Firewalls Don't Stop Dragons Podcast

Privacy has been defined in many ways. The right to tell your story your own way. The right to have control over your personal information. The right to be left alone. There's a reason we have T-shirts that say "dance like no one is watching". We censor ourselves when we're being watched. But if knowledge is power, then asymmetries in knowledge must lead to asymmetries in power. Privacy is a human right but it's also a collective good - something we need to respect and support, even if we do not personally feel the need to exercise it. Today I'll explore why privacy is essential, how it is being threatened, and what we can do to reclaim it with Carissa Véliz, a professor of philosophy and author of the wonderful and important book, Privacy is Power.

Interview Notes

Carissa’s website: https://www.carissaveliz.com/

Privacy is Power: https://www.penguinrandomhouse.com/books/673341/privacy-is-power-by-carissa-veliz/ 

My review of her book: https://firewallsdontstopdragons.com/privacy-is-power-review/ 

The Ethics of Privacy and Surveillance: https://www.oxford-aiethics.ox.ac.uk/blog/new-book-ethics-privacy-and-surveillance 

TEDx: The Case for Ending Data Economy: https://www.youtube.com/watch?v=luCXlPYrTP4 

Google’s Don’t Be Evil motto history:  https://en.wikipedia.org/wiki/Don't_be_evil 

Give Thanks & Donate! https://firewallsdontstopdragons.com/give-thanks-donate/ 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:31: Give Thanks & Donate!

0:01:27: Follow me on Bluesky

0:02:06: Interview setup

0:04:17: What inspired you to write this book?

0:07:04: What impacts has your book had? Did any response surprise you?

0:10:01: When researching the book, what surveillance methods most surprised you?

0:13:31: How and when did all this surveillance start?

0:15:40: Are behavior ads really more effective than contextual ads?

0:19:04: Is it possible to have privacy and still target ads?

0:22:08: What's your take on Google's Privacy Sandbox concept?

0:23:57: Why is the 'notice and consent' model such a failure?

0:28:14: What's your take on the notion of data sovereignty?

0:30:09: Why is privacy a collective good that we all need to protect?

0:32:12: How does asymmetry in knowledge lead to asymmetry in power?

0:34:06: Are we at risk of normalizing surveillance for future generations?

0:37:09: What will it take to trigger a surveillance backlash?

0:40:21: What can we learn from history about overzealous data collection?

0:43:35: How will AI technology impact our privacy?

0:49:30: Can we reap the benefits of our data without giving up privacy?

0:52:45: How do we manifest a society that values and respects privacy?

0:56:15: Interview wrap-up

0:58:36: Still celebrating 400th episode!

0:59:02: Looking ahead

Holiday shopping season is here! And today I'll give you the highlights of my annual Best & Worst Gift Guide for 2024, with regard to privacy and security. The worst offenders may not surprise you, though some have actually gotten worse since just last year. And I have a few new suggestions for people on your nice list!

In the news this week: another popular browser extension has gone rogue; Mozilla laid off 30% of their staff; FBI warns that bad guys are filing fraudulent emergency data requests to steal your private info; Apple quietly introduces a brilliant security feature that is frustrating cops; Microsoft will stop providing security updates for Windows 10 next October; a free decryptor was released for ShrinkLocker ransomware; Signal offers new call link feature; an air fryer app is sending your data to China; and Apple announces feature to share AirTag location with others including airlines to help find lost luggage.

Article Links

[cyberinsider.com] Popular Chrome Extension to Hide YouTube Shorts Turned Malicious https://cyberinsider.com/popular-chrome-extension-to-hide-youtube-shorts-turned-malicious/

[Tech Crunch] Mozilla Foundation lays off 30% staff, drops advocacy division https://techcrunch.com/2024/11/05/mozilla-foundation-lays-off-30-staff-drops-advocacy-division/ 

[Tech Crunch] FBI says hackers are sending fraudulent police data requests to tech giants to steal people’s private information https://techcrunch.com/2024/11/08/fbi-says-hackers-are-sending-fraudulent-police-data-requests-to-tech-giants-to-steal-peoples-private-information/

[404media.co] Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops https://www.404media.co/apple-quietly-introduced-iphone-reboot-code-which-is-locking-out-cops/

