00:00SPEAKERHave you ever thought about, you know, what happened to the turbo button?
00:03SPEAKERNot especially recently, no. I mean, I'm not running a four point something megahertz computer anymore, but go on.
00:10SPEAKERSo we were talking about this on the full nerd a couple of weeks ago, and I realized I never had a computer with a turbo button.
00:18SPEAKERMine were always full speed. And then we went and did some research, you know, did our own research as it were.
00:24SPEAKERAnd we learned that the turbo button for most PC users was actually, the turbo speed was actually the native speed of the processor.
00:36SPEAKERAnd then when you turned off turbo mode, it slowed it down to like 8086 speed.
00:41SPEAKERWhich is the 4.77 megahertz, is that right?
00:45SPEAKERYeah, it was a lot. It's like you take a 25 megahertz 386 and crank it all the way down to 4 megahertz or 6 megahertz or something.
00:53SPEAKERYep, 4.77, in fact.
00:55SPEAKERBut the thing I've been thinking about, and I can't stop thinking about it, is I have this reset button on my computer.
01:02SPEAKEROh. Oh.
01:04SPEAKERAnd I would love to be able to switch my Ryzen from eco mode, like their default built in under volt, to light some shit on fire, let's go fast.
01:17SPEAKERYes.
01:18SPEAKERAnd that reset button's right there.
01:19SPEAKERIt's okay. Is that something you can do on the fly or does that require a reboot?
01:23SPEAKERIt does not require a reboot.
01:24SPEAKEROh, because I'm sure AMD software can do that, right?
01:27SPEAKERYou can do that with the unfortunately named Ryzen Master software.
01:31SPEAKERYeah.
01:31SPEAKERSame as you can do with the Intel Extreme Overclocker, except for Intel doesn't have machines that they do eco processor modes on because, you know, Intel.
01:39SPEAKEROkay, well now do they expose a hardware interface on the motherboard for changing the processor voltage or power cap then is the question.
01:47SPEAKERNo, this is the sad thing, but a lot of motherboards do have software configurability for the reset button now because a lot of cases don't have reset buttons anymore.
01:57SPEAKERSo often you'll have that, you can hook that up to something else.
02:00SPEAKERYeah.
02:01SPEAKERThere's also, you know, another trick, not to digress, another trick you can do with the reset button is wire it into the reset CMOS header.
02:08SPEAKERYeah.
02:08SPEAKERIf you don't need to hardware reset and frankly, it's a good idea to have a hard reset capability, although I guess you can always just flip the switch on your power supply.
02:16SPEAKERI don't know if that's bad or not.
02:18SPEAKERWait, doesn't your mother, yeah, you just long press the button too.
02:21SPEAKERIf you long press the power button, it'll, it'll restart the computer.
02:24SPEAKERSure, but, but, but especially if you're doing a lot of configuring that might mess up or, you know, where you might need to reboot and clear CMOS settings, you can wire that switch into that header if you just want to press the button to wipe your bios and start fresh.
02:36SPEAKERIt seems really high risk though.
02:38SPEAKERCause I sometimes like when I turn on the computer, I'm like, I'm just smashing buttons and then all of a sudden, boom.
02:42SPEAKERWait, what are you doing to your computer?
02:45SPEAKERWell, I don't look at it.
02:45SPEAKERI just reach down there and start whacking until it turns.
02:48SPEAKERI apply, I apply a single fingertip to a single power button and then we, then we get computing.
02:52SPEAKERWhat is going on there?
02:54SPEAKERIt's pretty far back there, but here's, doesn't your motherboard have the buttons on the backplane?
02:59SPEAKERThis one does.
02:59SPEAKERYes, yes.
03:00SPEAKERBut my previous one, the AMD board I had last year did not.
03:04SPEAKERI think most enthusiast-ish motherboards have that these days.
03:08SPEAKERSo this would be more for like entry mid-level motherboards, but this, that was a $500 motherboard I had last year that did not have that feature.
03:15SPEAKERInexplicably anyway, you were saying.
03:18SPEAKERSo anyway, what I really want though, and this is a bad idea, just to be clear, is I want a stream deck plugin that hooks into the Ryzen, again, the unfortunately named Ryzen master software that lets me shift modes by pressing a button on my stream deck.
03:33SPEAKEROh sure.
03:34SPEAKERYeah.
03:35SPEAKERCause why wouldn't you want that?
03:36SPEAKERWhy wouldn't you want that?
03:37SPEAKERIt could be green for eco and red for go fast.
03:40SPEAKERAnd like you can even slip on the PBO there.
03:43SPEAKERListen, okay. You can, you can put whatever you want on your stream deck or any other interface, but there is a requirement here you have to fulfill on top of that.
03:49SPEAKERYeah. What is that?
03:50SPEAKERYou have to install a proper old school, seven segment display on the front of the case that displays what the power consumption is at all times.
03:59SPEAKERLike fucking computers have never been as cool as when they had, had those little, um, what is the, what is the name for that type of screen?
04:07SPEAKERThey're not LEDs, it's like VFD or something.
04:09SPEAKERIt's a VFD or, or, uh, did I, did I, did I tell you?
04:14SPEAKERWhat's that?
04:15SPEAKERSpeaking of these kinds of displays, we have the same receiver, don't we? That Sony from like 10 years ago.
04:20SPEAKERYes. I have a, it's a STR DN 840 I want to say.
04:24SPEAKERThat's, that's the one. Yeah.
04:26SPEAKERSo it has one of those displays, one of those, it's like a string of, it's like a gas one, gas version of that.
04:31SPEAKERYeah. It's got the little seven segment numbers. I just looked it up.
04:33SPEAKERIt is the VFD vacuum fluorescent display is in fact the name of the type of screen on old VCRs and receivers and stuff.
04:40SPEAKERYeah. So here's the, here's what is exciting for me. That screen doesn't work on my receiver anymore.
04:45SPEAKEROh, oh, the same thing happened to me. Actually, it turns out, how'd you fix it?
04:49SPEAKERI took it to a repair shop about five years ago and paid upwards of a hundred bucks.
04:54SPEAKERWhat did they just solder a new one in?
04:56SPEAKERI don't know what they did, but they fixed it.
04:57SPEAKERHuh?
04:58SPEAKERBut anyway, I've gotten another five years out of that receiver. So I figured I decided it was worth it.
05:02SPEAKERHuh? A hundred bucks is right at the line at which I would not pay that, but also I would do the soldering, I think.
05:09SPEAKERYeah, you could. Yeah. I just, I, I wasn't sure I could reliably find the problem, but that, wow, that must be a common manufacturing defect on that thing.
05:18SPEAKERWell, so, I mean, it's like 10 years old. It's at the edge of what I would expect is like a legal time to have that receiver work.
05:25SPEAKERBut I was like, most of the time we use the HDMI CEC stuff.
05:30SPEAKERSo it's not been an issue because I don't ever see the screen.
05:35SPEAKERI just hit the Apple TV, but it switches to the Apple TV and put it turns on. I don't need to look at it.
05:39SPEAKERSame thing for the consoles, but the Steam Deck doesn't support CEC right now.
05:45SPEAKERSo when my daughter wanted to play teardown on the TV and I was like, well, just plug the Steam Deck and you can play, it didn't switch the receiver input automatically.
05:53SPEAKERAnd as a result, I opened up the thing and was like, wait, it was on for a second there when I turned the receiver on and then it immediately goes away.
06:01SPEAKERAnd I had to turn the knob. It has a little knob with notches one at a time until I heard the sounds of teardown coming out of the TV.
06:11SPEAKERAnd yeah, it wasn't a great experience, I'm going to say, but also apparently that's coming in the next major revision of the Steam Deck OS.
06:18SPEAKERSo I might just try to hold, hold out another couple of weeks and see, see if we get there.
06:22SPEAKERBut if you harvest that screen off your receiver and try to do something fun with it, like put it on the front of your computer, that's an interesting idea.
06:52SPEAKERWelcome to Brad and Will Made a Tech Pod, I'm Will.
07:02SPEAKERI'm Brad.
07:04SPEAKERThat was a pregnant pause.
07:05SPEAKERI had a real brain fart there for a second.
07:07SPEAKERWow, Brad, I mean, it's been a long week, it is Friday afternoon when we're recording this.
07:12SPEAKERIt is late, it's like end of day on a Friday.
07:13SPEAKERThis is not the best time cognitively to do a podcast.
07:17SPEAKERFor some reason, when you said I'm Will, my brain interpreted that as you saying my name.
07:21SPEAKERWell, I mean, look, next week I'm going to I'll hit you with that I'm Brad and see if you see if you react.
07:27SPEAKERBut I genuinely paused and was like, did he just say I'm Brad?
07:30SPEAKERDo I need to call him on this or should I just keep going?
07:32SPEAKERAlso, I was staring at this vacuum fluorescent display page.
07:35SPEAKERThey're pretty good.
07:36SPEAKERAnd I kind of just want to talk about VFD displays now.
07:39SPEAKERI had I had a my favorite one of those of all time was on a Logitech.
07:44SPEAKERIt wasn't a Logitech when I bought it, but a squeeze box, which was that one of the first MP3 streaming boxes.
07:51SPEAKERAnd it just had a screen that had like your ID3 tag info on it, your title of the song and the artist would scroll.
07:56SPEAKERIt was a real good scroll.
07:59SPEAKERAnd it was like it was it was a pleasant light blue color.
