00:00SPEAKERHello, tech pod listeners will hear before we start the podcast.
00:03SPEAKERI wanted to ask a favor.
00:05SPEAKERWe're a few months into the show and would love to know how we're doing.
00:08SPEAKERSo we put up the first tech pod survey.
00:11SPEAKERWe want to find out what you like, what you don't like, what you'd like to hear
00:14SPEAKERmore of and what you'd like to hear less of from us each week, this isn't about
00:18SPEAKERcollecting demographics for advertisers.
00:20SPEAKERIt's a way for you to directly impact the future of the show.
00:23SPEAKERThe address is survey.content.town.
00:27SPEAKERAgain, the address is survey.content.town and now on with the show.
00:34SPEAKERMy kid's school flooded.
00:35SPEAKEROh, no, that's right.
00:37SPEAKERI saw you talking about that.
00:38SPEAKERThat sounds like a bad thing.
00:39SPEAKERI mean, like a benign bad thing, right?
00:41SPEAKERIt's like a, it's kind of a low key disaster.
00:43SPEAKERIt is like it's as disasters go.
00:46SPEAKERIt's the one you want.
00:47SPEAKERNobody got hurt.
00:48SPEAKERNobody got hurt.
00:48SPEAKERI hope it was definitely traumatic for the kids.
00:51SPEAKERThey were sitting there.
00:52SPEAKERIt was raining.
00:53SPEAKERLike we had an inch of rain in 25 minutes in Pacifica last Thursday.
00:56SPEAKERThat storm was really something like, man, not to digress here.
01:01SPEAKERI feel like I'm developing a bad habit of just assuming that every extreme weather
01:06SPEAKERevent is related to climate change.
01:07SPEAKERAnd I don't know if that's maybe that's probably, that's probably painting with an
01:10SPEAKERoverly broad brush.
01:12SPEAKERI think that that is probably the way things are going to be going forward, but
01:15SPEAKERwe have had some real humdingers of a storm here the last couple of few months.
01:22SPEAKERI mean, we had fire, we had massive fires in the, in the, in the fall.
01:25SPEAKERWe had high winds.
01:27SPEAKERWe have the fires.
01:27SPEAKERI know are related, but storms, you know, I mean, bad storms happen.
01:31SPEAKERI mean, the whole point of climate change is not that like it's going to get colder
01:34SPEAKERor warmer necessarily, but like all the weather is going to be more intense
01:37SPEAKERbecause there's more energy in the atmosphere.
01:38SPEAKERThese are some intense, so there we go.
01:41SPEAKERSo they flooded and she said like it happened immediately after school started,
01:45SPEAKERbut they're sitting there looking at the, looking like they're doing reading,
01:48SPEAKERreading time.
01:49SPEAKERAnd one of the kids says, Hey, look, there's a bunch of water out in the, out
01:52SPEAKERthe window and the courtyard outside their window had filled up to the point
01:55SPEAKERthat it was starting to come under the door from the outside drainage out there.
01:59SPEAKERWell, there is, but it got backed up and it was backed up under the, like
02:03SPEAKERin the drain so nobody could see it.
02:04SPEAKERLuckily the city got there really fast, but like, by the time I got there to
02:07SPEAKERpick them up from school, they shut down the school by the time I got there to
02:10SPEAKERpick them up, there was like four and a half, five inches of water in the, in
02:13SPEAKERthe hallway of the classroom.
02:16SPEAKERSo they like, luckily it was a four day weekend anyway.
02:18SPEAKERSo they just shut down school on Thursday and Friday, and they're going to be
02:21SPEAKERsomeplace else Wednesday, Thursday, and Friday of this week.
02:23SPEAKERAnd then it's hopefully back to normal and a perfectly cleaned out school.
02:27SPEAKERBut man, talk to your school about their emergency preparedness plan.
02:30SPEAKERIt turns out it didn't go well.
02:32SPEAKERIt went pretty well.
02:34SPEAKERIf it had been a real emergency and people had been hurt, it would have been
02:37SPEAKERbad, but luckily everybody was fine.
02:39SPEAKERAnd like the kids were mildly traumatized.
02:40SPEAKERI think they watched the secret life of pets too in the gym while they
02:43SPEAKERwere waiting for all the kids to come.
02:44SPEAKERSo that'll bring anybody back down to earth.
02:51SPEAKERHello and welcome to another episode of Brad and Will Made a Tech Pod.
03:17SPEAKERI'm Will and Brad.
03:18SPEAKERSee, thank you for not welcoming yourself.
03:20SPEAKERI was welcoming them, not you.
03:22SPEAKERI'm learning.
03:23SPEAKERAh, it's like, you've never done a podcast before.
03:25SPEAKERYeah.
03:25SPEAKERWhat is that?
03:26SPEAKERIt's an audio file that's like, has an RSS feed attached to it.
03:29SPEAKERSo people can download it with a tool called a podcast podcatcher.
03:33SPEAKERThe show is educational.
03:34SPEAKERRemember what we used to remember?
03:35SPEAKERRemember podcatchers?
03:37SPEAKERSure.
03:37SPEAKERRemember, remember before there were apps.
03:39SPEAKERMy old podcatchers hanging up behind the back.
03:41SPEAKERYeah.
03:43SPEAKERYou got to put that need, need, need, need foot oil in there.
03:45SPEAKERNeed, need, need some.
03:48SPEAKERYep.
03:48SPEAKERYep.
03:49SPEAKERThat's the one.
03:49SPEAKERYep.
03:50SPEAKERRub that oil.
03:51SPEAKERI remember the first time I heard about podcasts and I was like, man, that sounds
03:54SPEAKERneat.
03:55SPEAKERAnybody can make a radio show about audio production.
03:57SPEAKERStuff's too expensive.
03:58SPEAKERWho's going to do that?
03:59SPEAKERI'll never catch on.
03:59SPEAKERYeah.
03:59SPEAKERNobody's ever going to do that.
04:00SPEAKERYeah.
04:01SPEAKERWhat are we talking about this week, Brad?
04:02SPEAKERInfoSec.
04:04SPEAKEROh, I love saying that word.
04:05SPEAKERReally?
04:06SPEAKERInfoSec and OpsSec are words that, cause I just imagine people who are really angry
04:10SPEAKERall the time yelling at me.
04:11SPEAKERWell, that is definitely one constituency probably, but I don't know.
04:16SPEAKERTo me, talking about InfoSec makes you feel kind of like you live in a spy movie.
04:19SPEAKERYou got important stuff to protect.
04:21SPEAKERLike maybe Dan Aykroyd is telling you that the man is out to get you all the time and
04:24SPEAKERyou got to pay attention to SeaTech astronomy.
04:26SPEAKERBut I mean, but instead of, instead of James Bond, it's really more like hackers,
04:30SPEAKERlike zero cool kind of shit, I guess like it's kind of, it's a little bit cheesy and
04:35SPEAKERabsurd, but also very important in this day and age.
04:37SPEAKERWell, information security is what we're talking about.
04:40SPEAKERYeah.
04:40SPEAKERIt's one of those things that like, when I worked at the computer magazine, people
04:43SPEAKERalways yelled at us about bad information security stuff and they were right to him.
04:46SPEAKERYeah.
04:47SPEAKERBut the people, I mean, it's been a while since you were in a magazine and back then
04:50SPEAKERit was just less dangerous out there.
04:52SPEAKERWell, it's gotten a lot worse in the last few years.
04:55SPEAKERYeah.
04:55SPEAKERAs people become, as people spend more time online and have more of their stuff
04:59SPEAKERonline, that is a value, like their bank accounts and their credit cards and all
05:02SPEAKERthat stuff.
05:03SPEAKERThere are just way, way more vectors into somebody's personal life now.
05:06SPEAKERYeah.
05:07SPEAKERElectronic vectors, ways to access finances and information and all that stuff.
05:10SPEAKERAnd, and if you, if you handle your stuff poorly, then like you can get into real
05:17SPEAKERtrouble.
05:17SPEAKERNow, like 20 years ago, it was like an annoyance and you'd lose your Yahoo mail
05:21SPEAKERaccount or whatever, but ultimately who cares now, if you lose access to your bank
05:25SPEAKERaccount, you can just, somebody can destroy your credit and just absolutely wreck you.
05:29SPEAKEROr if I tell you that your whole identity, not, not even just your money, but like
05:32SPEAKERI've, I haven't, I haven't read too deeply into what happened, but I've just seen in
05:35SPEAKERgeneral, like horror stories about like, Oh, I had my identity stolen and it took like
05:39SPEAKERmonths or a couple of years to get like, cause you think about all the bureaucracy
05:42SPEAKERyou have to go through to like get everything fixed and all the, all the
05:46SPEAKERinformation stuff put back.