[blog.0patch.com] Long Live Windows 10... With 0patch https://blog.0patch.com/2024/06/long-live-windows-10-with-0patch.html

[The Hacker News] Free Decryptor Released for BitLocker-Based ShrinkLocker Ransomware Victims https://thehackernews.com/2024/11/free-decryptor-released-for-bitlocker.html

[signal.org] Improving Private Signal Calls: Call Links & More https://signal.org/blog/call-links/

[malwarebytes.com] Air fryers are the latest surveillance threat you didn’t consider https://www.malwarebytes.com/blog/news/2024/11/air-fryers-are-the-latest-surveillance-threat-you-didnt-consider

[macrumors.com] Apple Announces iOS 18.2's New AirTag Location Sharing Feature Coming to These 15+ Airlines https://www.macrumors.com/2024/11/11/apple-announces-airtag-location-sharing/

Best & Worst Gift Guide 2024! https://firewallsdontstopdragons.com/best-worst-gifts-2024/ 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:50: Update Android phones

0:01:23: News preview

0:03:23: Popular Chrome Extension to Hide YouTube Shorts Turned Malicious

0:10:30: Mozilla Foundation lays off 30% staff, drops advocacy division

0:14:06: FBI says hackers are sending fraudulent police data requests to steal people’s private info

0:19:59: Apple Quietly Introduced iPhone Reboot Code Which is Locking Out Cops

0:29:46: Long Live Windows 10... With 0patch

0:39:54: Free Decryptor Released for BitLocker-Based ShrinkLocker Ransomware Victims

0:42:45: Improving Private Signal Calls: Call Links & More

0:45:23: Air fryers are the latest surveillance threat you didn’t consider

0:48:28: Apple Announces iOS 18.2's New AirTag Location Sharing Feature

0:51:40: Tip of the Week: Best & Worst Gift Guide

0:56:38: Worst Gifts

0:59:31: Best Gifts

1:06:32: Dragon book and coupons

1:09:55: Wrapping up

Device manufacturers are breathing new life into old mundane products by connecting them to the internet, giving us the ability to monitor and control them from anywhere. However, this connection to the cloud works both ways. Not only do device makers now have unprecedented access to our usage and personal information, but they can hobble or limit our use of these devices at their whim. Today I'll speak with IoT expert Stacey Higginbotham who is working with Consumer Reports and other consumer rights groups to bring more transparency to the smart device industry, and hopefully allow us to regain control over the devices we purchase.

Interview Notes

Stacey Higginbotham: https://www.linkedin.com/in/staceyhigginbotham/ 

Consumer Reports’ FTC filing on software tethering: https://advocacy.consumerreports.org/press_release/ftc-software-tethering/ 

Who Ya Gonna Call? https://innovation.consumerreports.org/who-ya-gonna-call/ 

Spotify Cancels Car Thing: https://innovation.consumerreports.org/how-to-kill-a-smart-device-spotify-car-thing-post-mortem/ 

When Will Your Smart Appliance Turn Dumb? https://innovation.consumerreports.org/when-will-your-smart-appliance-turn-dumb/ 

CR’s Permission Slip: https://www.permissionslipcr.com/ 

CR’s Security Planner: https://securityplanner.consumerreports.org/

My interview with Cory Doctorow on adversarial interoperability: https://podcast.firewallsdontstopdragons.com/2020/02/17/adversarial-interoperability-part-1/ 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:54: Chevron deference

0:01:48: US election impacts

0:03:15: Interview setup

0:03:55: What does it mean for devices to be 'software tethered'?

0:09:23: How might software tethering affect resale of smart devices?

0:13:52: What are the impacts on security and privacy?

0:15:20: How did we agree to these limitations?

0:27:50: What devices might fail to work when offline?

0:39:05: What happened to Amazon Dash buttons?

0:46:28: Is it easier to get FTC rulings than new regulations?

0:51:29: Does the DMCA still apply to abandoned products?

0:53:13: Should we force companies to escrow software for release if they fail?

0:56:06: What should we be doing as consumers to further this cause?

0:57:39: What's next for your FTC filing?

0:59:55: Interview wrap-up

1:01:28: Patron bonus preview

1:02:19: Looking ahead

Our location is being tracked mercilessly today, in several ways. In the digital age, location data is among the most sensitive information we share, providing a record of our daily lives that can reveal where we live, who we associate with, and our personal routines. For app developers, marketers, and even law enforcement, this data is a goldmine for the ‘app economy’. Today I’ll talk about the most common sources of location data and give you some tips for limiting the tracking.