08:04SPEAKERLike it wasn't like the blue of a blue led that just kind of digs deep into your soul and makes you want to murder somebody.
08:10SPEAKERIt's like it's like pleasantly bright, like it's bright, but not eye searingly.
08:13SPEAKERSo it's it's it's kind of like a washed out teal color sort of.
08:17SPEAKERYeah, it's like a warm blue almost, which I know is a contradiction.
08:21SPEAKERBut like anyway, it was good.
08:23SPEAKERI like those I like those displays.
08:25SPEAKERWe need more of those.
08:26SPEAKERThey look rad.
08:26SPEAKERThe other thing the other thing you could do is just jam a couple of nixie tubes on the top.
08:30SPEAKEROh, yeah.
08:31SPEAKERJust poke those out of the top of the case.
08:33SPEAKEROh, I've got a I've got a nixie clock.
08:35SPEAKERI don't know if it was gifted by a very, very generous fan of the show or fan of next.
08:43SPEAKERI believe they were on the next line or discord.
08:45SPEAKERI can't remember they may have also listened to this show.
08:48SPEAKERI love it.
08:48SPEAKERIt's one of the coolest looking things I have.
08:50SPEAKERI don't know if this is a long standing project.
08:53SPEAKERI don't mean to derail the podcast with this.
08:55SPEAKERIt's got it's got a pair of mutually reinforcing issues with it that are maybe the most maddening thing I've ever dealt with.
09:02SPEAKEROK, and I've actually been thinking for ages about I took it apart and just looked at the circuit boards.
09:07SPEAKERI've been thinking about going in the maker channel on Discord for a long time and just posting photos and saying, hey, here are the here's the trouble I'm having with this.
09:14SPEAKERHow repairable do you think this is?
09:15SPEAKERBecause it was made in Ukraine.
09:17SPEAKERThe small boutique manufacturer that made it, I don't think, exists anymore for a variety of reasons.
09:23SPEAKERThat sucks.
09:24SPEAKERSo it's not like I can just like go get it repaired necessarily unless maybe I found somebody around here.
09:28SPEAKERBut, OK, A, the clock is insanely fast.
09:31SPEAKEROh, like like the time it doesn't get a good time.
09:34SPEAKERIt gains like probably five minutes a month, at least.
09:38SPEAKERThat's a lot.
09:39SPEAKERIt's a lot.
09:39SPEAKERYeah, mechanical watch territory there.
09:41SPEAKERSo like you have to you have to set it every two weeks or whatever to keep it reasonable.
09:46SPEAKERYeah.
09:47SPEAKERThe other thing is so it's got two buttons on it.
09:49SPEAKERIt's got like change mode and then modify mode.
09:52SPEAKERYou know what I mean?
09:53SPEAKERIt's like you hit like you hit the one button to say, OK, now I'm changing seconds.
09:57SPEAKERNow I'm changing minutes, hours.
10:00SPEAKERAnd then the other button is is increment the thing, right?
10:03SPEAKERIt's like hit it twice to go to minutes and then hit the thing on minutes until you get to the minute you want.
10:07SPEAKERLet me see if I can explain this correctly.
10:09SPEAKERHitting the increment button also now is triggering the change mode button.
10:13SPEAKERSo oh, so if I go to minutes and I want to increment the minutes a few times after two or three presses,
10:20SPEAKERit will then change the mode to hours and now hours have gotten bumped up two or three times.
10:24SPEAKERI bet there's a there's a ground somewhere that's jumped or something.
10:28SPEAKERThat's exactly it.
10:29SPEAKERThere's just some electrical connection in there where like some something's touching the one button is triggering the other button.
10:35SPEAKERBut it makes it and there's a cascading effect.
10:38SPEAKERI wish I had a video of me raging, trying to set the time on this thing because this is this seems like the kind of thing that's designed to make you absolutely go crazy.
10:46SPEAKERIt is like it is absolutely custom engineered to make a person lose their mind because there's all kinds of settings on there for brightness of the tubes,
10:53SPEAKERwhether the little blue backlight works or not, like how they how they blink, how they increment, like all kinds of stuff.
10:58SPEAKERAnd I haven't said exactly like I like it again.
11:00SPEAKERI love this thing. It's amazing.
11:02SPEAKERBut there's a cascade effect every time you start trying to just change the minutes because the minutes are the thing you need to change.
11:08SPEAKEROne o'clock is fast.
11:09SPEAKERBut the minutes are at the very beginning of the chain of then hours, then dates, then blink pattern, then brightness, then backlight.
11:17SPEAKERAnd every single one of those gets thrown off when I try to change them because it cascades from one mode to the next, throwing all of those settings off.
11:26SPEAKERAnd it takes like 20 minutes to change the time and get everything back to where I want it.
11:30SPEAKERAnd again, I love that thing so much.
11:31SPEAKERI would like to fix it. I just lack the electrical know how to do so.
11:36SPEAKERI bet somebody in the maker channel could could help you figure it out.
11:39SPEAKERYeah, I would I would love to get that thing repaired and back to full working order because it looks so cool.
11:43SPEAKERI I was while we were while we were between the cold open and now I went and looked at at like the voltage current meters that you can wrap around the power cable coming out of the back of the PC.
11:57SPEAKERSo I was like, I could make a screen that has the wattage that's being taken by the PC at any given moment.
12:03SPEAKERBut then I was like, I don't think I want that information.
12:05SPEAKERBut do you know what information I do want, Brad?
12:08SPEAKERSorry, I apologize for derailing so much of this podcast.
12:12SPEAKERWhat information do you want?
12:13SPEAKERI want to make sure that my voter registration is up to date because we're coming up on an election here in the United States in early November.
12:22SPEAKERSo we have about two months from the time you hear this little bit more than that.
12:26SPEAKERBut you can go to vote for one one dot org, which is a site run by the League of Women Voters that helps you figure out how to check your voter registration, regardless of which state you live in in the United States.
12:40SPEAKERSee if you're allowed to vote, see if you're registered to vote, see if your registration is still good.
12:44SPEAKERAnd again, it's vote for one one dot org.
12:46SPEAKERAnd we would ask you to go do that now if you live in the United States.
12:50SPEAKERWeirdly, for depending on where you live, for any number of reasons, it might be fairly urgent that you go check and see if you're still allowed to vote or not.
12:58SPEAKERYeah, there's a lot of there's a lot of shenanigans happening right now.
13:02SPEAKERSo make sure you're registered to vote.
13:04SPEAKERAnyway, that's it.
13:04SPEAKERYeah.
13:06SPEAKERBrad, this week we're going to talk.
13:07SPEAKERWell, we got a twofer for you today.
13:10SPEAKERMaybe.
13:11SPEAKERMaybe a threefer.
13:12SPEAKERAre we going to make this decision on the fly?
13:14SPEAKERWe were going to do a twofer and then we were like, one of these might take up most of the episode.
13:18SPEAKERI think both of these could be a full up.
13:20SPEAKERWe thought these were both going to be smalls and then they ended up being bigs.
13:25SPEAKERBut I think I think let's rerecord this intro if it ends up being a twofer maybe and instead of a threefer.
13:31SPEAKERAnd sometimes I think it's fun to just pull the curtain back and let people see how the sausage is made a little bit.
13:36SPEAKERLook, that's fine, too.
13:37SPEAKERSo let's see to let people see how the boar's head ham is sliced.
13:40SPEAKERNope, don't.
13:40SPEAKERNo, no, don't want to go in the meat coated room.
13:45SPEAKERDon't read that article if you like cold cuts, by the way.
13:47SPEAKERI'm going to straight up stop buying deli meat.
13:51SPEAKERLook, I there was a period of another digression.
13:54SPEAKERI used to buy turkey breasts all the all the time and I would like roast them myself and then I have a slicer and I would slice them myself and then I would have my own cold cuts.
14:05SPEAKERIt was delicious.
14:06SPEAKERI think that is the way to go.
14:08SPEAKERYeah, it was a lot of work.
14:10SPEAKERYeah, I believe that.
14:11SPEAKERAlso making things like pastrami and corned beef pretty challenging.
14:14SPEAKERYeah, I wouldn't do that.
14:15SPEAKERBut, you know, like a rotisserie chicken or, you know, you can make sandwiches out of non cured deli meat eat.
14:20SPEAKERYeah, but what if you like the cured?
14:22SPEAKERAnyway, I love it, but it's, you know, there's maybe multiple reasons now it's not the best for you anyway.
14:27SPEAKERSo we're going to start this potential trifecta of topics with a little thing that we've been talking about for a while now called pesky's.
14:36SPEAKERYes, quite a while.
14:39SPEAKERQuite a while was it was a last year sometime that this started becoming the hotness and authentication.
14:45SPEAKERYeah, they've been they've been on the rise for a while.
14:48SPEAKERThey people are and by people, I mean Apple, Google, Microsoft, your password manager companies are all kind of pitching them as the arbiters of authentication.
15:00SPEAKERYeah, this is the most alliterative intro we've ever done.
15:05SPEAKERThey were pitching these as, hey, we've got this new thing.
15:08SPEAKERIt's like a password, but it's better for you to log into your to your places.
15:14SPEAKERIt depends what what what pesky's are is they're they're passed without and that's exactly what they're they're password replacements that work using Fido standards.
15:25SPEAKERAnd those are the standards that are used in a bunch of like hardware tokens that your job may make you use to sign into your work and work corporate accounts and stuff like that.
