WEBVTT

00:00:03.484 --> 00:00:05.125
A vulnerability impacting more than

00:00:05.245 --> 00:00:06.966
seventy percent of Web servers,

00:00:07.107 --> 00:00:09.067
a certificate flaw impacting millions of

00:00:09.108 --> 00:00:10.589
websites and devices around the world,

00:00:10.968 --> 00:00:13.170
and a potential remote zero click iPhone

00:00:13.451 --> 00:00:14.131
vulnerability.

00:00:14.532 --> 00:00:15.631
All this and more coming up on this

00:00:15.651 --> 00:00:17.112
week in privacy number seventy six.

00:00:17.292 --> 00:00:17.893
So stay tuned.

00:00:39.729 --> 00:00:41.850
Welcome back to This Week in Privacy,

00:00:41.990 --> 00:00:43.792
our weekly series where we discuss the

00:00:43.851 --> 00:00:45.353
latest updates with what we've been

00:00:45.393 --> 00:00:47.393
working on within the Privacy Guides

00:00:47.432 --> 00:00:49.975
community and this week's top stories in

00:00:50.015 --> 00:00:52.896
data privacy and cybersecurity while

00:00:52.996 --> 00:00:54.716
answering viewer questions.

00:00:55.216 --> 00:00:55.716
I'm Jordan,

00:00:56.076 --> 00:00:58.018
and this week I'm joined by Nate.

00:00:58.078 --> 00:00:59.698
How are you, Nate?

00:00:59.738 --> 00:01:00.979
Hello, I'm good.

00:01:01.020 --> 00:01:01.619
How was your week?

00:01:03.265 --> 00:01:03.947
really good week.

00:01:04.307 --> 00:01:05.748
Definitely a lot happening this week,

00:01:06.268 --> 00:01:08.409
a lot to cover on the podcast.

00:01:08.769 --> 00:01:08.909
Um,

00:01:08.950 --> 00:01:10.370
so why don't we dive straight into the

00:01:10.430 --> 00:01:13.614
first and highlight story this week?

00:01:14.493 --> 00:01:15.415
Yeah, for sure.

00:01:15.635 --> 00:01:15.974
All right.

00:01:15.995 --> 00:01:17.296
So our first story this week,

00:01:17.316 --> 00:01:18.878
let me move these cameras around real

00:01:18.897 --> 00:01:20.358
quick is, uh,

00:01:20.379 --> 00:01:23.361
the legendary PHP to shell that you guys

00:01:23.381 --> 00:01:24.841
have probably heard about.

00:01:25.843 --> 00:01:26.063
Um,

00:01:27.125 --> 00:01:28.504
I'll just I'll jump into it and we'll

00:01:28.525 --> 00:01:29.206
explain as we go.

00:01:29.605 --> 00:01:31.046
So I have a couple of articles here.

00:01:31.085 --> 00:01:32.126
The first one comes from Bleeping

00:01:32.165 --> 00:01:32.605
Computer,

00:01:33.066 --> 00:01:35.367
and it says that the PHP security team

00:01:35.406 --> 00:01:37.287
released emergency patches for two

00:01:37.388 --> 00:01:38.947
critical remote code execution

00:01:38.968 --> 00:01:41.649
vulnerabilities, which the CVEs are there,

00:01:41.668 --> 00:01:42.569
but I'm not going to read those off,

00:01:42.608 --> 00:01:45.069
tracked collectively as PHP to shell.

00:01:45.909 --> 00:01:47.909
The two are unauthenticated remote code

00:01:47.969 --> 00:01:51.471
execution flaws were affect all PHP

00:01:51.551 --> 00:01:53.091
installations that serve web requests,

00:01:53.152 --> 00:01:54.132
including PHP FM,

00:01:54.512 --> 00:01:56.992
Apache with ModPHP, PHP CGI,

00:01:57.112 --> 00:02:00.334
FrankenPHP and Lightspeed.

00:02:00.394 --> 00:02:01.954
Both flaws stem from the same underlying

00:02:01.995 --> 00:02:02.355
problem,

00:02:02.375 --> 00:02:03.834
which is PHP can leave its memory in

00:02:03.855 --> 00:02:05.436
a corrupted state when a request ends

00:02:05.516 --> 00:02:06.036
abnormally,

00:02:06.376 --> 00:02:07.656
and both can be exploited to achieve

00:02:07.777 --> 00:02:10.418
remote code execution.

00:02:10.598 --> 00:02:11.957
Admins should install PHP,

00:02:12.258 --> 00:02:13.258
eight point five point twelve,

00:02:13.338 --> 00:02:14.579
eight point four point twenty seven,

00:02:14.679 --> 00:02:15.818
eight point three point thirty six or

00:02:15.838 --> 00:02:17.219
eight point two point thirty five as soon

00:02:17.240 --> 00:02:19.320
as possible on servers running PHP eight

00:02:19.800 --> 00:02:21.200
and migrate to a fixed relief if they're

00:02:21.221 --> 00:02:23.081
running PHP seven or older.

00:02:26.338 --> 00:02:28.800
Let me check my notes here and see

00:02:28.820 --> 00:02:29.722
if there's anything else I missed.

00:02:30.622 --> 00:02:31.963
Yeah, so here we go.

00:02:33.405 --> 00:02:35.687
The core developer Gina Peter Banyard

00:02:35.727 --> 00:02:37.588
warned that no PHP to shell mitigations

00:02:37.609 --> 00:02:39.169
will fully block potential attackers and

00:02:39.189 --> 00:02:40.390
that applying the official security

00:02:40.431 --> 00:02:42.152
patches is the only permanent defense.

00:02:42.834 --> 00:02:44.254
If you guys have been following this

00:02:44.275 --> 00:02:44.854
pretty closely,

00:02:44.895 --> 00:02:46.477
then you've probably seen a lot of those

00:02:46.497 --> 00:02:47.418
videos.

00:02:48.481 --> 00:02:49.923
I guess like posts going around where it's

00:02:49.962 --> 00:02:50.963
like, oh, if you can't patch,

00:02:51.003 --> 00:02:52.724
either take your server offline or like do

00:02:52.764 --> 00:02:53.485
this mitigation.

00:02:54.026 --> 00:02:55.205
And that's basically what they're saying

00:02:55.225 --> 00:02:56.526
is like, yeah, there are mitigations,

00:02:56.586 --> 00:02:59.028
but they're not, they're mitigations,

00:02:59.088 --> 00:02:59.609
not fixes.

00:03:00.310 --> 00:03:01.871
The PHP security team did share a number

00:03:01.911 --> 00:03:03.251
of mitigation measures that should reduce

00:03:03.311 --> 00:03:04.852
exposure for those who can't immediately

00:03:04.893 --> 00:03:05.513
patch their servers.

00:03:05.552 --> 00:03:06.353
Although again,

00:03:06.713 --> 00:03:08.275
they don't fully protect against

00:03:08.395 --> 00:03:09.034
exploitation.

00:03:09.514 --> 00:03:11.217
And this was a really, really big story,

00:03:11.356 --> 00:03:11.817
which we are,

00:03:12.176 --> 00:03:13.437
going to break down here in a minute.

00:03:13.457 --> 00:03:15.677
But first, because it's such a big story,

00:03:15.717 --> 00:03:16.618
it's kind of one of those like there's

00:03:16.658 --> 00:03:18.439
multiple stories coming out that I wanted

00:03:18.460 --> 00:03:19.219
to touch on a little bit.

00:03:19.840 --> 00:03:20.740
This one comes from Wired.

00:03:20.780 --> 00:03:22.221
It says hackers exploited the PHP

00:03:22.241 --> 00:03:23.622
vulnerability days before they were

00:03:23.641 --> 00:03:24.002
patched.

00:03:24.887 --> 00:03:27.967
So apparently on – what was it?

00:03:28.008 --> 00:03:28.768
On Wednesday evening,

00:03:28.788 --> 00:03:30.788
which I think these were officially – so

00:03:30.848 --> 00:03:31.188
personally,

00:03:31.368 --> 00:03:33.090
I saw the post on like Tuesday,

00:03:33.710 --> 00:03:34.409
like Tuesday night.

00:03:34.449 --> 00:03:35.110
That was like, hey,

00:03:35.789 --> 00:03:37.230
really important security patches coming

00:03:37.251 --> 00:03:37.570
tomorrow.

00:03:37.610 --> 00:03:38.131
Be ready.

00:03:38.811 --> 00:03:41.731
And then Wednesday night – or Wednesday

00:03:41.752 --> 00:03:42.812
morning is when they were published,

00:03:43.332 --> 00:03:44.393
at ten a.m.

00:03:44.513 --> 00:03:45.334
Eastern time, I believe.

00:03:45.933 --> 00:03:46.813
And then –

00:03:46.954 --> 00:03:47.153
Yeah.

00:03:47.213 --> 00:03:47.655
Here it says,

00:03:47.694 --> 00:03:49.336
so research published Wednesday evening by

00:03:49.415 --> 00:03:51.157
Amazon web services indicates that at

00:03:51.197 --> 00:03:53.318
least one actor had starting to attempting

00:03:53.358 --> 00:03:55.039
to exploit the bugs on October,

00:03:56.060 --> 00:03:58.162
for four days before Wednesday's public

00:03:58.181 --> 00:03:58.701
revelations.

00:03:59.323 --> 00:03:59.723
And, uh,

00:03:59.742 --> 00:04:01.383
they did that with a honeypot in case

00:04:01.403 --> 00:04:02.544
you guys don't know, that is a very,

00:04:02.564 --> 00:04:03.885
very common thing in cybersecurity,

00:04:03.925 --> 00:04:05.646
especially with bigger companies is they

00:04:05.687 --> 00:04:08.588
will purposely leave servers open or, um,

00:04:10.070 --> 00:04:10.311
Anyways,

00:04:10.350 --> 00:04:11.911
they'll just purposely leave servers that

00:04:12.092 --> 00:04:12.731
have nothing there.

00:04:12.752 --> 00:04:13.831
They're just designed to be attacked,

00:04:13.872 --> 00:04:16.252
and they will monitor them to see what

00:04:16.273 --> 00:04:17.733
kind of attacks are attackers using.

00:04:18.512 --> 00:04:20.072
Did they manage to get in?

00:04:20.153 --> 00:04:21.934
It's a research tool to kind of understand

00:04:22.014 --> 00:04:23.314
what the current landscape looks like.

00:04:23.653 --> 00:04:25.154
So yeah,

00:04:25.875 --> 00:04:26.795
they said that they had one of their

00:04:26.814 --> 00:04:27.435
honeypots up,

00:04:27.935 --> 00:04:29.536
and the attempt came from an IP address

00:04:29.555 --> 00:04:30.776
that Amazon has linked to a quote-unquote

00:04:30.795 --> 00:04:32.175
commercial anonymization network,

00:04:32.255 --> 00:04:34.416
in other words, a proxy or VPN network.

00:04:34.776 --> 00:04:37.860
And their AWS chief information security

00:04:37.899 --> 00:04:39.060
officer, CJ Moses,

00:04:39.261 --> 00:04:40.961
wrote in a blog post that while the

00:04:40.982 --> 00:04:42.223
vulnerability was under embargo,

00:04:42.283 --> 00:04:43.283
the targeting of the honeypot from an

00:04:43.324 --> 00:04:44.906
anonymized IP address suggests that the

00:04:44.946 --> 00:04:46.286
activity was conducted by a threat actor,

00:04:46.627 --> 00:04:48.247
though it remains unclear how the actor

00:04:48.267 --> 00:04:50.149
acquired exploit information prior to

00:04:50.209 --> 00:04:50.850
disclosure.

00:04:52.665 --> 00:04:53.144
Let's see.

00:04:53.685 --> 00:04:55.565
Another executive director of the PHP

00:04:55.605 --> 00:04:56.086
Foundation.

00:04:56.146 --> 00:04:56.245
Sorry,

00:04:57.985 --> 00:05:01.247
that one's about not relying on the

00:05:02.567 --> 00:05:03.528
mitigations too much.

00:05:03.548 --> 00:05:04.627
Let me go back to my notes here.

00:05:05.387 --> 00:05:06.749
In the hours leading up to the disclosure,

00:05:06.809 --> 00:05:08.408
AWS researchers say that their honeypots

00:05:08.428 --> 00:05:09.709
were hit with multiple exploitation

00:05:09.728 --> 00:05:11.009
attempts anonymized using various

00:05:11.029 --> 00:05:12.449
providers and seemingly with various

00:05:12.470 --> 00:05:12.970
attack goals,

00:05:13.310 --> 00:05:14.550
likely indicating multiple different

00:05:14.651 --> 00:05:14.971
actors.

00:05:15.310 --> 00:05:16.870
Technical analysis is ongoing and it's

00:05:16.951 --> 00:05:18.151
unclear if any of these attempts would

00:05:18.170 --> 00:05:19.711
have succeeded in real-world systems,

00:05:19.791 --> 00:05:20.312
Moses wrote.

00:05:20.672 --> 00:05:22.274
He added that PHP shell is now being

00:05:22.314 --> 00:05:23.795
broadly exploited in the wild.

00:05:24.637 --> 00:05:25.757
And then the last one we want to

00:05:25.778 --> 00:05:27.139
share here comes from The Independent.

00:05:27.641 --> 00:05:29.021
It says websites across the world taken

00:05:29.062 --> 00:05:30.745
down to protect systems as critical

00:05:30.785 --> 00:05:32.307
cybersecurity update issued.

00:05:32.406 --> 00:05:32.567
So

00:05:34.411 --> 00:05:35.732
We'll talk about that a little more too.

00:05:35.992 --> 00:05:36.913
I'm just going to read off my notes

00:05:36.952 --> 00:05:37.113
here.

00:05:37.394 --> 00:05:38.694
Several government bodies in Finland,

00:05:38.714 --> 00:05:39.355
France, Denmark,

00:05:39.456 --> 00:05:40.836
and the Netherlands took down the sites as

00:05:40.857 --> 00:05:42.418
a precautionary step after reports that

00:05:42.439 --> 00:05:43.680
the flaws were being exploited by

00:05:43.720 --> 00:05:44.420
malicious actors.

