2pnwlMfL4N4Q5j/Q2VJzsv
X-Orig-Path	Telcontar.valinor!not-for-mail
Cancel-Lock	sha1:gnkXo9xXlQW2Rppt8H0a3yeBnXw= sha256:xn9+7Em0hJNcETYUkCU+qrQPzyML/8laJYdGUjWGn2A=
User-Agent	Mozilla Thunderbird
Content-Language	es-ES, en-CA
In-Reply-To	<10sbb7l$1qaa$1@nnrp.usenet.blueworldhosting.com>
X-Leafnode-NNTP-Posting-Host	127.0.0.1
Xref	csiph.com comp.mobile.android:153580

Show key headers only | View raw

On 2026-04-22 22:31, Maria Sophia wrote:
> Carlos E.R. wrote:
>>> Another example is someone clicking on a link inside of an SMS message.
>>> I don't think I've ever done that (unless it's from my wife or kids).
>>> So a serious CVE based on someone clicking a link isn't my concern.
>>
>> I do it often. It is required to sign contracts, for example.
> 
> I've had to sign paperwork with secure esign where I would never think of
> doing that on a phone, for a huge variety of reasons (not the least of
> which is how puny a phone is for reading fine print).
> 
> I do that on the PC and even then, since my PC is hardened, it's a bitch.

Often I am not given any option. It is phone, or phone. And I was at the 
physical shop, the last two contracts. Paper not accepted.

> 
> But this fact that each of us is different underlays my rationale that a
> simple looooooooooooooong list of CVEs isn't all that useful for any of us.
> 
> What we need is a list of CVEs that
>   a. Affect only our devices
>   b. And are based on actions that we do
> 
> Of course, zero-click CVEs are the exception.
> 
> I think it's possible, and, in fact, since I have solved some of the most
> difficult problems on earth when I was working in Silicon Valley, I could
> certainly solve it, but it's not something I will be spending energy on.
> 
> Since I'm not likely going to invest energy solving it, I'm assuming
> someone else already did, but we have to find that particular site.
> 
> Too-simply stated, it would, IMHO, ask for how we use the phone.
> And then it would show us the CVE's that are unpatched that affect us.

Of course I can read the CVES, but it is a full time job.

-- 
Cheers, Carlos.
ES🇪🇸, EU🇪🇺;

Back to comp.mobile.android | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

csiph-web