The Curious Engineer

All blogs / Security

René Mayrhofer

mayrhofer.eu.org

Personal web page of René Mayrhofer

SecurityMobile / iOS / AndroidNetworking

’05’10’15’20’25
Posts
234 from 1 Jan 2001 to 13 Oct 2026
Posting
monthly (7 in the last year)
Kind
personal blog
Feed
https://mayrhofer.eu.org/index.xml

2026 5

  1. Let’s talk about Cryptographic Attack Surfaces
  2. Stop blaming 'AI' on your negligent security practices!
  3. Why I’m Forced to Say Farewell: Google Management Has Lost Its Moral Compass
  4. Finding Vulnerabilities in the Era of AI/LLM Coding Agents
  5. Firewall throughput measurements: OPNsense on APU4d4 and Edge4Go, OPNsense in a Proxmox VM, and OpenWRT on Turris Omnia

2025 6

  1. Towards more globally inclusive security conferences
  2. AI and Security – Balancing Innovation and Risk Management
  3. Panel statement for the debate on security: freedom vs. surveillance
  4. Kepler Salon: Digital Shadows - Who owns your data?
  5. On data retention laws: Why this is (still) not a good balance between mass surveillance and law enforcement
  6. Defenses against abusive AI scrapers

2024 12

  1. Secure Messaging (and attacks against it)
  2. Android private space: How to install apps from other sources
  3. BioDSSL: A Domain Specific Sensor Language for global, distributed, biometric identification systems
  4. Shrinking embeddings, not accuracy: Performance-Preserving Reduction of Facial Embeddings for Complex Face Verification Computations
  5. Cryptographers’ Feedback on the EU Digital Identity’s ARF
  6. OPNsense and PPPoE with high availability: tricky, but doable
  7. Password managers: KeepassXC and Vaultwarden
  8. A Data-Driven Evaluation of the Current Security State of Android Devices
  9. Honeyquest: Rapidly Measuring the Enticingness of Cyber Deception Techniques with Code-based Questionnaires
  10. Honeyquest: Rapidly Measuring the Enticingness of Cyber Deception Techniques with Code-based Questionnaires
  11. On the critical path to implant backdoors and the effectiveness of potential mitigation techniques: Early learnings from XZ
  12. Threshold Delegatable Anonymous Credentials With Controlled and Fine-Grained Delegation

2023 15

  1. The Android Platform Security Model (and the security of actual devices)
  2. Anonymously Publishing Liveness Signals with Plausible Deniability
  3. Anonymously Publishing Liveness Signals with Plausible Deniability
  4. Face to Face with Efficiency: Real-Time Face Recognition Pipelines on Embedded Devices
  5. Mobile App Distribution Transparency (MADT): Design and evaluation of a system to mitigate necessary trust in mobile app distribution systems
  6. Suspend/resume with Linux on Lenovo Yoga 6 Gen8
  7. A Large-Scale Data Collection and Evaluation Framework for Android Device Security Attributes
  8. INFRASPEC – Automated Inspection of Critical Infrastructure
  9. Can we, pretty please, quickly get over the AI hype without too much collateral damage?
  10. A Survey on Fingerprinting Technologies for Smartphones Based on Embedded Transducers
  11. License for Text and Data Mining (TDM)
  12. Digitale Identitäten in der physischen Welt: Eine Abwägung von Privatsphäreschutz und Praktikabilität
  13. Efficient Aggregation of Face Embeddings for Decentralized Face Recognition Deployments
  14. Practical Delegatable Anonymous Credentials From Equivalence Class Signatures
  15. Some thoughts on ChatGPT and other large language models

2022 7

  1. Bye, bye, Twitter
  2. DNS resolver latency measurements: OPNsense Unbound
  3. Privacy Policy
  4. Decentralized, Privacy-Preserving, Single Sign-On
  5. Efficient aggregation of face embeddings for decentralized face recognition deployments (extended version)
  6. Evaluating Dynamic Tor Onion Services for Privacy Preserving Distributed Digital Identity Systems
  7. Fingerprinting Smartphones Based on Microphone Characteristics from Environment Affected Recordings

2021 11

  1. Adversary Models for Mobile Device Authentication
  2. Sweep-to-Unlock: Fingerprinting Smartphones based on Loudspeaker Roll-off Characteristics
  3. On the state of V3 onion services
  4. Ökologie des Internets: Ist die IT Klimaretter oder Klimakiller? – was sagt die Wissenschaft dazu?
  5. The academic review process in one example
  6. Importance of different facial parts for face detection networks
  7. On the feasibility of short-lived dynamic onion services
  8. The Android Platform Security Model
  9. Experiences and Recommendations from Operating a Tor Exit Node at a University
  10. Android security trade-offs 2: Lock states
  11. Analyzing inconsistencies in the Tor consensus

