Blog
Build notes on mobile security and verification-first architecture.
This index collects long-form writeups, shorter notes, and supporting fragments from active security work. Topics include hostile-client assumptions, replay resistance, trust-boundary design, and reliability under production constraints.
Build Notes
Hardening iOS Device Trust Signals Against Hostile Clients
A practical look at building and evaluating device trust signals under jailbreaks, instrumentation, replay, and tampered clients, with emphasis on server-side verification and failure-aware design.
March 29, 2026
12 min read
Labs
Labs
Replay and nonce handling
Notes on where nonce checks belong, what can be cached, and when the server should reject a reused claim.
Research note
Hostile-client verification
A short review of which signals are useful only as hints and which can support a real decision.
Notes
Note
Trust boundaries are easier to review than policy language.
The shape of the boundary is easier to reason about than the policy layered on top of it.
Note
Replay resistance belongs on the server, not in the client.
Client-side hints are useful, but replay resistance only becomes real once the server can verify freshness.
Note
Observability only helps if the failure state is explicit.
Logs and metrics are only useful when the system has a clear place to land after something goes wrong.
Concise Build Notes
Note 01
Hardening iOS device trust signals
Signal path, server verification, and replay resistance
Note 02
Session recovery without blind trust
State transitions, step-up checks, and recovery gating
Note 03
Backend verification under load
Tracing, metrics, and request-level guardrails