Firewalls Don't Stop Dragons Podcast

We here in the US like to believe that we're the gold standard for democracy. And yet, in recent years, much of the electorate has lost faith in the outcome of our elections. Many security researchers have found concerning vulnerabilities in our voting systems, and yet we have no evidence that those vulnerabilities have actually been exploited. Many people believe that people are voting multiple times or that ineligible people are voting, and yet study after study shows that voter fraud is nearly non-existent. How can we restore trust in our election results? What changes must we make to our election systems and processes to promote complete transparency and remove doubt? Today I'll dig deep into this complicated topic with Ben Adida, founder and Executive Director of VotingWorks.

Interview Notes

VotingWorks: https://www.voting.works/

Risk Limiting Audits with ARLO:  https://www.voting.works/risk-limiting-audits 

Verified Voting, Verifier tool: https://verifiedvoting.org/verifier/ 

Ben’s PhD thesis defense (Verifying a Secret-Ballot Election with Cryptography) and much more: https://ben.adida.net/presentations/ 

Voluntary Voting System Guidelines (VVSG) 2.0: https://www.eac.gov/sites/default/files/TestingCertification/Voluntary_Voting_System_Guidelines_Version_2_0.pdf 

Harri Hursti interview: https://podcast.firewallsdontstopdragons.com/2021/11/08/restoring-trust-in-our-elections/ 

ElectionGuard interview: https://podcast.firewallsdontstopdragons.com/2021/12/06/defending-democracy-with-technology/ 

DEF CON Voting Village videos: https://www.youtube.com/@defconvotingvillage/videos 

Further Info

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:03:28: What is the mission of VotingWorks and what drove you to found it?

0:04:39: How do election work, exactly, here in the US?

0:12:26: How are all the votes tabulated and reported?

0:14:11: Where are US elections most vulnerable to influence?

0:19:52: How does accessibility impact security in elections?

0:24:27: How can we harden the election systems and processes?

0:31:16: How to risk-limiting audits work?

0:33:11: How vulnerable are election computers to hacking?

0:36:37: If our systems are vulnerable, why haven't they been hacked?

0:43:37: How can we best convince people that our election outcomes are valid?

0:51:30: How prevelent is voter fraud in the US?

0:53:56: Do we have federal minimum guidelines for election security?

0:56:52: Why aren't election systems open for third party review?

0:58:25: How do I learn about my local election systems and processes?

1:04:22: Wrap-up

1:07:34: Looking ahead

Your online account credentials have two parts: a user name and a password. Today, most online providers force you to use your email address for your user name. This gives the service provider a guaranteed way to contact (and spam) their users, but it also means that bad guys know half of all your credentials and data brokers have a unique ID to track you across all your accounts. Today I'll explain the value of using email aliases for your online user names.

In other news: Iranian hackers attack US water plant; CISA launches program to address critical infrastructure threats; Google Drive users report missing data; Plex users fear new feature will leak p0rn watching habits; several articles on the ease of using data broker tools to spy on just about anyone, creating privacy and national security problems; smart mattress company CEO inadvertently reveals extent of data collection; concerns about IoT device sold with a home; overblown fears over Apple's new NameDrop feature; Zelle offering refunds to some scam victims; and Malwarebyte's survey of people's security practices (spoiler: it's bad).

Article Links

[The Hacker News] Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S. https://thehackernews.com/2023/11/iranian-hackers-exploit-plcs-in-attack.html

[Dark Reading] CISA Launches Pilot Program to Address Critical Infrastructure Threats https://www.darkreading.com/ics-ot/cisa-launches-pilot-program-critical-infrastructure-threats

[AppleInsider] Google Drive users complain of missing files, months of data disappearing https://appleinsider.com/articles/23/11/27/google-drive-users-complain-of-missing-files-months-of-data-disappearing

[404media.co] Plex Users Fear New Feature Will Leak Porn Habits to Their Friends and Family https://www.404media.co/plex-users-fear-discover-together-week-in-review-feature-will-leak-porn-habits-to-their-friends-and-family/

[Rolling Stone] We Spied on Trump’s ‘Southern White House’ From Our Couches https://www.rollingstone.com/culture/culture-features/data-brokers-trump-tech-spying-privacy-threat-1234897098/