05:47SPEAKERAnd also like the Matt Honan hack is one of the more famous ones.
05:50SPEAKERMatt Honan was a reporter for Gizmodo.
05:52SPEAKERThen I think he was wired at the time this happened.
05:55SPEAKERI can't remember, but he's at Buzzfeed now.
05:57SPEAKERAnd he logged onto, he sent out his Mac one day and stuff just started getting
06:01SPEAKERdeleted from his hard drive, like visibly like he was watching it happen.
06:04SPEAKERYeah.
06:04SPEAKERLike he got logged out and he, when he turned it back on, it was like, it was a
06:07SPEAKERbrand new computer.
06:08SPEAKERWow.
06:09SPEAKERAnd then he picked up his phone and the same thing happened there.
06:11SPEAKERAnd what had happened was somebody had hacked him.
06:14SPEAKERI want to say they went through Amazon to get his credit card number.
06:20SPEAKERLike he called somebody impersonated him on Amazon called using information they
06:24SPEAKERwere able to get from another site and use that to get his credit card number
06:28SPEAKERfrom them.
06:29SPEAKERAnd then use the credit card number to get Verizon or whoever his cell phone
06:33SPEAKERprovider was to give access to his SIM to, to dupe his SIM basically and turn off
06:37SPEAKERhis old SIM and then use all of that to re to lost password, everything else.
06:42SPEAKERYeah. So once that happened, they took over everything that he
06:47SPEAKERowned, I think, except they didn't get his Twitter maybe.
06:51SPEAKERAnd that's what they wanted because he's, well, he's at Matt on Twitter.
06:54SPEAKEROh, wow.
06:55SPEAKERSo it's three letters.
06:55SPEAKERIt's a really valuable account.
06:57SPEAKERYeah. How much, how much do you think you could sell that account?
06:59SPEAKERA couple hundred thousand dollars.
07:00SPEAKERWow.
07:01SPEAKERYeah. So I do that in a heartbeat.
07:03SPEAKERIt would be an easy decision, but anyway, the point is like it took him
07:07SPEAKERforever to unravel that.
07:09SPEAKERAnd he did a really good article.
07:10SPEAKERI think it was for wired that explained like the whole process of restoring
07:13SPEAKEReverything.
07:14SPEAKERI want to read this.
07:15SPEAKERIt's, it's, it's a fascinating article.
07:16SPEAKERHis name is Matt hone and H O N a N.
07:18SPEAKERAnd you will, I'll, if I remember, I'll put it in the show notes.
07:20SPEAKERNot to, this is maybe putting the cart before the horse a little bit, because
07:23SPEAKERwe haven't even really gotten into the basics here, but that form of social
07:26SPEAKERengineering is the one that actually scares me the most because there aren't as
07:29SPEAKERthere really aren't a lot of technological safeguards against it.
07:31SPEAKERIt's really more having to worry about human beings doing the right thing.
07:34SPEAKERWell, it's interesting.
07:35SPEAKERYou say that because that's starting to change really.
07:37SPEAKERYeah. So Google, the reason this is an interesting to talk about this week is
07:40SPEAKERGoogle just opened up the advanced protection program to everyone.
07:44SPEAKERSo previously this was for like celebrities and politicians.
07:48SPEAKERIt's something that I think they created as a result to the hacks on the Hillary
07:51SPEAKERClinton campaign, like the Podesta emails and all that, which were on Gmail.
07:55SPEAKERAnd another one I had forgotten about was the, um, was it Sony pictures?
07:58SPEAKEROne of the major movie studios, Sony massive Sony got hacked by North Korea,
08:02SPEAKERwhich is how we, which is why Spiderman is in the MCU now.
08:05SPEAKERRight. For real. Yeah. No, I, yeah. I remember a lot of that stuff.
08:10SPEAKERThere have been some very high profile data breaches in the last few years is
08:13SPEAKERthe point. Yeah. And, and the,
08:16SPEAKERso the advanced protection stuff is basically we'll talk about more toward the
08:20SPEAKERend when we, cause it's not something that most people should do on their main
08:22SPEAKERGmail account. Um, but what it does, but it basically what it does is it says,
08:26SPEAKERHey, you have to have two hardware authenticators, um, in tandem. No,
08:31SPEAKERnot, not in tandem. One is a backup.
08:34SPEAKERYeah. Because they're going to take away.
08:36SPEAKERCause I was envisioning like the straight up nuclear,
08:38SPEAKERlike insert two keys and turn your keys, turn both keys at the same time. No,
08:43SPEAKERit's not like that. But what, what it is is a, um,
08:47SPEAKERit turns off all of the non hardware encryption ways to
08:51SPEAKERrecover your account. So for example,
08:54SPEAKERright now if I lose my two factor authentication for my account,
08:57SPEAKERI can use the recovery codes or I can send an email to an email address and then
09:01SPEAKERclick a link. And that will let me go back and do that.
09:04SPEAKERHowever, if you're dealing with like a state agency who might hijack that email
09:08SPEAKERor may hijack your domain encryption and reroute your mail
09:13SPEAKERat the, at the, at the, at the router level, at the,
09:16SPEAKERat the DNS level to steal the recovery information,
09:21SPEAKERthere's not a whole lot you can do to protect about that against that stuff.
09:23SPEAKERSame thing as if somebody hijacks your SIM card.
09:25SPEAKERSo if you have your Google set to send a text to recover your account,
09:29SPEAKERif somebody calls your cell phone provider and hijacks that SIM,
09:33SPEAKERthen they can get that. And you're doing, there's nothing you can do to assault,
09:36SPEAKERfix that. Yeah. So, um,
09:39SPEAKERwhat this does is basically takes all that stuff out and replaces it with like
09:42SPEAKERUB keys or an Android device, or I think an iOS device now, um,
09:46SPEAKERphysical item you have to keep on your purse. Exactly. Um, and, and, uh,
09:52SPEAKERlike that, that is a great solution for famous people,
09:57SPEAKERthe fame's the politicians, you know,
10:00SPEAKERpeople who are going to be hijacked by like dedicated state level hackers,
10:04SPEAKERthe upper crest. Yes. Um,
10:06SPEAKERit has some real downsides in that,
10:08SPEAKERlike you can't connect anything to your AP at the API level,
10:11SPEAKERto your Google account, third party apps. So no third party apps you can't use.
10:15SPEAKERLike that means I assume that means you can't use Apple mail on your iPhone.
10:18SPEAKERYou have to use the Gmail client, stuff like that. So, um,
10:22SPEAKERbut I think it's a good, it's always a good time to talk about InfoSec. Yeah.
10:26SPEAKERAnd to be how to be safe. And what is the official name of this again?
10:30SPEAKERAdvanced protection program. It is the Google advanced protection program.
10:34SPEAKERI'd never heard of this before you brought it up. Um, it is relatively new.
10:37SPEAKERAnd I think you had, you used to have to be kind of invited to it. Okay.
10:41SPEAKERThis reminds me a lot of the filtering options that Twitter used to only give to
10:45SPEAKERverify accounts that now anybody can access. Yeah, exactly.
10:48SPEAKERIt's it's similar to that situation. And I think, um,
10:52SPEAKERif you have a Twitter account that is liable to be hacked,
10:55SPEAKERthat is like a target for hacking, then they'll lock it down.
10:59SPEAKERLike a lot of places now you can call and say, Hey,
11:02SPEAKERdon't let anybody change my password over the phone or whatever. Um, but,
11:05SPEAKERbut like for normal people,
11:09SPEAKERit's a lot less complicated than that.
11:10SPEAKERLike there's some basic stuff you can do that like makes you safe.
11:15SPEAKERThat starts with always using a password manager. Like don't,
11:19SPEAKERdon't use the same password multiple places.
11:21SPEAKERIs that the number one piece of advice you would give? I think so.
11:24SPEAKERI have a list of things that I think are best practices around this issue,
11:27SPEAKERbut I have no idea if they're actually, well, you know,
11:30SPEAKERif the experts would agree, I guess I could see like, I mean,
11:33SPEAKERthe two that come to mind are password manager and two factor,
11:35SPEAKERbut I guess they kind of go hand in hand. Well, it's okay.
11:38SPEAKERSo there's one other thing we should think about first one is that you don't
11:41SPEAKERwant, especially if you're any, in any way publicly visible,
11:46SPEAKERdon't make your recovery email address something that people are going to know.
11:50SPEAKERSo like the security through obscurity is generally speaking bad,
11:54SPEAKERbut if you have a public facing email address, like my work email is,
11:58SPEAKERwill it for VR?
12:00SPEAKERDon't make that the recovery email for all of your other stuff. Be, be,
12:05SPEAKERthoughtful about what gets recovery emails and how you can recover accounts.