00:05:44.920 --> 00:05:46.843
Danish IT company Combit said several

00:05:46.882 --> 00:05:47.843
services had been shut down,

00:05:47.863 --> 00:05:49.305
including the country's national school of

00:05:49.345 --> 00:05:50.326
communication platform.

00:05:50.646 --> 00:05:51.927
In the Netherlands, several hospitals,

00:05:51.968 --> 00:05:52.348
websites,

00:05:52.367 --> 00:05:53.930
and platforms for the five major political

00:05:53.949 --> 00:05:54.930
parties were taken offline.

00:05:55.430 --> 00:05:56.733
Some sites are now back up and running.

00:05:57.233 --> 00:05:58.394
Organizations across the board,

00:05:58.473 --> 00:05:59.995
including private, public, large,

00:06:00.016 --> 00:06:00.415
and small,

00:06:00.516 --> 00:06:02.257
have been advised to follow guidance

00:06:02.358 --> 00:06:03.778
issued by NCSE to, quote,

00:06:03.879 --> 00:06:05.261
understand their exposure and take the

00:06:05.281 --> 00:06:07.242
necessary actions to safeguard their

00:06:07.281 --> 00:06:07.742
systems.

00:06:08.163 --> 00:06:09.845
The widespread use of PHP sparked fears

00:06:09.865 --> 00:06:11.026
that a substantial number of online

00:06:11.065 --> 00:06:12.466
services and platforms could remain

00:06:12.547 --> 00:06:13.168
exposed.

00:06:13.668 --> 00:06:14.608
to cyber attacks.

00:06:15.189 --> 00:06:17.649
And cybersecurity company Huntress said in

00:06:17.670 --> 00:06:19.391
a blog post that HP is everywhere.

00:06:20.031 --> 00:06:21.612
PHP, excuse me, is everywhere.

00:06:21.692 --> 00:06:23.454
It quietly powers WordPress, Drupal,

00:06:23.533 --> 00:06:24.814
Joomla, and Magento sites,

00:06:25.074 --> 00:06:26.696
shared hosting platforms, control panels,

00:06:26.735 --> 00:06:28.055
and an awful lot of software that doesn't

00:06:28.076 --> 00:06:31.177
even advertise that it runs PHP under the

00:06:31.338 --> 00:06:31.598
hood.

00:06:32.418 --> 00:06:34.360
So yeah,

00:06:34.600 --> 00:06:36.201
that is a lot to take in.

00:06:37.360 --> 00:06:39.442
Fortunately, I think probably a lot of

00:06:40.651 --> 00:06:41.656
A lot of people, I think,

00:06:41.696 --> 00:06:43.622
have not seen a lot of...

00:06:45.221 --> 00:06:46.502
have not seen the effects so much on

00:06:46.523 --> 00:06:46.843
their end.

00:06:46.903 --> 00:06:48.043
I haven't heard a lot of people saying

00:06:48.103 --> 00:06:49.624
like, Oh, all the websites are down today.

00:06:50.004 --> 00:06:51.324
Although I did see one screenshot of down

00:06:51.345 --> 00:06:51.685
detector.

00:06:51.704 --> 00:06:54.125
That was a pretty bad, but, um, yeah,

00:06:54.165 --> 00:06:55.507
it seems fortunately, uh,

00:06:55.586 --> 00:06:58.048
PHP rolled this fix out really,

00:06:58.088 --> 00:06:58.687
really fast.

00:06:58.708 --> 00:06:58.747
Uh,

00:06:59.708 --> 00:07:00.889
and then at that point it was just

00:07:00.908 --> 00:07:03.290
kind of up to everybody downstream.

00:07:03.350 --> 00:07:05.130
Like, you know, your Linux distro, your,

00:07:05.211 --> 00:07:06.130
um, your service provider,

00:07:06.151 --> 00:07:07.411
your WordPress provider, et cetera,

00:07:07.451 --> 00:07:07.872
et cetera.

00:07:08.451 --> 00:07:11.514
So that's, um, kind of where we're at,

00:07:11.653 --> 00:07:12.473
but, um,

00:07:12.593 --> 00:07:13.555
I think I'll bring this back,

00:07:14.055 --> 00:07:16.257
bring Jordan back for the analysis portion

00:07:16.298 --> 00:07:16.557
of this.

00:07:16.637 --> 00:07:20.401
So other than the fact that PHP is

00:07:20.581 --> 00:07:24.125
used on like over two thirds of websites,

00:07:24.165 --> 00:07:24.826
web services,

00:07:25.507 --> 00:07:26.728
what would you say makes this so bad?

00:07:26.767 --> 00:07:27.668
Like why has this been making,

00:07:27.788 --> 00:07:29.091
I even saw this on the Reuters headlines

00:07:29.110 --> 00:07:30.072
for like two days straight.

00:07:30.172 --> 00:07:30.552
So what's,

00:07:31.052 --> 00:07:32.033
what do you think is making this such

00:07:32.053 --> 00:07:32.374
a big deal?

00:07:33.463 --> 00:07:33.744
Well,

00:07:33.843 --> 00:07:35.605
I think the main issue with this sort

00:07:35.665 --> 00:07:38.286
of vulnerability is it's not based on how

00:07:38.326 --> 00:07:39.906
well a website is programmed, right?

00:07:39.966 --> 00:07:42.666
Like this is an actual flaw within PHP

00:07:42.726 --> 00:07:45.387
itself, which is even more of a problem,

00:07:45.447 --> 00:07:45.627
right?

00:07:45.648 --> 00:07:46.788
Because, you know,

00:07:47.949 --> 00:07:49.310
you could have taken every possible

00:07:49.970 --> 00:07:51.750
precaution to make sure that your website

00:07:51.790 --> 00:07:52.971
is designed in a way that it can't

00:07:53.011 --> 00:07:53.610
be exploited,

00:07:53.711 --> 00:07:57.132
but it is a flaw within PHP itself

00:07:57.192 --> 00:08:00.353
that basically any website that runs...

00:08:02.000 --> 00:08:03.440
using PHP can be affected,

00:08:03.480 --> 00:08:05.723
which makes it kind of bad.

00:08:05.783 --> 00:08:07.983
Even if you're hosting a website that is

00:08:08.043 --> 00:08:09.285
like hello world,

00:08:09.605 --> 00:08:11.867
your server could have remote code

00:08:11.927 --> 00:08:13.747
execution.

00:08:13.848 --> 00:08:16.209
Someone could execute code on your server

00:08:16.230 --> 00:08:19.812
that you didn't intend to.

00:08:19.891 --> 00:08:22.213
So that's why it's so severe and that's

00:08:22.254 --> 00:08:23.214
why it's such an issue.

00:08:23.951 --> 00:08:24.151
you know,

00:08:24.430 --> 00:08:25.752
the entire internet seems like it's

00:08:25.793 --> 00:08:28.274
burning down right now because it is such

00:08:28.295 --> 00:08:29.456
a severe vulnerability.

00:08:30.797 --> 00:08:31.757
But I guess we could throw it back

00:08:31.797 --> 00:08:32.437
to, you know,

00:08:33.899 --> 00:08:35.179
the changes have been rolling out,

00:08:35.721 --> 00:08:38.822
things have been fixed, but is this over?

00:08:38.903 --> 00:08:39.123
Like,

00:08:39.244 --> 00:08:41.625
are we going to keep seeing more

00:08:42.206 --> 00:08:43.206
vulnerabilities like this?

00:08:44.347 --> 00:08:45.369
Is this going to be a problem in

00:08:45.389 --> 00:08:45.869
the future?

00:08:47.309 --> 00:08:47.590
You know,

00:08:48.730 --> 00:08:49.831
are people going to actually update?

00:08:49.851 --> 00:08:51.374
Because I feel like that's a big concern

00:08:51.394 --> 00:08:51.553
too.

00:08:51.614 --> 00:08:51.854
Yeah.

00:08:52.525 --> 00:08:53.687
Yeah, I mean, well, first of all,

00:08:54.187 --> 00:08:55.147
I personal opinion,

00:08:55.267 --> 00:08:56.148
I don't think this is over.

00:08:56.607 --> 00:08:58.109
I've mentioned before that usually when it

00:08:58.129 --> 00:08:59.048
comes to data breaches,

00:08:59.429 --> 00:09:01.070
we'll see a lot of like like a

00:09:01.169 --> 00:09:03.110
really big third party company will get

00:09:03.130 --> 00:09:04.471
breached, like Zendesk, for example.

00:09:04.532 --> 00:09:04.711
Right.

00:09:04.731 --> 00:09:06.332
Like Zendesk does support for a lot of

00:09:06.352 --> 00:09:06.773
websites.

00:09:07.274 --> 00:09:09.514
And so Zendesk will get breached and we'll

00:09:09.554 --> 00:09:10.115
hear about it.

00:09:10.475 --> 00:09:11.956
And then for the next like six months,

00:09:11.975 --> 00:09:13.797
companies will be coming forward as they

00:09:14.017 --> 00:09:14.897
do investigations.

00:09:14.976 --> 00:09:15.817
And they're like, oh, crap.

00:09:16.097 --> 00:09:17.798
It turns out we also got breached because

00:09:17.837 --> 00:09:19.578
we used Zendesk and they got us through

00:09:19.599 --> 00:09:19.759
that.

00:09:20.219 --> 00:09:21.219
So I think we're going to see a

00:09:21.259 --> 00:09:23.158
lot of that in the coming weeks.

00:09:23.219 --> 00:09:23.980
I mean, it's only been like, what,

00:09:24.019 --> 00:09:25.740
two or three days since this thing was

00:09:25.779 --> 00:09:26.120
covered.

00:09:26.659 --> 00:09:28.659
So like a week tops if you go

00:09:28.679 --> 00:09:30.301
back to the seventeenth, I think.

00:09:30.421 --> 00:09:30.980
I'm bad at math.

00:09:31.120 --> 00:09:31.780
Don't be mad.

00:09:32.480 --> 00:09:33.801
But it's been about a week tops.

00:09:34.260 --> 00:09:35.741
And so I think, yeah, first of all,

00:09:35.761 --> 00:09:37.282
we don't know who's been hit.

00:09:37.761 --> 00:09:39.381
Right now everybody's in like just shut up

00:09:39.422 --> 00:09:41.182
and fix it mode and we'll put the

00:09:41.202 --> 00:09:41.903
fires out later.

00:09:42.822 --> 00:09:45.046
Um, and yeah, I think like you said,

00:09:45.066 --> 00:09:47.187
a lot of the time when, um,

00:09:47.227 --> 00:09:48.349
when we have these like huge,

00:09:48.369 --> 00:09:49.269
huge vulnerabilities,

00:09:50.110 --> 00:09:51.932
the patches tend to have unforeseen

00:09:51.993 --> 00:09:52.692
knock-on effects,

00:09:52.793 --> 00:09:53.714
at least in my experience,

00:09:54.034 --> 00:09:57.317
I could be wrong, but, um, but, uh,

00:09:57.357 --> 00:09:57.837
the, uh,

00:09:58.739 --> 00:10:00.120
I'm thinking of like Spectre and Meltdown.

00:10:00.159 --> 00:10:02.621
Like they released a mitigation and it

00:10:02.662 --> 00:10:05.344
turned out that it seriously restricted

00:10:05.484 --> 00:10:06.884
performance to the point where it was

00:10:06.904 --> 00:10:07.264
like, okay,

00:10:07.304 --> 00:10:08.546
we can't just leave this as is.

00:10:08.885 --> 00:10:09.947
So then they had to kind of tweak

00:10:10.027 --> 00:10:10.187
it.

00:10:10.287 --> 00:10:12.008
And then they found out there were other,

00:10:12.067 --> 00:10:13.349
like not as bad,

00:10:13.389 --> 00:10:14.288
but there were still additional

00:10:14.308 --> 00:10:15.710
vulnerabilities that it didn't fix.

00:10:15.769 --> 00:10:16.671
And so, yeah,

00:10:16.711 --> 00:10:18.011
I think this is unfortunately probably

00:10:18.052 --> 00:10:19.852
something that experts are going to be

00:10:19.873 --> 00:10:20.572
dealing with for,

00:10:21.374 --> 00:10:24.414
uh for quite a while and it probably

00:10:24.434 --> 00:10:25.754
in the coming weeks and months we're gonna

00:10:25.774 --> 00:10:27.336
hear a lot of companies stepping forward

00:10:27.375 --> 00:10:29.395
and saying hey we got hit with this

00:10:29.416 --> 00:10:34.217
php thing despite our best efforts so um

00:10:34.258 --> 00:10:35.778
yeah i mean hopefully sysadmins are

00:10:35.798 --> 00:10:36.958
keeping an eye on this and patching

00:10:36.979 --> 00:10:38.418
accordingly but um do you think there's

00:10:38.438 --> 00:10:40.480
anything that end users can do if they're

00:10:40.519 --> 00:10:41.919
you know if they don't host their own

00:10:41.940 --> 00:10:44.181
next cloud or their own um whatever

00:10:44.260 --> 00:10:46.261
wordpress is there anything they can do to

00:10:46.361 --> 00:10:47.001
protect themselves

00:10:48.365 --> 00:10:50.687
I would say you can try and contact

00:10:50.746 --> 00:10:52.327
websites that you use that you know that

00:10:52.467 --> 00:10:53.148
use PHP.

00:10:53.207 --> 00:10:53.769
But again,

00:10:53.788 --> 00:10:55.769
it is so ubiquitous at this point that

00:10:56.691 --> 00:10:57.870
we saw, like you mentioned,

00:10:58.272 --> 00:11:00.932
government websites for Finland, France,

00:11:00.993 --> 00:11:02.534
Denmark, Netherlands,

00:11:02.554 --> 00:11:04.135
all these websites going down because they

00:11:04.155 --> 00:11:05.056
don't want to be exploited.

00:11:05.576 --> 00:11:08.879
So it's kind of tricky when something is

00:11:09.418 --> 00:11:11.500
so ubiquitous and there isn't really...