In other news: the FTC files rule that requires canceling be just as easy as subscribing; CFPB takes action against worker surveillance; macOS Sequoia's tightened app security may be annoying to some; it's now legal to hack McFlurry machines to fix them; the EU makes vendors liable for software bugs; city sues Flock saying license plate readers are Unconstitutional; tracking world leaders with a fitness app; smartphone location tracking is out of control.

Article Links

[theverge.com] The FTC is finally making it easier to cancel your gym membership https://www.theverge.com/2024/10/16/24271649/ftc-click-to-cancel-subscriptions-final-rule

[consumerfinance.gov] CFPB Takes Action to Curb Unchecked Worker Surveillance https://www.consumerfinance.gov/about-us/newsroom/cfpb-takes-action-to-curb-unchecked-worker-surveillance/

[appleinsider.com] What's changed in runtime protection for macOS Sequoia https://appleinsider.com/inside/macos-sequoia/tips/whats-changed-in-runtime-protection-for-macos-sequoia

[404media.co] It Is Now Legal to Hack McFlurry Machines (and Medical Devices) to Fix Them https://www.404media.co/it-is-now-legal-to-hack-mcflurry-machines-and-medical-devices-to-fix-them/

[Risky Business] The EU will make vendors liable for bugs https://news.risky.biz/risky-biz-news-the-eu-will-make-vendors-liable-for-bugs/

[404media.co] Lawsuit Argues Warrantless Use of Flock Surveillance Cameras Is Unconstitutional https://www.404media.co/lawsuit-argues-warrantless-use-of-flock-surveillance-cameras-is-unconstitutional/

[schneier.com] Tracking World Leaders Using Strava https://www.schneier.com/blog/archives/2024/10/tracking-world-leaders-using-strava.html

[arstechnica.com] Location tracking of phones is out of control. Here’s how to fight back. https://arstechnica.com/information-technology/2024/10/phone-tracking-tool-lets-government-agencies-follow-your-every-move/

Tip of the Week: https://firewallsdontstopdragons.com/how-to-curb-location-tracking/ 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:03:06: News preview

0:04:41: FTC is finally making it easier to cancel your gym membership

0:07:19: CFPB Takes Action to Curb Unchecked Worker Surveillance

0:14:23: What's changed in runtime protection for macOS Sequoia

0:21:57: It Is Now Legal to Hack McFlurry Machines (and Medical Devices) to Fix Them

0:28:15: The EU will make vendors liable for bugs

0:33:00: Lawsuit Argues Warrantless Use of Flock Surveillance Cameras Is Unconstitutional

0:41:09: Tracking World Leaders Using Strava

0:42:38: Location tracking of phones is out of control. Here’s how to fight back.

0:49:56: Tip of the Week: Curbing Location Tracking

1:00:57: Looking ahead

The first episode of Firewalls Don't Stop Dragons Podcast aired on March 8, 2017 - almost 8 years ago now. Over that time, I've interviewed over 135 unique and amazing people, covered countless cybersecurity and privacy stories, and offered 100's of tips for protecting your devices and data. To celebrate this momentous occasion, world-renowned cryptography guru Bruce Schneier has returned to for our traditional Podcentennial interview! We discuss several timely topics including the Crowdstrike incident, the pager bombing and supply attacks more generally, US election security, the open market for cyber vulnerabilities, US intelligence agencies' focus on offense versus defense, how AI might actually benefit democracy and much more!

Interview Notes

Bruce Schneier’s blog:https://www.schneier.com/ 

Inrupt’s Solid concept: https://www.inrupt.com/solid 

Data and Goliath (book): https://www.schneier.com/books/data-and-goliath/ 

Bruce’s NY Time article on pager bombs: https://www.schneier.com/essays/archives/2024/09/israels-pager-attacks-have-changed-the-world.html 

Joseph Cox “Anom” interview: https://podcast.firewallsdontstopdragons.com/2024/06/10/anom-the-fbis-phone-company/ 

WaPo detailed analysis of pager bomb attack: https://www.washingtonpost.com/world/2024/10/05/israel-mossad-hezbollah-pagers-nasrallah/ 

Restoring Trust in Elections: https://podcast.firewallsdontstopdragons.com/2023/12/11/restoring-trust-in-elections/ 

Hacking election systems w/ Harri Hursti: https://podcast.firewallsdontstopdragons.com/2021/11/08/restoring-trust-in-our-elections/ 

Hacker Halted conference info: https://hackerhalted.com/agenda/#day-two-october-31st 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:03:53: Interview setup

0:06:21: What should we have learned from the Crowdstrike incident?