12:10SPEAKERBecause that's that it turns out like if you, once you do all this,
12:13SPEAKERonce you do two factor authentication, once you do a password manager,
12:15SPEAKERso you're not doing the same passwords everywhere and you have to have a
12:19SPEAKERhardware encryption,
12:20SPEAKERthe easiest way to hijack an account is to do the lost lost password thing.
12:24SPEAKERAnd if, if that,
12:25SPEAKERlike I think what I might do is set up another Gmail account.
12:28SPEAKERThat's just for recovering accounts and put the super duper protection stuff on
12:32SPEAKERthat. Interesting. So that then that stuff is locked down.
12:35SPEAKERIt's not tied to my SIM card anymore. Yeah, that's a good idea.
12:38SPEAKERCause I feel like I like the thing that worries me is now you can call Verizon
12:42SPEAKERor AT&T and say, Hey, I don't want, I want to,
12:45SPEAKERI need to lock my account so that it can't,
12:47SPEAKERso that people can't change the SIM card unless I show up in person at a store
12:51SPEAKERand present ID. Which solves like 90% of the phishing problems.
12:55SPEAKERBut you have to opt into that. You have to opt into that.
12:58SPEAKERWell cause customer service, customers always right. You know,
13:01SPEAKERpeople don't want to go to the store, whatever.
13:03SPEAKERBut let's jump back to the key thing. So password managers,
13:07SPEAKERlike one password, last pass. You said you were using,
13:10SPEAKERwe're using Bitdefender for encryption. Bitwarden. Bitwarden. I really,
13:14SPEAKERwell whatever.
13:14SPEAKERI don't know if we want to sit here and talk about competing password managers
13:17SPEAKERall day long. I, I like it cause it is, it's open source,
13:20SPEAKERwhich is just nice from an auditing perspective. It's, you know,
13:23SPEAKERif all the code is out there, you can be pretty sure it's quite secure.
13:26SPEAKERWhere do you save the password files?
13:28SPEAKERSo they, that's an interesting question. They store them remotely by default.
13:32SPEAKEROkay. I got a server. Do you pay?
13:35SPEAKERNo. Well, no. So their free offering is incredibly robust.
13:39SPEAKEROh, okay.
13:40SPEAKERSo basically what happened was I switched from one password.
13:42SPEAKERWhen they went to the subscription model?
13:43SPEAKERNo.
13:44SPEAKERI had bought a proper license back in the day when they just sold licenses for
13:48SPEAKERversions. Um, and they're, uh,
13:51SPEAKERthe Chrome plugin for the version that I bought broke because Google changes the
13:55SPEAKERway they sign Chrome and one password's response was like, Hey,
13:59SPEAKERyou should to get a working Chrome plugin.
14:01SPEAKERYou should upgrade to our subscription model. And I was like,
14:04SPEAKERwhy don't I find a competing product? Um, I had already upgraded that point.
14:08SPEAKERI would have dumped them at that moment.
14:09SPEAKERSo people were actually hex editing the Chrome executable,
14:12SPEAKERwhich I know is a terrible idea, but they literally just replaced the string,
14:16SPEAKERthe company name string to what it used to be.
14:19SPEAKERAnd that made the plugin work again.
14:20SPEAKERAnd when it was like that level of change is what was preventing it from
14:23SPEAKERworking. I know this is incredibly old man shaking cane.
14:26SPEAKERNo, that sucks. Like, like it was a bad customer experience.
14:28SPEAKERI really put me out and that's what got me looking at other stuff.
14:32SPEAKERSo my,
14:33SPEAKERmy feeling on password managers and stuff like that is that anything I really
14:36SPEAKERrely on, I'm happy to pay for. Um,
14:39SPEAKERI felt like that company and I like it's look, it's a small developer.
14:43SPEAKERI get it. Like you have to have recurring revenue. And like,
14:47SPEAKERthat product is basically feature complete at this point. And they don't,
14:50SPEAKERthey don't need to add stuff to it, but they need to keep existing.
14:53SPEAKERLike I want them to keep existing so they can keep updating the product. Yeah.
14:56SPEAKERUm, if I were starting now, I probably wouldn't use one password.
14:59SPEAKERI just put my parents on one password over the Thanksgiving holiday and it was
15:03SPEAKERlike a 14 hour nightmare. Yeah.
15:06SPEAKERTo be fair,
15:07SPEAKERI feel like that probably true of just about every one on the market.
15:10SPEAKERNone of them are great. Yeah. So I read the wire cutter review before we came
15:14SPEAKERhere to see if they had a recommendation.
15:15SPEAKERPlenty of them are fine for people who are, you know, pretty tech savvy,
15:18SPEAKERbut that's your parents.
15:20SPEAKERI can't think of a single one that's really going to be that friendly.
15:23SPEAKERThere's always, well,
15:24SPEAKERso the takeaway is after I got them on board and got them using it,
15:27SPEAKERit seems to have stuck. Okay. Like previously they had a notes,
15:31SPEAKERa file in notes that each of them had all of their passwords,
15:35SPEAKERbut they didn't write the passwords down. They just put like hints to the
15:39SPEAKERpasswords. That's better than just plain text. I mean, it's not good.
15:43SPEAKERIt's a little bit better. Look getting them switched over.
15:45SPEAKERI got locked out of so many accounts trying to guess the passwords. Yeah. Um,
15:49SPEAKERit was like a beautiful mind in there because they weren't putting new lines or
15:53SPEAKERanything. It was just like a giant, she would, anyway,
15:56SPEAKERit was the point is once there's a pain process,
16:00SPEAKERwhen you switch to the password manager, no matter which one you choose,
16:03SPEAKERit takes a little work and like the first week or two are going to be really
16:07SPEAKERfrustrating. But once you get through to the point that it's,
16:10SPEAKERthat you're using it reliably and most of your passwords are just in there and
16:13SPEAKERyou just, you know,
16:13SPEAKERpress your thumb on the fingerprint sensor or look at the phone it's magic.
16:18SPEAKEROnce the biometric integration happened,
16:20SPEAKERthis was even with when I was still using one password. I mean,
16:22SPEAKERit's been a few years now. Um, but that was, that was the family.
16:25SPEAKERI used it before, but I'm more, it was more like I used it grudgingly. Yeah.
16:29SPEAKERBut once that came about is when I got excited about using it because it,
16:32SPEAKERbecause it made it so seamless. Well, and now like, like for a while,
16:35SPEAKERyou couldn't create new passwords from the, from apps and stuff like that.
16:38SPEAKERAnd now the keyboard integration and iOS and Android is,
16:41SPEAKERare both so seamless that like,
16:43SPEAKERI think the password manager works better on my phone than it does on my PC now.
16:47SPEAKERInteresting. Because, because of the biometrics, like I don't have to like,
16:51SPEAKERso like I have one really long pass phrase that I remember.
16:55SPEAKERIt's literally the only password I remember anymore.
16:57SPEAKERThat's for your vault. That's for the vault. Yeah. Um,
17:00SPEAKERand then you have to save the other stuff.
17:02SPEAKERLike you have to save the backup keys to get access to that vault.
17:05SPEAKERSomeplace else on a piece of paper, presumably. Um,
17:08SPEAKERbut the nice thing is like one password, last pass, key pass,
17:11SPEAKERall those handled the two factor authentication software,
17:14SPEAKERtwo factor authentication too,
17:16SPEAKERwhich means if you're syncing them across multiple devices,
17:19SPEAKERyou have the two factor authenticator just built into the password manager,
17:23SPEAKERwhich is, I feel like that's maybe not super secure, but it's very convenient.
17:28SPEAKERUm, so using, so the,
17:30SPEAKERand like a good password manager will also tell you things like, Hey,
17:34SPEAKERyou have the same password on these two accounts that you created before you
17:37SPEAKERwere using me. Or, Hey, this,
17:40SPEAKERthis service had a breach and you should probably change the password on it.
17:43SPEAKEROr this service was hacked and they lost all their passwords because they were
17:47SPEAKERa holes and didn't salt and hash the passwords. So you need to,
17:52SPEAKERyou know, reset this password too. Do you have any, uh,
17:54SPEAKERdo you have any infosec breach stories? I have lost a credit card. I,
17:59SPEAKERfor a while I was replacing bank of America credit cards every three months or
18:03SPEAKERsix months. Well, that's, I feel like that's a little different. I mean,
18:06SPEAKERthose could just get skimmed at an ATM or in a drug store or something like
18:09SPEAKERthat. But no, that's not your fault is what I'm saying. They were,
18:11SPEAKERthey were getting hacked at the processing centers. Oh, not off your card. Yeah.
18:15SPEAKERIt wasn't off my card.
18:16SPEAKERSo they were having to replace hundreds of thousands of cards. Oh wow. Yeah.