00:11:12.441 --> 00:11:14.143
that much that you can do as like

00:11:14.163 --> 00:11:15.344
an end user in this instance.

00:11:15.403 --> 00:11:18.385
You can make your make your concerns known

00:11:18.446 --> 00:11:19.888
to your service providers and such.

00:11:20.628 --> 00:11:22.149
But yeah,

00:11:22.230 --> 00:11:23.471
if you if you host any sort of

00:11:23.490 --> 00:11:24.772
website that uses PHP,

00:11:24.792 --> 00:11:26.052
you should definitely be checking to make

00:11:26.072 --> 00:11:27.634
sure that your service provider has

00:11:28.095 --> 00:11:28.855
brought out a fix.

00:11:28.975 --> 00:11:30.897
But if you're just someone accessing a

00:11:30.937 --> 00:11:31.317
website,

00:11:31.336 --> 00:11:32.798
there's really not much you can do.

00:11:33.739 --> 00:11:34.159
But, you know,

00:11:34.200 --> 00:11:36.000
we could always move and pivot back

00:11:36.020 --> 00:11:38.283
towards the other important things is,

00:11:38.764 --> 00:11:38.984
you know,

00:11:39.740 --> 00:11:40.741
protecting your information,

00:11:40.841 --> 00:11:42.143
using alias information,

00:11:42.263 --> 00:11:44.965
using all things that will protect you in

00:11:45.004 --> 00:11:46.525
case of a breach when something like this

00:11:46.546 --> 00:11:46.905
happens.

00:11:46.946 --> 00:11:48.868
Because like we always know,

00:11:49.268 --> 00:11:51.250
these sort of things are bound to happen,

00:11:51.370 --> 00:11:54.652
but it's about kind of taking

00:11:54.711 --> 00:11:56.653
precautionary steps to make sure that if

00:11:56.673 --> 00:11:59.875
there is a breach of your data that's

00:11:59.916 --> 00:12:01.096
caused by one of these remote code

00:12:01.157 --> 00:12:03.918
execution exploits, then...

00:12:05.120 --> 00:12:06.660
you will be less affected.

00:12:06.760 --> 00:12:07.520
But yeah,

00:12:07.541 --> 00:12:09.000
there's not really that much you can do,

00:12:09.542 --> 00:12:10.241
in my opinion,

00:12:11.081 --> 00:12:12.763
as an end user using these websites,

00:12:12.802 --> 00:12:13.523
which really sucks.

00:12:15.082 --> 00:12:16.464
Yeah, I agree, for sure.

00:12:18.004 --> 00:12:18.965
I guess we'll throw it over to the

00:12:19.024 --> 00:12:19.384
audience.

00:12:19.404 --> 00:12:21.245
Were any of you guys impacted by this?

00:12:21.365 --> 00:12:22.405
Like, did you, you know,

00:12:22.446 --> 00:12:23.765
you were unable to go to a website

00:12:23.785 --> 00:12:24.907
because it was taken offline?

00:12:24.947 --> 00:12:27.148
Or do you have any defense tips that

00:12:27.168 --> 00:12:28.847
we missed or anything that we didn't

00:12:28.908 --> 00:12:30.129
address on this one?

00:12:30.229 --> 00:12:30.408
So...

00:12:31.379 --> 00:12:32.961
Yeah, I guess with that,

00:12:32.981 --> 00:12:34.582
we'll go ahead and we'll start.

00:12:35.484 --> 00:12:36.284
In case you guys didn't know,

00:12:36.325 --> 00:12:37.485
you can always leave questions and

00:12:37.505 --> 00:12:38.307
comments in the chat.

00:12:38.687 --> 00:12:40.448
And we have a forum thread here that

00:12:40.469 --> 00:12:41.710
we make for every single episode.

00:12:42.230 --> 00:12:42.971
And looking through there,

00:12:42.990 --> 00:12:48.155
we do have one member who added a

00:12:48.196 --> 00:12:49.096
whole bunch of other... Like,

00:12:49.116 --> 00:12:50.138
this has just been a bad week for

00:12:50.197 --> 00:12:50.818
cybersecurity.

00:12:51.198 --> 00:12:52.900
I don't think these are all necessarily

00:12:52.941 --> 00:12:53.562
related to...

00:12:55.342 --> 00:12:55.682
What's it called?

00:12:55.724 --> 00:12:56.423
PHP to Shell.

00:12:56.903 --> 00:12:57.424
But yeah,

00:12:57.504 --> 00:12:59.826
one of our regulars did comment a whole

00:12:59.846 --> 00:13:01.327
bunch of other projects that announced

00:13:01.408 --> 00:13:02.629
that they have some vulnerabilities that

00:13:02.649 --> 00:13:03.149
need to be fixed.

00:13:03.168 --> 00:13:04.690
So there's CodeBurg and ForgeJoe.

00:13:05.370 --> 00:13:06.150
There's GitLab.

00:13:06.611 --> 00:13:08.072
There's Plex.

00:13:08.413 --> 00:13:09.653
They're calling it Plex to Shell.

00:13:10.634 --> 00:13:13.777
They did add the Wikipedia page for PHP

00:13:13.797 --> 00:13:14.256
to Shell.

00:13:14.898 --> 00:13:16.318
And they also mentioned Linux.

00:13:16.359 --> 00:13:18.039
We almost actually covered this story,

00:13:18.059 --> 00:13:19.480
but there's not too much to it.

00:13:20.182 --> 00:13:21.201
There were two Linux...

00:13:22.403 --> 00:13:22.583
Actually,

00:13:22.604 --> 00:13:24.264
I think there were several Linux

00:13:24.284 --> 00:13:25.645
vulnerabilities that were exposed by

00:13:25.725 --> 00:13:26.005
accident,

00:13:26.025 --> 00:13:27.326
but two of them are high severity and

00:13:27.726 --> 00:13:32.711
that were accidentally disclosed early via

00:13:32.750 --> 00:13:33.871
the Linux mailing list.

00:13:34.412 --> 00:13:35.712
I guess they just accidentally replied to

00:13:35.732 --> 00:13:37.995
the wrong person and told everybody about

00:13:38.014 --> 00:13:38.154
them.

00:13:41.136 --> 00:13:42.477
Like I said, bad week for cybersecurity.

00:13:42.498 --> 00:13:45.740
I don't know if you have any thoughts

00:13:45.841 --> 00:13:47.322
on any of those.

00:13:49.414 --> 00:13:50.596
I do have a little bit on the

00:13:50.655 --> 00:13:51.176
Linux one.

00:13:51.836 --> 00:13:52.596
Okay, sure.

00:13:52.677 --> 00:13:54.018
It's a little bit of a concern here.

00:13:54.719 --> 00:13:56.580
This specific story,

00:13:57.441 --> 00:14:00.942
it is kind of a problem because these

00:14:00.982 --> 00:14:02.865
vulnerabilities that were brought forward,

00:14:02.924 --> 00:14:05.365
they haven't actually received fixes yet

00:14:05.405 --> 00:14:06.346
in the mainline kernel,

00:14:06.746 --> 00:14:07.768
so they are exploitable.

00:14:08.248 --> 00:14:09.909
That's why it's kind of such a big

00:14:09.950 --> 00:14:10.269
problem.

00:14:10.289 --> 00:14:11.049
As Nate said,

00:14:11.070 --> 00:14:17.554
CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS-CVS

00:14:19.187 --> 00:14:21.472
other issues that have happened this week

00:14:21.754 --> 00:14:23.256
later on in the show so stay tuned

00:14:23.297 --> 00:14:25.182
for that but yeah this this is kind

00:14:25.201 --> 00:14:27.668
of an unfortunate situation there was some

00:14:28.429 --> 00:14:28.509
uh

00:14:30.791 --> 00:14:32.032
speculation, let's say,

00:14:32.131 --> 00:14:34.052
about how this actually happened.

00:14:34.393 --> 00:14:36.312
How did someone accidentally reply to the

00:14:36.332 --> 00:14:39.835
wrong person or reveal these

00:14:39.875 --> 00:14:42.395
vulnerabilities that were possible to the

00:14:42.416 --> 00:14:43.657
public before they were patched?

00:14:45.177 --> 00:14:46.778
There was concerns that maybe someone was

00:14:46.878 --> 00:14:49.198
using some sort of AI agent to reply

00:14:49.278 --> 00:14:50.259
or something like that,

00:14:51.059 --> 00:14:52.200
but that's not super clear.

00:14:53.660 --> 00:14:55.101
So yeah, it's kind of a concern.

00:14:55.162 --> 00:14:56.082
This one says here,

00:14:56.222 --> 00:14:58.664
one of the vulnerabilities was it required

00:14:58.745 --> 00:15:00.846
no authentication exposing any server

00:15:00.866 --> 00:15:03.830
running KSM BD on port four, four, five.

00:15:04.330 --> 00:15:07.212
So that's a concern for people running

00:15:07.873 --> 00:15:08.413
SMB.

00:15:09.715 --> 00:15:09.875
Yeah,

00:15:09.894 --> 00:15:11.755
but there wasn't really a huge amount of

00:15:12.157 --> 00:15:13.398
talk about that story this week.

00:15:13.837 --> 00:15:15.539
But it was, in my opinion,

00:15:15.600 --> 00:15:16.581
another big one.

00:15:17.260 --> 00:15:18.663
There was also the other one that the

00:15:18.982 --> 00:15:19.923
person on the forum mentioned,

00:15:19.943 --> 00:15:22.505
which was the critical GitLab floor,

00:15:22.546 --> 00:15:24.128
which could basically allow people to

00:15:24.168 --> 00:15:24.388
make...

00:15:27.832 --> 00:15:30.573
changes to Git repositories on GitLab,

00:15:30.594 --> 00:15:31.854
which was also pretty bad.

00:15:32.214 --> 00:15:33.634
That was a CVS-X.

00:15:34.294 --> 00:15:35.375
So like huge,

00:15:35.434 --> 00:15:37.315
huge vulnerabilities this week.

00:15:38.275 --> 00:15:39.176
Really unfortunate.

00:15:41.115 --> 00:15:42.996
GitLab says that under certain conditions,

00:15:43.037 --> 00:15:44.897
it could allow an unauthenticated user to

00:15:44.937 --> 00:15:47.337
run arbitrary code on the server due to

00:15:47.437 --> 00:15:50.118
an integer overflow during the compilation

00:15:50.197 --> 00:15:51.938
of a specifically crafted regular

00:15:51.999 --> 00:15:52.479
expression.

00:15:53.578 --> 00:15:55.740
GitLab has not said what those conditions

00:15:55.879 --> 00:15:56.019
are.

00:15:57.357 --> 00:15:59.578
And GitLab also reported there was no sign

00:15:59.599 --> 00:16:01.019
that the flaw had been used in attacks.

00:16:01.500 --> 00:16:01.899
So, you know,

00:16:01.940 --> 00:16:04.880
kind of short little burst of a few

00:16:04.900 --> 00:16:07.682
things that happened this week.

00:16:07.962 --> 00:16:09.423
But there's just so many that we can't

00:16:09.442 --> 00:16:10.644
really cover them all this week.

00:16:10.663 --> 00:16:12.104
It feels like literally the entire

00:16:12.144 --> 00:16:13.764
internet is on fire at the moment.

00:16:15.086 --> 00:16:15.905
So we can't go into, like,

00:16:16.125 --> 00:16:17.626
super high depth on everything.

00:16:17.726 --> 00:16:17.927
But...

00:16:19.107 --> 00:16:21.389
We do appreciate it whenever someone lets

00:16:21.429 --> 00:16:24.153
us know about some of these issues in

00:16:24.212 --> 00:16:24.873
our forum thread.

00:16:25.014 --> 00:16:25.533
And yeah,

00:16:25.793 --> 00:16:27.375
be sure to drop some comments there,

00:16:27.456 --> 00:16:29.038
or you can leave some comments in the

00:16:29.518 --> 00:16:29.837
chat,

00:16:29.857 --> 00:16:31.039
and we'll try and get back to those

00:16:31.700 --> 00:16:33.142
later.

00:16:33.621 --> 00:16:33.802
Yeah,

00:16:33.822 --> 00:16:35.464
that happened to me with the data breaches

00:16:35.504 --> 00:16:36.384
this week.

00:16:36.445 --> 00:16:37.405
Right after I published them,

00:16:37.446 --> 00:16:38.246
somebody was like, oh,

00:16:38.267 --> 00:16:39.668
there was also this data breach in...

00:16:41.097 --> 00:16:42.379
Oh, God, I can't even remember now.

00:16:42.460 --> 00:16:43.822
But yeah, I replied.

00:16:43.841 --> 00:16:44.261
I was like, hey,

00:16:44.282 --> 00:16:46.004
thanks for sharing because that did not

00:16:46.024 --> 00:16:47.206
show up in my RSS feed.

00:16:47.245 --> 00:16:48.727
So if I don't know about it,

00:16:48.788 --> 00:16:49.668
I can't post about it.

00:16:49.688 --> 00:16:51.371
And yeah, we're only human.

00:16:51.572 --> 00:16:53.875
So real quick on that note,

00:16:53.894 --> 00:16:54.975
we did have one other thing as well

00:16:54.995 --> 00:16:56.719
as a question about this.

00:16:57.259 --> 00:16:57.740
They said that...

00:16:58.740 --> 00:17:00.581
As AI continues to prove its utility in

00:17:00.642 --> 00:17:01.201
cybersecurity,

00:17:01.221 --> 00:17:02.461
this comes from the forum thread,

00:17:02.841 --> 00:17:04.143
bad actors will certainly shift their

00:17:04.163 --> 00:17:04.982
attention towards it,

00:17:05.063 --> 00:17:06.804
and surely cyber warfare between nations

00:17:06.844 --> 00:17:08.163
will also become an increasing worry,

00:17:08.183 --> 00:17:09.084
which is a frightening thought.

00:17:09.443 --> 00:17:10.164
This makes me wonder,

00:17:10.204 --> 00:17:11.904
should AI have far stricter regulations

00:17:11.924 --> 00:17:12.786
than it currently has?

