Espionage-motivated threat actors have gigantic budgets. You cannot expect a smaller software project to outmatch these people.
You're not rich enough. You don't have an elite network giving you intel that your work may be exploited... Unless you're a vulnerability researcher, then it is certain you don't have comparable offensive skills. You are far from being a mega corporation or a government unless you're a major talent.
But, it's not all nihilistic. Even if it feels like the odds are against you, you can make these groups work harder and increase the costs of a successful campaign. Difficulty of exploitation increases cost, time and manpower to reach their goals. If a certain conceptual attack is too expensive to come to life, it would not be worth spending it on, and every new victim increases the risk of the technique being burned.
App developers, especially those working with apps that load remote content (e.g. messengers and web browsers) should think of security from the beginning. Operating systems should contain apps to add defence in depth if they are exploited to misbehave. Every additional countermeasure to a threat is an increase in cost and minimum technical skills required.
Commercial operating systems have security settings that they should enable if they feel at risk. Lockdown Mode on iOS is an example. There's still a lot that these operating systems could do to make things difficult. We do a lot more beyond just what Android's Advanced Protection mode does.
View quoted note →