15:34SPEAKERYeah, I have I have to look up Fido fast identity online.
15:36SPEAKERI had never I think I've seen the term before, but I didn't realize it's should I read the AI overview?
15:43SPEAKERNo, don't give the machine it's do we test them an open standard for for authentication that uses public key cryptography to replace passwords with more secure logins?
15:53SPEAKERThat sounds like what I know Fido to be.
15:55SPEAKERThat's what that's what Fido is.
15:57SPEAKERSo Fido, for example, like YubiKeys, which are the I think of them as the kind of de facto hardware token.
16:04SPEAKERFido, too, is one of the one of the standards that they support.
16:07SPEAKERRight. I guess the key there that I didn't realize, at least as the Fido is an open standard that is consistent across devices and login methods.
16:16SPEAKERYeah. So and and passkeys use Fido, the Fido standards to do this.
16:21SPEAKERThe gist is and this is a this is a little bit of a simplification.
16:25SPEAKERWe don't need to get into the cryptographic weeds, but when you sign up for a site, the site creates a crypto your device rather creates a cryptographic key pair,
16:34SPEAKERmeaning a private and a public key that's bound to that Web service domain.
16:40SPEAKERSo say I'm going to Twitch TV and I need to create a passkey for Twitch.
16:46SPEAKERIt says Will's email address is will@techpod.content.town.
16:51SPEAKERAnd we're going to make a key pair that is that is attached for will@techpod.content.town that's bound to this Web service domain, twitch.tv.
17:02SPEAKERPerfect. Yeah. Your device registers the public side of that key pair with the service and then it keeps the private key.
17:09SPEAKERThis is just like everything from like PGP on how to key how how cryptographic key pairs have worked for all eternity.
17:18SPEAKERThe math is different, but the idea is the same.
17:20SPEAKERYeah. And the idea there, gosh, so I've got a fair amount of experience with this using SSH key pairs.
17:26SPEAKERBut God help me if I try to explain how it works and get something wrong.
17:30SPEAKERPeople will yell at you, Brad. The basic idea, as I understand it, is the public key exactly as it sounds is public.
17:36SPEAKERLike you can put that on your you can put it on, you can sky write it, you know, you can drag it behind an airplane if you want.
17:43SPEAKERThe whole idea is that part is public and the private key.
17:46SPEAKERWhen you authenticate with the private key, you are not providing the private key to the remote endpoint.
17:51SPEAKERYou are cryptographically proving that you have it, I believe is how the the math, the cryptography works out there,
17:58SPEAKERis that you're providing a response that does not contain the private key,
18:01SPEAKERbut you're providing a token that is generated by signing the public key with the private key.
18:05SPEAKERRight. Right. So you can you're essentially proving that you have the valid private key without actually having to expose the private key.
18:11SPEAKERYes. So so when you do this, when you create this account on the site, that thing is the past key, that private key public key pair is the past key.
18:19SPEAKEREach one is inherently unique and it establishes a two way relationship between you and the site service you're using for authentication.
18:26SPEAKERSo if you think about when you go to Twitch.TV and you type in your username and password, that's a one way authentication, right?
18:33SPEAKERYou know, Twitch knows that that's you because you have some information and you have some private information.
18:39SPEAKERBut you don't actually know that that's Twitch.TV unless you're really careful and you always check the URL and stuff like that.
18:45SPEAKERSomebody could make Twatch.TV or Twatch, well I capitalized, but I'm trying to think how would you make a point.
18:54SPEAKERIt doesn't matter. The point is they can make a website that looks just like Twitch, send you an email that says, hey, you need to sign into your Twitch account.
19:00SPEAKERYou click the link in the thing, you put your username and password in, and then all of a sudden they have your username and password for Twitch and Twitch thinks that they're you.
19:07SPEAKERRight. This is this is the basis of like of every phishing attack ever or not every, but there's this is this is how phishing attacks work.
19:15SPEAKERIt's a common vector. Common vector. So when you try to log on to a site that doesn't have your public key, the past key is not going to work.
19:22SPEAKERIt's going to say, hey, man, these people don't know you. And because that public key, private key pair is site specific, no one else should have that public key pair.
19:31SPEAKERNow, if Twitch has a problem and their store of the public keys gets corrupted or gets attacked somehow and they lose access to those,
19:41SPEAKERA, they've probably done something wrong in the configuration end of their past key implementation, but B, you're going to have to make a new past key the next time you log in, which is fine.
19:52SPEAKERThis is this is why this is why Microsoft and Apple and Google and all the big providers are saying, hey, this is more secure.
19:59SPEAKERIt also means you don't have anything you have to remember because this key pair is stored on your device.
20:04SPEAKERWhether it's your Windows machine or your Mac or your iPhone or your Google, Android or whatever.
20:10SPEAKERYeah, and that's how people use it in the like in the kind of open source terminal Linux world.
20:15SPEAKERWhen you're SSHing with these things, most people just don't use a password there.
20:18SPEAKERLike they literally just sort of click or type the connection and they just go like, yeah, like it fully replaces any kind of active authentication.
20:25SPEAKERI think in the case of past keys, which you're about to describe, it's more secure than that.
20:29SPEAKERLike they're not they're not saying, hey, you should just be able to open a website on any device and just get into it with zero friction.
20:35SPEAKERLike like you still need to access the past key with some off.
20:38SPEAKERYeah. And I think the assumption on, for example, the SSH example that you used is that if you're a Linux sysadmin, your login to your Linux machine should be secure and you should lock it when you're not there.
20:52SPEAKERBut that's trusting the user to do the smart thing. This doesn't trust the user to do the smart thing.
20:57SPEAKERThis requires some sort of local authentication.
21:01SPEAKERSo, for example, if your past key is stored on your phone, it's going to ask you for a face or a finger biometric swipe.
21:08SPEAKERIt might ask for the passcode or if you're using, say, a hardware FIDO key token, which you can also use as a passkey, it will ask you to touch the physical device to make sure that you have it.
21:20SPEAKERActually, I don't understand why the FIDO key touch is a safe thing.
21:25SPEAKERIt seems like anybody could do that. But whatever. You have to have the physical key, which presumably you should keep safe.
21:30SPEAKERRight. You don't have to remember anything to log in.
21:34SPEAKERThis isn't two-factor authentication. Two-factor authentication is that you know something and you bring something, and that something is a machine that generates numbers in a predictable way.
21:47SPEAKERYou just have to have this passkey, and the passkey is on one of your devices.
21:54SPEAKERNow, it does mean that it's important that you keep the device with the passkeys pretty locked down.
21:59SPEAKERIf your passkey, if your phone's password is 11111 and somebody steals your phone, then they probably are going to be able to get access to all your passkeys pretty easily, right?
22:09SPEAKERYes. How do you deal with a lot of PIN numbers across various devices and services?
22:16SPEAKERLike, I've got a pretty good memory. I remember a lot of passwords.
22:19SPEAKERLike, I know all my bank account and credit card numbers. Like, I know a lot of numbers, but for whatever reason, I think I've just hit saturation on PIN numbers.
22:27SPEAKERSorry, PINs. Somebody's going to call out the redundancy on PIN number. Anyway, you know what I mean?
22:33SPEAKERLike, I have to stop myself from just using the same PIN on, like, my iPhone, my authenticator, my signal, anything that wants a PIN.
22:41SPEAKERI have to force myself to come up with another PIN because I just don't want to keep remembering PINs.
22:44SPEAKERI'm really uncomfortable with this conversation. Brad would like to move on.
22:47SPEAKERAll right.
22:49SPEAKERI use the same one everywhere.
22:50SPEAKERYeah. I mean, like I said, it's a struggle. Nobody knows your PIN. You're probably fine.
22:56SPEAKERIt's long, but yeah, I use the same one everywhere.
22:59SPEAKERLike, listen, I get the reluctance to talk about stuff like that in public, but consider it a public service announcement for people to know that they shouldn't do that.
23:08SPEAKERB, let it motivate you to go change your own behavior.
23:11SPEAKERWell, so the interesting thing I was going to say is that I actually don't have that many PINs anymore.
23:15SPEAKERYeah, it's not that many.
23:17SPEAKERI don't really use an ATM anymore, ever. I don't. My Windows, I have a Windows PIN and then I have a Windows PIN, a different one for like shared computers that my, so that like my daughter and wife have one that they can log into.
23:31SPEAKERBut the one that's my main computer, my main laptop has a different PIN on it.
23:35SPEAKERAnd then my phone uses the, the, like I have, I have the serious PIN and the non-serious PIN, I guess.
23:42SPEAKERAnd the serious PIN is the same everywhere.
23:44SPEAKERYeah. I mean, I guess in fairness, we just named basically every PIN number I have.
23:48SPEAKERIt's like phone, ATM, like Signal and WhatsApp use them.
23:51SPEAKERMy two factor authentication app uses one and that's kind of it, but still.
23:55SPEAKEROh, I don't use a PIN for my two factor authentication app.
23:59SPEAKERI, that's all in one password, so I just use the big long one password passphrase for that.
24:04SPEAKERSure.
24:05SPEAKERAnd then my hardware keys do have a hardware PIN, but they get the, they get the serious one.
24:10SPEAKERSure. The authenticator app I just moved to requires a PIN, but we'll get to that.
24:14SPEAKERWe'll talk to that and then we'll talk about that in a minute.
24:18SPEAKERSo, okay. So the big benefit is you don't have to remember anything.
