RESEARCH
Academic submissions, conference talks, and threat reports. We say which papers are accepted, which are still being written, and which we have only thought about starting.
How a phone can prove it is running a specific, verifiable image without leaking identifying information — and what happens when the chip lies.
Internal + collaborators (anonymized for review)
A federation that shares the right amount of information about threats without sharing user identity, location, or content.
Internal + collaborators
Why one signing key is one too few, and how three independent roles plus a role-diverse quorum changes the threat model.
Internal
How SOURCE_DATE_EPOCH, Soong overlays, and signing-role separation deliver a deterministic image that anyone can re-derive from source.
Internal
An ongoing campaign sends spoofed cell-broadcast alerts on stock Android. Our cell-broadcast verifier rejects unsigned alerts on LyDos Phone; we are publishing IOCs to help other vendors detect the pattern.
Three coordinated disclosures handled in Q1, each patched and published the same day. Findings paid out under the bug bounty program.
We share work under permissive licenses. Pre-prints land on the arXiv mirror as soon as venues allow. Source for every artifact lives in the public repository — including the bibliography.