00:17:13.105 --> 00:17:14.605
Must we now distinguish by law between

00:17:14.645 --> 00:17:16.386
consumer-level AI and advanced highly

00:17:16.426 --> 00:17:17.166
capable AI?

00:17:17.487 --> 00:17:19.468
Must the populace's access to advanced AI

00:17:19.488 --> 00:17:19.887
be blocked?

00:17:19.968 --> 00:17:22.648
What do you guys think?

00:17:22.669 --> 00:17:23.449
Do we have thoughts on that?

00:17:25.200 --> 00:17:28.021
I mean, yeah, it's definitely a concern.

00:17:28.082 --> 00:17:29.462
I think one of the stories,

00:17:29.482 --> 00:17:30.843
we're going to talk about a story later

00:17:30.963 --> 00:17:33.505
today where this was kind of an issue.

00:17:33.944 --> 00:17:34.846
This specifically,

00:17:35.066 --> 00:17:36.686
what you're saying was an issue.

00:17:37.587 --> 00:17:40.229
So it is definitely becoming a problem

00:17:40.269 --> 00:17:42.009
because, you know, these AI tools,

00:17:42.049 --> 00:17:45.311
they can scan massive amounts of servers

00:17:45.392 --> 00:17:45.952
and like, you know,

00:17:47.054 --> 00:17:48.755
automate tasks that would usually take

00:17:49.316 --> 00:17:50.576
like a threat actor a lot of time

00:17:50.596 --> 00:17:51.737
to actually investigate, right?

00:17:51.757 --> 00:17:54.118
Because it can just automate that entire

00:17:54.138 --> 00:17:54.618
process.

00:17:55.380 --> 00:17:55.440
Um,

00:17:55.460 --> 00:17:56.800
so that's why it does become kind of

00:17:56.820 --> 00:17:57.260
scary when,

00:17:57.381 --> 00:17:59.423
when we have these like AI tools.

00:17:59.643 --> 00:18:02.444
And I think it is definitely one of

00:18:02.484 --> 00:18:03.945
the reasons why we're seeing more

00:18:03.986 --> 00:18:05.767
vulnerabilities like this being unveiled.

00:18:06.247 --> 00:18:06.386
Um,

00:18:06.446 --> 00:18:09.009
I think there's a GitLab vulnerability as

00:18:09.068 --> 00:18:09.509
well, you know,

00:18:14.873 --> 00:18:16.513
I'm not sure if that was unveiled by

00:18:16.554 --> 00:18:17.213
using an AI,

00:18:17.253 --> 00:18:20.815
but the more that we see these tools

00:18:22.935 --> 00:18:25.276
becoming better and more sophisticated,

00:18:25.316 --> 00:18:27.737
then this does become more of a concern.

00:18:29.758 --> 00:18:31.597
Yeah, it is kind of scary,

00:18:31.657 --> 00:18:33.778
but I definitely think it is helping

00:18:34.118 --> 00:18:36.339
threat actors to craft attacks more

00:18:36.380 --> 00:18:36.680
easily.

00:18:38.553 --> 00:18:39.373
Yeah, I don't know.

00:18:39.712 --> 00:18:41.034
I have really conflicting opinions.

00:18:41.054 --> 00:18:41.834
Like, I agree with you,

00:18:41.894 --> 00:18:42.814
but at the same time,

00:18:42.855 --> 00:18:43.734
it's kind of one of those, like,

00:18:44.454 --> 00:18:45.634
if you outlaw something,

00:18:45.714 --> 00:18:47.395
then only the bad guys will have access

00:18:47.415 --> 00:18:48.896
to it kind of arguments, I think.

00:18:49.116 --> 00:18:50.336
And, I mean, first of all,

00:18:50.376 --> 00:18:50.757
for the record,

00:18:50.856 --> 00:18:52.897
I do think AI in general needs regulation.

00:18:53.057 --> 00:18:55.019
I think I'm not a fan of the

00:18:55.098 --> 00:18:55.479
U.S.'

00:18:55.459 --> 00:18:56.878
's, like, Wild West just, like,

00:18:56.919 --> 00:18:58.420
first across the finish line gets to take

00:18:58.440 --> 00:18:59.660
all the money and everybody else gets to

00:18:59.700 --> 00:19:00.641
start that attitude.

00:19:01.560 --> 00:19:02.980
But that's more of a political take.

00:19:03.902 --> 00:19:05.082
But, no, like, when it comes to, like,

00:19:05.281 --> 00:19:06.442
AI and security, I don't know.

00:19:06.722 --> 00:19:06.962
I think...

00:19:08.402 --> 00:19:09.442
I think something should be done,

00:19:09.462 --> 00:19:10.583
but I don't think I'm smart enough to

00:19:10.603 --> 00:19:11.763
say what should be done.

00:19:12.163 --> 00:19:13.345
I don't think I'm qualified to give

00:19:13.384 --> 00:19:14.486
feedback on that, but I do.

00:19:15.425 --> 00:19:16.287
I don't think you have to be a

00:19:16.346 --> 00:19:18.567
doctor to recognize when like your arm is

00:19:18.587 --> 00:19:20.249
in pain and you need a doctor.

00:19:20.308 --> 00:19:21.710
So that's kind of where I'm at is

00:19:21.730 --> 00:19:22.130
like, okay,

00:19:22.150 --> 00:19:23.330
something's wrong here and I don't know

00:19:23.351 --> 00:19:23.810
what it is,

00:19:23.911 --> 00:19:26.073
but I think somebody should come in.

00:19:26.553 --> 00:19:28.933
I will say if you're a pro AI

00:19:28.973 --> 00:19:31.576
person, at least in the terms of like,

00:19:31.655 --> 00:19:32.777
like cybersecurity and stuff,

00:19:33.076 --> 00:19:34.917
Bruce Schneier is very optimistic about

00:19:34.958 --> 00:19:36.378
the potential of AI and,

00:19:36.719 --> 00:19:38.319
um a little too much in my personal

00:19:38.359 --> 00:19:39.961
honest opinion but he's also a really

00:19:40.000 --> 00:19:41.961
really smart guy and i i just say

00:19:41.981 --> 00:19:43.402
like maybe following him and some of his

00:19:43.442 --> 00:19:45.482
posts and some of his work like maybe

00:19:45.563 --> 00:19:47.344
that would be a good place to start

00:19:47.364 --> 00:19:48.265
if you want to learn more about this

00:19:48.285 --> 00:19:50.766
stuff um because even even though i

00:19:50.786 --> 00:19:52.385
disagree with him i think he's very smart

00:19:52.486 --> 00:19:54.426
and he knows what he's talking about um

00:19:54.467 --> 00:19:55.867
i know carrie parker from fireballs don't

00:19:55.887 --> 00:19:57.949
stop dragons is very i don't know if

00:19:58.009 --> 00:19:59.369
i say pro ai but just in terms

00:19:59.390 --> 00:20:01.671
of like security and code is very um

00:20:01.851 --> 00:20:03.551
optimistic about ai's potential so

00:20:04.392 --> 00:20:05.393
Maybe start in those places,

00:20:05.833 --> 00:20:07.452
but that's kind of the best I got,

00:20:07.634 --> 00:20:08.054
to be honest.

00:20:09.394 --> 00:20:10.674
Yeah, no, great recommendations.

00:20:10.875 --> 00:20:11.915
Really big fan of both of them.

00:20:12.635 --> 00:20:15.116
I think this is probably time for us

00:20:15.136 --> 00:20:16.278
to jump into the next story,

00:20:16.518 --> 00:20:17.597
unless you have anything else you want to

00:20:17.617 --> 00:20:17.938
add here.

00:20:18.618 --> 00:20:19.459
No, totally agree.

00:20:19.479 --> 00:20:20.239
I was about to turn it over to

00:20:20.259 --> 00:20:20.420
you.

00:20:20.859 --> 00:20:21.980
What you got for us?

00:20:22.621 --> 00:20:26.402
So that was this post on our community

00:20:26.442 --> 00:20:28.682
forum that someone made,

00:20:28.843 --> 00:20:31.464
and they basically posted a clip of...

00:20:32.679 --> 00:20:34.740
from Tucker Carlson's podcast with

00:20:35.442 --> 00:20:36.182
Kim.com.

00:20:36.342 --> 00:20:37.644
And basically,

00:20:37.663 --> 00:20:40.605
kind of to summarize what exactly this

00:20:40.786 --> 00:20:41.767
short clip was about,

00:20:42.428 --> 00:20:44.088
the short clip of Kim.com on Tucker

00:20:44.108 --> 00:20:46.771
Carlson's show claimed that Signal is the

00:20:46.852 --> 00:20:48.814
worst messenger because, quote,

00:20:48.894 --> 00:20:51.056
everyone is using it and, quote,

00:20:51.215 --> 00:20:52.936
the government has a backdoor.

00:20:53.577 --> 00:20:53.758
So

00:20:54.759 --> 00:20:56.560
This is kind of a wild claim, right?

00:20:56.621 --> 00:20:57.280
Obviously,

00:20:57.401 --> 00:20:58.642
when someone makes a claim like this,

00:20:58.682 --> 00:20:59.962
we kind of assume, you know,

00:21:00.163 --> 00:21:01.365
they probably got a lot of evidence,

00:21:01.664 --> 00:21:01.964
right?

00:21:03.066 --> 00:21:04.446
So that is not the case.

00:21:04.907 --> 00:21:06.588
This kind of started a bit of a

00:21:06.628 --> 00:21:07.630
discussion on our forum.

00:21:08.490 --> 00:21:08.891
Freya,

00:21:08.971 --> 00:21:11.093
one of our privacy guides team members,

00:21:11.792 --> 00:21:13.755
replied and said, Signal is open source,

00:21:13.934 --> 00:21:16.136
supports reproducible builds,

00:21:16.517 --> 00:21:18.499
and the protocol is so well known that

00:21:18.578 --> 00:21:19.880
other apps use it like WhatsApp,

00:21:20.380 --> 00:21:22.321
And previously, Google's RCS,

00:21:22.362 --> 00:21:24.923
before they switched to MLS encryption,

00:21:25.284 --> 00:21:27.566
it's analyzed by security researchers.

00:21:27.905 --> 00:21:29.807
If there's some kind of backdoor in

00:21:29.886 --> 00:21:30.248
Signal,

00:21:30.347 --> 00:21:32.509
it will be reported by one of them.

00:21:32.990 --> 00:21:34.871
And just a quick note,

00:21:35.371 --> 00:21:36.971
a lot of those things that Freya posted,

00:21:37.472 --> 00:21:39.094
he had links attached to that to support

00:21:39.114 --> 00:21:39.534
his claims.

00:21:39.914 --> 00:21:40.255
Continue.

00:21:41.808 --> 00:21:42.249
Exactly.

00:21:42.269 --> 00:21:42.469
Yeah.

00:21:42.489 --> 00:21:44.309
This is like, you know,

00:21:44.470 --> 00:21:46.652
we're linking to actual evidence.

00:21:47.192 --> 00:21:48.092
When we're making claims,

00:21:48.152 --> 00:21:49.893
we're linking to actual evidence.

00:21:50.032 --> 00:21:51.913
And that is kind of important, right?

00:21:52.434 --> 00:21:53.734
And there was another user that said,

00:21:54.095 --> 00:21:55.576
if I was going to claim a software

00:21:55.596 --> 00:21:57.576
had a backdoor that is known for security,

00:21:57.856 --> 00:21:59.817
has many audits and reproducible builds,

00:22:00.199 --> 00:22:01.940
I'd be sharing it in a technical write-up,

00:22:02.279 --> 00:22:04.320
not a random statement on a podcast.

00:22:05.501 --> 00:22:06.482
Another user mentioned,

00:22:06.702 --> 00:22:08.223
zero evidence whatsoever, it seems.

00:22:08.263 --> 00:22:09.305
Signal is open source.

00:22:09.625 --> 00:22:11.386
He's perfectly welcome to show us this

00:22:11.426 --> 00:22:12.888
backdoor if it exists,

00:22:13.249 --> 00:22:15.250
but burden of proof is on him.

00:22:16.592 --> 00:22:17.853
Basically, there was,

00:22:18.193 --> 00:22:19.755
to kind of summarize what happened in the

00:22:19.775 --> 00:22:20.435
rest of the thread,

00:22:20.476 --> 00:22:22.938
the thread kind of devolved into some red

00:22:22.998 --> 00:22:25.601
string conspiracy theories with

00:22:26.121 --> 00:22:26.961
circumstantial

00:22:27.590 --> 00:22:29.472
facts and without any evidence.

00:22:30.012 --> 00:22:32.695
And there was definitely some heated

00:22:32.736 --> 00:22:35.298
exchanges had in that thread specifically,

00:22:35.337 --> 00:22:36.558
which now got locked,

00:22:36.959 --> 00:22:38.381
but it's worth a look because it shows

00:22:38.721 --> 00:22:39.402
how to make a claim,

00:22:39.442 --> 00:22:40.863
how to refute it and the difference

00:22:40.903 --> 00:22:43.565
between circumstantial evidence and actual

00:22:43.605 --> 00:22:43.986
logic.

00:22:44.787 --> 00:22:45.707
So yeah,

00:22:45.767 --> 00:22:47.449
this is kind of one of these things

00:22:47.489 --> 00:22:49.371
where in the privacy community,

00:22:49.391 --> 00:22:51.332
there's a lot of people making claims

00:22:51.352 --> 00:22:53.134
about things and saying things,

00:22:53.594 --> 00:22:53.855
but

00:22:55.608 --> 00:22:58.150
Not everyone has evidence to support what

00:22:58.170 --> 00:22:58.670
they're saying.

00:22:59.210 --> 00:23:00.550
So I guess to throw it back to

00:23:00.570 --> 00:23:01.211
you, Nate,

00:23:02.590 --> 00:23:05.632
do you have any tips for actually thinking

00:23:05.791 --> 00:23:10.753
critically about things and not devolving

00:23:10.794 --> 00:23:11.614
into this sort of thinking?