24:20SPEAKERThis is, this is great, especially for people who don't like passwords.
24:23SPEAKERIt's pretty easy to use.
24:24SPEAKERThe bad news is if you lose your phone, you lose access to your phone, that information's gone.
24:29SPEAKERThis is why if you set up pass keys, it's probably really important to make sure that you have your recovery information on those accounts set up properly.
24:36SPEAKERSo if you have to do the forgot password dance, you, you have that option.
24:41SPEAKERIt also means that just like when you're setting up two factor, it is vitally important that you save the recovery codes and you put them someplace that's safe.
24:48SPEAKEREither in a password manager, worst case, chuck them in a folder in Dropbox or OneDrive or something like that.
24:54SPEAKERJust put them someplace where you can get to them and where they'll be reasonably safe.
25:01SPEAKERThe other thing to know is that typically pass keys, the reason, one of the reasons Microsoft and Google and Apple and everybody are trying to get you to sign up for pass keys is that they are a retention mechanism.
25:13SPEAKERI think for they make it more difficult to switch away from their products because if all of your passwords are stored in your Microsoft cloud account, it's going to be harder for you to switch to Mac or Google or whatever.
25:25SPEAKERShould, should you get such a desire to do so?
25:29SPEAKERYeah, and to be clear, it's not because it's especially difficult, more just because it's laborious, right?
25:33SPEAKERI mean, it's a fair amount of work as I just touched on as I'm switching authenticator apps.
25:37SPEAKERI know from experience, it's, it's a fair amount of work to change all these accounts over.
25:41SPEAKERBut what you're saying is it's not impossible, right?
25:43SPEAKERIt's not like they are truly locking you in.
25:45SPEAKERIt's more just they're relying on those people not wanting to put the work in to make all those changes.
25:50SPEAKERI honestly, I don't think it's an intentional, I don't think it's an intentional, hey, we can get them on the pass keys and we'll have them forever kind of thing.
25:57SPEAKERI think it's just like one more thing in the, in the list of a million things that makes it harder to change platforms.
26:03SPEAKERTo that end, when you're setting up pass keys in the, at the beginning, it's important to think about how and where you're going to use them.
26:11SPEAKERSo, for example, you probably don't want to set up all your pass keys exclusively on your Windows desktop PC because that's not a device you're going to have with you all the time.
26:23SPEAKERRight? The, the device that you, if you're, likewise, you may not want to put them on your phone because then you're tied to that phone forever and ever.
26:33SPEAKERThis is, this is why it's just for the same reason I like password managers for saving your passwords and your two factor authentication stuff.
26:40SPEAKERI like putting the pass keys in the password manager.
26:43SPEAKERMost of the big password managers support pass keys now, like 1Password and Bitwarden and I didn't look at LastPass because probably don't use LastPass.
26:51SPEAKERBut anyway, those provide a multi-platform solution because they provide clients that will transfer the pass key, you know, bring the pass key to different platforms, regardless of, of your device.
27:05SPEAKERAnd then for example, if you're on Windows, you don't have a biometric tag, you'll type your Windows hello pin to unlock them, stuff like that.
27:11SPEAKERRight. Real quick before we move on, are you able to just like walk me through what a typical login process looks like?
27:17SPEAKERIs it, is it similar to the types of authentic, like the old Blizzard authenticator or the steam app where you try to log in and then you get a notification on your phone?
27:25SPEAKERLike, does it actively ping you saying like, Hey, you've got a login requests you need to authenticate here?
27:30SPEAKERSo I store mine in 1Password and when I get it, it just says, Hey, this site wants to log in with a pass key, do you want to do it?
27:37SPEAKERAnd then you authenticate with Windows hello for 1Password or your face on the phone and it just signs you in.
27:43SPEAKEROkay.
27:43SPEAKERLike there's, it's really easy.
27:46SPEAKERYeah. That's okay. That's exactly how like steam and the old Blizzard one work.
27:50SPEAKERYeah. It's, it's, I would say it's one step easier than the steam because with steam, you don't have to do, um, I guess I always use the QR code login for steam these days.
28:00SPEAKERI don't do the old steam cart style one anymore.
28:03SPEAKERUm, but, but it works.
28:04SPEAKERIt's, it's not even as involved as say the Microsoft authenticator thing where it's like, Hey, which number is on your screen?
28:11SPEAKERYou have to pick the right one.
28:13SPEAKERYeah.
28:13SPEAKERUm, the, now, if you are trying to log in to a device that you have to an account that you have secured with the pass key on a device that doesn't have that pass key, which happens, right?
28:25SPEAKERYou, you, so if, if you say you're using a device that doesn't have a pass, the pass key for the site that you're trying to use on it, right.
28:34SPEAKERAnd the, but the pass keys on your phone, how do you, how do you access that?
28:37SPEAKERYou, you hit a button that says, Hey, the pass keys on another device, and it pops up a QR code and you aim your phone's camera at the QR code.
28:45SPEAKERAnd then it opens up your password manager or your, your devices pass key, uh, uh, in the, in the, in the chain, in the security chain.
28:57SPEAKERAnd it says, do you want to log in here?
28:59SPEAKERAnd you say, yes.
29:00SPEAKERAnd then it face IDs you and you, and you log in.
29:02SPEAKERThis is why I think the phone and ideally the phone with the password manager is the right place to put, to save these.
29:08SPEAKERSo then, then they're more readily.
29:10SPEAKERCause if you do that, then you open up, you have your password manager on your PC and you're, you don't have to open the phone to, to do the login and all that stuff.
29:17SPEAKERYeah, yeah.
29:18SPEAKERAnd then as far as, as far as, um, all of your pass keys being centralized on a device that is small and somewhat easily lost or stolen, if somebody gets ahold of your phone, you are just, at that point, you're just relying on your standard authentication on the phone, like biometrics or whatever.
29:32SPEAKERTo not let them get in.
29:33SPEAKERYeah, that's it.
29:35SPEAKERCause if you were not for those types of authentication, they could just want to leave, log into all of your sites.
29:40SPEAKERRight.
29:41SPEAKERWell, I think, I think for most people, the phone is probably their most secure device.
29:45SPEAKERYeah, that's fair.
29:46SPEAKERUm, I, by, by default, both Google and Apple encourage people to put passcodes and use the face login and the finger touch ID and stuff like that.
29:55SPEAKERYeah.
29:56SPEAKERSo, um, so yeah, so I guess what, what's the best practices, right?
29:59SPEAKERThe best practice is I think you want to probably store all of your pass keys on one device, like as a, as a matter of course.
30:05SPEAKERUm, my first choice would be to pay one password or sign up for Bitwarden or something and, and use the same, use a password manager to keep all of your pass keys synced up across all of your devices.
30:19SPEAKERUm, if you don't want to use a password manager, which I, I, I know people, some people feel that way, I would use the phone for your pass keys and know that when you change phones, you'll probably have to, uh, uh, probably, probably have to change.
30:34SPEAKERIf you want to, sorry, not when you upgrade hardware, but when, if you want to change from say Android to iOS or iOS to Android, you'll have to reset up all of your logins for all of the devices, all of the accounts that use pass keys.
30:45SPEAKERYeah, there's not like some standardized export from one to the other.
30:48SPEAKERThere might be, but I, it feels hinky right now.
30:53SPEAKERThat is an example of something the vendors absolutely would not want to implement because that would make it a lot easier for you to jump ship to the other side.
30:59SPEAKERI mean, it's, it's when I, when I tried to figure out how to do that, I couldn't find clear instructions and I spent a fair amount of time reading about it.
31:08SPEAKERUm, the, the, yeah, and then when you log, once you log in once you can check the box that says, Hey, don't make me log in again. And then you're subject to the rules on whatever site you're using about how long, you know, like a Google accounts for your domain, a Google account will every two weeks prompt you to put the passkey in again.
31:29SPEAKERUm, the other thing that's weird about this is pass keys. The other way to approach this is just to save the passkey on all of your devices. So you can do that as well. So once you log in.
31:40SPEAKEROh, interesting. I was, I was waiting to ask that question, but I just assumed the answer was no, that they would lock you out of that.
31:45SPEAKERUm, it seems like at least with the Google accounts that I've tried it on, when I logged in to say, for example, when I logged in with Firefox and I logged into Chrome to my, one of my Google accounts that uses a passkey it, I logged in with the phone.
32:00SPEAKERAnd then it said, Hey, do you want to save a passkey on this device? And at that point, it prompted me with the one password, uh, the, the, you know, the one password prompt to add a new passkey and it would have let me save another passkey for that same account.
32:14SPEAKERCause all you're doing is doing an authentication token that says, Hey, you're me. You're the, you're Will, you're Will Smith.
32:20SPEAKEROh, wait, I'm sorry. I'm sorry. We're talking about, I mean, I don't know how much insight you have into this. We're talking about cryptographically different key pairs on different devices that you're not talking about copying the same key pair to other devices.
32:31SPEAKERThat's what I thought they would disallow.
32:33SPEAKERI do not know what it was doing behind the scenes, but I know that it was offering to let me save a new, a passkey on this, on the device that did not have one.
32:41SPEAKEROkay. Um, the reason I ask is because with SSH key pairs, they're just files and you could literally just copy the same private key to as many machines as you want, which is probably a terrible idea.
32:53SPEAKERBut, but yeah, so I don't think, so if you think about it, the, the device that didn't have the, the passkey at the start there wouldn't have had access to the private key. So there's no way for it to, it has to be a new key, a new passkey.