2020 21

  1. Secure Accelerometer-based Pairing of Mobile Devices in Multi-modal Transport
  2. The Android Platform Security Model (and the security status of actual devices)
  3. A highly personal take on KDE vs. Gnome over two decades
  4. Aktuelle Entwicklungen zu Digitalen Identitäten
  5. Digitale Identitäten und Authentifizierung
  6. Privacy-preserving features in the Mobile Driving License
  7. Managing Digital Identities - from Contact Tracing in the Crisis to Future Virtual Passports
  8. Adversary Models for Mobile Device Authentication
  9. On the secure delivery of regular information
  10. Settings for Flatpak sandboxing for the Zoom Linux client
  11. Digital Authentication in the Real World without Sacrificing Privacy
  12. Digitale Identitäten – Was, Warum, Wie?
  13. Android-Device-Security.org: Towards a Transparent Database of Android Device Security Attributes
  14. Disposable dynamic accumulators: toward practical privacy-preserving mobile eIDs with scalable revocation
  15. Dynamic Taint Tracking Simulation
  16. Dynamic Taint Tracking Simulation
  17. Enabling per-device traffic analysis with separate VLANs, 802.1x MAC based authentication, and OpenWRT
  18. The not so private way of tracing contacts: A first analysis of the NOVID20 Android SDK
  19. Git Cheat Sheet
  20. Poster: Towards an Architecture for Private Digital Authentication in the Physical World
  21. DAMFA: Decentralized Anonymous Multi-Factor Authentication

2019 16

  1. Migrating a GadgetBridge installation to a new device
  2. Disclosing Proof-of-Concept (PoC) exploits for vulnerabilities: A defender's point of view
  3. CORMORANT: Ubiquitous Risk-Aware Multi-Modal Biometric Authentication across Mobile Devices
  4. Android Security: Taming the Complex Ecosystem
  5. Android security trade-offs 1: Root access
  6. Android security trade-offs 0: Ecosystem complexity
  7. The Android Platform Security Model
  8. Transparent Tor-ifying VLAN (separated WLAN SSID) with OpenWRT
  9. Example
  10. Insider Attack Resistance in the Android Ecosystem
  11. Context authentication
  12. Context prediction
  13. OpenUAT
  14. Relate
  15. Insider Attack Resistance in the Android Ecosystem
  16. KinPhy: A Kinetic in-Band Channel for Millimetre-Wave Networks

2018 11

  1. Android-IPv6Config
  2. Gibraltar firewall
  3. Android Pie à la mode: Security & Privacy
  4. Investigating the impact of network security on the line current differential protection system
  5. Design, Implementation, and Evaluation of Secure Communication for Line Current Differential Protection Systems over Packet Switched Networks
  6. Bridging the Gap in Privacy-Preserving Revocation: Practical and Scalable Revocation of Mobile eIDs
  7. Mobile Match-on-Card Authentication Using Offline-Simplified Models with Gait and Face Biometrics
  8. Introspection for C and its Applications to Library Robustness
  9. Recovery of Encrypted Mobile Device Backups from Partially Trusted Cloud Servers
  10. Sulong, and Thanks For All the Bugs: Finding Errors in C Programs by Abstracting from the Native Execution Model
  11. Wie sicher ist die schöne, neue und vernetzte Welt?

2017 6

  1. Smartphone-based Gait Recognition: From Authentication to Imitation
  2. Extensibility in a Privacy-preserving eID: Towards a Mobile eID System for Real-world Identification and Offline Verification
  3. Real-world Identification for an Extensible and Privacy-preserving Mobile eID
  4. Protecting Touch: Authenticated App-To-Server Channels for Mobile Devices Using NFC Tags
  5. A Large-Scale, Long-Term Analysis of Mobile Device Usage Characteristics
  6. ShakeUnlock: Securely Transfer Authentication States Between Mobile Devices

2016 9

  1. Who are you…And how to prove your identity digitally?
  2. Accelerometer based Gait Recognition using Adapted Gaussian Mixture Models
  3. DAMN - A Debugging and Manipulation Tool for Android Applications
  4. Mobile Gait Match-on-Card Authentication from Acceleration Data with Offline-Simplified Models
  5. Real-World Identification: Towards a Privacy-Aware Mobile eID for Physical and Offline Verification
  6. Location-based Risk Assessment for Mobile Authentication
  7. JKU Tor exit node
  8. Josef Ressel Center u'smile
  9. Eyewear Computing – Augmenting the Human with Head-mounted Wearable Assistants (Dagstuhl Seminar 16042)