0:11:21: Why is it more profitable for products to be brittle?

0:13:59: Do regulations stifle innovation?

0:15:27: Should intelligence agencies focus more on cyber offense or defense?

0:22:29: Should it be legal to buy and sell zero-days on the open market?

0:26:44: How secure are our election systems today? How do we get people to trust the outcomes?

0:35:41: What's your take on the arrest of Telegram's CEO?

0:39:18: How do we convince lawmakers not to subvert encrypted communications?

0:43:48: How did the exploding pager attack change our views of supply chain security?

0:49:26: In what ways might AI actually benefit our democracy?

0:58:03: Should there be any guardrails on AI systems?

1:01:17: What's next for you? What's the latest on the Solid project?

1:03:49: Interview wrap-up

1:07:51: More info for new listeners

1:13:38: Meet me at Hacker Halted Conference!

1:14:14: Looking ahead

Artificial Intelligence (AI) is the buzzword of the day. There are many types of AI, but one particular flavor is getting a lot of press these days: chatbots. Formally referred to as Large Language Models (LLMs), chatbots like ChatGPT, Claude and Gemini are everywhere - either directly or integrated with other popular apps. This technology is real and it's here to stay, so it's important that we understand what it is, how it works, and what the limitations are. Today I'll explore some aspects of LLMs that you probably weren't aware of.

In other news: critical, exploited Firefox bug is fixed (update now!); National Public Data files for bankruptcy after massive breach; hackers target Qualcomm chip zero-day used in many Android phones; China attackers exploit legally-mandated wiretapping backdoor in major telecom systems; new FIDO standard proposed for allowing passkeys to be exported and backed up; a PSA on why you shouldn't share personal information with AI chatbots.

Article Links

[The Hacker News] Mozilla Warns of Active Exploitation in Firefox, Urges Users to Update Immediately https://thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html

[therecord.media] National Public Data files for bankruptcy, citing fallout from cyberattack https://therecord.media/national-public-data-bankruptcy-cyberattack

[techcrunch.com] Hackers were targeting Android users with Qualcomm zero-day https://techcrunch.com/2024/10/09/hackers-were-targeting-android-users-with-qualcomm-zero-day/

[pluralistic.net] China hacked Verizon, AT&T and Lumen using the FBI’s backdoor https://pluralistic.net/2024/10/07/foreseeable-outcomes/

[appleinsider.com] Future Passkeys will be able to be shared across platforms & password vaults https://appleinsider.com/articles/24/10/15/future-passkeys-will-be-able-to-be-shared-across-platforms-password-vaults

[9to5mac.com] PSA: Here’s another reason not to include personal details in AI chats https://9to5mac.com/2024/10/17/psa-heres-another-reason-not-to-include-personal-details-in-ai-chats/

Tip of the Week: Understanding AI Chatbots

Further Info

Help me reach more people! https://fdsd.me/awareness2

Privacy Not Included chatbot privacy guide: https://foundation.mozilla.org/en/privacynotincluded/articles/how-to-protect-your-privacy-from-chatgpt-and-other-ai-chatbots/

Gandalf AI game: https://gandalf.lakera.ai/baseline 

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:01: Google finally killing uBlock Origin

0:04:07: News preview

0:05:54: Mozilla Warns of Active Exploitation in Firefox

0:08:55: National Public Data files for bankruptcy

0:14:42: Hackers were targeting Android users with Qualcomm zero-day

0:19:14: China hacked Verizon, AT&T and Lumen using the FBI’s backdoor

0:26:10: Future Passkeys will be able to be shared across platforms & password vaults

0:31:08: Here’s another reason not to include personal details in AI chats

0:37:40: Tip of the Week: Understanding Chatbots

0:55:55: Wrapping up

0:56:35: Celebrating 400 episodes!