33:07SPEAKERRight.
33:08SPEAKERSo all it's saying is you can have multiple passkeys the same way you could have multiple hardware key fobs that let you log into the same website. So you have a backup if you need one.
33:18SPEAKERSure.
33:19SPEAKERLike they don't seem bad if you use multiple browsers, if you're, if you're a non-standard, if you're not using the most default kind of version of computing, like if you use multiple browsers, you use multiple OSs, you use multiple phones, it gets more complicated.
33:33SPEAKERBut for, for like, if my parents were like, Hey, should I be using these passkey things? I'd say probably, yeah, just save them on your phone.
33:40SPEAKERYeah. And when you say, to be clear, when you say save on your phone, you're talking about whatever facility is built into the OS on your phone. Like what is it on iOS as a key chain?
33:48SPEAKERThere's the cloud key chain, cloud key chain, I think is what it's called on Android. There's a similar feature. I would not use the one that's built into your browser, although on Chrome, that probably ties into the Android key chain right on windows.
34:03SPEAKERThey want you to use the one that's built into windows. That seems like the least valuable thing in the world to me.
34:08SPEAKERHowever, if your option, if your, if your intent is to have multiple pass keys for one pass key for each device, that's probably fine.
34:19SPEAKERYeah, I guess so. I mean, if you were to want to use the windows key store, I assume they probably have an app for phones now.
34:26SPEAKERI'm sure they'll have an app for your phone. That's the last thing I want to install.
34:30SPEAKEROh yeah, yeah, no, I wouldn't either, but I just, if for whatever reason you really want to be based on windows, I'm sure they have some mobile solution since windows phone is no longer a thing. RIP.
34:41SPEAKERYeah. Never forget. Yes. So yeah, that's it. That's pass keys. If people have questions, I guess feel free to send them into techpot at content@town and we'll tackle them on the Q and A.
34:53SPEAKERYeah. Thank you for the explainer. I've wondered for a while what was up with pass keys. And then when I read through these notes, I was like, oh, it's just like SSH key pairs.
34:59SPEAKEROkay. Now I fully, well not fully, but I definitely basically understand what this is.
35:04SPEAKERWell, they sanded the rough edges off so that you don't have to have a text file with all of your cryptographic important stuff.
35:10SPEAKERI don't, I don't have to, I don't have to pick the algorithm that I'm generating my key pairs with, like don't use RSA anymore. What is it? ED25519 is the one now everybody likes.
35:19SPEAKERI just, most of my stuff's inside the firewall, so I don't do encryption on SSH, it's at the house.
35:25SPEAKERI know, I'm ultra paranoid. You were talking about paranoid, not only do I have SSH, not only do I have key pairs set up, I also still require a password.
35:34SPEAKEROh, wow.
35:35SPEAKERAlthough actually that was something that I should mention, not to talk too much about that specific context of the subject, but that is something you can do when you run SSH key gen to spit those keys out.
35:47SPEAKERYou have the option of giving the key pair a pass phrase.
35:50SPEAKERYeah.
35:51SPEAKERWhich is essentially a password to unlock the key pair.
35:53SPEAKERYeah.
35:54SPEAKERSo that's kind of exactly where like the biometrics would come in on your phone. It's the same thing of authenticating to authenticate with the key pair, basically.
36:01SPEAKERIt's exactly, it's exactly the same idea. Yeah. And I think the, so the, the big, the big, big takeaways, the TLDRs for this are still make sure you save your recovery keys, make sure you have email address.
36:15SPEAKERIf you, if you're somebody who's being attacked and are at risk of being phished, like a government person or something like that, you probably have smarter people than us telling you what to do.
36:26SPEAKERBut having a phone number attached to your, to your recovery stuff is often a bad idea because the phone is typically the, the easiest thing to get control of.
36:36SPEAKERYeah. Anyway, we, we did an episode talking about all that stuff years ago now, but yeah, I I'm happy to answer other questions about this. I think, I think it's an interesting topic.
36:46SPEAKERI think it's from what I was able to tell, I'm not a security person, but the, the, the general vibe on the security blogs that I read about this is that it's a good implementation that solves a lot of the problems, the two factor in that it's unwieldy and you have to have this thing that generates numbers for you.
37:03SPEAKERYeah.
37:04SPEAKERFor normal people.
37:05SPEAKERYeah. You're kind of winning me over with this. Like I'm starting to feel a little outdated with my setup, which we'll describe in a second. I was going to ask one more question.
37:13SPEAKERYeah. Hit me.
37:14SPEAKERMight be a dumb question. Also, I'm sure every service probably handles this differently. What happens to your password? You still technically have a password in their system, right? I assume even though you're not actively using it anymore.
37:24SPEAKERSo when I set it up on a personal Gmail, that's my locked down one. It kept the password. It kept the two back. No, the two factor stuff is gone now. So the password remains. The two factor is gone. The pass key is now how I log in with that account or hardware key is the backup.
37:46SPEAKERSo of what use is the password? If you now have to use this, I don't know. Let me see what, let me see if I can log in with the, with the password, right? We'll do forget it. Let's do it live.
37:55SPEAKERYeah. Well, while you're doing that, I'll just say like, it gets, it gets a little unwieldy with certain accounts. Like the Microsoft account, for example, is the one that comes to mind where, or I guess Google does the same thing.
38:05SPEAKERYou can just kind of list as many login methods as you want, you know, like they'll ask for your phone number. They'll ask for a password, they'll ask for a two factor app or an authenticator app. Now they'll do a pass key and like, you can kind of use any of those, right?
38:20SPEAKERYeah. To a certain extent, it depends. Like that's a security setting you can turn on or off on the Google side. I don't, I don't know about the Microsoft side. There's also concerns with Microsoft. Like I don't want to have to have this to sign into Microsoft accounts. Right. It's a, it's a pain in the butt.
38:34SPEAKERThey use their own authenticator for Microsoft accounts these days, which makes it a little bit easier.
38:39SPEAKEROh, you can, you can use whatever you want. I actually will get into that in a second. Like any, any standard, like QR code base, time-based one time password authenticator app will work with Microsoft account.
38:51SPEAKERSo when I look at my Google account that set up with pass keys, I have three pass keys that I can sign in with two hardware keys and then the phone. And then I have a password. I have a Google prompt that will log in.
39:05SPEAKERThey will pop up a Gmail prompt that says, Hey, you want to sign in on this device? And then, um, two step verification for phones, which I should probably turn off. That's scary. Anyway.
39:15SPEAKERYeah. So, so like when, when you're presented with the actual login prompt, you can say, it'll, it'll say, Hey, sign in with a, with a pass key or try another way.
39:25SPEAKERAnd when you try another way, it gives you the option of entering your password or using a pass key.
39:29SPEAKEROkay. Okay. So you can still use the fallback if necessary, but you could turn all that stuff off. I wonder, I wonder you get rid of the password. That seems high risk.
39:38SPEAKERYeah, maybe. So you're probably right. It's not what I don't think any of us are ready to let go of passwords all the way. Yeah. Yeah. Probably wrong. I'm not wrong.
39:46SPEAKERCan we talk about Aussie real quick? Cause this is, this is like, this is now the, I don't want to say legacy technology, but it feels like legacy technology to me.
39:55SPEAKERI just said it. I literally just said, I'm starting to feel obsolete after that conversation about my setup, which less than five years ago was like the bleeding edge recommended.
40:04SPEAKERI think you mean extinct, Brad. I'm still using an authenticator app, the type that has the 32nd, you know, timer and a six digit number that cycles every 30 seconds.
40:14SPEAKERAnd you have to provide that number before the timer and the change is over.
40:17SPEAKERDo you not put that in your password manager? No. First of all, I set it up ages ago. Yeah.
40:23SPEAKERI used the Google authenticator for a while and then I moved to Aussie some years ago and I'm guessing it might be because Twitch was requiring you to use Aussie for a long time.
40:31SPEAKERI have an Aussie account because Twitch required Aussie for partner accounts. Yeah.
40:36SPEAKERAnd those are, I just mentioned T O T P is the term you'll see, which we triple check that I've got that right is yes. Time, time-based one time password is, is the little six digit number that it's spitting out every 30 seconds.
40:47SPEAKERI thought it was top of the park.
40:48SPEAKERIt could be whatever you want it to be.
40:51SPEAKEROkay. But they had a, they had a breach, right?
40:53SPEAKERYes. They had a, they had an unsecured end point that allowed some hacker group to dump 33 million phone numbers because they require phone numbers.
41:05SPEAKERLike that's the thing. I don't think this is necessary or even standard for the other authenticator apps. They make you make an account, like you said, and they attach your phone number to that.
41:15SPEAKERAnd it's not super clear how much data they got along with those phone numbers that like identifies account or user information or pairs that with the phone numbers.
41:25SPEAKERThey didn't get private keys though, right?
41:27SPEAKERNo, they didn't get anything.
41:29SPEAKEROkay.
41:30SPEAKERAccording to Twilio, the company that now owns Aussie, reading from their statement here, while Aussie accounts are not compromised, threat actors may try to use the phone number associated with Aussie accounts for phishing and smishing attacks.
41:44SPEAKERYou know what smishing means?
41:45SPEAKERI don't. I'm not sure if I want to know what smishing means. Social engineering attack that uses fake mobile text messages. You trick people into downloading malware, sharing sensitive information.