18:19SPEAKERIt was bad. That's rough. Um, I had my,
18:23SPEAKERI had all of my, my lifetime, uh,
18:26SPEAKERkind of store credit that I'd built up on delivery.com stolen. Oh no.
18:31SPEAKERI made the delivery.com account like 15 years ago or something and used a shitty
18:36SPEAKERpassword that I reused too many times. Oh yeah. And I forgot to change that.
18:40SPEAKERI have like,
18:41SPEAKERit was like $65 worth of free food that I never used and somebody logged into
18:44SPEAKERthat account in like Brooklyn or the Bronx or somewhere ordered a bunch of wings
18:49SPEAKERand soda money went away.
18:51SPEAKERSo Gina had, um,
18:54SPEAKERsomebody in Louisiana steal her Starbucks, uh,
18:58SPEAKERlogin, which like, I don't know if you use the Starbucks app, but it is,
19:01SPEAKERit's actually money. Like you can't add credit to it if you don't have the
19:06SPEAKERpassword. Okay. Sorry. If you don't know the credit card number,
19:09SPEAKERif you don't know the last, the security code on the credit card number. Okay.
19:12SPEAKERBut you can spend the money that's in the account. Okay. Like a, like a,
19:16SPEAKERit's like a, it's like a gift card basically. So people were going up and like,
19:19SPEAKERshe, she finally, when we find, when I was like, she was like, Hey, did you,
19:23SPEAKERdid you buy Starbucks the other day? I was like,
19:25SPEAKERdid you buy $62 worth of Starbucks? And I was like, no. And she said,
19:30SPEAKERhuh, I got to call them. So she called and when we went,
19:34SPEAKERthey went back through a year's worth of use and she was like,
19:38SPEAKERthey spent like $400 in $10 chunks over, over a year,
19:43SPEAKERan eight month period or something. It's intense. Um, and they refunded it,
19:47SPEAKERof course, but like, like you gotta pay attention to that stuff.
19:51SPEAKERAnd there's so much of it. Now that's good of them.
19:53SPEAKERI never got my delivery cash. I forgot my food books back.
19:56SPEAKERWell, so the nice thing was,
19:58SPEAKERthat was the thing that convinced Gina finally to buckle buck down,
20:01SPEAKERlike to do the two weeks. And now she's all in, like, she's, she's like,
20:05SPEAKERI can't believe I didn't do this 10 years ago when you told me to,
20:08SPEAKERbecause it's so much more convenient now than having to remember that stuff the
20:12SPEAKERold way.
20:12SPEAKERDo you generate every single password you use now? Every single one. Really?
20:15SPEAKERYeah. I do it for anything remotely important. I just do it for everything.
20:19SPEAKERHave some kind of like stuff. I just remember for like, like services.
20:23SPEAKERI don't really care about, but the,
20:25SPEAKERthe only ones that I do manually sometimes is sometimes I
20:30SPEAKERswitched from like the just gibberish like letter symbols and numbers,
20:33SPEAKERall mixed up to like the words, the words with the hyphens between them. Yeah.
20:37SPEAKERI use those for things like Netflix and PlayStation and X-Box and things like
20:41SPEAKERthat, that I might have to type in manually.
20:42SPEAKERLike I don't know. You know, I'm certainly no cryptographer or like, you know,
20:46SPEAKERI'm not in that world necessarily, but I, yeah. Isn't,
20:48SPEAKERisn't it the case that like just a,
20:50SPEAKERan intelligible English passphrase is like a considered a strong,
20:53SPEAKERlike from a brute force cracking perspective, like that's a,
20:56SPEAKERthat's a pretty strong way to go. Right.
20:57SPEAKERSo like there's, there's all sorts of ways to attack that stuff.
21:01SPEAKERLike there's these things called rainbow tables that basically have every
21:05SPEAKERcombination of words that are in the English language and names and common
21:09SPEAKERthings, which is why we put symbols and numbers and stuff on our passwords now.
21:14SPEAKERIt's my understanding is that it's pretty difficult. Like the longer,
21:19SPEAKERthe length is the thing that is more important than anything else.
21:23SPEAKERAssuming you're not just using common English phrases or English words. Right.
21:28SPEAKERBut the upshot is if you do that right, nobody else will ever have access.
21:32SPEAKERSo for example,
21:33SPEAKERlike one password has a secret key that gives you access to the thing.
21:37SPEAKERAnd then it's like,
21:39SPEAKERit's like three chunks of data that have to be there in order for somebody to
21:42SPEAKERhack your password. So, so they automatically,
21:46SPEAKERthey automatically create something that's pretty good.
21:49SPEAKERAnd then your password is just like icing on top of that already good code.
21:55SPEAKEROkay. Two factor authentication.
21:58SPEAKERUse it and love it. Yes. Well, I don't love it. I mean, it's a pain.
22:01SPEAKERIt's a chore. Well, if your password manager's good, it's not,
22:04SPEAKERcause like mine just automatically fills it in.
22:06SPEAKERIt just pops in with like when it recognized, but, but what it is is,
22:10SPEAKERyou know how you go to the ATM, do you just walk up to the ATM and you're like,
22:14SPEAKERyou're like, yo, I'm Brad shoemaker. Give me money. Yes. They heard I was coming.
22:16SPEAKERYes. No, you have to bring a card. They rolled out the red card.
22:19SPEAKERYou have to have a thing and you have to have something and know something. Yeah.
22:22SPEAKERSo two factor authentication.
22:24SPEAKERThat is a phrase that I have become acquainted with as I started kind of caring
22:27SPEAKERmore about the stuff. Yeah. A thing you have at a thing, you know. Yeah.
22:30SPEAKERSo in this case, that's the golden kind of combo, right? Yeah.
22:33SPEAKERThe thing you have is a device that has an algorithm generator on it that's tied
22:38SPEAKERto the time and it generates a code that's good for like 30 or 40 seconds or a
22:42SPEAKERminute, whatever. And then that code expires and you have to get another one.
22:45SPEAKERAnd it just keeps prompting new codes all the time.
22:47SPEAKERAnd it's generated with math that is unassailable or difficult to a sale.
22:52SPEAKERThere's also these things called hardware two factor authentication,
22:55SPEAKERwhich is what we talked about in the Google protection program.
22:58SPEAKERAnd like YubiKey is a big vendor of these.
23:01SPEAKERI think if you sign up for like an ARS premium subscription,
23:04SPEAKERthey'll send you a free YubiKey now. And that's a brand name to be clear.
23:07SPEAKERIt's a brand name. Y-U-B-I. Y-U-B-I-K-Y.
23:09SPEAKERI always wondered if that was a generic term or if that was just a company
23:13SPEAKERthat's making them.
23:14SPEAKERIt's the company that's making them. And those,
23:16SPEAKERthey have all sorts of different models and strengths of encryption based on
23:22SPEAKERwhether you like need like government level, but that is a hardware thing.
23:25SPEAKERThe interesting thing about YubiKey specifically in the hardware encryption is
23:29SPEAKERthat Google claims that they've never had a data breach on an account that was
23:34SPEAKERsecured with a hardware hardware to FA.
23:36SPEAKERInteresting. And does, does does an authenticator app on your phone count in the
23:41SPEAKERsame vein? Like, no, not as good. Those are not as good. Okay.
23:44SPEAKERSo Authy or Google authenticator, stuff like that.
23:46SPEAKERI think Authy, yeah, that my understanding is that the YubiKey is,
23:50SPEAKERis so far flawless. I mean, people have obviously lost the keys, but
23:56SPEAKERyou know, if you, assuming you hold onto your key, then you're,
24:00SPEAKERyou're pretty Bulletproof. Okay. The,
24:05SPEAKERthe YubiKey is kind of a bunch of different form factors.
24:07SPEAKERMost of them have a USB port on one side. Some of them are USB-C,
24:10SPEAKERsome of them have lightning ports, some have NFC contacts.
24:13SPEAKERAnd usually you have to plug the thing in and touch it.
24:15SPEAKERSo like you have to have a physical contact with the device in order for it to
24:19SPEAKERauthenticate when, when the time is right.
24:21SPEAKERSo like there's no like remote man in the middle type exploit situations.
24:25SPEAKERLike you like there's a, there's a thing,
24:27SPEAKERit's not like a fingerprint sensor or whatever, but it, generally speaking,
24:31SPEAKERpeople feel my understanding is that the security community feels like those are
24:34SPEAKERmore secure than say a biometric thing where you have to scan a fingerprint or
24:38SPEAKERface recognition or something like that, which are not easily spoofed,
24:41SPEAKERbut are more easily spoofed than the YubiKeys.
24:43SPEAKERYeah. I mean, you could, like,
24:45SPEAKERyou could lift somebody's fingerprint off of.
