David Kleidermacher

@Google Security/Privacy - @Android, @GooglePlay, @madebygoogle, team ASAP and team DSAP | Opinions my own | linkedin davekleidermacher, @[email protected]

[David Kleidermacher @DaveKSecure]

I started an (occasional) personal blog, inaugural post on #protectedcomputing. https://t.co/XF4iKkrTou

[Rachel Tobac @RachelTobac]

Also, the demo of fake call detection that @Google made for me was an early version.
In the launch today, the contact’s photo is also removed as another visual signal that it's likely an impersonator calling.
Really cool to see that update in action as we found that impactful in our research together!

[Heather Adkins - Ꜻ - Spes consilium non est @argvee]

Happy for @Google to take part in this work for a more secure digital ecosystem for everyone.

[David Kleidermacher @DaveKSecure]

@trucku_kun @ArnoldLabour @ssamat @davestrokes Of course identity can also be compromised. But IDV / KYC is a critical defense-in-depth for valuable online services worldwide for good reason. It eliminates entire classes of threats, substantially raising exploit cost and reducing user harm.

[David Kleidermacher @DaveKSecure]

@ArnoldLabour @trucku_kun @ssamat @davestrokes That’s why scanning is just one layer of defense-in-depth. ADV fundamentally raises the cost of the exploit. By requiring verification, scammers can no longer endlessly spin up anonymous burner accounts to blast out these dynamic dropper links at scale. 3/3

[David Kleidermacher @DaveKSecure]

@ArnoldLabour @trucku_kun @ssamat @davestrokes FluBot is a perfect example. Scammers use texts to trick users into sideloading it. The app then connects to a new domain to dynamically download a fake banking UI. No scanner can detect malicious code that doesn't exist yet. ThreatMark report: https://t.co/ItyPsARJJL 2/3

[David Kleidermacher @DaveKSecure]

@trucku_kun @ssamat Many folks aren't aware how scammers use sideloading to harm users at scale, e.g. broadcasting texts to massive databases to trick people into installing malware. A great example is FluBot. Check out how that scam worked: https://t.co/6BejrNNoiw ADV stops these attacks.

[David Kleidermacher @DaveKSecure]

We appreciate the public/private partnerships with governments around the world working with us to fight crime and protect the security and privacy of billions of users

[Sadiq Khan @SadiqKhan]

As Mayor, I've been calling on phone firms to do more to combat mobile phone theft.

Good to visit Google’s London office today to see the important work they are doing on new state-of-the-art AI technology that will make Android mobile phones less attractive to thieves.

[Christiaan Brand @christiaanbrand]

Worried about “passkey lock-in”? This should help put your mind at ease: https://t.co/cZgS9DVjjs

[David Kleidermacher @DaveKSecure]

@MishaalRahman Correct, we didn't request that Samsung turn on the Auto Blocker by default either

[David Kleidermacher @DaveKSecure]

@MishaalRahman No we did not

[David Kleidermacher @DaveKSecure]

To make this about access to a game is deliberately misleading; this is about user safety. And Epic’s lawsuit puts their corporate interests above user protections. (5/5)

[David Kleidermacher @DaveKSecure]

🧵Epic’s latest lawsuit is a meritless and dangerous move. Google did not request that Samsung create their Auto Blocker feature. (1/5)

[Engadget @engadget]

Epic is suing Google and Samsung for making it too hard to download Fortnite https://t.co/2UTGuuL4RQ

[David Kleidermacher @DaveKSecure]

That’s why Google offers its own safety features such as Google Play Protect, which checks for harmful apps on a user’s device, regardless of where the app was downloaded. Android device makers are free to innovate and design additional safety features for their devices. (4/5)

[Mishaal Rahman @MishaalRahman]

Putting aside their opinions on Wired, iVerify, and Palantir, the GrapheneOS account raises a lot of good points about how this "vulnerability" is way overblown and being misrepresented.

And given how brutally critical of Google they often are, the fact that the GrapheneOS folks are coming out this hard in defense of them really shows how bad the reporting on this issue has been.

The original report makes for a salacious headline but it falls apart really quickly when you actually look at the details.

[Daniel Kang @ddkang]

@OpenAI claimed in their GPT-4 system card that it isn't effective at finding novel vulnerabilities.

We show this is false. AI agents can autonomously find and exploit zero-day vulnerabilities.

Paper: https://t.co/ywjCe7BfE6

🧵 1/7

[Dave Burke @davey_burke]

It's going to be a big day tomorrow! All that's left is to🙏 to the demo gods and try to get some good 💤's

[Royal Hansen @royalhansen]

Proud @Google joined @CISAgov + others to sign today's secure by design pledge.W/new tech&growing cyber threats I'm proud to work for a company w/such a strong security culture. That's why we've been using secure by design for years&amplify its criticality https://t.co/oYoTwfX862