The user is vulnerable, not only to "malware" but also to the phone vendor (and anyone the vendor enables, notably government). The degree of control one can a

The user is vulnerable, not only to "malware" but also to the phone vendor (and anyone the vendor enables, notably government). The degree of control one can attain over a phone or tablet is much less than on a general-purpose PC, and the latter is hard enough to relatively secure. Smartphones are captive, remote-controllable devices and as such are not trustworthy for secure communications or any important secrets. This fact, together with grc's implications that the scheme is novel, important or secure, supports the derisive view of the author in the sub-thread above. Also check out the stylistic buffoonery on his site.