L0pht Heavy Industries (pronounced "loft") was one of the most influential hacker groups in history. Unlike many others, L0pht carefully cultivated a relationship with mass media, sold profitable products, started businesses, and even testified before the US Senate. Cris Thomas, aka Space Rogue, was one of the earliest members of the L0pht and he recently published a book chronicling the groups long and storied history called Space Rogue: How the Hackers Known As L0pht Changed the World. Today I sit down with Cris to discuss that history and the impacts that the L0pht and other hacker groups have had on all of us.

Interview Notes

Space Rogue’s website: https://www.spacerogue.net/

L0pht homepage: https://l0pht.com/ 

L0phtCrack: https://www.l0phtcrack.com/ 

Textfiles.com: http://textfiles.com/ 

L0phy testimony: https://www.youtube.com/watch?v=VVJldn_MmMY 

Charlie Rose “Hackers” interview: https://www.youtube.com/watch?v=zbTkOuPv2fo 

PicoCTF: https://www.picoctf.org/ 

Hack the Box: https://help.hackthebox.com/en/articles/5200851-introduction-to-ctfs 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:23: Episode 400 coming soon!

0:01:16: Interview setup

0:03:49: Tell us about your book

0:04:52: What is your origin story? How'd you get into hacking?

0:08:15: How often did you meet your fellow hackers in person?

0:10:49: How did the L0pht get started?

0:15:39: What was the reaction when you "come out" as a hacker to friends and family?

0:20:02: How much did different hacker groups interact back in the day?

0:23:19: L0pht cultivated a relationship with the media - how did that affect the dynamic?

0:28:19: What's the history behind the infamous L0phtCrack password tool?

0:35:36: What was it like testifying in front of the US Senate?

0:38:32: How did you get away with testifying under your hacker names?

0:45:29: How did Hacker News Network come to be?

0:52:06: How did we avoid a hacker cyber war against China in the late 90s?

0:57:15: Which of L0pht's many achievements are you most proud of?

0:59:40: What advice would you give to someone wanting to get into cybersecurity?

1:05:39: What's next for you?

1:06:23: Patron bonus content preview

1:06:52: Post-interview notes

1:08:36: Looking ahead

Sometimes it’s obvious when your accounts are hacked. Maybe your money is gone. Maybe you can no longer log in using the password you know is correct. Maybe everyone you know has gotten a scam email from you that you didn’t send. But sometimes bad guys aren’t so obvious. They may lurk around in your accounts to gather information for identity theft or in hopes of gaining access to other more lucrative accounts. I'll tell you how to find out.

In other news: CA governor vetoes opt-out signal bill but signs car privacy bill; 23andMe is in trouble and your data may be, too; PayPal opted you into data sharing without asking; Kaspersky deletes itself and installs UltraAV without asking; 100 million Americans had background data leaked; researchers add facial recognition tech to Meta's smart glasses; NIST updates password rules to with common sense changes; US & Microsoft seize 100+ web domains used by Russian hackers.

Article Links

[Ars Technica] Calif. Governor vetoes bill requiring opt-out signals for sale of user data https://arstechnica.com/tech-policy/2024/09/calif-gov-vetoes-attempt-to-require-new-privacy-option-in-browsers-and-oses/ 

[Teach Privacy] Bankruptcy Sale of DNA Data: From Toysmart to 23andMe https://teachprivacy.com/bankruptcy-sale-of-dna-data-from-toysmart-to-23andme/ 

[404 Media] Paypal Opted You Into Sharing Data Without Your Knowledge https://www.404media.co/paypal-personalized-shopping-opt-out/ 

[Bleeping Computer] Kaspersky deletes itself, installs UltraAV antivirus without warning https://www.bleepingcomputer.com/news/security/kaspersky-deletes-itself-installs-ultraav-antivirus-without-warning/ 

[Tom’s Guide] 100 million Americans just had their background check data exposed https://www.tomsguide.com/computing/online-security/100-million-americans-just-had-their-background-check-data-exposed-online-how-to-stay-safe 

[404 Media] Someone Put Facial Recognition Tech onto Meta's Smart Glasses to Instantly Dox Strangers https://www.404media.co/someone-put-facial-recognition-tech-onto-metas-smart-glasses-to-instantly-dox-strangers/ 