[9to5mac.com] Data brokers selling even more sensitive info; national security risk, says report https://9to5mac.com/2023/11/14/data-brokers-sensitive-info/

[MIT Technology Review] The US military’s privacy problem in three charts https://www.technologyreview.com/2023/11/13/1083262/the-us-militarys-privacy-problem-in-three-charts/

[therecord.media] Court rules automakers can record and intercept owner text messages https://therecord.media/class-action-lawsuit-cars-text-messages-privacy

[404media.co] CEO Reminds Everyone His Company Collects Customers' Sleep Data to Make Zeitgeisty Point About OpenAI Drama https://www.404media.co/ceo-reminds-everyone-eightsleep-pod-collects-sleep-data-to-make-zeitgeisty-point-about-openai-drama/

[sdmmag.com] Who Is Gonna “Own” the IoT? https://www.sdmmag.com/articles/93730-who-is-gonna-own-the-iot

[TechRadar] NameDrop in iOS 17 doesn’t have to be a privacy nightmare – here’s how to control it https://www.techradar.com/phones/ios/namedrop-in-ios-17-doesnt-have-to-be-a-privacy-nightmare-heres-how-to-control-it

[9to5mac.com] Zelle scams: App now starting limited refunds, under pressure from lawmakers https://9to5mac.com/2023/11/13/zelle-scams/

[malwarebytes.com] 3 crucial security steps people should do, but don't https://www.malwarebytes.com/blog/news/2023/10/the-3-crucial-security-steps-people-should-do-but-dont

OwnCloud hack: https://www.helpnetsecurity.com/2023/11/28/cve-2023-49103/ 

Pros & Cons of Antivirus Software: https://firewallsdontstopdragons.com/the-pros-and-cons-of-anti-virus-software/ 

Tip of the Week: https://firewallsdontstopdragons.com/how-to-use-email-aliases-part-1/

Further Info

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:57: Important software updates

0:01:56: News run down

0:05:18: Iranian Hackers Exploit PLCs in Attack on Water Authority in U.S.

0:07:49: CISA Launches Pilot Program to Address Critical Infrastructure Threats

0:09:38: Google Drive users complain of missing files, data

0:14:55: Plex Users Fear New Feature Will Leak P*rn Habits to Their Friends and Family

0:19:34: We Spied on Trump’s ‘Southern White House’ From Our Couches

0:23:36: Data brokers selling even more sensitive info creating national security risk

0:26:48: The US military’s privacy problem in three charts

0:30:33: Court rules automakers can record and intercept owner text messages

0:32:49: CEO Reminds Everyone His Company Collects Customers' Sleep Data via Tweet

0:39:09: Transferring IoT devices in a home sale

0:43:30: NameDrop in iOS 17 doesn’t have to be a privacy nightmare

0:47:56: Zelle now starting limited refunds, under pressure from lawmakers

0:52:08: 3 crucial security steps people should do, but don't

0:57:56: Tip of the Week: email aliases

1:03:12: Plan for December

1:08:59: Reaching more people

City governments are relying more and more on a vast network of sensors to tell them what's going on: stop light cameras, gunshot detectors, air quality sensors, license plate readers, automated toll booths, and much more. While these technologies can help the powers that be allocate precious resources and gain helpful insights, they can also lead to over-policing, chilling of free speech and mass warrantless surveillance. Today I'll discuss the dangers of smart cities with Eleni Manis from the Surveillance Technology Oversight Project (STOP).

Interview Notes

Surveillance Technology Oversight Project: https://www.stopspying.org/ 

S.T.O.P.'s Beginner’s Guide to the All-Too-Dumb World of Smart Cities: www.justcities.tech 

CCOPS laws: https://www.eff.org/issues/community-control-police-surveillance-ccops 

Further Info

Best & Worst Gifts for 2023: https://firewallsdontstopdragons.com/best-worst-gifts-2023/

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:04:38: What got you into researching smart cities?

0:09:03: What are the positive aspects of smart cities?

0:13:06: How ubiquitous are these smart city technologies?

0:15:32: What are some of the most concerning smart city technologies?

0:16:45: is this data being shared between local and federal agencies?

0:19:14: Can students opt out of school surveillance?

0:20:48: How can the police access footage from video doorbells?

0:24:20: How is this tech used for predictive policing?

0:26:31: Do these predictive policing systems actually work?