24:47SPEAKERWe've done that. We did that and tested, right? We,
24:49SPEAKERwe lifted a fingerprint off of a glass or something and made a graphite version.
24:55SPEAKERI think we did it with, with crazy glue and scotch tape and graphite.
25:00SPEAKERYeah. The trick is like getting the conductance and all that stuff. Right.
25:03SPEAKERIt's hard, but it was,
25:05SPEAKERit was something that a bunch of chuckleheads could do in like a normal ass
25:08SPEAKERshop and like a couple hours, a little frightening to hear actually. Yeah.
25:12SPEAKERSo that's why the face recognition is so much better. I was going to ask you,
25:15SPEAKERdo you think face ID is better than touch ID? It's like both of them are
25:18SPEAKERconvenient. Okay. If you're really serious about security,
25:20SPEAKERyou're going to have a giant long ass password on your, on your device. Yeah.
25:24SPEAKEROr you just smash the home button five minutes, five times. Uh,
25:28SPEAKERso like the face recognition stuff, you can turn off by slam,
25:30SPEAKERby smashing the power button a bunch while it's in your pocket. Oh,
25:33SPEAKERinteresting.
25:34SPEAKERSo if you're about to get a snatched by the fuzz and you don't want them to force
25:37SPEAKERyou to look at your phone and unlock it, then you just do that.
25:39SPEAKERAnd then you have to put the code in. Oh, cause that's the legal standard,
25:42SPEAKERright? The legal standard is to use a biometric data,
25:45SPEAKERbut they can't force you to use a numeric code. It's unclear.
25:47SPEAKERI think the fingerprint is unclear,
25:49SPEAKERbut the face they can make you look at the phone. Okay. I mean, you look,
25:53SPEAKERif you don't make eye contact, if you don't make eye contact with the phone,
25:56SPEAKERit doesn't unlock. Yeah. Right. Which is fucking bananas. Yeah.
26:00SPEAKERBut I don't like if I'm in a, if I'm in a,
26:03SPEAKERif I'm in a North Korean prison and I, you know, I, I don't,
26:06SPEAKERI just matched the button five times. Yeah. The LDR. Yeah. Um, okay.
26:09SPEAKERSo that's two factor authentication. You can get real in the weeds with this,
26:13SPEAKERlike that. I think that's, I think turn on two factor authentication.
26:16SPEAKERAnd this is another thing that your password manager will tell you. It'll say,
26:18SPEAKERHey, these sites support two FA and you're not using it. So sign up.
26:23SPEAKERYou want that. Um,
26:25SPEAKERif you can avoid using SMS two factor authentication, that's better.
26:29SPEAKERCause if you get SIM hacked, then, then, you know,
26:33SPEAKERthat doesn't save you at all.
26:34SPEAKERSomebody can intercept your text messages that have the codes in them. Uh,
26:37SPEAKERexactly. Or, or they just, yeah, they just, they just intercept your,
26:40SPEAKERthey just take over your phone. Like they had your phone first and then you're
26:43SPEAKERdoomed. Um, and, and, and like you can get real,
26:48SPEAKERlike I said, if you're really concerned about this,
26:50SPEAKERyou can call Verizon and or your AT&T or whoever your cell phone provider is and
26:54SPEAKERsay, look, I want my phone put on super secret lockdown mode.
26:57SPEAKERSome carriers do that. Some don't. Your mileage may vary based on your carrier.
27:01SPEAKERAnd maybe even the person you talk to on the phone.
27:03SPEAKERThat's the thing I was actually thinking was like, I bet that you're,
27:06SPEAKERI bet the results are not consistent. You call and try to get this done.
27:09SPEAKERMy guess is that the more famous you are,
27:11SPEAKERthe more lucky you'll have with that experience. So if I call,
27:15SPEAKERI'm not going to have a great time, but if the other Will Smith calls,
27:17SPEAKERhe's probably going to get exactly what he needs. Yeah.
27:19SPEAKERAlso probably his cell phone is in some holding company's name,
27:22SPEAKERso it's going to be harder for them to figure out.
27:24SPEAKERYou know what you just kind of made me think of this mentioning Will Smith,
27:27SPEAKERbut cell phones and the hacking of cell phones has like,
27:31SPEAKERhas weirdly been one of those kinds of great equalizers between people of that
27:34SPEAKERcaliber of celebrity and regular people. Yeah. Like it was wild. Like that,
27:38SPEAKERthat wave of phone breaches that happened a few years ago when Apple had the,
27:41SPEAKERyeah. Like seeing, I mean, it's, it's stupid. It's,
27:44SPEAKERthis is some full on us magazine, like, Oh, celebrities go get ice cream cones.
27:47SPEAKERYou know what I mean? Yeah. Like of course everybody has a phone,
27:50SPEAKERbut like you don't really think about like everybody has a phone and everybody
27:53SPEAKERuses their phone in the exact same way. Oh yeah.
27:56SPEAKERIt brings people who are like up on this lofty celebrity pedestal in societal
28:00SPEAKERterms, knocks them down a few tiers. Yeah.
28:02SPEAKERIt's like a weirdly humbling thing where you see like, Oh, well that's like,
28:05SPEAKERthose people win Oscars, but they can be hacks just like anybody else. Hey,
28:08SPEAKERBrad Pitt is shitty at password security. Just like everybody else. Yeah. Um,
28:13SPEAKERit's, I mean it, look, it happened to the fucking president.
28:16SPEAKERIt happened to presidential campaigns, but on both sides, like it's, it is,
28:19SPEAKERit is really, really easy to make one mistake. Okay. So other stuff,
28:23SPEAKERdon't click links in emails ever. Yes. Never,
28:27SPEAKERhonestly just get rid of email,
28:30SPEAKERlike move to Slack or discord or something. But, but for real,
28:34SPEAKERlike if your bank sends you a note that says, Hey,
28:36SPEAKERyour account has been compromised,
28:38SPEAKERgo pick your debit card out of your wallet,
28:42SPEAKERcall the 800 number on the back and call.
28:44SPEAKERIf somebody calls you on the phone and says they're with the bank, say, Hey,
28:47SPEAKERI'm going to call you back to the number on the back of the card.
28:48SPEAKERDon't tell them what it is.
28:51SPEAKERDon't let them give you a number to call them back on, ask how you connect with
28:54SPEAKERthem after you call the main line for your, for your banks,
28:56SPEAKERfor your specific account. Um, don't, uh,
29:01SPEAKERyou just, yeah, just assume that everything in email,
29:05SPEAKEReverything you get via email is probably a bad actor.
29:08SPEAKERI can't remember if this maybe was out of the DNC hacks or I saw some security
29:12SPEAKERexpert use the phrase email is skywriting. Yeah. How do I have, when some of those,
29:17SPEAKERsome of those breaches were happening, like basically just like anything in email
29:20SPEAKERis like, might as well be broadcast to the entire,
29:21SPEAKERjust assume that every single person in the world is going to see,
29:24SPEAKERbut anything you put in email, that's how easy it is to get. Yeah.
29:27SPEAKERCause most servers don't even encrypt between like on server to server. Right.
29:31SPEAKERSo most, most, um, I mean,
29:34SPEAKERthis is the benefit of switching to something like Gmail versus running your own
29:37SPEAKERemail server. It is really hard to keep your own email server secure in
29:41SPEAKER2020. They're, they're constantly under threat. It's hard to manage spam.
29:46SPEAKERIt's like, it's, that's why I switched to Gmail in the early 2000s.
29:50SPEAKERAnd I'm very glad that I did.
29:51SPEAKERCause it saved me a lot of hassle over the interceding of the, uh, uh,
29:55SPEAKERpreceding anti-ceding. I can't remember the years between then and now. Yes. Um,
30:00SPEAKERare you familiar with proton mail? Is that even more secure?
30:02SPEAKERI feel like I see a lot of reporters. That's a Russian thing, isn't it?
30:05SPEAKERIs it really, I think proton mail is owned by a Russian company,
30:08SPEAKERwhich is possible probably five years ago. I said, yeah, that sounds great.
30:10SPEAKERRussians are really good at security. I see a lot of reporters say, Hey,
30:13SPEAKERif you want to get at me in a super secure fashion,
30:15SPEAKERand this is the email address you use and it's on that service.
30:18SPEAKEROh no. Proton is open source and served in Switzerland. So it's fine.
30:22SPEAKERI was mixing that proton.ru is the thing I was thinking about. I think.
30:26SPEAKERIs it a mistake to feel like stuff that's open sources are potentially more
30:30SPEAKERsecure? It depends. Okay.
30:32SPEAKERLike that's kind of the point I was making about Midwarden. Yeah.
30:35SPEAKERFor something that's security oriented to me, it's just a good gesture.
