I don't use Signal because of Google Play Services, which is the backdoor this article refers to.

I'm reasonably confident that my phone's OS is uncompromised and I take the radio problem into consideration as part of my threat model and change my behaviors on my phone accordingly. I have also made some progress on using OsmocomBB as a radio baseband, and on building a custom phone that treats the radio as hostile and isolates it as much as possible.

Which device are you using OsmocomBB on? Which custom device are you building?

Neo900 looks pretty good for baseband isolation.

The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though.

Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.

>Which device are you using OsmocomBB on?

A Motorola C139.

>Which custom device are you building?

A, uh, custom one.

>The phone network and the protocols for connecting to it are pretty user hostile no matter how open and secure the phone and baseband are though.

>Don't forget the SIM card runs its own insecure OS that people have hacked before and you just can't replace that.

Yeah, I'm keeping both of those things in mind. There won't be any assumption that your phone calls or SMS will be secure, but rather that your mainboard OS is secure _from_ the radio and that you don't have to worry about discussions had near your phone and such.

So we should just aim for no security at all then? Why is it that every time someone points out a security flaw, people say "well then don't use a phone?" As if we shouldn't strive for improvements unless everything is 100% secure.