41:56SPEAKEROh, that reminds me. I got a text from the US postal service that says that I have a package that I need to send them a message about, or I'm going to, it's going to be delayed.
42:05SPEAKERLucky you.
42:06SPEAKERThey sent me a text. It was weird. I wouldn't expect. And then the address is a Gmail that I'm supposed to respond to. So who knew? Weird.
42:12SPEAKERIs the security industry vernacular here that phishing is just emails and smishing is social media and text messages? Is that what we're doing?
42:20SPEAKERI guess SMS would be smish.
42:22SPEAKERYes. So does that mean phishing is just email?
42:26SPEAKERI think phishing is just email. Maybe that's e-phishing now.
42:30SPEAKERI don't know. Anyway, threat actors may try to use the phone number associated with Aussie accounts for phishing and smishing attacks. We encourage all Aussie users to stay diligent and have heightened awareness around the texts they are receiving.
42:40SPEAKERMy awareness is heightened.
42:42SPEAKERSo I'm not entirely clear what else was compromised along with those phone numbers, but at any rate, I decided to dump Aussie in the wake of this.
42:50SPEAKERI mean, now Twitch doesn't require Aussie anymore. You can just use a normal two factor account.
42:54SPEAKERSo, and I don't know how many other services ever even use this, but Twitch was doing direction integration with Aussie where you didn't have to use a TOTP.
43:02SPEAKERYeah.
43:03SPEAKERIt would just, it would do the thing of your phone would just say, Hey, you want to log into Twitch, press here.
43:07SPEAKERYeah.
43:08SPEAKERAnd it would go, but it kind of feels like your two factor authenticator should not have an account attached to it is my, is my feeling.
43:15SPEAKERLook, there's pros and cons. The benefit of having the two factor account attached to Aussie was that if you lost the device, it was easy to recover.
43:22SPEAKERYeah, sure.
43:23SPEAKERWhich I liked because some of the stuff that I had on my Aussie account is, would be hard to recover without access to a two factor authentication.
43:32SPEAKERYes. Well, so the authenticator app I've moved to, although now again, you've kind of made me think maybe I should just start doing pass keys.
43:38SPEAKEROf course, there's, there's also the concern. I didn't even think to ask you about this, that I'm sure plenty of services have not migrated.
43:44SPEAKERThere's a lot of, pass keys support yet.
43:47SPEAKERPass keys are mostly like big, big, giant companies. Like you're not, the number of places that support two factor that don't support pass keys is probably like 90% of the two factor.
43:58SPEAKERLike there's probably 10% of the existing two factor audience in my password manager supports pass keys at this point.
44:04SPEAKERMeanwhile, the fucking financial industry.
44:06SPEAKERLook, banks are complicated for reasons we don't need to get into here.
44:10SPEAKEROh my God. They, anyway, anyway.
44:12SPEAKERSteve from, from the bank is going to call you when it's time to log into your device.
44:16SPEAKERAnyway, given what you just said about a lot of services not supporting pass keys yet, you're probably still going to need a time-based authenticator app.
44:23SPEAKERSo I have moved to one called, I guess I'm pronouncing this too fast, too FAS.
44:29SPEAKERTwo factor is shit. Is that too crass?
44:32SPEAKERI like that. It's too FAS.com.
44:36SPEAKERBe funny if it was too, too FAF for what it's worth.
44:39SPEAKERSo the thing I was going to say about Authy, about you mentioning the Authy account advantage was that you could recover all the, you know, your codes if you lost your phone.
44:49SPEAKERSo this will do the same thing, but not by centralizing an account on their servers.
44:53SPEAKERIt will just upload some encrypted store to your iCloud account or the equivalent on Android.
44:59SPEAKEROh.
45:00SPEAKERSo it just uses your built-in like the iPhones or a built-in iCloud storage to back up all your stuff that way.
45:06SPEAKERAnd it's not a local thing, but it's not on their servers. It's just in your iCloud.
45:10SPEAKERSo if you lose the app, you can just pull it all back down that way.
45:14SPEAKERAnd this is free too, right?
45:15SPEAKERThis is free. I guess I'll say, and I actually looked up some, some like breakdowns on different websites of like what's the best current authenticator and like the, a lot of sites seem to like this one.
45:25SPEAKERThe biggest con I saw was like, it's not quite clear what their business model is, but the app is fully open source.
45:31SPEAKERLike the whole thing is hosted on GitHub. You can go look at all the code yourself if you want.
45:36SPEAKERBut I don't know currently what, what the, what this like company's whole deal is.
45:42SPEAKERI wonder if they're selling into corporate environments.
45:46SPEAKERThat's possible. This, this, but this seemed like the, this seemed like the most recommended and open authenticator app I could find.
45:53SPEAKERIt's very straightforward, but like you said, it's a lot of work moving all these accounts over.
45:59SPEAKERLike I'd actually, I broke it up over a period of like a week, like every, I was like, you know what, I'm going to move four services a day.
46:05SPEAKERAnd I would spend at least half an hour, 45 minutes in a couple of days is going through those logins, detaching Authy, reattaching a new app.
46:14SPEAKERYou know, like it was, it was, it was a fair commitment.
46:17SPEAKERYeah, it's, it's it's, it's a lot like it's, it's a lot of work anytime you have to do this stuff.
46:23SPEAKERSo apparently you can update your brand icon to the Too Fast app and it'll, it takes about three weeks.
46:29SPEAKERHmm. So yeah, they have, they have a browser extension actually. I have not messed with that. I don't think I want to, I think I'd prefer all that stuff to just live on the phone and that's it.
46:38SPEAKERYeah. I don't mind having to look up, look up that stuff.
46:41SPEAKERRight. Like in fact, that was the whole reason I wanted to get off of Authy was I don't want to send anything off of the phone for this purpose that I don't have to.
46:48SPEAKERWell, you use it so infrequently that it shouldn't be something that you need all the time.
46:53SPEAKERYeah. And not to shill the Apple watch endlessly, but ever since I got this watch two factor time-based codes are even less of a big deal cause they're right there on my wrist.
47:01SPEAKERI never use that.
47:02SPEAKEROh really?
47:03SPEAKERI just, I just let one password paste it in.
47:05SPEAKEROh, it's great.
47:06SPEAKERCause the way it works when you put the one, the two factors in one password is it auto fills the, the username and the password and then it copies the two factor into the clipboard.
47:17SPEAKERSo when you go to the two factor code page, you just paste it in.
47:20SPEAKERSo that brings me to the last subject here, as far as switching authenticators. I use Bitwarden as my password manager and they also like one password.
47:28SPEAKERThey have this style of time-based authentication built in as well. I kind of wondered if it's maybe a better idea.
47:35SPEAKERI mean, I'm sure it's obviously it's very convenient to have it all in one place, but just for mitigating risk, not having the password and the thing that approves the password sitting right next to each other in the same account,
47:46SPEAKERfelt like maybe a bit of spreading the attack surface out. You tell me.
47:51SPEAKERMy feeling has generally been that if somebody gets access to my one password, I'm already doomed.
47:57SPEAKERYeah, that's a fair point.
48:00SPEAKERSo yeah, I mean, I have two factor on the one password.
48:05SPEAKEREverybody that connects to the one password has a, or has access to the shared Depot has a really, really long passphrase.
48:14SPEAKERSo yeah, yes, that is a concern. Anything that's really important has a hardware token attached to it.
48:22SPEAKERSo the two, it's not the time-based it's the hardware token and anything else is a bank or something stupid that doesn't support anything like that.
48:31SPEAKERSo, yeah, yeah, yeah. Anyway, anyway, I like you, I have considered moving all of that stuff under the one umbrella.
48:37SPEAKERI've not taken the step yet. Maybe, maybe if, and when I moved past keys, it'll work itself out.
48:42SPEAKERSo, okay. There's two topics, Brad. What's our third.
48:45SPEAKERWait. Oh, you're counting that as.
48:48SPEAKERWe talked about, we talked about past keys. We talked about the authi breach and you switching over.
48:52SPEAKERI'm sitting right here looking at this doc. The authi breach is under the security bullet point.
48:58SPEAKERI don't know what you're talking about, Brad. It's right there, even with the secure, with the, with the past keys.
49:04SPEAKERShould never have taught you how to unindent the bullet points.
49:07SPEAKERI guess the authi breach is now changing authenticators is now our second topic we were going to, I think we,
49:12SPEAKERI think we have actually successfully filled most of this episode with this and we have a bonus little addendum thing.
49:20SPEAKERWhat we always plan to do clearly.
49:23SPEAKERWe'll save this, this Phantom third topic that is actually extremely chunky here in the notes for, for an episode, I guess.
49:30SPEAKERYeah. The notes for the third topic are bigger than the notes for the, for the second topic.
49:34SPEAKERSo anyway, for all this, should we say what it is?
49:37SPEAKERNo, let them wait.
49:38SPEAKEROh, it's all right. Fine. I was edified. I thought it was educational.
49:42SPEAKERWe're going to talk about Wi-Fi seven is the topic.
49:45SPEAKERYeah. It was, it was, it was a deep dive on, on what's up with Wi-Fi seven and if you should care and if you should upgrade and et cetera,
49:53SPEAKERwhich I'd like to know myself because I still have a Wi-Fi five access point.
49:56SPEAKERYou will, you are primed for Wi-Fi seven is the answer.
