Obfuscated JS.

How do you handle offline access, for example when using a Laptop? Syncthing seems to be an option.

Use a separate home partition to decouple the system from your user data. Easier to snapshot and to replace the system.

Yes, by default windows launches UAC prompts in the supposedly isolated “secure desktop” instead of the classical “interactive user desktop”.

It is not necessary for the attack and was used to illustrate the vulnerable app manifest configuration.

Enigma balls

Element Desktop has profiles. But sadly there are no profiles on the mobile app.

Any modded app provided for free by some rabdom uploader is suspicious. You cannot blindly trust any platform. If you care about your privacy and your device’s security you should analyze the app’s content in depth or buy the app (or crack it yourself, but it usually means you need to buy the app first).