undefined | Better HN

0 pointssangnoir2y ago0 comments

I'd love for my banking app to be completely isolated from the rest of my phone OS, in case I get malware. I'm sure journalists at risk of targeting by NSO and its ilk would appreciate isolation or their messaging apps

0 comments

saagarjha2y ago

This is an interesting usecase (basically Qubes) but it has high overhead and I don't really see the framework as being designed to support this, at least yet. You'd need to move all sorts of services into the VM to support the app (like, for example, someone needs to pass touch input and network traffic into the VM) and at this begins to look like an entire OS running in there.

rfoo2y ago

Qualcomm does have similar architecture deployed, here is their hypervisor: https://github.com/quic/gunyah-hypervisor.

AFAIK Qualcomm's implementation does include passing touch input / display into the VM and is marketed in similar term ("Trusted User Interface") to TEE-based techs, except they are not in S-EL0/1.

I've only seen this used in some really obscure scenario (cryptocurrency wallet) though.

j / k navigate · click thread line to collapse