30:37SPEAKERI feel like to expose everything you're doing generally outside scrutiny,
30:42SPEAKERassuming that the thing you're talking about is big enough that people do out
30:44SPEAKERscrutinize it from outside. It's good. Like I use VeraCrypt because of that.
30:48SPEAKERIt's like an open source,
30:51SPEAKERfollow up to true crypt and it's backwards compatible with true crypt volume.
30:54SPEAKERSo if you want to, if you have sensitive information, so for example,
30:58SPEAKERif you have you know,
31:00SPEAKERyou want to keep your tax returns on a hard drive someplace or on a thumb drive,
31:03SPEAKERif you're carrying around a thumb drive and going to say like themed restaurants
31:08SPEAKERand you don't want the stuff that's on that to be exposed to the world,
31:11SPEAKERshould you lose the thumb drive, you can use a piece of software like VeraCrypt
31:15SPEAKERto encrypt the entirety of the contents of that drive,
31:18SPEAKERkeep a version of VeraCrypt on the drive.
31:20SPEAKERSo no matter which computer you plug it into, you can,
31:22SPEAKERyou can fire it up and access that information.
31:25SPEAKERAnd you can store a really long password in your password manager.
31:28SPEAKERSo you don't even have to remember anything. These are all best practices.
31:32SPEAKERIt's very good practices.
31:35SPEAKERYou encrypting that stuff is good.
31:38SPEAKERAny external drives that you carry around with you, I think are good to encrypt.
31:42SPEAKERI don't generally encrypt hard drives in computers just because there's a little
31:46SPEAKERbit of a performance impact and the challenge of recovering data.
31:50SPEAKERIf you, something goes bad, it's scary.
31:52SPEAKERIt's you have to be real good at backups if you're going to encrypt your hard
31:56SPEAKERdrives. I know NASA has come up quite a bit. We love NASA.
31:59SPEAKERWe love the nasty my, my giant storage pool on my free NAS machine is
32:04SPEAKERencrypted because the tutorial,
32:06SPEAKERwhen I first got into free to ask a couple of years ago, tutorial recommended,
32:09SPEAKERdoing it. No, Brad, I didn't know what I was getting into.
32:12SPEAKERNo. Can you decrypt it easily or no?
32:15SPEAKERThat's one of the downsides, like nothing. So you have to upgrade your pool.
32:18SPEAKERNothing about a ZFS pool really can be changed after it's created. So whatever,
32:23SPEAKERI'm getting more discs to it. Yeah.
32:24SPEAKERI'm in the process of finally backing everything up.
32:27SPEAKERAnd I think I'm just going to destroy that pool and recreate it unencrypted.
32:30SPEAKERYeah. Okay. Because like you have to keep up with a file.
32:33SPEAKERYou have to keep up with the decryption key in the form of a file.
32:36SPEAKERAnd if you store that on the pool and the pool goes away, bad things, man.
32:40SPEAKERIf you, if you lose that file and the discs get, well,
32:44SPEAKERI mean they are encrypted at every boot. The OS decrypts them when you boot,
32:49SPEAKERbut for any reason you get locked out of that pool and you don't have that key
32:53SPEAKERfile. Like that data is gone forever. Like that's just, it's nerve wracking.
32:56SPEAKERYeah. Yeah. You be careful with encryption.
32:59SPEAKERWell, and, and windows has BitLocker built in. I think what is the,
33:04SPEAKERthere's a thing in OS 10 now.
33:06SPEAKERIt has been for a decade. We have to use it at work.
33:08SPEAKERI can't remember the name of it's file vault file vault. Yes. Yeah.
33:11SPEAKERAnd it'll do a whole hard drive encryption. Like it's pretty seamless.
33:14SPEAKERThe challenge. I mean, look on a Mac laptop,
33:17SPEAKERit doesn't matter because the SSDs are soldered on the motherboard now. Yeah.
33:21SPEAKERSo like it's not like you can take them out and put them in the machine to get
33:23SPEAKERyour data off. You're just boned if that thing dies. Right. But
33:28SPEAKERbeing careful with encrypted disks is important. Yes. Not to be used lightly.
33:33SPEAKERYeah. And, and I have not enjoyed it. Yeah. No, it's, I, I,
33:37SPEAKERI looked at that when I was doing my free NAS machine a decade ago,
33:40SPEAKEReight years ago or whatever. And I was like, I don't,
33:43SPEAKERI just seems like a bad idea. I'm not going to do this. I, I, I regret it.
33:48SPEAKERWell, I mean, next time you upgraded the disks in your pool, you can,
33:50SPEAKERyou can just copy it over and it'll be fine. I mean,
33:54SPEAKERthat's kind of the high points. I feel like maybe we missing some stuff.
33:57SPEAKERDon't click links. Don't answer phone calls. Block down.
34:02SPEAKERI think one of the big ones is making sure that your recovery stuff all goes to
34:06SPEAKERsomeplace that's secure and making that the most secure thing.
34:10SPEAKERAnd then everything down the stream from that is going to be less secure.
34:13SPEAKERAnd that's fine. You've got, I don't know, man,
34:15SPEAKERyou've got me feeling like I should go through and generate passwords for
34:17SPEAKEReverything that I don't already have them generate a bad idea. I mean, I mean,
34:22SPEAKERsome of that stuff is just inconsequential enough that I don't know if I care.
34:25SPEAKERI think if stuff like a delivery.com account, like, yes,
34:28SPEAKERI lost a little bit of fluid free food. Well, but,
34:31SPEAKERbut like if you think about it as potential vectors,
34:33SPEAKERif they can call delivery.com or login,
34:36SPEAKERif they can hack your delivery.com stuff and get your credit card information,
34:40SPEAKERthen that lets them call Amazon and get your zip code.
34:44SPEAKERLike how would they get that number though?
34:46SPEAKERBecause the whole number shouldn't be available in the account.
34:48SPEAKEREven if you have a login for it, you say that,
34:50SPEAKERbut if you get somebody on the phone, they're going to have the whole number.
34:53SPEAKERIt's also like your social engineering aspect. Again,
34:56SPEAKERthat's why I'm afraid of it. The social engineering aspect is the big,
34:59SPEAKERis the big problem. That's the big question, Mark,
35:01SPEAKERbecause human beings are unreliable and make mistakes all the time. Well, yeah.
35:04SPEAKERAnd like, if you think about calling delivery.com,
35:06SPEAKERI apologize for picking on delivery.com because it's a fine service they'd ever
35:09SPEAKERget. They said,
35:10SPEAKERI contacted sport and they said they would give me my $65 back and they never
35:13SPEAKERdid. Where's his $65.
35:15SPEAKERThat was like not even two meals ordering out in San
35:20SPEAKERFrancisco these days. Yeah. You can barely get a cheeseburger McDonald's.
35:24SPEAKERThe thing is if they it's, you're just looking at minimizing threat surface.
35:29SPEAKERSo like the number of places that people can get personally identifiable
35:32SPEAKERinformation, like for example,
35:35SPEAKERa lot of times you can call the bank and you can get access to somebody's bank
35:38SPEAKERaccount if you have the last three transactions. So if they call,
35:41SPEAKERif they have your delivery.com account,
35:44SPEAKERthen they can go and place three orders to delivery.com and then call your bank
35:48SPEAKERand say, Oh, my last three transactions were $12 and 11 cents,
35:51SPEAKER$7 and 60 cents and $5 and 95 cents.
35:54SPEAKERI thought about that because obviously a lot of services like that,
35:56SPEAKERyou can opt to save your full payment information and then just make orders
35:59SPEAKERwithout having to reconfirm it every time.
36:00SPEAKERBut like I assume common sense is what stopped the people that got into my
36:05SPEAKERaccount from straight up doing that. Because at that point,
36:07SPEAKERare you committing like massive fraud?
36:08SPEAKERWe're committing fraud.
36:09SPEAKERAnd you're also presumably giving them your home address or an address where you
36:12SPEAKERare known. Well, they did that anyway. I have the address of the people who,
36:16SPEAKERoh, really have an address where they got delivered.
36:19SPEAKERI can't say it's necessarily their address. Yeah. But they,
36:22SPEAKERthey saved the address in the account. I had that.
36:26SPEAKERBut I assume they were either smart enough or didn't think to actually use my
36:31SPEAKERcredit card to buy food because what I'm getting at is I assume that is a pretty
36:34SPEAKERdifferent level of crime than credit card fraud. So, yeah. But I mean,
36:39SPEAKERthe point is if they want to get into your case,
36:41SPEAKERthey want to get into your bank account. Then once they do that,
36:43SPEAKERthen they can get into your bank account.
36:44SPEAKEROther things to think about are like PayPal. Like if you have,
36:46SPEAKERif you have e-commerce stuff that took directly to bank accounts.