0:27:29: How does this mass surveillance affect people?

0:28:58: What about use of surveillance tech in neighborhoods?

0:33:56: Who operates these sensor networks? Who can access the data?

0:37:49: Is it possible to anonymize this data properly?

0:42:06: Can government agencies access our cellular data?

0:45:22: Can you refuse to hand your cell phone over to authorities?

0:48:04: Can we find ways to collect this data without ruining privacy?

0:49:42: How do I find out what smart city tech is being used in my area?

0:53:29: Wrap-up

0:54:57: Preview of upcoming shows

The holiday gift-giving season is upon us - and therefore it's time for my annual guide on the best and worst gifts for your loved ones, at least in terms of security and privacy. There are some perennial favs on the nice and naughty lists, but there are some newcomers, as well. And I've got some top tips for how to shop for privacy-respecting, security-protecting products! I've even got some ideas for free and helpful stocking stuffers.

In the news: FCC tried to protect consumers from SIM-swap attacks; cheap children's tablet came with malware and data mining software; medical transcription service has data of 9M patients exposed; hackers hold data from plastic surgeon patients for ransom, including nude photos; FTC filing in Kochava case unsealed showing 'staggering' amount of data for sale; Bitwarden announces support for passkeys; Article 45 of eIDAS 2.0 bill will completely undermine internet security in the EU.

Article Links

[The Hacker News] FCC Enforces Stronger Rules to Protect Customers Against SIM Swapping Attacks https://thehackernews.com/2023/11/fcc-enforces-stronger-rules-to-protect.html

[TechCrunch] Children’s tablet has malware and exposes kid’s data, researcher finds https://techcrunch.com/2023/11/16/childrens-tablet-has-malware-and-exposes-kids-data-researcher-finds/

[BleepingComputer] PJ&A says cyberattack exposed data of nearly 9 million patients https://www.bleepingcomputer.com/news/security/pj-and-a-says-cyberattack-exposed-data-of-nearly-9-million-patients/

[8newsnow.com] Hackers target Las Vegas plastic surgeons, post patient information, naked photos online https://www.8newsnow.com/investigators/hackers-target-las-vegas-plastic-surgeons-post-patient-information-naked-photos-online/

[Ars Technica] Data broker’s “staggering” sale of sensitive info exposed in unsealed FTC filing https://arstechnica.com/tech-policy/2023/11/data-brokers-staggering-sale-of-sensitive-info-exposed-in-unsealed-ftc-filing/

[bitwarden.com] Bitwarden launches passkey management https://bitwarden.com/blog/bitwarden-launches-passkey-management/

[Electronic Frontier Foundation] Article 45 Will Roll Back Web Security by 12 Years https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years

Best & Worst Gifts for 2023: https://firewallsdontstopdragons.com/best-worst-gifts-2023/ 

Further Info

Give Thanks!: https://firewallsdontstopdragons.com/give-thanks-donate/ 

Consumer Reports Naughty List: https://foundation.mozilla.org/en/privacynotincluded/articles/our-longest-naughty-list-ever-the-2023-holiday-buyers-guide-is-here/ 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:37: News run-down

0:03:18: FCC Enforces Stronger Rules to Protect Against SIM Swapping

0:06:39: Children’s tablet has malware and exposes kid’s data

0:11:22: Cyberattack exposed data of nearly 9 million patients

0:15:16: Hackers target plastic surgeons, post patient info, naked photos online

0:22:37: Data broker’s “staggering” sale of sensitive info exposed in unsealed FTC filing

0:27:10: Bitwarden launches passkey management

0:30:45: Article 45 Will Roll Back Web Security by 12 Years

0:39:00: Best & Worst Gifts for 2023

0:42:38: The Naughty List

0:47:50: The Nice List

0:59:14: Give thanks!

1:00:03: FDSD Merch sale!

1:00:25: Upcoming shows & promotion

Today there is a thriving market for legal, for-profit smartphone spyware (aka mercenary spyware). Companies like the NSO Group are free to create and sell highly sophisticated, zero-click malware such as Pegasus which has been used to spy on dissidents, politicians, activists and journalists around the world. There are also several apps available to parents to track their children, but are often used to abuse or stalk adult partners or ex-lovers. Today I'll discuss the state of these malicious apps, ways to protect our smartphones and even detect such spyware after the fact with the co-founders of iVerify, Danny Rogers and Rocky Cole.