00:23:12.409 --> 00:23:12.729
Yeah.

00:23:12.949 --> 00:23:14.509
And, um, I do want to,

00:23:14.549 --> 00:23:15.790
I want to give the critics a little

00:23:15.810 --> 00:23:17.311
bit of credit because we can't prove a

00:23:17.352 --> 00:23:17.932
negative, right?

00:23:17.992 --> 00:23:19.634
Like we can't prove that signal doesn't

00:23:19.673 --> 00:23:20.875
have a backdoor for example.

00:23:21.494 --> 00:23:21.855
But, uh,

00:23:21.875 --> 00:23:23.336
but one thing that bugs me is like,

00:23:23.497 --> 00:23:25.057
okay, we pointed out, um,

00:23:25.117 --> 00:23:26.057
or I should say a lot of our

00:23:26.077 --> 00:23:28.000
community pointed out signal is open

00:23:28.039 --> 00:23:28.299
source.

00:23:28.420 --> 00:23:28.519
It

00:23:28.779 --> 00:23:30.059
it supports reproducible builds.

00:23:30.400 --> 00:23:31.681
At one point they got into talking about

00:23:31.721 --> 00:23:32.701
the server and how like,

00:23:33.080 --> 00:23:34.501
it doesn't really matter if the server is

00:23:34.541 --> 00:23:36.041
compromised because all the encryption

00:23:36.061 --> 00:23:37.721
happens on device and stuff like that.

00:23:38.163 --> 00:23:40.623
So a backdoored server would just like,

00:23:40.722 --> 00:23:42.023
yeah, you could scoop up some metadata,

00:23:42.044 --> 00:23:42.943
which still wouldn't be good,

00:23:43.423 --> 00:23:45.084
but it's not like, you know, a backdoor,

00:23:45.384 --> 00:23:46.704
it can read all your content.

00:23:46.904 --> 00:23:47.805
It doesn't work that way.

00:23:48.404 --> 00:23:50.865
And just, you know, it's,

00:23:53.367 --> 00:23:54.569
My brain just suddenly lapsed.

00:23:55.270 --> 00:23:58.315
But we can't prove that Signal's not

00:23:58.596 --> 00:24:00.157
compromised, but it's, oh,

00:24:00.499 --> 00:24:02.000
it's about like the type of evidence.

00:24:02.040 --> 00:24:03.883
When you present, in my opinion,

00:24:03.923 --> 00:24:05.665
you present all these types of evidence

00:24:06.166 --> 00:24:06.728
that say like,

00:24:06.768 --> 00:24:07.888
here's why we should trust it.

00:24:08.490 --> 00:24:09.871
And then, you know, one thing I see,

00:24:09.911 --> 00:24:11.530
like I clicked on one of the links

00:24:11.550 --> 00:24:12.951
in that post is like, oh,

00:24:13.051 --> 00:24:15.112
Signal has gotten founding from the CIA in

00:24:15.132 --> 00:24:15.492
the past.

00:24:15.913 --> 00:24:16.532
And I kid you not,

00:24:16.553 --> 00:24:17.532
when you click on this post,

00:24:17.613 --> 00:24:20.894
it's like Signal got founding from the

00:24:21.394 --> 00:24:23.134
Open Technology Fund, or excuse me,

00:24:23.315 --> 00:24:23.615
funding.

00:24:23.934 --> 00:24:24.976
Signal got funding from the Open

00:24:24.996 --> 00:24:25.635
Technology Fund,

00:24:25.895 --> 00:24:27.457
who in turn got funding from someone else,

00:24:27.497 --> 00:24:28.957
who in turn got funding from someone else,

00:24:29.176 --> 00:24:30.678
who in turn got funding from the CIA

00:24:30.758 --> 00:24:31.438
once upon a time.

00:24:31.938 --> 00:24:33.318
And so it's like this...

00:24:34.525 --> 00:24:35.806
Again, is it possible?

00:24:35.905 --> 00:24:37.048
Yeah, it's possible.

00:24:37.087 --> 00:24:38.148
I'm not going to say it's impossible.

00:24:38.169 --> 00:24:39.369
If somebody comes forward with evidence,

00:24:39.750 --> 00:24:40.830
it's like that one person said,

00:24:41.291 --> 00:24:42.073
Signal is open source.

00:24:42.093 --> 00:24:43.753
He's perfectly welcome to show us this

00:24:43.773 --> 00:24:44.234
backdoor.

00:24:45.096 --> 00:24:46.217
Yeah, come forward and prove it.

00:24:46.237 --> 00:24:47.478
Please prove it because if Signal is

00:24:47.498 --> 00:24:48.538
compromised, I want to know.

00:24:48.940 --> 00:24:50.721
But the reason I call it red string

00:24:50.761 --> 00:24:52.242
conspiracy theories is it's like that meme

00:24:52.262 --> 00:24:53.604
of Charlie Day from It's Always Sunny

00:24:53.904 --> 00:24:54.965
where he's got the board and he's got

00:24:54.986 --> 00:24:56.366
all the red string connecting everything

00:24:56.386 --> 00:24:58.591
and he's like –

00:24:57.248 --> 00:24:58.209
It's a conspiracy!

00:24:58.288 --> 00:24:58.829
And it's like, yeah,

00:24:58.849 --> 00:24:59.851
if you want to play Six Degrees of

00:24:59.871 --> 00:25:00.392
Kevin Bacon,

00:25:00.491 --> 00:25:01.813
everything's connected to everything.

00:25:01.913 --> 00:25:02.093
Like,

00:25:02.894 --> 00:25:04.876
if you play the Six Degrees game long

00:25:04.896 --> 00:25:05.057
enough,

00:25:05.176 --> 00:25:06.597
I'm connected to literally every person on

00:25:06.657 --> 00:25:06.838
Earth,

00:25:07.159 --> 00:25:08.740
including the random farmer in China that

00:25:08.780 --> 00:25:09.300
I've never met.

00:25:09.561 --> 00:25:11.604
Like, you can play this game all day.

00:25:11.703 --> 00:25:13.246
So it just...

00:25:13.605 --> 00:25:14.487
This kind of stuff bugs me.

00:25:14.507 --> 00:25:16.429
But anyways, yeah, no, I...

00:25:17.410 --> 00:25:20.472
um yeah number four said a nice username

00:25:20.492 --> 00:25:21.492
by the way we'll talk about that later

00:25:21.913 --> 00:25:23.275
uh number four said giving evidence of

00:25:23.295 --> 00:25:24.715
your claims should be a norm i agree

00:25:25.376 --> 00:25:26.518
um because that is the thing is like

00:25:26.538 --> 00:25:27.898
when you make a claim like that the

00:25:27.919 --> 00:25:29.920
burden of proof is on you like it's

00:25:29.940 --> 00:25:32.321
not like anybody's telling you don't prove

00:25:32.402 --> 00:25:34.263
it like again if it's compromised we want

00:25:34.284 --> 00:25:35.644
to know people are trusting the software

00:25:35.664 --> 00:25:37.787
with their lives but you can't just say

00:25:37.866 --> 00:25:39.188
like signal is compromised

00:25:40.555 --> 00:25:42.758
okay i i'm a millionaire i have a

00:25:42.798 --> 00:25:44.400
green dragon in my closet like what i

00:25:45.020 --> 00:25:46.583
i you could say anything you want you

00:25:46.603 --> 00:25:48.625
got to prove it um i'm not a

00:25:48.645 --> 00:25:50.248
millionaire i wish i was anyways getting

00:25:50.268 --> 00:25:51.650
back to your actual question getting off

00:25:51.670 --> 00:25:54.653
my soapbox um i don't have i mean

00:25:55.795 --> 00:25:56.635
I think just in general,

00:25:56.655 --> 00:25:57.455
like critical thinking,

00:25:57.576 --> 00:25:59.698
and I almost hate using that word because

00:25:59.738 --> 00:26:00.897
I feel like it's been so weaponized.

00:26:01.018 --> 00:26:03.240
Like I'm actually having this discussion

00:26:03.259 --> 00:26:04.461
with somebody right now in a completely

00:26:04.520 --> 00:26:05.121
unrelated chat.

00:26:05.201 --> 00:26:05.681
But, you know,

00:26:05.740 --> 00:26:08.242
it's like it's letting the evidence lead

00:26:08.282 --> 00:26:10.284
you regardless of your biases.

00:26:10.344 --> 00:26:10.884
You know,

00:26:10.964 --> 00:26:11.904
don't – like there's always that,

00:26:12.144 --> 00:26:13.006
you know, oh,

00:26:13.066 --> 00:26:14.727
I question who funded this study and I

00:26:14.767 --> 00:26:16.407
question the methodology of this study.

00:26:16.488 --> 00:26:17.087
And it's like, okay,

00:26:17.127 --> 00:26:19.190
but you're not questioning the studies

00:26:19.250 --> 00:26:21.590
that confirm your biases that are

00:26:21.671 --> 00:26:24.392
obviously –

00:26:22.991 --> 00:26:25.653
methodology and funding conflict of

00:26:25.692 --> 00:26:26.012
interest.

00:26:26.053 --> 00:26:29.553
But I guess the only resource I have,

00:26:29.593 --> 00:26:30.374
I hate to show myself,

00:26:30.413 --> 00:26:33.534
but over on my ghost, ghost.newoil.org,

00:26:34.094 --> 00:26:35.634
I have a blog post about critical

00:26:35.654 --> 00:26:35.954
thinking.

00:26:36.035 --> 00:26:36.394
And this is,

00:26:36.954 --> 00:26:38.375
I took a philosophy class in college.

00:26:38.914 --> 00:26:39.895
I know I've told this story before,

00:26:39.935 --> 00:26:40.855
but for anybody who hasn't heard it,

00:26:41.236 --> 00:26:42.615
I took a philosophy class in college and

00:26:42.635 --> 00:26:43.915
it was purely just for the credits.

00:26:44.016 --> 00:26:44.496
I was just like,

00:26:44.537 --> 00:26:46.037
I just needed something in that category.

00:26:46.057 --> 00:26:46.457
And I was like, eh,

00:26:47.136 --> 00:26:48.238
i'm interested in philosophy i'll take

00:26:48.258 --> 00:26:50.719
that and the one-on-one class i actually

00:26:50.739 --> 00:26:51.939
think should be taught in all classes

00:26:52.318 --> 00:26:53.400
because they didn't really talk about

00:26:53.440 --> 00:26:55.039
philosophy that much instead they talked

00:26:55.059 --> 00:26:57.181
about how to evaluate a claim and how

00:26:57.201 --> 00:26:59.241
to evaluate like the evidence and the

00:26:59.281 --> 00:27:00.883
person making the claim without attacking

00:27:00.923 --> 00:27:03.483
them and you know um does it conflict

00:27:03.503 --> 00:27:04.683
with what we already know does it conflict

00:27:04.703 --> 00:27:07.144
with other experts say and uh yeah i

00:27:07.184 --> 00:27:07.965
definitely um

00:27:09.175 --> 00:27:11.178
definitely recommend i guess i would say

00:27:11.278 --> 00:27:12.919
starting there um because that kind of

00:27:12.939 --> 00:27:16.182
summarizes all that stuff but uh and yeah

00:27:16.362 --> 00:27:17.843
actually i was the last thing i had

00:27:17.863 --> 00:27:18.844
written here in the notes is to turn

00:27:18.864 --> 00:27:19.865
it over to you guys do you guys

00:27:19.884 --> 00:27:22.267
have any favorite blogs videos podcasts

00:27:22.346 --> 00:27:24.307
books whatever about critical thinking and

00:27:24.347 --> 00:27:25.509
how to evaluate a claim and how to

00:27:25.548 --> 00:27:29.392
avoid falling into the trap of like only

00:27:29.452 --> 00:27:30.773
paying attention to things that confirm

00:27:30.794 --> 00:27:34.856
your biases and um yeah i guess uh

00:27:37.017 --> 00:27:38.519
or any techniques you use.

00:27:39.119 --> 00:27:39.300
Sorry,

00:27:39.320 --> 00:27:40.221
I was trying to click on that link

00:27:40.241 --> 00:27:41.624
there to read it.

00:27:41.724 --> 00:27:43.346
But yeah, I think that's all I got.

00:27:44.530 --> 00:27:45.892
I'm going to start with that one so

00:27:45.912 --> 00:27:46.451
I can read it later.

00:27:46.471 --> 00:27:46.712
I agree.

00:27:46.772 --> 00:27:47.673
I agree with everything you said.

00:27:47.732 --> 00:27:49.394
Definitely all good points.

00:27:49.894 --> 00:27:52.317
I think also we did get a small,

00:27:52.356 --> 00:27:53.857
I'm not sure exactly what this means,

00:27:54.057 --> 00:27:54.817
ten jewels.

00:27:54.857 --> 00:27:55.979
We just got ten jewels.

00:27:56.019 --> 00:27:57.039
I'm not sure what that means,

00:27:57.079 --> 00:27:57.700
but thank you.

00:27:59.040 --> 00:27:59.842
Thanks so much for that.

00:28:01.042 --> 00:28:02.483
Someone said, I love your username,

00:28:02.683 --> 00:28:03.263
number four.

00:28:03.765 --> 00:28:04.045
Yes,

00:28:04.085 --> 00:28:05.746
we will get into the number four later.

00:28:05.965 --> 00:28:07.146
We are going to cover that,

00:28:07.247 --> 00:28:08.067
just so you all know.

00:28:08.127 --> 00:28:09.328
So stick around for that later.

00:28:09.828 --> 00:28:10.068
Yeah.

00:28:11.009 --> 00:28:11.369
But yes,

00:28:11.589 --> 00:28:12.510
we're keeping an eye on the chat.

00:28:12.530 --> 00:28:14.152
And if anyone has any questions about what

00:28:14.172 --> 00:28:14.712
we're talking about,

00:28:14.813 --> 00:28:17.213
do leave that in the chat.

00:28:17.894 --> 00:28:18.115
But yeah,

00:28:18.134 --> 00:28:19.655
I guess we can just hop straight into

00:28:19.675 --> 00:28:21.978
the next story, unless you see anything.