2015 9

  1. Confidence and Risk Estimation Plugins for Multi-Modal Authentication on Mobile Devices using CORMORANT
  2. Proceedings of the 14th International Conference on Mobile and Ubiquitous Multimedia (MUM '15)
  3. Towards Device-to-User Authentication: Protecting Against Phishing Hardware by Ensuring Mobile Device Authenticity using Vibration Patterns
  4. A password-authenticated secure channel for App to Java Card applet communication
  5. Malware report for appjolt.com
  6. Only play in your comfort zone: interaction methods for improving security awareness on mobile devices
  7. Cross Pocket Gait Authentication using Mobile Phone Based Accelerometer Sensor
  8. CORMORANT: Towards Continuous Risk-aware Multi-modal Cross-device Authentication
  9. Optimal Derotation of Shared Acceleration Time Series by Determining Relative Spatial Alignment

2014 14

  1. Mobile Application to Java Card Applet Communication using a Password-authenticated Secure Channel
  2. Mobile Device Usage Characteristics: The Effect of Context and Form Factor on Locked and Unlocked Usage
  3. Optimal Derotation of Shared Acceleration Time Series by Determining Relative Spatial Alignment
  4. Orientation Independent Cell Phone Based Gait Authentication
  5. ShakeUnlock: Securely Unlock Mobile Devices by Shaking them Together
  6. A Survey of User Interaction for Spontaneous Device Association
  7. Android Exploit Framework
  8. Using the Austrian 'Buergerkarte' under Linux
  9. A Practical Hardware-Assisted Approach to Customize Trusted Boot for Mobile Devices
  10. An Architecture for Secure Mobile Devices
  11. Diversity in Locked and Unlocked Mobile Device Usage
  12. Managing the life cycle of Java Card applets in other Java virtual machines
  13. Special Issue on Security and Trust in Context-Aware Applications
  14. Special Issue: The confluence and synergy of mobile computing and multimedia with pervasive computing and communication

2013 10

  1. (Ab)using foreign VMs: Running Java Card Applets in non-Java Card Virtual Machines
  2. An Analysis Of Different Approaches To Gait Recognition Using Cell Phone Based Accelerometer
  3. Range Face Segmentation: Face Detection and Segmentation for Authentication in Mobile Device Range Images
  4. Requirements for an Open Ecosystem for Embedded Tamper Resistant Hardware on Mobile Devices
  5. Visualizations and Switching Mechanisms for Security Zones
  6. When Users Cannot Verify Digital Signatures: On the Difficulties of Securing Mobile Devices
  7. UACAP: A Unified Auxiliary Channel Authentication Protocol
  8. Towards Secure Personal Device Unlock using Stereo Camera Pan Shots
  9. 'My Life, Shared' - Trust and Privacy in the Age of Ubiquitous Experience Sharing (Dagstuhl Seminar 13312)
  10. Towards pan shot face unlock: Using biometric face information from different perspectives to unlock mobile devices

2012 7

  1. Creating X.509 certificates programmatically in Java
  2. SAPHE - Simple Accelerometer based wireless Pairing with HEuristic trees
  3. Towards Face Unlock: On the Difficulty of Reliably Detecting Faces on Mobile Phones
  4. Towards a Practical, Scalable Self-Localization System for Android Phones based on WLAN Fingerprinting
  5. Towards usable authentication on mobile phones: An evaluation of speaker and face recognition on off-the-shelf handsets
  6. Unify localization using user interface description languages and a navigation context-aware translation tool
  7. Air-Writing: A Platform for Scalable, Privacy-Preserving, Spatial Group Messaging

2011 12

  1. Feature interaction analysis in mobile phones: on the borderline between application functionalities and platform components
  2. Private Notes: Encrypted XML Notes Synchronization and Sharing with Untrusted Web Services
  3. A Critical Review of Applied MDA for Embedded Devices: Identification of Problem Classes and Discussing Porting Efforts in Practice
  4. DVCS-Autosync
  5. IPsec/L2TP gateway for Android and iPhone clients on OpenWRT
  6. A framework for on-device privilege escalation exploit execution on Android
  7. SSD Linux benchmarking: Comparing filesystems and encryption methods
  8. Private Notes
  9. emphFriends Radar: Towards a Private P2P Location Sharing Platform
  10. Evaluation of Descriptive User Interface Methodologies for Mobile Devices
  11. Mobile Platform Architecture Review: Android, iPhone, Qt
  12. Global indexing of indoor localization data