[Ars Technica] NIST proposes barring some of the most nonsensical password rules https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-most-nonsensical-password-rules/ 

[The Record] California passes car data privacy law to protect domestic abuse survivors https://therecord.media/california-car-data-privacy-law-domestic-abuse-tracking 

[Semafor] US, Microsoft seize more than 100 websites used by Russian hackers https://www.semafor.com/article/10/03/2024/us-microsoft-seize-more-than-100-websites-used-by-russian-hackers 

Tip of the Week: Indicators of Account Compromise: https://firewallsdontstopdragons.com/indicators-of-account-compromise/ 

Further Info

Help me reach more people! https://fdsd.me/awareness2

Treasure Chest promotion: https://firewallsdontstopdragons.com/treasure-coin-promo/ 

How to enable Global Privacy Control: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 

My article on removing your data from the web: https://firewallsdontstopdragons.com/osint-remediation/ 

CISA Cybersecurity Awareness Month resources: https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-cybersecurity-awareness-month-2024-toolkit 

Stay Safe Online CAM site: https://staysafeonline.org/programs/cybersecurity-awareness-month/ 

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:12: Cybersecurity Awareness Month!

0:01:51: Update Apple software

0:03:21: News rundown

0:05:41: CA Governor vetoes bill requiring opt-out signals for sale of user data

0:11:51: Potential Bankruptcy Sale of DNA Data from 23andMe

0:17:22: Paypal Opted You Into Sharing Data Without Your Knowledge

0:22:01: Kaspersky deletes itself, installs UltraAV antivirus without warning

0:28:14: 100 million Americans just had their background check data exposed

0:32:13: Someone Put Facial Recognition Tech onto Meta's Smart Glasses to Instantly Dox Strangers

0:36:33: NIST proposes barring some of the most nonsensical password rules

0:42:21: California passes car data privacy law to protect domestic abuse survivors

0:45:36: US, Microsoft seize more than 100 websites used by Russian hackers

0:47:49: Tip of the Week

1:04:13: promoting the 400th episode

1:05:42: Patron perks!

1:09:08: Looking ahead

Two security researchers showed how many modern VPN services are vulnerable to malicious misconfiguration, exposing some or all of your internet traffic. While this is not likely to impact most of us, it does expose the limitations of Virtual Private Networks and why they are not silver bullets for security of privacy - despite many marketing claims to the contrary. Today we'll discuss how TunnelVision works, how it can be mitigated, and how this affects different privacy threat models with the two researchers from Leviathan Security, Dani Cronce and Lizzie Moratti.

Interview Notes

Lizzie Moratti: https://www.linkedin.com/in/lmoratti/ 

Dani Cronce: https://www.linkedin.com/in/danicronce/ 

TunnelVision: https://www.tunnelvisionbug.com/ 

ProtonVPN threat model: https://protonvpn.com/blog/threat-model 

Dani’s GitHub: https://github.com/superit23 

Leviathan Security blog: https://www.leviathansecurity.com/blog 

Veilid: https://veilid.com/ 

Willy Wonka scene: https://www.youtube.com/watch?v=pvS3j8VtanM 

Linux network namespaces: https://blog.scottlowe.org/2013/09/04/introducing-linux-network-namespaces/ 

What is DeFi? https://www.investopedia.com/decentralized-finance-defi-5113835 

Further Info

Help me brainstorm ways to reach more people!: https://fdsd.me/awareness2 

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:23: Reminder: brainstorming survey

0:01:47: Podcast chapter markers!

0:02:54: Interview setup

0:05:55: What is a VPN and what isits intended purpose?

0:10:27: If most connections are secured today, why do we need a VPN?

0:12:40: Why do we trust a VPN provider more than our internet access provider?

0:17:40: What are you trying to do with a VPN?

0:19:13: Who can see my internet traffic?

0:25:30: What is TunnelVision and what are the implications for VPN users?

0:29:42: What's a less technical way to understand TunnelVision?

0:33:06: Why might I not want all my traffic to go through the VPN?

0:35:02: How dangerous is TunnelVision for the average person?

0:42:30: How did the VPN companies respond?

0:51:19: What VPN features can mitigate the risk?

0:57:42: Have any VPN makers fixed this problem? Do OS vendors have responsibility here?