Interview Notes

iVerify app: https://www.iverify.io/consumer

xkcd “Security” cartoon: https://xkcd.com/538/ 

Moxie Marlinspike (Signal) on Cellebrite tool: https://signal.org/blog/cellebrite-vulnerabilities/ 

Further Info

Nominate someone for a challenge coin: https://fdsd.me/quest 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:38: Interview setup

0:03:08: How does iVerify work and why did you create it?

0:07:10: What sort of people need protection like iVerify?

0:11:07: How do you know that you can trust a security app?

0:14:54: What do MDM profiles do to my phone? Is it reversible?

0:20:37: How dangerous are third-party app stores, compared to Apple/Google?

0:27:37: If an app I've installed is pulled from the app store, will I be notified?

0:28:50: How hard is it today to jailbreak a phone?

0:31:49: How do you tell if a phone has been hacked?

0:33:21: Can you detect if an app has escaped its sandbox?

0:38:09: What is the marketplace like for spyware?

0:41:36: Are phones getting harder to hack?

0:44:16: Is it possible to detect or prevent hacking via physical access?

0:49:11: How do Apple and Google phones compare on security?

0:52:08: How does Apple's Lockdown Mode work?

0:54:47: Should governments outlaw the sale of mercenary spyware?

1:01:10: Should governments hoard 0-days or disclose them?

1:03:31: What are your top security tips for regular users?

1:05:44: What's next for iVerify?

1:07:28: Wrap-up

Connecting all our stuff to the internet – making devices “smart” – brings with it a lot of risks. Besides the more obvious cybersecurity vulnerabilities, these devices are also collecting a lot of personal data, offsetting razor thin profit margins by monetizing our data. In most cases, we can limit this data exfiltration using outbound firewalls and DNS services, or just by disconnecting the devices from the internet altogether. But lately I've been seeing devices coming configured with cellular data connections, which would effectively bypass your home network entirely - and therefore your ability to block or control the data flow.

In other news: 1Passwords discloses security breach; Drug makers to pay 23andMe for access to your DNA; EFF publishes guidance for 23andMe customers after further data breach; Apple's private Wi-Fi MAC address feature has never worked right, until now; Hackers find side-channel attack on Apple Silicon to pull private data from Safari browsers; Windows PCs targeted with new malware; YouTube is waging a new way on ad blockers; Apple's iMessage has new method to thwart 'ghost' listeners; the White House releases sweeping executive order on AI; Pew publishes new study on data privacy views.

Article Links

[BleepingComputer] 1Password discloses security incident linked to Okta breach https://www.bleepingcomputer.com/news/security/1password-discloses-security-incident-linked-to-okta-breach/

[Bloomberg] Drugmakers Are Set to Pay 23andMe Millions to Access Consumer DNA https://www.bloomberg.com/news/articles/2023-10-30/23andme-will-give-gsk-access-to-consumer-dna-data

[Electronic Frontier Foundation] What to Do If You're Concerned About the 23andMe Breach https://www.eff.org/deeplinks/2023/10/what-do-if-youre-concerned-about-23andme-breach

[AppleInsider] Apple's private Wi-Fi MAC addresses were security theater until iOS 17.1 https://appleinsider.com/articles/23/10/27/apples-private-wi-fi-mac-addresses-were-security-theater-until-ios-171

[Ars Technica] Hackers can force iOS and macOS browsers to divulge passwords and much more https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

[TechRadar] Windows PCs are being targeted with a nasty new malware - here's what you need to know https://www.techradar.com/pro/security/windows-pcs-are-being-targeted-with-a-nasty-new-malware-heres-what-you-need-to-know

[404media.co] YouTube's 'War' on Adblockers Shows How Google Controls the Internet https://www.404media.co/youtubes-war-on-adblockers-shows-how-google-controls-the-internet/

[9to5mac.com] iMessage Contact Key Verification blocks the ‘ghost proposal’ plan by government spy agency https://9to5mac.com/2023/10/30/imessage-contact-key-verification-reason/

[Mashable] White House drops an AI regulation bombshell: 10 new mandates that'll shake up the industry https://mashable.com/article/white-house-drops-ai-regulation-bombshell

[pewresearch.org] How Americans View Data Privacy https://www.pewresearch.org/internet/2023/10/18/how-americans-view-data-privacy/