2010 20

  1. Howto use an encrypted container under Windows XP/7 and Linux
  2. Howto use Aladdin eToken under Linux
  3. Air-Writing: A Platform for Scalable, Privacy-Preserving, Spatial Group Messaging
  4. User Created Machine-readable Policies for Energy Efficiency in Smart Homes
  5. Howto create a Debian chroot on an Android phone
  6. OpenUAT: The Open Source Ubiquitous Authentication Toolkit
  7. Running (K)Ubuntu Linux on a Dell Latitude XT
  8. Howto configure encrypted home directories under Linux
  9. Howto auto-mount devices under Linux with hotplug
  10. Howto combine Chillispot with OpenSwan on one machine
  11. Howto fix emails for Cyrus LMTP and IMAP
  12. Howto make a USB stick bootable
  13. Howto setup SyncEvolution on a Nokia N900 with Egroupware
  14. Howto use Debian GNU/Linux on a Gericom Phantom notebook
  15. Howto use Debian GNU/Linux on a Thinkpad T42p
  16. Howto use the SpeedTouch 330 ADSL USB modem with kernel 2.4
  17. Mkinitrd-cd
  18. Sampling Pulse-Width-Modulation Codes on the Parallel Port
  19. Secure and User-Friendly Encrypted Suspend-to-Disk with Debian GNU/Linux
  20. Squid filter patches

2009 3

  1. Shake well before use: Intuitive and Secure Pairing of Mobile Devices
  2. On Structural Identification of 2D Regression Functions for In-door Bluetooth Localization
  3. Special Issue: Secure Spontaneous Interaction

2008 5

  1. Towards Alternative User Interfaces for Capturing and Managing Tasks with Mobile Devices
  2. Ubiquitous Computing Security: Authenticating Spontaneous Interactions
  3. Spontaneous Mobile Device Authentication based on Sensor Data
  4. Building Flexible Manufacturing Systems Based on Peer-Its
  5. Peer-it: Stick-on solutions for networks of things

2007 10

  1. Proc. IWSSI 2007: First International Workshop on Security for Spontaneous Interaction (part of Adjunct Proc. Ubicomp 2007)
  2. Security by Spatial Reference: Using Relative Positioning to Authenticate Devices for Spontaneous Interaction
  3. Shake well before use: two implementations for implicit context authentication
  4. The Candidate Key Protocol for Generating Secret Shared Keys From Similar Sensor Data Streams
  5. Shake well before use: Authentication based on Accelerometer Data
  6. A Human-Verifiable Authentication Protocol Using Visible Laser Light
  7. On the Security of Ultrasound as Out-of-band Channel
  8. Towards an Open Source Toolkit for Ubiquitous Device Authentication
  9. Using a Spatial Context Authentication Proxy for Establishing Secure Wireless Connections
  10. Extending the Growing Neural Gas Classifier for Context Recognition

2006 2

  1. A Context Authentication Proxy for IPSec using Spatial Reference
  2. An Authentication Protocol using Ultrasonic Ranging

2005 7

  1. Technische Hintergründe f̈̊ das rechtliche Handeln im Internet
  2. Speech at Promotio sub auspiciis Praesidentis rei publicae
  3. Bridging the Gap with P2P Patterns
  4. Advances in Pervasive Computing: Adjunct Proceedings of the 3rd International Conference on Pervasive Computing
  5. Context Prediction based on Context Histories: Expected Benefits, Issues and Current State-of-the-Art
  6. Eine Architektur zur Kontextvorhersage
  7. An Architecture for Context Prediction

2004 9

  1. An Architecture for Context Prediction
  2. Recognizing and Predicting Context by Learning from User Behavior
  3. A Context Prediction Code and Data Base
  4. A Notebook Sensory Data Set for Context Recognition
  5. An Architecture for Context Prediction
  6. Digital Aura
  7. A Light-Weight Component Model for Peer-to-Peer Applications
  8. A Peer-to-Peer Light-Weight Component Model for Context-Aware Smart Space Applications
  9. The Peer-to-Peer Coordination Framework --- Architecture Reference

2003 3

  1. Feature Extraction in Wireless Personal and Local Area Networks
  2. Recognizing and Predicting Context by Learning from User Behavior
  3. Securing Passive Objects in Mobile Ad-Hoc Peer-to-Peer Networks

2002 3

  1. A New Approach to a Fast Simulation of Spiking Neural Networks
  2. DEVS Simulation of Spiking Neural Networks
  3. Generic Heuristics for Combinatorial Optimization Problems

2001 1

  1. About