00:28:22.038 --> 00:28:25.420
Yeah, not that Anon said less wrong.

00:28:25.640 --> 00:28:26.921
I feel like I've heard of that one.

00:28:28.321 --> 00:28:28.722
Maybe,

00:28:29.063 --> 00:28:30.223
or maybe it just sounds similar to other

00:28:30.243 --> 00:28:30.784
things I've heard.

00:28:30.864 --> 00:28:34.266
So not to belabor it,

00:28:34.286 --> 00:28:35.807
but one person said, for safety purposes,

00:28:35.847 --> 00:28:36.667
it's better to assume that it's

00:28:36.708 --> 00:28:37.167
compromised.

00:28:37.548 --> 00:28:37.729
I mean,

00:28:38.148 --> 00:28:39.430
my personal opinion is you could play that

00:28:39.450 --> 00:28:40.391
game all day with everything.

00:28:41.092 --> 00:28:41.231
Like,

00:28:41.511 --> 00:28:42.913
if you literally just throw that out there

00:28:42.933 --> 00:28:44.674
with zero evidence whatsoever, like,

00:28:44.974 --> 00:28:46.036
what's your messenger of choice?

00:28:46.396 --> 00:28:47.877
Like, well, just for safety purposes,

00:28:47.917 --> 00:28:48.719
we'll assume that's wrong.

00:28:48.739 --> 00:28:49.358
And then at that point,

00:28:49.378 --> 00:28:49.980
what are you going to do?

00:28:50.079 --> 00:28:50.259
Like,

00:28:50.599 --> 00:28:51.721
you just can't have a conversation with

00:28:51.760 --> 00:28:52.041
anybody.

00:28:52.061 --> 00:28:52.281
And yeah,

00:28:52.342 --> 00:28:53.843
I know the easy answer is like,

00:28:53.863 --> 00:28:54.703
we'll meet up in person.

00:28:55.124 --> 00:28:55.464
Okay.

00:28:55.664 --> 00:28:58.207
And back when I lived in California and

00:28:58.386 --> 00:28:59.948
my mom lived on the East Coast, like...

00:29:00.669 --> 00:29:01.368
what am I just going to hop on

00:29:01.388 --> 00:29:02.369
the plane every time I wanted to talk

00:29:02.390 --> 00:29:02.809
to my mom?

00:29:02.890 --> 00:29:03.210
Like that's,

00:29:03.269 --> 00:29:04.371
that's not an option all the time.

00:29:04.431 --> 00:29:06.611
So we have to trust something somewhere.

00:29:06.651 --> 00:29:08.211
That's again, not to show my own stuff,

00:29:08.231 --> 00:29:09.553
but that's another blog post I have is

00:29:09.573 --> 00:29:11.532
like anybody who says I don't trust

00:29:11.573 --> 00:29:12.993
anything is lying because you are

00:29:13.074 --> 00:29:15.295
literally trusting somebody somewhere all

00:29:15.315 --> 00:29:15.634
the time.

00:29:15.674 --> 00:29:16.634
You're trusting the building you're

00:29:16.654 --> 00:29:18.076
standing in, not to collapse on your head.

00:29:18.375 --> 00:29:19.596
You're trusting the food you're eating,

00:29:19.676 --> 00:29:20.717
not to poison and kill you.

00:29:20.957 --> 00:29:23.278
You're trusting everything at some point

00:29:23.317 --> 00:29:23.657
somewhere.

00:29:23.778 --> 00:29:25.979
So you have to draw the line somewhere

00:29:26.098 --> 00:29:26.700
is my opinion.

00:29:26.819 --> 00:29:27.920
But anyways,

00:29:28.299 --> 00:29:29.201
I could rant about that all day.

00:29:29.800 --> 00:29:29.881
Uh,

00:29:30.800 --> 00:29:32.603
We'll go ahead and move on to our

00:29:32.623 --> 00:29:34.683
next story, which is about Cash App.

00:29:34.903 --> 00:29:36.445
And I think everybody loves Cash App,

00:29:36.486 --> 00:29:36.705
right?

00:29:36.726 --> 00:29:39.847
Oh, sorry, let me, forgot to,

00:29:39.887 --> 00:29:41.469
you already shifted them around and I

00:29:41.489 --> 00:29:42.089
didn't even notice.

00:29:44.111 --> 00:29:45.412
So this comes from four oh four and

00:29:45.432 --> 00:29:46.873
the headline says someone opened a Cash

00:29:46.932 --> 00:29:49.295
App in her name and she faces years

00:29:49.474 --> 00:29:50.296
in prison.

00:29:51.135 --> 00:29:55.179
So this one I think actually requires a

00:29:55.299 --> 00:29:55.980
login wall.

00:29:57.401 --> 00:29:57.961
Yes, it is.

00:29:58.101 --> 00:29:59.942
So this one is free to read,

00:30:00.583 --> 00:30:02.104
but you do have to sign up for

00:30:02.223 --> 00:30:03.983
an account, which, uh,

00:30:04.384 --> 00:30:06.266
four Oh four does that to prevent bots

00:30:06.425 --> 00:30:07.266
scraping the website.

00:30:07.465 --> 00:30:08.467
So, um,

00:30:08.527 --> 00:30:09.247
if you don't want to do that,

00:30:09.287 --> 00:30:10.627
I totally understand, but also just,

00:30:10.748 --> 00:30:12.189
if you do, it is free just FYI.

00:30:12.868 --> 00:30:14.130
And, uh, this story, uh,

00:30:14.877 --> 00:30:15.738
I'm going to go ahead and read from

00:30:15.758 --> 00:30:16.239
my notes here.

00:30:16.699 --> 00:30:18.138
It says Amanda Smith answered the door one

00:30:18.179 --> 00:30:19.680
afternoon in April and came face to face

00:30:19.700 --> 00:30:20.880
with the local sheriff's department in

00:30:20.960 --> 00:30:21.921
upstate Pennsylvania.

00:30:22.280 --> 00:30:23.520
The officer said they had a warrant for

00:30:23.560 --> 00:30:24.721
her arrest with a crime that she had

00:30:24.741 --> 00:30:26.142
allegedly committed more than a thousand

00:30:26.162 --> 00:30:27.262
miles away in Arkansas.

00:30:28.202 --> 00:30:29.983
Smith recalled, I was completely confused.

00:30:30.263 --> 00:30:31.743
For one, she had never been to Arkansas.

00:30:31.804 --> 00:30:32.243
And second,

00:30:32.263 --> 00:30:33.464
the warrant was for computer fraud.

00:30:33.765 --> 00:30:34.565
By her own admission,

00:30:34.605 --> 00:30:36.246
Smith was not a very tech savvy person.

00:30:36.826 --> 00:30:38.146
What developed over the next few days and

00:30:38.166 --> 00:30:39.948
has now stretched across six months is a

00:30:39.988 --> 00:30:41.868
Kafkaesque situation in which Smith,

00:30:41.949 --> 00:30:42.509
in her telling,

00:30:42.869 --> 00:30:44.391
is being asked to prove her innocence in

00:30:44.411 --> 00:30:45.431
an ongoing criminal case,

00:30:45.711 --> 00:30:47.412
while Cash App refuses to provide her any

00:30:47.432 --> 00:30:48.833
information about the account because she

00:30:48.853 --> 00:30:50.134
couldn't prove that she was the owner.

00:30:50.653 --> 00:30:53.915
Which would make sense if she's, you know,

00:30:53.976 --> 00:30:54.196
not...

00:30:55.436 --> 00:30:56.678
Yeah, if she's telling the truth,

00:30:56.698 --> 00:30:57.159
she can't get it.

00:30:57.878 --> 00:30:59.140
According to a copy of the prosecuting

00:30:59.160 --> 00:31:00.161
attorney's affidavit form,

00:31:00.181 --> 00:31:01.882
police responded to an Arkansas address on

00:31:01.922 --> 00:31:03.763
February fourth after a report of fraud.

00:31:04.483 --> 00:31:05.724
The victim said that they recently found

00:31:05.765 --> 00:31:06.905
some items for sale on Facebook

00:31:06.945 --> 00:31:07.486
Marketplace.

00:31:07.886 --> 00:31:09.147
When the victim messaged about buying the

00:31:09.228 --> 00:31:09.448
items,

00:31:09.468 --> 00:31:10.709
the seller told him to send the money

00:31:10.729 --> 00:31:11.869
to his wife's Cash App account,

00:31:11.890 --> 00:31:12.410
which he did.

00:31:12.829 --> 00:31:13.990
That account was in the name of Amanda

00:31:14.030 --> 00:31:16.252
Smith and had the username Smithy five,

00:31:16.292 --> 00:31:17.054
six, eight, seven.

00:31:17.594 --> 00:31:18.673
It turned out the seller's Facebook

00:31:18.713 --> 00:31:19.315
account was hacked,

00:31:19.394 --> 00:31:20.795
the seller wasn't really selling the items

00:31:20.815 --> 00:31:22.175
at all, and the person had been scammed.

00:31:22.476 --> 00:31:23.915
The Cash App account was created just

00:31:23.955 --> 00:31:25.297
shortly before the scam at the end of

00:31:25.376 --> 00:31:25.836
January.

00:31:26.217 --> 00:31:27.478
Investigators then took the Cash App

00:31:27.498 --> 00:31:29.077
account's username and served Block,

00:31:29.137 --> 00:31:30.058
which owns Cash App,

00:31:30.298 --> 00:31:31.858
with a search warrant seeking information

00:31:31.878 --> 00:31:32.759
connected to the account.

00:31:33.180 --> 00:31:34.840
The data returned included Smith's social

00:31:34.881 --> 00:31:36.080
security number and date of birth.

00:31:36.421 --> 00:31:37.922
Cash App requires users to provide their

00:31:37.961 --> 00:31:39.561
social security number to, ironically,

00:31:40.163 --> 00:31:41.063
protect against fraud.

00:31:42.414 --> 00:31:43.415
The Cash App account was made...

00:31:43.996 --> 00:31:45.017
This is a little further down in the

00:31:45.416 --> 00:31:45.696
article.

00:31:46.116 --> 00:31:47.337
The Cash App account was made with Smith's

00:31:47.357 --> 00:31:48.519
social security number and date of birth,

00:31:48.538 --> 00:31:49.740
but a lot of other information from the

00:31:49.759 --> 00:31:51.080
account does not line up with Smith,

00:31:51.401 --> 00:31:57.505
according to the Philadelphia address on

00:31:57.605 --> 00:31:59.026
it is not Smith's or Josh's,

00:31:59.046 --> 00:32:01.627
which is her husband, nor either one...

00:32:02.087 --> 00:32:02.448
excuse me,

00:32:02.788 --> 00:32:04.189
nor one either of them have ever lived

00:32:04.249 --> 00:32:04.328
in.

00:32:04.689 --> 00:32:05.910
They said that they did live together in

00:32:05.950 --> 00:32:07.450
Philadelphia in the same zip code as the

00:32:07.470 --> 00:32:08.830
address on the Cash App account,

00:32:08.851 --> 00:32:09.790
but not that address,

00:32:09.851 --> 00:32:10.891
and they don't live in Philadelphia

00:32:10.931 --> 00:32:11.352
anymore.

00:32:11.932 --> 00:32:13.132
Smith said the number used to create the

00:32:13.172 --> 00:32:14.393
Cash App account is not her current

00:32:14.413 --> 00:32:14.633
number.

00:32:14.992 --> 00:32:16.433
Her husband did not remember Smith using

00:32:16.473 --> 00:32:17.354
that phone number at all,

00:32:17.453 --> 00:32:18.794
although Smith said she may have done so

00:32:18.834 --> 00:32:20.095
in the early two thousands before she

00:32:20.134 --> 00:32:21.315
switched from T-Mobile to AT&T.

00:32:21.355 --> 00:32:24.557
Not a smoking gun,

00:32:24.616 --> 00:32:25.777
but that is a little detail to remember,

00:32:25.876 --> 00:32:26.477
T-Mobile, AT&T.

00:32:29.065 --> 00:32:30.586
Four Oh four did not find this phone

00:32:30.605 --> 00:32:32.768
number linked to an Amanda or four or

00:32:32.788 --> 00:32:34.209
four did find this phone number linked to

00:32:34.348 --> 00:32:35.891
an Amanda Smith in various data breaches

00:32:35.931 --> 00:32:37.632
from years ago using open source

00:32:37.652 --> 00:32:38.152
intelligence.

00:32:38.692 --> 00:32:39.933
They also found that someone made a Venmo

00:32:39.953 --> 00:32:41.214
account using the same phone number,

00:32:41.255 --> 00:32:42.875
but under another name entirely,

00:32:42.895 --> 00:32:44.277
whoever made that account did so about a

00:32:44.317 --> 00:32:45.817
week before the scam cash app account.

00:32:46.538 --> 00:32:47.940
The Cash App data also shows that whoever

00:32:47.960 --> 00:32:49.461
made the account used an iPhone running

00:32:49.501 --> 00:32:50.482
sixteen dot one dot one,

00:32:50.603 --> 00:32:52.163
a very out of date operating system from

00:32:52.203 --> 00:32:52.865
twenty twenty two.

00:32:53.184 --> 00:32:53.685
Smith, however,

00:32:53.705 --> 00:32:55.406
has an iPhone thirteen mini with iOS

00:32:55.426 --> 00:32:56.628
twenty six point five point two,

00:32:56.709 --> 00:32:58.049
according to a screenshot of her devices

00:32:58.089 --> 00:32:58.349
settings.

00:32:58.369 --> 00:33:00.833
She shared the IP address used during the

00:33:00.853 --> 00:33:02.114
creation of the Cash App account during

00:33:02.153 --> 00:33:04.036
the scam itself related to connections

00:33:04.056 --> 00:33:05.477
from Verizon's wireless network.

00:33:05.517 --> 00:33:06.718
So remember, I said T-Mobile, AT&T.

00:33:08.779 --> 00:33:09.079
Again,

00:33:09.140 --> 00:33:11.060
Smith is on an AT&T plan and says

00:33:11.080 --> 00:33:12.221
she never had a Verizon plan.

