We’re all busy people with busy lives. We only have so much time and energy. So when security people dole out to-do lists, we really need to focus on the tips with the most bang for the buck. Conversely, we need to avoid wasting people’s precious resources on advice that is no longer valid or worth the effort. Today, we’ll debunk several of these “Hacklore” tips with security guru Bob Lord.
Interview Notes
Hacklore: https://www.hacklore.org/letter Hacklore resources: https://www.hacklore.org/resources Elevator (un)safety analogy: https://medium.com/@boblord/psa-elevator-un-safety-7ac69a9498de DNC Security Checklist: https://democrats.org/security/ CISA Secure by Design: https://www.cisa.gov/securebydesign MITRE’s 2007 Unforgivable Vulnerabilities (PDF): https://cwe.mitre.org/documents/unforgivable_vulns/unforgivable.pdf Take 9: https://pausetake9.org/ Consumer Reports Security Planner tool: https://securityplanner.consumerreports.org/ EFF security planning: https://ssd.eff.org/module/your-security-plan Removing online data: https://firewallsdontstopdragons.com/data-diet-introduction/ Generate passphrases with d20 dice! https://d20key.com/#/ Dragon coupons: https://fdsd.me/coupons/ Rafifi (film): https://www.imdb.com/title/tt0048021/ Xkcd password strength: https://xkcd.com/936/ Further Info
My book: https://fdsd.me/book My newsletter: https://fdsd.me/newsletter Support the mission: https://fdsd.me/support Give the gift of privacy and security: https://fdsd.me/coupons Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents
0:00:14: Intro0:00:25: Survey, promo wrap-up0:01:30: Interview setup0:02:22: Lingo definitions0:02:52: What drove you to launch Hacklore?0:07:12: Is this advice truly wrong?0:11:51: 1) Avoid public WiFi0:17:38: 2) Never scan QR codes0:22:43: 3) Never charge devices from public USB ports0:24:38: 4) Turn off Bluetooth and NFC0:28:25: 5) Regularly clear cookies0:32:47: 6) Regularly change passwords0:38:19: Why do we not have web password standards?0:44:24: Any bad tips that didn’t make the cut?0:45:53: WIll Hacklore be regularly updated?0:46:32: What has been the response to Hacklore?0:48:08: So what are the actual top security tips?0:49:56: How do we shift the onus to software makers?0:53:14: What other resources can you recommend?0:55:40: What’s next for you?0:56:53: Wrap-up1:00:40: Generating passphrases1:02:00: Accessing show notes1:03:08: Dragon coupons1:03:40: Patron podcast preview1:04:24: Looking ahead