1:02:11: Do you have recommendations for VPNs? Is there new tech that might help here?

1:04:00: Would privacy regulations help here?

1:06:24: What are you working on next?

1:08:51: Interview wrap-up

1:13:31: Looking ahead

We often think of malware as a problem for our computers and perhaps our smartphones. But bad guys love to hack our home routers and IoT devices, as well. Thankfully, purging malware from those types of devices can usually be done just by rebooting them. (There's a reason tech support always asks you to try turning your device off and back on again.) I'll explain why this works and what you should do to protect your connected devices.

In other news: I explain why most people are not in danger of their devices blowing up; a new Windows phishing campaign uses fake CAPTCHAs and PowerShell; LinkedIn started training their AI on your data before telling you how to opt out; Oracle's CEO touts his vision of ubiquitous AI surveillance; Ford seeks a patent to show you ads in your vehicle based on your conversations and other private data; Meta admits to scraping public Instagram and Facebook posts to train its AI; four great new iOS 18 privacy and security features; Apple Intelligence servers are very basic, for a reason; and the FBI shuts down a massive Chinese botnet.

Article Links

[WIRED] Your Phone Won’t Be the Next Exploding Pager https://www.wired.com/story/exploding-pagers-hezbollah-phones/

[briankrebs] This Windows PowerShell Phish Has Scary Potential https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/

[404media.co] LinkedIn Is Training AI on User Data Before Updating Its Terms of Service https://www.404media.co/linkedin-is-training-ai-on-user-data-before-updating-its-terms-of-service/

[theregister.com] Ellison declares Oracle 'all in' on AI mass surveillance https://www.theregister.com/2024/09/16/oracle_ai_mass_surveillance_cloud/

[therecord.media] Ford seeks patent for tech that listens to driver conversations to serve ads https://therecord.media/ford-patent-application-in-vehicle-listening-advertising

[9to5Mac] Meta scraped all public Facebook and Instagram posts since 2007 for AI training https://9to5mac.com/2024/09/11/meta-scraped-all-public-facebook-and-instagram-posts-since-2007-for-ai-training/

[TechRadar] I'm a privacy expert—here are the 4 iOS 18 features I'm excited about https://www.techradar.com/phones/im-a-privacy-experthere-are-the-4-ios-18-features-im-excited-about

[9to5Mac] Apple Intelligence servers are really basic, says Craig Federighi – and that’s deliberate https://9to5mac.com/2024/09/12/apple-intelligence-servers-are-really-basic-says-craig-federighi-and-thats-deliberate/

[Gizmodo] FBI Shuts Down Botnet Run by Beijing-Backed Hackers That Hijacked Over 200,000 Devices https://gizmodo.com/fbi-shuts-down-botnet-run-by-beijing-backed-hackers-that-hijacked-over-200000-devices-2000500627

Tip of the Week: Malware Reboot Remedy

Further Info

Awareness Campaign Phase 2!: https://fdsd.me/awareness2 

LinkedIn privacy settings: https://www.linkedin.com/mypreferences/d/categories/privacy 

Test your ad blocker(s): https://d3ward.github.io/toolz/adblock.html 

Send me your questions! https://fdsd.me/qna 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Become a patron! https://www.patreon.com/FirewallsDontStopDragons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Support our mission! https://fdsd.me/support 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:31: Update Apple devices

0:01:36: Awareness Campaign teaser

0:02:04: News rundown

0:04:08: Your Phone Won’t Be the Next Exploding Pager

0:08:00: This Windows PowerShell Phish Has Scary Potential

0:12:34: LinkedIn Trains AI on Your Data Before Updating Its ToS

0:16:41: Ellison declares Oracle 'all in' on AI mass surveillance

0:20:15: Ford seeks patent for tech that listens to driver conversations to serve ads

0:26:32: Meta scraped all public Facebook and Instagram posts since 2007 for AI training

0:30:29: I'm a privacy expert—here are the 4 iOS 18 features I'm excited about

0:35:55: Apple Intelligence servers are really basic – and that’s deliberate

0:40:57: FBI Shuts Down Botnet Run by Beijing-Backed Hackers

0:45:02: Tip of the Week: Malware Reboot Remedy

0:54:29: Ad Block Tester

0:55:43: Awareness Campaign, Phase 2!

1:01:44: Looking ahead