00:33:12.821 --> 00:33:14.182
Smith said she never used the username

00:33:14.222 --> 00:33:15.423
Smithy-Five-Six-Eight-Seven.

00:33:15.483 --> 00:33:16.884
Four-O-Four Media found other people

00:33:16.944 --> 00:33:17.865
online using this moniker,

00:33:17.884 --> 00:33:19.346
but none appeared to be this Smith.

00:33:20.166 --> 00:33:21.307
Smith's leading theory is that someone

00:33:21.326 --> 00:33:22.028
stole her identity,

00:33:22.067 --> 00:33:23.188
perhaps through a data breach like the

00:33:23.208 --> 00:33:24.568
National Public Data Breach in December of

00:33:24.588 --> 00:33:25.589
twenty-twenty-four and used that

00:33:25.609 --> 00:33:26.910
information to open a Cash App account.

00:33:27.310 --> 00:33:28.750
Authorities offered Smith a plea deal of a

00:33:28.790 --> 00:33:29.551
thousand dollar fine,

00:33:29.612 --> 00:33:30.692
a thousand dollar restitution,

00:33:30.853 --> 00:33:32.614
various other costs like a bailiff and DNA

00:33:32.634 --> 00:33:33.034
samples.

00:33:33.513 --> 00:33:34.595
and three years probation.

00:33:34.894 --> 00:33:36.236
Smith said she refuses to accept it

00:33:36.276 --> 00:33:37.576
because she's innocent and doing so would

00:33:37.596 --> 00:33:39.798
have long-term negative consequences on

00:33:39.857 --> 00:33:40.278
her life.

00:33:40.719 --> 00:33:42.779
And I totally agree.

00:33:42.900 --> 00:33:45.582
So let me get up and rant here

00:33:45.602 --> 00:33:46.041
for a second.

00:33:46.923 --> 00:33:49.424
In the article, Smith says like,

00:33:50.144 --> 00:33:51.726
I am something to the effect of like,

00:33:52.027 --> 00:33:54.308
I was raised to believe that, um,

00:33:54.368 --> 00:33:54.888
in America,

00:33:54.909 --> 00:33:55.990
you're supposed to be innocent until

00:33:56.029 --> 00:33:56.590
proven guilty.

00:33:57.030 --> 00:33:57.892
And, you know, a minute ago,

00:33:58.011 --> 00:33:58.633
I just said like,

00:33:58.692 --> 00:33:59.834
you can't prove a negative, right?

00:33:59.854 --> 00:34:02.415
Like she can't prove that this wasn't her

00:34:02.977 --> 00:34:04.417
unless she can like prove that she was

00:34:04.458 --> 00:34:04.679
like,

00:34:05.179 --> 00:34:05.598
I don't know,

00:34:05.719 --> 00:34:07.940
on a deserted island at like a no

00:34:07.980 --> 00:34:09.460
electronics retreat of some kind or

00:34:09.481 --> 00:34:09.981
something, right?

00:34:10.442 --> 00:34:11.121
But in general,

00:34:11.161 --> 00:34:12.782
you can't prove that this isn't you.

00:34:13.282 --> 00:34:14.884
But if we did things the way we're

00:34:14.923 --> 00:34:15.483
supposed to,

00:34:15.623 --> 00:34:16.925
where we're saying innocent and we have to

00:34:16.945 --> 00:34:18.144
prove this is you, I mean,

00:34:18.164 --> 00:34:19.266
this is so shaky, right?

00:34:19.326 --> 00:34:22.146
Like the address is not her address that

00:34:22.166 --> 00:34:23.128
she's ever lived at.

00:34:23.527 --> 00:34:24.809
She's never had Verizon.

00:34:24.909 --> 00:34:26.148
And this is all stuff they can prove

00:34:26.309 --> 00:34:26.568
through,

00:34:26.628 --> 00:34:27.449
like this is all stuff

00:34:27.849 --> 00:34:29.692
Cash app proved, um, you know,

00:34:29.731 --> 00:34:30.753
she's never had Verizon.

00:34:31.092 --> 00:34:32.454
She doesn't have that cell phone.

00:34:32.715 --> 00:34:34.255
She's never lived in Arkansas.

00:34:34.376 --> 00:34:35.496
And, uh,

00:34:35.516 --> 00:34:37.278
four Oh four said they use querying IP

00:34:37.298 --> 00:34:39.221
geo location tools with the, the,

00:34:39.240 --> 00:34:40.262
the IP address from cash app,

00:34:40.282 --> 00:34:41.202
the Verizon IP address.

00:34:41.603 --> 00:34:43.965
So presumably that puts the phone in, uh,

00:34:44.485 --> 00:34:46.548
you know, Arkansas, which yeah,

00:34:46.568 --> 00:34:48.130
I know there's ways to like root things

00:34:48.170 --> 00:34:49.313
and she could be hiding the phone at

00:34:49.353 --> 00:34:50.733
a friend's house or something like that.

00:34:51.195 --> 00:34:52.297
But I mean, it's, it's one of those,

00:34:52.317 --> 00:34:53.277
like it's Occam's razor, right?

00:34:53.297 --> 00:34:54.679
Like what's more likely this lady who

00:34:54.719 --> 00:34:57.523
claims that she's not very tech savvy has

00:34:57.563 --> 00:34:59.766
this burner phone and she's using,

00:34:59.786 --> 00:35:00.206
you know,

00:35:00.527 --> 00:35:01.668
tools to spoof it,

00:35:01.708 --> 00:35:03.148
to scam this person out of a thousand

00:35:03.188 --> 00:35:05.130
dollars and blah, blah, blah, blah, blah.

00:35:05.469 --> 00:35:06.891
Or somebody stole her identity,

00:35:06.931 --> 00:35:08.052
which I was actually ranting about this to

00:35:08.072 --> 00:35:08.612
my wife earlier.

00:35:08.931 --> 00:35:10.393
We shouldn't even consider social security

00:35:10.413 --> 00:35:11.853
number to be privileged information

00:35:11.893 --> 00:35:13.275
anymore because there've been so many

00:35:13.295 --> 00:35:14.175
freaking data breaches.

00:35:14.635 --> 00:35:16.757
Hi, we do a roundup every single week,

00:35:16.777 --> 00:35:17.097
by the way,

00:35:17.117 --> 00:35:17.956
in case you guys don't remember.

00:35:19.418 --> 00:35:21.702
We do – there's so many data breaches,

00:35:21.782 --> 00:35:23.905
and a lot of them do reveal social

00:35:23.925 --> 00:35:25.427
security number and date of birth and

00:35:25.487 --> 00:35:26.630
sensitive information like that.

00:35:27.811 --> 00:35:30.034
It's so easy to steal somebody's identity

00:35:30.074 --> 00:35:30.295
now.

00:35:30.394 --> 00:35:31.336
So –

00:35:31.860 --> 00:35:32.820
Yeah, I don't know.

00:35:34.902 --> 00:35:35.543
I'll get off that one.

00:35:36.182 --> 00:35:38.204
I'm a little surprised by this because I

00:35:38.224 --> 00:35:40.007
was thinking about what possible defenses

00:35:40.027 --> 00:35:40.947
would exist for this thing,

00:35:41.748 --> 00:35:46.010
and I'm really not sure because I actually

00:35:46.030 --> 00:35:47.311
had to open a cash app myself the

00:35:47.331 --> 00:35:48.793
other day because...

00:35:49.829 --> 00:35:50.329
Just reasons.

00:35:50.829 --> 00:35:51.891
And first of all,

00:35:51.911 --> 00:35:52.811
I'm not even sure how they were able

00:35:52.831 --> 00:35:53.992
to do it because even me,

00:35:54.032 --> 00:35:56.512
Cash App made me like do the whole

00:35:56.552 --> 00:35:57.353
liveness check, right?

00:35:57.373 --> 00:35:58.673
To like show my face and turn my

00:35:58.713 --> 00:35:59.333
head and whatnot.

00:35:59.813 --> 00:36:00.833
So I don't know how they got through

00:36:00.873 --> 00:36:01.155
that.

00:36:01.574 --> 00:36:02.594
But then also I was thinking about it

00:36:02.614 --> 00:36:02.934
and I'm like,

00:36:03.375 --> 00:36:05.135
my credit is frozen and I've never,

00:36:05.315 --> 00:36:07.416
like I had no issues opening that account.

00:36:07.496 --> 00:36:09.597
So I don't know.

00:36:09.757 --> 00:36:11.278
Usually our defense against identity theft

00:36:11.318 --> 00:36:15.420
is like freeze your credit and you won't

00:36:15.440 --> 00:36:15.860
get it stolen.

00:36:15.880 --> 00:36:16.541
But clearly this is,

00:36:17.768 --> 00:36:19.068
Not necessarily the case here.

00:36:19.148 --> 00:36:20.730
So I don't know.

00:36:21.010 --> 00:36:21.911
I guess after all that,

00:36:22.130 --> 00:36:22.911
I'll go ahead and turn it over to

00:36:22.931 --> 00:36:23.112
you.

00:36:23.172 --> 00:36:23.311
Jordan,

00:36:23.331 --> 00:36:24.393
do you have any thoughts on what we

00:36:24.413 --> 00:36:26.375
could do to prevent this kind of stuff?

00:36:26.494 --> 00:36:27.775
I mean, yes.

00:36:27.896 --> 00:36:30.217
I would say it seems like in this

00:36:30.257 --> 00:36:30.737
case,

00:36:31.458 --> 00:36:33.480
am I right in saying that the person

00:36:33.539 --> 00:36:37.043
wasn't aware that their social security

00:36:37.103 --> 00:36:39.085
number and identity documents weren't

00:36:39.164 --> 00:36:40.085
actually breached?

00:36:40.184 --> 00:36:41.967
Am I understanding that correctly?

00:36:43.260 --> 00:36:45.000
Yeah, so the Amanda Smith person,

00:36:45.039 --> 00:36:46.460
she didn't even know this was happening.

00:36:46.820 --> 00:36:48.121
She probably doesn't know.

00:36:49.041 --> 00:36:49.300
I mean,

00:36:49.641 --> 00:36:51.201
most people don't pay attention to these

00:36:51.260 --> 00:36:52.081
data breach stories.

00:36:52.242 --> 00:36:53.822
And most of the people I meet too,

00:36:54.702 --> 00:36:55.961
even if it made headlines and she saw

00:36:55.981 --> 00:36:57.021
it on the news, she'd be like, oh,

00:36:57.041 --> 00:36:57.362
whatever.

00:36:57.382 --> 00:36:58.262
I don't have any money for them to

00:36:58.282 --> 00:36:58.902
steal anyways.

00:36:58.943 --> 00:37:00.182
Like that's usually what people say.

00:37:00.302 --> 00:37:01.882
So yeah,

00:37:01.902 --> 00:37:03.284
she's probably not super familiar with all

00:37:03.324 --> 00:37:03.583
this stuff.

00:37:03.603 --> 00:37:04.983
They don't know exactly where the data

00:37:05.023 --> 00:37:05.403
came from.

00:37:05.423 --> 00:37:06.744
They're just speculating with that whole

00:37:06.784 --> 00:37:08.184
twenty twenty four data breach thing.

00:37:08.565 --> 00:37:08.945
Because again,

00:37:08.965 --> 00:37:10.105
there's been so many breaches.

00:37:10.184 --> 00:37:11.065
It could have come from anywhere.

00:37:12.597 --> 00:37:13.036
Exactly.

00:37:13.378 --> 00:37:13.697
Yeah, no,

00:37:13.757 --> 00:37:15.559
I think one thing that's kind of

00:37:15.579 --> 00:37:17.621
frustrating about this sort of story is if

00:37:17.641 --> 00:37:19.143
you don't know that your information is

00:37:19.163 --> 00:37:19.884
being compromised,

00:37:19.923 --> 00:37:21.545
there's not really much you can do, right?

00:37:22.246 --> 00:37:23.688
But I think if you do know that

00:37:23.708 --> 00:37:25.088
your information is being compromised,

00:37:25.608 --> 00:37:27.110
there are things you can do, right?

00:37:27.170 --> 00:37:29.572
So I think in this circumstance, you know,

00:37:30.313 --> 00:37:31.855
getting those documents replaced,

00:37:32.115 --> 00:37:34.137
getting... Actually, I'm not sure.

00:37:34.177 --> 00:37:35.998
Can you get a new social security number

00:37:36.018 --> 00:37:36.780
if it's been breached?

00:37:37.000 --> 00:37:37.641
Do they allow that?

00:37:38.137 --> 00:37:40.402
You can, but from what I understand,

00:37:40.443 --> 00:37:43.429
it's a huge ordeal and it's kind of

00:37:43.469 --> 00:37:44.932
something that's like a last resort.

00:37:45.333 --> 00:37:46.396
It's like a real process.

00:37:47.771 --> 00:37:48.070
I see.

00:37:48.170 --> 00:37:50.472
OK, so, yeah, that could be an option.

00:37:50.572 --> 00:37:52.114
I guess it depends on how bad the

00:37:52.134 --> 00:37:52.634
breach is.

00:37:53.534 --> 00:37:54.996
Honestly, I would probably do it anyway,

00:37:55.456 --> 00:37:56.476
because, you know,

00:37:56.516 --> 00:37:57.577
like we saw in the story,

00:37:58.097 --> 00:38:00.018
you don't want to be sentenced to prison

00:38:00.159 --> 00:38:01.739
or like sentenced to years in prison

00:38:01.780 --> 00:38:03.141
because of someone who's stolen your

00:38:03.201 --> 00:38:03.561
identity.

00:38:03.621 --> 00:38:03.822
Right.

00:38:04.461 --> 00:38:06.123
This is like the worst case scenario for

00:38:06.663 --> 00:38:08.465
any sort of identity theft situation.

00:38:09.085 --> 00:38:09.865
sort of story, you know,

00:38:09.905 --> 00:38:11.626
this is probably as bad as it's going

00:38:11.646 --> 00:38:12.628
to get at this point.