Tip of the Week: The Rise of Cellular IoT https://firewallsdontstopdragons.com/the-rise-of-cellular-iot/  

Further Info

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:56: News rundown

0:03:11: 1Password discloses security incident linked to Okta breach

0:06:09: Drugmakers Are Set to Pay 23andMe Millions to Access Consumer DNA

0:10:08: What to Do If You're Concerned About the 23andMe Breach

0:16:32: Apple's private Wi-Fi MAC addresses were security theater until iOS 17.1

0:18:59: Hackers can force iOS and macOS browsers to divulge private data

0:25:14: Windows PCs are being targeted with a nasty new malware

0:30:24: YouTube's 'War' on Adblockers Shows How Google Controls the Internet

0:38:48: iMessage Contact Key Verification blocks the ‘ghost proposal’ plan by government spy agency

0:43:50: White House drops an AI regulation bombshell

0:49:53: How Americans View Data Privacy

0:54:33: Tip of the Week: The Cellular IoT Bypass

1:03:14: Wrap-up

What happened to the internet? It had so much promise. Social media and search results are full of stuff we never wanted to see. Surveillance capitalism is monetizing our most private information to serve us so many ads that we can never seem to consume the actual content. And if we're all so unhappy with the incumbents, where are the competitors offering better service? Cory Doctorow helps us understand how the internet got so crappy and what we can do to fix it.

Cory Doctorow is a science fiction author, activist, journalist and blogger at the site Pluralistic. He has written a bunch of great books, both fiction and non, including Little Brother, Red Team Blues and Chokepoint Capitalism.

Interview Notes

TikTok’s Ensh*tification: https://pluralistic.net/2023/01/21/potemkin-ai/#hey-guys 

Cory’s blog: https://pluralistic.net/

Cory at DEF CON 31: https://www.youtube.com/watch?v=rimtaSgGz_4 

The Internet Con: https://craphound.com/category/internetcon/ 

Chokepoint Capitalism: https://chokepointcapitalism.com/ 

Red Team Blues: https://craphound.com/category/novels/redteamblues/  

Saving the News from Big Tech: https://www.eff.org/deeplinks/2023/04/saving-news-big-tech 

Tracking Exposed: https://tracking.exposed/ 

Further Info

Nominate someone for a challenge coin: https://fdsd.me/quest 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:55: Defining some terms

0:03:57: Swear warning

0:04:25: What have you been up to since we last had you on the show?

0:07:58: What is ensh*tification? How does it work?

0:18:26: Have any companies actually completed the ensh*tification cycle?

0:22:36: Do we have concrete examples of interoperability breaking this cycle?

0:29:07: What percentage of oday are not what we asked for?

0:37:04: What happens to DRM'd content when the licencing company goes away?

0:39:19: How can we reverse engineer these algorithms?

0:41:04: How is social media promotion like a big carnival teddy bear?

0:44:28: Whatever happened to the Amazon Smile program?

0:45:58: What do you mean by the End-to-End Principle?

0:51:53: Isn't ensh*tification just a natural result of modern capitalism?

0:54:02: Doesn't capitalism require rules (aka regulations)?

0:57:18: So what are the solutions? How do we fix the internet?

1:02:46: Did we undermine antitrust by lowering the bar of consumer harm?

1:04:25: What can we do to help, as consumers and citizens?

1:07:06: Wrap-up

1:07:50: Looking ahead

Email is old and was never built for security and privacy. Thankfully there are several modern secure email services. My personal favorite is Proton Mail and I'll explain to you today why you should really give it a try. I will also (finally) answer several interesting "Dear Carey" questions from listeners.

In other news: If you use WinRAR, you need to update right away; hackers are targeting a company that brokers Emergency Data Requests between law enforcement and Big Tech companies; Google is forced to reveal user search history in a CO court case; Google is making passkeys the default, but you may want to wait; EFF asks MasterCard to stop selling our data; and Bruce Schneier has an insightful article around the rather heated discussions over the benefits and dangers of artificial intelligence.