36:50SPEAKERSo if you have a PayPal vendor account and you're connected directly to a
36:54SPEAKERchecking or savings account, then once they get into PayPal,
36:57SPEAKERthey can clean you out by PayPal money from your bank accounts to themselves or
37:01SPEAKERto like a series of cutoffs cutouts basically until they,
37:05SPEAKERthey empty your, your accounts. So like PayPal,
37:09SPEAKERgreat place to have two factor authentication turned on. Right. Yes.
37:13SPEAKERAre those services, do you think typically they'd be able to be pretty good if
37:15SPEAKERyou did fall victim to something like that?
37:17SPEAKERWould they be pretty good about getting your money back? Cause like there are
37:19SPEAKERlike the classic thing about like using a debit card with the bank is like that
37:22SPEAKERmakes it good luck, tough, right? Well, you used to, it depends on the debit.
37:26SPEAKERIt depends on the,
37:26SPEAKERit depends on your bank and it depends on the account that you sign up for and
37:29SPEAKERit depends on the debit card. Right?
37:30SPEAKERSo some of them have different levels of protection, fraud protection,
37:34SPEAKERthere are instances of using something like debit card where if somebody takes
37:37SPEAKERthat money, you're just kind of shit out of luck, right? For a long, long time,
37:40SPEAKERI didn't use a debit card because if they like the best practice is to have a
37:45SPEAKERbank account that has a few hundred dollars in it to use with your debit card
37:48SPEAKERand do not carry a debit card for whatever your main,
37:52SPEAKERsay that's not attached to your main savings account, your main checking.
37:55SPEAKERRight. Yeah. So I'm, I'm,
37:57SPEAKERI'm just wondering in that same vein how some of these digital intermediaries
38:00SPEAKERlike PayPal would treat usually tells you to get fucked. Really is my
38:04SPEAKERunderstanding. I thought it would be the opposite. No, cause, cause they'll tell,
38:08SPEAKERlike, this is why a lot of people don't use anything but a credit card on PayPal
38:12SPEAKERis because when they have access to your bank,
38:13SPEAKERthen a lot of your fraud protection stuff goes away. So two factor,
38:17SPEAKERgood password PayPal for sure. Yes. Think about stuff like Venmo,
38:22SPEAKERsquare cash, all of the Apple pay,
38:24SPEAKERall of the bazillions of different places that you can connect to your bank
38:28SPEAKERaccount. Do you think we have anything else? I don't, I don't know. Oh,
38:31SPEAKERhere's a good one.
38:32SPEAKERWhen you're at like a conference or a convention and you're in the convention
38:36SPEAKERcenter and you sit down for a meal and you're sitting there and there's a plug
38:38SPEAKERright there and there's a USB port on the plug. Yeah. Do you plug the phone?
38:43SPEAKERYeah. That's the right choice. Yeah. However, you can get, uh,
38:47SPEAKERUSB cables that are power only.
38:49SPEAKERThey probably won't charge it like the full maximum speed that your phone will
38:52SPEAKERcharge, but basically you just cut the two data wires inside the,
38:56SPEAKERinside the cable and you'll get five milliamps of power. Okay. I've seen,
39:00SPEAKERthey also sell 500 milliamps. So I'll just kind of little in between connectors.
39:05SPEAKERYeah. It's like a USB condom. Do the same thing. Yeah. Yes. Basically. Yeah.
39:09SPEAKERUm,
39:10SPEAKERthe better solution is to carry a battery backup and just plug into your battery
39:14SPEAKERwhen you're, when you need to recharge on the go.
39:15SPEAKERI don't know if I'm being overly paranoid there.
39:17SPEAKERI'd like airplanes are probably fine. I use airplane seats.
39:21SPEAKERI feel like that's maybe I, so I haven't seen anybody. I haven't seen any, like,
39:26SPEAKERuh, uh, what's his name? Uh,
39:30SPEAKERthe Brian crabs hasn't posted it. He's a, he's the credit card skimmer guy.
39:35SPEAKERUm, he hasn't posted anything about like USB skimmers. I'm sure it's coming.
39:39SPEAKERI was just about to ask if such a thing exists. Yeah, I, I'm sure,
39:42SPEAKERI'm sure that like there's Defcon proof of concepts of here's a USB skimmer that
39:46SPEAKERjust snaps on top of the Alaska. I mean,
39:49SPEAKERthe thing there is the threat surface is really huge.
39:51SPEAKERLike every seat back on Alaska has my God has the same plug.
39:55SPEAKERCan you imagine? So you design one thing, you make 20,000 of them.
39:59SPEAKERAnd every time you get on a flight, you smack them on your row. And then,
40:02SPEAKERbut I don't know how you get data back.
40:04SPEAKERI wonder how that's being communicated out of there. Yeah.
40:07SPEAKERThat's the challenging part. They'll figure out a way. I mean, you,
40:10SPEAKERyou can't use the in-flight wifi because you have to capture in flight once the
40:14SPEAKERplanes off the ground, presumably a connection to wifi on the terminals,
40:18SPEAKERwhen they get where they're going. But any, anyway,
40:21SPEAKERthe point is I haven't seen any attacks like that, but be aware,
40:24SPEAKERlike don't use strange USB port. Don't use the one in the back of your Uber.
40:27SPEAKERI was just about to say when I get an Uber and they offer me a charge cable that
40:31SPEAKERleads to somewhere I can't see. No, no, thank you. Thank you. I'm good. Yeah.
40:36SPEAKERLike appreciate it. Yeah. It's, it's like safe sex guidelines.
40:39SPEAKERWe all learned in the eighties when we thought we could have sex and immediately
40:42SPEAKERdie. Yes. Don't, you know, think about that before you,
40:46SPEAKERbefore you go stick in your plugs in there. Yeah. It's a frightening topic.
40:50SPEAKERI mean, it is the, the one thing I really do think that the best thing you can do,
40:54SPEAKERstop using the same passwords everywhere is an enormous quality of life
40:58SPEAKERimprovement,
40:59SPEAKERespecially if you frequently find yourself trying to figure out what fucking
41:03SPEAKERpassword you set up for eBay six months ago and you haven't logged into sense or
41:06SPEAKERwhatever. So yeah, maybe, maybe that's the best way to end this.
41:10SPEAKERLike what are the kind of, let's say like top three things.
41:13SPEAKERIf people have just people listening,
41:14SPEAKERI've just never thought about their digital security and they want to just like
41:17SPEAKERa lock down the most obvious stuff. It's like,
41:19SPEAKERnumber one is never click a Lincoln email. Yeah. Well, yeah. Yeah. Like never,
41:23SPEAKERever, ever click a Lincoln email. I mean like the things you can do right now,
41:27SPEAKERlike you said, going out and changing all your passwords,
41:29SPEAKERsetting up a password manager,
41:30SPEAKERturning on two factor are the two biggest things and,
41:34SPEAKERand going through and doing an audit of the important accounts like bank, uh,
41:38SPEAKERcredit credit cards, uh, PayPal, Venmo, square,
41:43SPEAKERApple, all those things that make sure you have a cohesive
41:48SPEAKERaccount recovery situation. Um, the other thing is when you turn on two factor,
41:52SPEAKERa lot of times that will disable the ability to recover an account with like a
41:57SPEAKERlost, lost your email, you know, uh, forgot my password button.
42:00SPEAKERSo you'll get a series of keys like 16 digit or 24 digit encryption
42:05SPEAKERkeys that will give you access, one time access or multi-time access.
42:09SPEAKERIn some cases, back to that account, you'll get like 16 of them.
42:12SPEAKERUsually where's a good place to keep those. This is, um, that's, that's,
42:16SPEAKERthat's an esoteric question that actually it's not, you should, yeah,
42:21SPEAKERyou should print those out. Well, I keep mine in a cloud folder.
42:25SPEAKERI'm not going to say which one, but it's in one of the cloud storage folders.
42:29SPEAKERI don't think it's a great solution. Probably. I was going to say,
42:31SPEAKERthat's making up.
42:32SPEAKERI've also printed them all out and put them in a fire safe that's in my office.
42:37SPEAKERSo, um, I used to have them in a safe deposit box and then my lawyer was like,
42:41SPEAKERHey,
42:42SPEAKERdon't safe deposit boxes are impossible to get back into if you die or something
42:45SPEAKERhappens to you. Or even it might just be the Sunday and you can't get into the
42:48SPEAKERbank. Right. So, um, he was like, buy a $300 fire safe.
42:52SPEAKERThis is the one I recommend. Wirecutter likes it,
42:54SPEAKERput it in your office and put, put them in a folder.
42:57SPEAKERThat's like put all of your two factor authentication stuff,
43:01SPEAKERall of your tax documents, your will, all of that stuff in the fire.