50:00SPEAKERYes. But yeah, we'll do it on a, on a soon episode, like next week or the week after probably.
50:05SPEAKERYes. But our, our last bonus topic, this is episode 250 of this podcast.
50:12SPEAKERMy understanding is that that's a milestone.
50:14SPEAKERThat seems like a nice round number. Also, we didn't, it didn't quite line up.
50:19SPEAKERThis is just coincidence anyway, because, you know, there have been weeks when we ran old patron episodes, like we didn't do a numbered episode,
50:25SPEAKERbut we are at the time of this posting, we are 11 days shy of the five year anniversary of posting the first episode of the podcast.
50:35SPEAKERThat's crazy.
50:36SPEAKERSo we're at episode 250, just around the five year mark.
50:40SPEAKERThat it doesn't feel like it's been five years, but also it feels like a lot longer than five years all at the same time.
50:45SPEAKERYes. It was September 12th, 2019 was when episode zero went up.
50:49SPEAKERDid we do, did we do an episode zero that was like a yo, what, here's what this podcast is about. The placeholder one.
50:55SPEAKERIs that what our episode zero is?
50:56SPEAKEROh, I have closed the RSS.
50:58SPEAKERIs our episode zero the refresh rates?
51:03SPEAKERNo, that was, that was the first thing we recorded. If I'm not mistaken, the refresh rates,
51:08SPEAKERthe screens episode was the first thing we ever recorded as a test, but it looks like.
51:12SPEAKEROh, that's right.
51:13SPEAKERYes. That was, that was episode six. We held that one for whatever reason for a few weeks.
51:17SPEAKERWe were like, we need to have something in the hopper in case we get busy and can't record.
51:20SPEAKERYes, that was, that turned out to be a good idea that we should try to get back to at some point.
51:25SPEAKERThat's not what we should record this wifi episode. We just stay on after the call and keep it rolling.
51:30SPEAKERYes. Episode, episode zero, which I will never go back and listen to because I can't stand to hear myself.
51:35SPEAKERBut it was, it was our tech origin stories.
51:37SPEAKERIt was us just talking about where we came from, like our early computers, why we did this podcast in the first place.
51:43SPEAKERThat's really funny.
51:44SPEAKERI had a lifelong love of nerdy shit.
51:47SPEAKERWell, I mean, honestly, this started because I used to come on the bomb cast and you and I would go on incredible technology tangents and everybody else in the room.
51:56SPEAKERPoor Ben Pack would be sitting over there, just kind of looking, staring off into space, praying for an early death.
52:01SPEAKERThat man just wants to play some Dota. He doesn't give a shit about what DirectX version it's running on.
52:05SPEAKERYep. Nope. And, and then like eight weirdos would be in the chat and, or it would be in the, in the comments and be like, man, I love it when Will and Brad talk and everybody else would be like, shut the fuck up. Don't encourage them.
52:16SPEAKERSo we made a podcast.
52:17SPEAKERYes. What if we could just talk about GPU's as much as we want?
52:20SPEAKERYep. And here we are five years later.
52:23SPEAKERWe talked about it before. How many episodes did we do in person? It was not that many.
52:27SPEAKERWe did episodes in person until I'm going to guess February of 2003, probably 2020 rather.
52:34SPEAKERI can't believe, how the fuck has that been going on five years ago?
52:38SPEAKERWe did not start, we did not start doing in person or not in person until the pandemic started, but it was only like six months.
52:48SPEAKERYeah, it was not that much. God, were you really driving up here for six months?
52:52SPEAKERYeah, I'm going to go and tell you at the end of that, but this was the one nice thing about the pandemic is we had to figure out how to record remotely because while I didn't mind driving up there, there's some days that like like San Francisco, I guess all cities are like this, but like occasionally there'd be like a street festival or just some sort of traffic fuckery that would mean that instead of it being like a 20 minute Saturday morning drive, it was a 45 minute Saturday morning drive.
53:16SPEAKERYeah.
53:17SPEAKEROr like there wouldn't be parking in your neighborhood because there'd be something going on the park or wherever.
53:21SPEAKERYeah.
53:22SPEAKERAnd yeah, I, I don't, I don't miss that. It turns out.
53:26SPEAKERYes, I understand that. Were you taking 19th up?
53:28SPEAKERYep.
53:29SPEAKEROh God, no wonder. Yeah, 19th is a-
53:31SPEAKERThe worst road in the city.
53:33SPEAKERRandomly a nightmare several times a day.
53:36SPEAKERSo just so people know 19th is, it's like the west side, north south through line through San Francisco to the Golden Gate Bridge. It's six, three lanes each way. It's not separated. It's a street level street with stoplights every, every block. People's driveways are on it. There's street parking on it. It's, it's people are turning right. They don't let people turn left anymore. Thank God.
54:02SPEAKERBut it's, it's like, there's, there's every, every lane is fraught with peril.
54:08SPEAKERYeah. It's bad.
54:09SPEAKERYeah. And then you drive through the park and there's a big zigzag and that always backs up for no reason that I can tell.
54:14SPEAKEROh God. Yes, that, yes, yes. It's, it's, it's all, it's all bad. And yet if you were going north south through the city, you're inevitably going to end up on it.
54:21SPEAKERWhat's either that or you take 10 minutes guaranteed. It's like, it's look, this is like, it's the biggest gambling road in the city. Cause like if it, if it works out, it's real fast, but if it doesn't, it's an extra 20 minutes.
54:35SPEAKERAnd yeah, you never know until you're there. Waze, Waze is it can, it's impenetrable to Waze.
54:41SPEAKERYeah. Yes. I drove 19th every day when we worked in Salsalito. It was terrible. Oh God. Oh God. Yeah. In some ways going remote made things a little easier because I don't think we ever solved the problem of the mic bleed when we were recording in my house here.
54:56SPEAKERYeah. When we recorded in your house, we used to use my headset mics like broad. They're like broadcast studio headset mics. And you just get a little bit of a, like now I know how to fix that because we would just put a gate on them. But back then we were using a zoom H6, I think, and just plugging them in. And yeah, I don't know for what it's worth. I don't think our podcast has ever sounded bad. There are definitely episodes that sounded better than others.
55:24SPEAKERYeah. That's yeah, that's fair. But God, I'd, it's hard for me to think back to the time when we didn't know what a noise gate was released. I mean, didn't use one commonly.
55:32SPEAKERI, we always, I can't remember. I might've just run everything. I might've just synced it up and run it through level later back in the day.
55:40SPEAKERYeah. Yeah. It's been less than a year since I got off of level later.
55:47SPEAKERI think, I think the first one we recorded remotely was episode 26. Come on down to dongle town. Okay. And I shout outs to the, that E in down doing a lot of work.
55:59SPEAKERThis town also has an E. Right. Yes. Pretty good. Pretty good. Oh yeah. Look at that. Discuss their approach to social distancing, working from home and coping with isolation.
56:10SPEAKERYep. We might've started before that. Cause I feel like, I feel like I pulled the kiddo out of school a week before schools closed here. That's right.
56:18SPEAKERBecause I was like, people are getting the weird sick. It's not good. Yes. Anyway. Yeah. It's weird to think this podcast has been almost exclusively a work from home phenomenon.
56:28SPEAKERYeah. And it's, it's funny. I feel like we've gone up and down on how often we see each other throughout the year for a while. I was seeing you a lot, like a lot, a lot, and then never at all.
56:38SPEAKERAnd now then a little bit for a while there, and now it's back to like twice a year, I think.
56:43SPEAKERWell, that tracked pretty closely with my inability to get myself out of the house.
56:47SPEAKERWell, there you go.
56:48SPEAKERWhich, which ebbs and flows, but thanks to you and other friends of the show, like Steve Lin.
56:54SPEAKERYeah.
56:54SPEAKERKind of been getting out and doing some stuff again.
56:56SPEAKERWe need a poke and stick is the thing.
56:58SPEAKERYes. Yes. Might, might, might hit that last electronics flea market of the year.
57:02SPEAKERThat's soon. Is that, is that this weekend or next weekend?
57:05SPEAKERNext weekend, I think.
57:06SPEAKEROkay. I would go to that probably. I got to figure out if I can.
57:09SPEAKERThe vintage computer festival, like wet, wetted, wetted? Wet my whistle or what?
57:14SPEAKERI think it's wetted.
57:15SPEAKERWetted my whistle?
57:16SPEAKERI think you wet your whistle, but in past tense, it's wetted probably.
57:20SPEAKERIs that, is that W-E-T or W-H-E-T? I can't remember.
57:23SPEAKERThat, that is a truly, no one can say.
57:26SPEAKERThis is a, if you had asked me if we ranked windowses before the pandemic, I never ever would have said yes, but we did.
57:37SPEAKERThat was up to 21.
57:39SPEAKERThat was here?
57:40SPEAKERUh huh. On the dining room table.
57:43SPEAKERWow.
57:44SPEAKERYeah.
57:45SPEAKERNo memory of, I mean, I remember doing the episode, but no memory of doing that in this house.
57:49SPEAKERNo, it's shocking.
57:51SPEAKERThat was the first one that we accidentally did a twofer.
57:53SPEAKERYes.
57:54SPEAKERCause we, we, we got into it and we got to the end of like windows XP and we were an hour and a half or something ridiculous.
58:00SPEAKERYes.
58:01SPEAKERIt turns out talking in a, in a mostly tongue in cheek, but also kind of earnest way about every version of windows generates a lot of material.