Article Links

[Gizmodo] You Need to Update WinRAR, Right Now https://gizmodo.com/you-need-to-update-winrar-right-now-1850939201

[404media.co] Hackers Target Company That Vets Police Data Requests for Tech Giants https://www.404media.co/hackers-target-kodex-accounts-edrs/

[TechSpot] Google forced to reveal user search history in Colorado court ruling https://www.techspot.com/news/100529-google-forced-reveal-users-search-queries-colorado-court.html

[blog.google] Passwordless by default: Make the switch to passkeys https://blog.google/technology/safety-security/passkeys-default-google-accounts/

[Electronic Frontier Foundation] Mastercard Should Stop Selling Our Data https://www.eff.org/deeplinks/2023/10/mastercard-should-stop-selling-our-data

[Schneier Blog] AI Risks https://www.schneier.com/blog/archives/2023/10/ai-risks.html

Tip of the Week: Try Proton https://firewallsdontstopdragons.com/its-time-to-try-proton/ 

Further Info

De-Googling Your Life: https://firewallsdontstopdragons.com/reducing-my-google-footprint/ 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:12: News rundown

0:02:38: You Need to Update WinRAR, Right Now

0:05:10: Hackers Target Company That Vets Police Data Requests for Tech Giants

0:11:22: Google forced to reveal user search history in Colorado court ruling

0:15:59: Google: Passwordless by default

0:21:48: EFF: Mastercard Should Stop Selling Our Data

0:25:59: Bruce Schneier: AI Risks

0:33:12: Mailbag!!

0:42:28: Tip of the Week: Try Proton

0:54:25: Wrap up, look ahead

There are several privacy-focused services available today. And the products we use have a dizzying array of privacy and security settings. How do you know which products you need and which vendors you can trust? How do you know which protections you need and which ones you don't? It comes down to understanding your personal threat model. We each have different things to protect and different consequences for failure. Today I'll speak with Andy Yen, CEO and founder of Proton, to help us figure out what we need.

Interview Notes

Proton Sentinel: https://proton.me/blog/sentinel-high-security-program 

Privacy Decrypted #1: https://proton.me/blog/what-is-a-threat-model?ref=instantsearch 

Private from Everyone (But Us):  https://podcast.firewallsdontstopdragons.com/2022/04/25/private-from-everyone-but-us/

Security Planner (threat model tool): https://innovation.consumerreports.org/initiatives/security-planner/ 

Ars Technica threat model series: https://arstechnica.com/features/2021/10/securing-your-digital-life-part-1/ 

Further Info

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:01:03: Show preview0:01:44: Delete Act passes0:02:36: What new at Proton since we last spoke?0:07:00: How do you determine your personal threat model?0:09:21: How does Proton decide which threat models to address?0:13:40: How do you learn about all the possible security settings?0:15:37: How do you know which companies and products you can trust?0:18:11: How should VC money and buyouts affect our trust?0:22:30: What should tech reviewers be focusing on with privacy products?0:26:24: How important is a company's location for privacy?0:28:47: Are technological solutions sufficient to protect our data?0:30:22: Has Proton received any pressure from governments to weaken privacy?0:33:27: Does Proton actively market to government officials?0:34:43: How can larger companies protect against insider threats?0:37:05: What's your take on the LastPass breach?0:41:32: What is Proton Sentinel and who is it for?0:46:09: Will Sentinel be able to scale?0:47:31: Proton asks Sentinel users for personal information - is that safe?0:51:04: Can you share any specific Sentinel success stories?0:53:39: What other features would you like to add to Proton?0:58:30: Wrap-up1:00:11: Look ahead

October is national Cybersecurity Awareness Month here in the US. One of the four key themes this year is Recognizing and Reporting Phishing. We just discussed this at length with Nick Oles, but I wanted to give my perspective and tell you how to report phishing emails to the proper authorities.

In other news: cheap Android TV boxes come laced with malware and fraud software; 23andMe investigating massive data breach; US agencies caught using location data illegally; Meta proposes subscription plans in Europe for Facebook and Instagram; FBI warns of 'phantom hacker' scams targeting elderly; new Microsoft AI tool can simulate any voice with just 3 seconds of audio; attackers don't bother brute-forcing long passwords; free upgrade from Windows 7/8 to 10 is going away soon; FCC details plans to reinstate net neutrality; how to turn off Google's new Topics tracking system; new app from Consumer Reports to delete personal data; new privacy-respecting URL shortening tool from Panquake.