43:03SPEAKERSo I'm trying to think like,
43:04SPEAKERwhat are the things that you might have a one-time a set of one-time codes for,
43:08SPEAKERlike obviously your primary email address, anything with two factor,
43:11SPEAKERso primary email Dropbox, PayPal,
43:16SPEAKERI either didn't generate or don't keep up with the codes.
43:18SPEAKERYou got to keep up with those. I have them for my email, but not much else.
43:23SPEAKERI don't think I should probably go regenerate. It's worth generating the codes.
43:27SPEAKERWhat do you think about maybe, I don't know if this is a good idea or not,
43:30SPEAKERbut maybe just like print out a little laminated card and keep it in your
43:33SPEAKERwallet. I don't think I want that. I don't want to carry that around with me.
43:35SPEAKERI want it secure. Yeah. Right. Wallet is not good. So I guess not. I mean,
43:39SPEAKERhow often is your wallet been? How long, how many times have you, I mean,
43:41SPEAKERI haven't lost my wallet since I was in elementary school. Probably wait,
43:44SPEAKERyou had a wallet in elementary school, like fifth grade. Wow.
43:48SPEAKERHow did you pay for lunch? I started, I just shoved $2 in my pocket. Wow.
43:52SPEAKERI don't think I carried a wallet until I was like a junior in high school.
43:54SPEAKERI was wearing khakis and like button down shirts.
43:57SPEAKERI was like a young NASA employee in 1985, real young Sheldon over here.
44:02SPEAKERHey, quit bringing your CBS bullshit into our, uh, no. Yeah.
44:05SPEAKERI wouldn't care on my wallet. Really? Okay. Yeah. I think it's too important.
44:09SPEAKERIt's like carrying your social security card. You don't carry that either. Yeah.
44:11SPEAKERSo somewhere in your house, probably the best. Okay.
44:15SPEAKERWhat if your house burns down? That's fair. I mean, here's the thing.
44:18SPEAKERTheoretically I have my phone with me all the time. Yeah.
44:20SPEAKERKeeping them in a file on the phone,
44:22SPEAKERwhich will be locked and is destroyed the date on it is destroyed.
44:25SPEAKERIf somebody tries to log in it too many times, unsuccessfully probably is good.
44:28SPEAKERThe only downside is you want to have a backup that's not in your phone because
44:32SPEAKERwhat if your phone, what if you smash your phone, it doesn't work. Yeah. Um,
44:36SPEAKERyou know,
44:36SPEAKERit catches on fire because it's a Samsung galaxy note seven and the battery
44:40SPEAKERexplodes, whatever. Also, I'm trying to think like maybe this is easier on
44:42SPEAKERAndroid, but what's a good way to keep data on. And yeah,
44:45SPEAKERthis probably is more iPhone centric,
44:46SPEAKERbut like I'm trying to think of a way to put data on an iPhone where it is that
44:49SPEAKERdata is not also immediately reflected in some kind of cloud service.
44:52SPEAKERAnd I can't immediately think of, I guess you could type it into like a notes.
44:56SPEAKERWell, it's still going to get backed up to iCloud. Yeah.
44:58SPEAKERLike I'm trying to think of a way to put information just on a phone and only on
45:02SPEAKERthat phone. You can buy an, there's apps that will encrypt notes for you. Okay.
45:06SPEAKERUm, but like the place to start is to dump into your Dropbox,
45:11SPEAKERa folder that has all of your two factor recovery codes. Um,
45:16SPEAKERthe followup,
45:16SPEAKERthe second best thing to do is to take those files and print them and put them
45:20SPEAKERin, um, in, in your, uh, fire safe. Okay.
45:25SPEAKERAnd then also you want to save things like your windows key, right?
45:27SPEAKERLike if you have a windows key that you use when you restore,
45:30SPEAKERthat's a good place to put that stuff too. So.
45:32SPEAKERAnd it seems like modern password managers are pretty good about letting you put
45:35SPEAKERthings that are not passwords in there.
45:36SPEAKERYou can just create like sort of notes entries there,
45:38SPEAKERbut then more stuff like that in there too.
45:40SPEAKERBut then when we talk about the audit thing,
45:41SPEAKERpart of the process is thinking about, okay,
45:44SPEAKERso what happens if my recovery passwords are on my Dropbox?
45:47SPEAKERHow do I get into my Dropbox? If I don't have my,
45:49SPEAKERif my phone and my computers are gone. Right. Right. So then you have to,
45:53SPEAKERyou can either share it with a family member or like, like one password.
45:57SPEAKERWhen you have a one password family account, I was able to say, okay,
46:00SPEAKERmy wife is able to access this in case of an emergency and she'll,
46:04SPEAKERshe can do it,
46:05SPEAKERbut I'm going to get a notification says she's been digging around my password.
46:07SPEAKERSo it's like, it's literally a, this person is allowed to grant me new,
46:12SPEAKERregrant me access to my stuff in case something goes horribly wrong and I can't
46:16SPEAKERauthenticate myself.
46:17SPEAKERDoes this stuff ever feel like a full-time job to you? It's a lot of work.
46:21SPEAKERI mean, but it's, it's the kind of,
46:22SPEAKERit's like the free NAS server where it's a lot of work occasionally,
46:25SPEAKERlike very infrequently. And most of the time it's just like seamless.
46:29SPEAKERAnd in the background, yeah.
46:30SPEAKERI think my next step is to buy a YubiKey and start YubiKeying. Well,
46:34SPEAKERI don't know if I care that much. Is that a key chain thing?
46:37SPEAKERIt's a key chain thing probably on there. Yeah. Yeah.
46:39SPEAKERIt feels good to lock it down. It's like, it's a lot of work, like you said,
46:42SPEAKERbut it's just some nice peace of mind.
46:44SPEAKERIt's really nice not to have to remember passwords. Yeah.
46:46SPEAKERLike that is the big win out of this whole thing.
46:49SPEAKERAnd feeling like your stuff,
46:50SPEAKERlike your financial accounts are protected because yeah, it's just so,
46:53SPEAKERit's so much more connected than it was 20 years ago.
46:55SPEAKERWell, yeah.
46:56SPEAKERAnd the unfortunate thing is a lot of the banks still are using SMS for
46:58SPEAKERauthentication on stuff like that. Cause they're not on two factor. Yeah.
47:01SPEAKERI've got a credit card that does not allow like any kind of moderate two factor.
47:05SPEAKERAnd I'm like, what? You're a giant fucking financial organization.
47:09SPEAKERLike get your shit together. Yeah. Yeah. Well, they're really good internally,
47:12SPEAKERbut really bad externally. Yeah. Who knew? No surprise.
47:16SPEAKERIf you enjoyed the show or you have, I mean,
47:18SPEAKERI'm sure we made mistakes on this cause this is really complicated. And,
47:21SPEAKERand we are at best dilettantes. I am at best a dilettante on this.
47:25SPEAKERSo we would love to hear thoughts. We'll talk about it on our next Q and a
47:28SPEAKERepisode. So send them to tech pod@content.town or hit us on Twitter at
47:32SPEAKERsweatpants tech pod, or I'm Will Smith on Twitter. Yes, I am @bradshirmaker.
47:37SPEAKERAnd if you like the podcast, leave a review on iTunes, tell your friends,
47:40SPEAKERwe love to hear people telling their friends about us. Spread the good word.
47:43SPEAKERYeah. Or if you don't like us, you know, leave an iTunes review and we read
47:46SPEAKERthose too. Either way, get up on your rooftop and yell about it.
47:49SPEAKERAnd we've been talking about people have asked us about stuff like a user
47:53SPEAKERsupport, a Patreon and stuff like that.
47:55SPEAKERAnd I think we're going to start working on that soon. Cause I'm like,
47:59SPEAKERit doesn't cost a ton of money, but it takes a fair amount of time.
48:01SPEAKERAnd it would be nice to, you know, to not have it,
48:05SPEAKERhave this be a positive expense rather than a negative expense. Sure.
48:08SPEAKERBlack instead of red. I can get behind that. Yeah. We'll see y'all next week.
48:12SPEAKERThanks for listening. Bye.
48:14SPEAKERThe show's over, but we'd still love to know how we're doing.
48:16SPEAKERLet us know@survey.content.town. We're not collecting demographics,
48:20SPEAKERyour personal information or anything insidious.
48:23SPEAKERWe just want to know what you do and don't like about the show.
48:26SPEAKERThe whole thing will take just a minute or two to fill out and will help us
48:28SPEAKERfigure out how we're doing for a limited time.
48:31SPEAKEREveryone who fills out the survey will get our undying affection.
48:35SPEAKERYou can't beat that. Again, the address is survey.content.town.
48:39SPEAKERThat's survey.content.town. Thanks.
48:43SPEAKERAnd we'll see you next week.