58:08SPEAKERThis is why I think we need to, we need to do a ranking of things you can plug into your computer.
58:12SPEAKERI think that's, I've been thinking about it. I think that should be the next one because when we did, when we did the list of most impactful technologies, I've done that.
58:21SPEAKERI think we did, we did one of those here too, right?
58:23SPEAKERYes. Well, in our case, it was a specific, like best innovations in PC building or PC operations.
58:31SPEAKERIt was things like USB or soft power switches or tools.
58:35SPEAKERThat was a good episode.
58:37SPEAKERWe did best technologies at maximum PC once, and it resulted in a week long argument in the conference room.
58:43SPEAKERWow.
58:44SPEAKERAnd like 10, 15 sheets of sticky pads stuck up on the walls everywhere while we decided what order things went in.
58:50SPEAKERThat's, that's pretty good.
58:51SPEAKERIt was pretty good.
58:52SPEAKERI like doing rankings and I would love to hear people's ideas for other rankings or if you don't, if you really don't like rankings, let us know that too.
58:59SPEAKERBut yeah, rankings are fun.
59:01SPEAKERIt's, it's, it's, it's a good excuse to talk about stuff we don't normally get to talk about.
59:05SPEAKERYes. And it's a good excuse to like, just let your like extreme nerd flag fly, I guess I would say, you know, like, like where else can you go that deep on something that meaningless in a way that lets you just pull every bit of minutia in your head out?
59:19SPEAKERYou know, I realized we forgot thumb screws on the PC building innovations one.
59:24SPEAKERDid we?
59:25SPEAKERI don't think we talked about thumb screws.
59:26SPEAKERShit man, that might have won.
59:27SPEAKERWe might have to go back and redo that.
59:29SPEAKERThat might have won.
59:30SPEAKERYeah.
59:31SPEAKERBut, but yeah, the reason I ask for people's ideas on rankings is I shouldn't admit this, but I think we screwed up and did the best possible ranking episode as our first one.
59:41SPEAKERYeah, we absolutely did.
59:42SPEAKERLike we did, ranking windows hits the exact sweet spot of just serious enough, but just stupid enough.
59:48SPEAKERWell, and the problem is I don't, I don't, I don't think either of us have a lot of experience with early Maco, enough experience with early Macos is to have informed opinions.
59:57SPEAKERYes.
59:58SPEAKERYou know, like I, like if I had the experience, I'd love to rank like all operating systems.
1:00:03SPEAKERIt's like OS2 warp is better than Echo West system seven or whatever, but.
1:00:07SPEAKERThere's something, there's something really mad, like the, the old game of the year podcast that you all used to do at giant bomb were among my favorite, like, Hey, here are people making incredibly like he hears people just putting down the flag for a thing that they loved.
1:00:23SPEAKERAnd I love that.
1:00:25SPEAKERI love that.
1:00:26SPEAKERAnd I think the rankings give us an opportunity to dig back into that energy again.
1:00:30SPEAKERYeah, that was always, that was always the key is you have to both recognize that it's all meaningless and then still get way more serious about it than it deserves.
1:00:38SPEAKERYeah, that's exactly it.
1:00:39SPEAKERI like the classic example was the year that Skyrim and saints for the third came out.
1:00:46SPEAKERWhat's not, I don't know, but you had to, were you on the wrong side of that one?
1:00:50SPEAKERI don't even remember what you consider the wrong side.
1:00:52SPEAKERWell, which, which game won?
1:00:54SPEAKERSkyrim one.
1:00:55SPEAKERYeah.
1:00:56SPEAKERWhich game should have won?
1:00:57SPEAKERI feel that history has vindicated me thoroughly.
1:01:01SPEAKERYou would, you thought Skyrim should win?
1:01:03SPEAKERI like people, millions of people still play Skyrim to this day.
1:01:07SPEAKERThat's just because saints row is owned by an ambiguous multinational corporation.
1:01:12SPEAKERSaints, saints row was a quite funny and totally middling open world game.
1:01:16SPEAKEROh no.
1:01:17SPEAKERIt was a totally fine, if, but unremarkable open world crime game.
1:01:21SPEAKERThat was very funny.
1:01:23SPEAKERAnyway, humor needed to come to video games, Brad.
1:01:26SPEAKERAnyway.
1:01:27SPEAKERNow we're relitigating a different podcast.
1:01:28SPEAKERI'm not going to, yeah, I'm not going to, you're not going to trap me on this.
1:01:31SPEAKERIt's been a fun 250 episodes, man.
1:01:33SPEAKERYeah.
1:01:34SPEAKERI'm still, I'm still learning stuff.
1:01:35SPEAKERI learned what pass keys are today.
1:01:37SPEAKERMe too.
1:01:38SPEAKERWell, I learned yesterday, but you know, some today too, I guess.
1:01:41SPEAKERYeah.
1:01:42SPEAKERI will, I mean, we should do another 250, I guess.
1:01:45SPEAKERYeah.
1:01:46SPEAKERYeah, I think so.
1:01:47SPEAKERIf the people want it.
1:01:48SPEAKEROr, I mean, we just shut the whole thing off, call it a week.
1:01:50SPEAKERIt's been a good run.
1:01:51SPEAKERAs long as, as long as people want us to keep doing it.
1:01:54SPEAKERThere you go.
1:01:55SPEAKERSo speaking of people that want us to keep doing it, if you, we are a listener supported
1:02:00SPEAKERshow, so we are supported by people who want us to keep doing it.
1:02:05SPEAKERWe call them patrons.
1:02:06SPEAKERYou can find out more at patreon.com/techbod.
1:02:09SPEAKERAgain, that's patreon.com/techbod.
1:02:12SPEAKERIt costs five bucks a month to join the Patreon.
1:02:15SPEAKERYou get access to the Discord.
1:02:16SPEAKERYou get access to our Patreon exclusive episode, which we recorded, we talked about.
1:02:20SPEAKERWe made notes.
1:02:21SPEAKERI don't think we've ever made notes for a Patreon episode before.
1:02:24SPEAKERWe actually had so many topics, we were like, we need to put these down.
1:02:27SPEAKERAnd I thought that was a pretty good, a pretty good patron episode.
1:02:31SPEAKERTalked about, talked about your use of Llama3.
1:02:33SPEAKERWe talked about the end of a non-tech.
1:02:34SPEAKERHold on.
1:02:35SPEAKERWe did not talk about me using Llama3.
1:02:36SPEAKERWe talked about Llama3 abusing me.
1:02:39SPEAKERThat was probably one of the best stupid AI stories I have ever heard actually to date.
1:02:43SPEAKEROkay.
1:02:44SPEAKERThank you.
1:02:45SPEAKERI could not, I actually could not believe it pulled that shit.
1:02:47SPEAKERI lost my shit last night when it happened to me.
1:02:49SPEAKERIt's, it's rude.
1:02:51SPEAKERWe talked about KB5041587.
1:02:55SPEAKERWe poured one out for a Nantec.
1:02:57SPEAKERYes, a non-tech.
1:02:58SPEAKERTalked about the end of a non-tech.
1:02:59SPEAKERThat, that, that, that KB, does that, that doesn't stand for knowledge base, does it?
1:03:02SPEAKERKnowledge base.
1:03:03SPEAKERDoes it really?
1:03:04SPEAKERKB5041587 is the 504th, 105 millionth, 441 thousandth, 587th knowledge base article as
1:03:12SPEAKERfar as I can tell.
1:03:13SPEAKERBut why, why would they name their Windows update patches after knowledge, well, I guess
1:03:17SPEAKERthey attach a knowledge base.
1:03:18SPEAKERThey attach a knowledge base to the patch.
1:03:20SPEAKERThat's where the, that's where the patches are.
1:03:22SPEAKERYes.
1:03:23SPEAKEROkay.
1:03:24SPEAKERAnyway, that's the one you really want to get if you have an AMD CPU.
1:03:26SPEAKERYeah.
1:03:27SPEAKERParticularly a newer Ryzen.
1:03:28SPEAKERTalked about how I got black and white working for the stream we did today.
1:03:31SPEAKERWe talked about some, some soft, some new apps that we were very excited to try.
1:03:34SPEAKERYeah.
1:03:35SPEAKERIt's good stuff.
1:03:36SPEAKERA lot of stuff in there.
1:03:37SPEAKERAnd you can get, you can get access to that by going to patreon.com/techpod and join the
1:03:42SPEAKERranks.
1:03:43SPEAKERThousands.
1:03:44SPEAKERThere are literally thousands of you.
1:03:46SPEAKERWe appreciate each and every one, but we especially appreciate our executive producer
1:03:50SPEAKERto your patrons, including Andrew Slosky, Paddle Creek Games, makers of Fractured Veil,
1:03:55SPEAKERJordan Lippett, Bunny Fiend, Twinkle Twinkie, David Allen, James Cammack, and Pantheon makers
1:04:01SPEAKERof the HS3 high-speed 3D printer.
1:04:02SPEAKERThank you all so much.
1:04:03SPEAKERYeah.
1:04:04SPEAKERThank you.
1:04:05SPEAKERWe will be back next week with another edition of the Techbot until then, keep on techin'.
1:04:13SPEAKERDon't throw your dad into a volcano or kid into a volcano.
1:04:16SPEAKERI don't know.
1:04:17SPEAKERThat's all I know about techin'.
1:04:18SPEAKERBye.
1:04:20SPEAKERBye.