Article Links

[WIRED] Your Cheap Android TV Streaming Box May Have a Dangerous Backdoor https://www.wired.com/story/android-tv-streaming-boxes-china-backdoor/

[cyberscoop.com] DNA testing service 23andMe investigating theft of user data https://cyberscoop.com/23andme-user-data-theft/

[404media.co] ICE, CBP, Secret Service All Illegally Used Smartphone Location Data https://www.404media.co/ice-cbp-secret-service-all-broke-law-with-smartphone-location-data/

[9to5mac.com] Meta proposing ad-free Facebook and Instagram plans for up to $17/month https://9to5mac.com/2023/10/03/facebook-instagram-no-ads-plan/

[BleepingComputer] FBI warns of surge in 'phantom hacker' scams impacting elderly https://www.bleepingcomputer.com/news/security/fbi-warns-of-surge-in-phantom-hacker-scams-impacting-elderly/

[futurism.com] New Microsoft AI Can Clone Your Voice From Three Seconds of Audio https://futurism.com/the-byte/new-microsoft-ai-clone-your-voice

[therecord.media] Attackers don’t bother brute-forcing long passwords, Microsoft engineer says https://therecord.media/attackers-dont-bother-brute-forcing-long-passwords-microsoft-engineer-says/

[TechRadar] Been putting off that free Windows 11 or 10 upgrade? Windows 7 and 8 diehards need to move fast https://www.techradar.com/computing/windows/been-putting-off-that-free-windows-11-or-10-upgrade-windows-7-and-8-diehards-need-to-move-fast

[Ars Technica] FCC details plan to restore the net neutrality rules repealed by Ajit Pai https://arstechnica.com/tech-policy/2023/09/fcc-details-plan-to-restore-the-net-neutrality-rules-repealed-by-ajit-pai/

[Electronic Frontier Foundation] How To Turn Off Google’s “Privacy Sandbox” Ad Tracking—and Why You Should https://www.eff.org/deeplinks/2023/09/how-turn-googles-privacy-sandbox-ad-tracking-and-why-you-should

[CNET] This App Can Delete Your Personal History from Websites. And It's Simple https://www.cnet.com/tech/services-and-software/this-app-can-delete-your-personal-history-from-websites-and-its-simple-heres-how-to-use/

[talkliberation.substack.com] NOW SERVING: An early release of the Panquake Pie! https://talkliberation.substack.com/p/panquake-early-release-pnqk-now-available

Tip of the Week: Catching Phish: https://firewallsdontstopdragons.com/how-to-catch-a-phish/ 

Further Info

Win a copy of “How to Catch a Phish”! https://fdsd.me/catchaphish 

National Cybersecurity Awareness Month: https://www.cisa.gov/cybersecurity-awareness-month 

Microsoft’s VALL-E voice-gen tool: https://www.microsoft.com/en-us/research/project/vall-e-x/ 

Panquake URL shortener: https://pnqk.me/ 

Give the gift of privacy and security: https://fdsd.me/coupons 

Send me your questions! https://fdsd.me/qna 

Support our mission! https://fdsd.me/support 

Subscribe to the newsletter: https://fdsd.me/newsletter 

Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book 

Generate secure passphrases! https://d20key.com/#/ 

Table of Contents

Use these timestamps to jump to a particular section of the show.

0:00:21: iOS update, book giveaway

0:01:17: News rundown

0:03:33: Your Cheap Android TV Streaming Box May Have a Dangerous Backdoor

0:07:03: DNA testing service 23andMe investigating theft of user data

0:10:53: ICE, CBP, Secret Service All Illegally Used Smartphone Location Data

0:15:32: Meta proposing ad-free Facebook and Instagram plans for up to $17/mo

0:19:26: FBI warns of surge in 'phantom hacker' scams impacting elderly

0:24:07: New Microsoft AI Can Clone Your Voice From Three Seconds of Audio

0:33:34: Attackers don’t bother brute-forcing long passwords

0:38:08: Free upgrade to Windows 10 about to be cut off

0:41:05: FCC details plan to restore the net neutrality rules

0:45:13: How To Turn Off Google’s “Privacy Sandbox” Ad Tracking

0:51:05: This App Can Delete Your Personal History from Websites

0:56:09: Panquake releases free URL shortening tool

0:59:33: Tip of the Week: Recognizing & Reporting Phish

1:05:42: Wrap-up