00:38:13.128 --> 00:38:14.048
So, you know,

00:38:14.068 --> 00:38:17.130
obviously this is a very extreme case of

00:38:17.172 --> 00:38:17.791
what can happen,

00:38:18.291 --> 00:38:20.393
but I think getting those documents

00:38:20.434 --> 00:38:20.793
replaced,

00:38:21.574 --> 00:38:24.137
getting a new social security number,

00:38:24.237 --> 00:38:25.318
even if it might be a kind of

00:38:25.458 --> 00:38:25.898
a pain,

00:38:26.239 --> 00:38:27.480
it depends on which country you live in

00:38:27.500 --> 00:38:28.420
because it depends.

00:38:29.141 --> 00:38:30.282
Here it's not that hard to get it

00:38:30.302 --> 00:38:31.543
replaced as long as you can prove that

00:38:31.563 --> 00:38:32.242
it's been reached.

00:38:33.844 --> 00:38:34.065
You know,

00:38:34.105 --> 00:38:36.347
getting those identity documents voided

00:38:37.429 --> 00:38:38.231
is pretty important.

00:38:38.291 --> 00:38:40.456
It's going to stop people from stealing

00:38:40.496 --> 00:38:40.976
that stuff.

00:38:41.318 --> 00:38:44.222
And also just be a little bit more

00:38:44.344 --> 00:38:46.708
cautious about what information you share

00:38:46.789 --> 00:38:47.309
with people.

00:38:48.411 --> 00:38:48.813
So, you know,

00:38:50.672 --> 00:38:52.793
not sharing your date of birth on social

00:38:52.833 --> 00:38:54.833
media, not sharing when your birthday is,

00:38:54.914 --> 00:38:55.494
not, you know,

00:38:55.574 --> 00:38:57.675
all these sort of extra data points is

00:38:57.715 --> 00:39:00.536
things that people can use to steal your

00:39:00.597 --> 00:39:01.036
identity.

00:39:02.458 --> 00:39:04.539
And I don't think this doesn't seem like

00:39:04.579 --> 00:39:06.739
it's a cash app specific issue, right?

00:39:07.119 --> 00:39:08.641
Like this could have happened to pretty

00:39:08.681 --> 00:39:11.601
much any other like, you know,

00:39:11.641 --> 00:39:13.382
financial services provider, right?

00:39:14.954 --> 00:39:15.856
Yeah, potentially.

00:39:15.996 --> 00:39:16.155
I mean,

00:39:16.195 --> 00:39:17.317
I think we won't know that until we

00:39:17.336 --> 00:39:20.338
figure out how they were able to game

00:39:20.559 --> 00:39:21.579
the Cash App system.

00:39:22.739 --> 00:39:22.980
But yeah,

00:39:23.039 --> 00:39:23.940
it says they were able to open a

00:39:23.981 --> 00:39:25.101
Venmo, which for the record,

00:39:25.262 --> 00:39:26.242
I was not able to do that one.

00:39:26.282 --> 00:39:27.503
I tried to open both because I was

00:39:27.523 --> 00:39:27.623
like,

00:39:27.643 --> 00:39:28.724
let me just get both in case I

00:39:28.764 --> 00:39:29.003
need it.

00:39:29.184 --> 00:39:32.166
And Venmo did not like my phone number.

00:39:32.467 --> 00:39:33.586
But yeah,

00:39:33.608 --> 00:39:35.748
so it's potentially not a Cash App thing,

00:39:35.809 --> 00:39:36.369
possibly.

00:39:38.431 --> 00:39:40.431
Yeah.

00:39:41.032 --> 00:39:42.893
I think this could also be a good

00:39:43.054 --> 00:39:44.375
argument for some of those,

00:39:46.000 --> 00:39:46.764
What's the word I'm looking for?

00:39:48.992 --> 00:39:50.574
those data removal services or even doing

00:39:50.594 --> 00:39:51.793
it yourself if you want, that's fine.

00:39:51.873 --> 00:39:52.994
I know some people really don't trust

00:39:53.014 --> 00:39:53.614
those services,

00:39:53.655 --> 00:39:54.875
but it is a lot of work to

00:39:54.914 --> 00:39:55.474
do it yourself.

00:39:55.916 --> 00:39:57.056
Um, yeah,

00:39:57.135 --> 00:39:58.456
universe middle productions here did point

00:39:58.536 --> 00:39:59.317
out only if you're a Senator,

00:39:59.356 --> 00:40:00.157
Congressman or judge.

00:40:00.456 --> 00:40:01.557
Um, I,

00:40:01.677 --> 00:40:04.099
I know a lot of places like if

00:40:04.159 --> 00:40:06.280
you are like a judge or law enforcement,

00:40:06.300 --> 00:40:07.679
they'll automatically remove your stuff

00:40:07.699 --> 00:40:09.561
from public records or not automatically,

00:40:09.581 --> 00:40:10.740
but you have to like file for it

00:40:10.780 --> 00:40:11.722
and they'll do it without argument.

00:40:12.121 --> 00:40:12.601
Everyone else,

00:40:12.641 --> 00:40:13.581
I guess we just don't matter.

00:40:13.661 --> 00:40:15.083
We're not important and our lives don't

00:40:15.123 --> 00:40:15.382
matter.

00:40:15.422 --> 00:40:16.543
So always fun.

00:40:17.403 --> 00:40:17.583
Um,

00:40:19.150 --> 00:40:19.630
Yeah, I mean,

00:40:19.650 --> 00:40:20.492
I have a couple other thoughts,

00:40:20.532 --> 00:40:23.197
but did you have anything before I offer

00:40:23.217 --> 00:40:23.739
those real quick?

00:40:24.621 --> 00:40:26.023
No, no, please do go ahead.

00:40:27.153 --> 00:40:27.594
Um, yeah.

00:40:27.634 --> 00:40:27.914
So, uh,

00:40:28.474 --> 00:40:29.556
a couple other things that stuck out to

00:40:29.576 --> 00:40:30.335
me while I was reading this,

00:40:30.376 --> 00:40:31.677
first of all, not to victim blame, but,

00:40:31.876 --> 00:40:32.597
um,

00:40:32.657 --> 00:40:34.079
if you're the person in Arkansas in this

00:40:34.099 --> 00:40:34.539
situation,

00:40:35.119 --> 00:40:36.420
I don't know who would pay in advance

00:40:36.440 --> 00:40:37.121
for goods online.

00:40:37.380 --> 00:40:38.081
Like maybe it's me,

00:40:38.121 --> 00:40:39.541
maybe I'm a not very trusting person,

00:40:39.581 --> 00:40:39.963
but like,

00:40:40.503 --> 00:40:42.123
I'll pay you when I'm standing in the

00:40:42.143 --> 00:40:43.505
parking lot and you have the item.

00:40:43.764 --> 00:40:43.925
Like,

00:40:44.025 --> 00:40:46.086
I don't know why you would just cash

00:40:46.126 --> 00:40:48.188
up somebody a thousand dollars and you

00:40:48.228 --> 00:40:49.849
haven't seen the item yet.

00:40:50.590 --> 00:40:54.032
Um, and as for, uh, Amanda Smith,

00:40:54.192 --> 00:40:54.371
I mean,

00:40:54.411 --> 00:40:55.072
it seems like things are

00:40:56.121 --> 00:40:57.762
hopefully going well for her in the sense

00:40:57.802 --> 00:40:59.003
that like, she's, she's got a case,

00:40:59.023 --> 00:41:00.563
she's got a lawyer, but, um,

00:41:01.603 --> 00:41:02.264
my wife and I, again,

00:41:02.284 --> 00:41:03.304
I was like ranting about this to my

00:41:03.324 --> 00:41:03.485
wife.

00:41:03.525 --> 00:41:04.326
We were talking about it earlier.

00:41:04.726 --> 00:41:05.606
Always ask for a lawyer.

00:41:05.706 --> 00:41:06.907
Like, even if you are innocent,

00:41:07.188 --> 00:41:09.608
there's so many people who think like, oh,

00:41:09.789 --> 00:41:10.469
I didn't do anything.

00:41:10.510 --> 00:41:10.929
So I'll just like,

00:41:10.969 --> 00:41:12.170
I'll talk to the cops and we'll straighten

00:41:12.190 --> 00:41:12.751
this whole thing out.

00:41:13.092 --> 00:41:14.893
And as you can see from this mountain

00:41:14.932 --> 00:41:17.594
of evidence, the cops,

00:41:17.614 --> 00:41:20.596
I'm going to give them the benefit of

00:41:20.615 --> 00:41:20.996
the doubt here.

00:41:21.036 --> 00:41:21.396
Um,

00:41:22.871 --> 00:41:24.554
Usually the cops get their person when

00:41:24.574 --> 00:41:25.134
they get somebody.

00:41:25.715 --> 00:41:27.757
So I will say there are a lot

00:41:27.797 --> 00:41:28.880
of innocent people sitting in jail,

00:41:28.920 --> 00:41:30.822
but it's not like sixty percent of them

00:41:30.862 --> 00:41:31.242
or something.

00:41:31.664 --> 00:41:34.067
So they have this bad habit of once

00:41:34.086 --> 00:41:35.329
they decide that you did it.

00:41:36.617 --> 00:41:37.117
You did it.

00:41:37.498 --> 00:41:39.019
And they will ignore all evidence that

00:41:39.039 --> 00:41:39.840
says you didn't do it.

00:41:39.880 --> 00:41:41.242
And they will only focus on the evidence

00:41:41.262 --> 00:41:42.021
that says you did do it.

00:41:42.061 --> 00:41:42.402
And again,

00:41:42.443 --> 00:41:43.684
this story is a perfect example.

00:41:44.103 --> 00:41:45.485
So if you ever have to talk to

00:41:45.505 --> 00:41:45.925
the cops,

00:41:47.606 --> 00:41:49.527
make sure that like you get a lawyer

00:41:49.588 --> 00:41:51.849
because there are some innocent people

00:41:51.869 --> 00:41:52.530
sitting in jail right now.

00:41:52.570 --> 00:41:53.630
Again, I know it's not the majority,

00:41:53.670 --> 00:41:55.193
but there are some innocent people sitting

00:41:55.213 --> 00:41:56.373
in jail right now who were like, oh,

00:41:56.494 --> 00:41:56.994
I didn't do it.

00:41:57.014 --> 00:41:57.795
I have nothing to hide.

00:41:58.155 --> 00:41:59.335
We'll just talk and get this whole thing

00:41:59.356 --> 00:41:59.835
straightened out.

00:42:00.255 --> 00:42:02.077
But the cops were like, you're our guy.

00:42:02.217 --> 00:42:03.778
And they just turned everything against

00:42:03.798 --> 00:42:03.958
them.

00:42:04.018 --> 00:42:04.500
So I don't know.

00:42:04.579 --> 00:42:05.300
Anyways, I just...

00:42:06.280 --> 00:42:07.181
I feel the need to point that out

00:42:07.221 --> 00:42:07.521
every time.

00:42:07.641 --> 00:42:08.442
Always ask for a lawyer.

00:42:09.661 --> 00:42:10.021
And then, yeah,

00:42:10.061 --> 00:42:11.302
if any listeners have any advice on how

00:42:11.322 --> 00:42:12.222
to defend against this kind of stuff,

00:42:12.242 --> 00:42:13.282
because I did send a message in a

00:42:13.302 --> 00:42:19.025
group chat, but nobody responded yet.

00:42:19.045 --> 00:42:20.605
I don't know if maybe nobody else had

00:42:20.644 --> 00:42:23.085
any ideas or just nobody's had time to

00:42:23.106 --> 00:42:26.507
look at it, but yeah.

00:42:26.567 --> 00:42:27.748
I'm checking through some of the comments

00:42:27.807 --> 00:42:28.027
here.

00:42:29.244 --> 00:42:29.885
Oh, interesting.

00:42:30.264 --> 00:42:31.927
About DIY data broken removal service.

00:42:31.947 --> 00:42:33.588
Some people are setting up local AI agents

00:42:33.608 --> 00:42:34.289
to do it for them.

00:42:34.309 --> 00:42:35.289
You need to know how to secure these

00:42:35.309 --> 00:42:36.291
security nightmares, but in the end,

00:42:36.331 --> 00:42:37.070
it could be a good option.

00:42:39.092 --> 00:42:39.733
Yeah, I mean,

00:42:39.893 --> 00:42:40.994
I don't know enough about setting up a

00:42:41.014 --> 00:42:42.295
local AI agent.

00:42:42.556 --> 00:42:44.157
I wouldn't trust myself to do it right,

00:42:44.257 --> 00:42:46.039
but if you know what you're doing and

00:42:46.059 --> 00:42:47.340
you're confident that it's not going to be

00:42:47.380 --> 00:42:47.940
leaking data,

00:42:48.981 --> 00:42:53.005
I guess that could be one thing for

00:42:53.045 --> 00:42:53.106
it.

00:42:54.918 --> 00:42:55.619
Yeah,

00:42:55.659 --> 00:43:01.188
I guess we can kind of pivot to

00:43:01.929 --> 00:43:03.231
recommendations on our website.

00:43:04.353 --> 00:43:06.675
We do recommend data removal services.

00:43:06.755 --> 00:43:08.277
I think right now we only recommend one,

00:43:08.297 --> 00:43:09.280
which is easy opt-outs.

00:43:09.820 --> 00:43:10.820
And it's really cheap.

00:43:10.942 --> 00:43:12.643
So you don't have to make a whole

00:43:12.663 --> 00:43:14.045
local AI agent to do it for you.

00:43:14.065 --> 00:43:15.246
You can just pay them to do it.

00:43:16.347 --> 00:43:17.467
It's like twenty dollars a year.

00:43:17.688 --> 00:43:18.409
It's really cheap.

00:43:18.710 --> 00:43:20.911
It can remove a lot of information about

00:43:20.931 --> 00:43:21.112
you.

00:43:21.873 --> 00:43:24.195
That is one step you can take to

00:43:24.235 --> 00:43:25.137
stop that.

00:43:25.456 --> 00:43:26.057
As far as I know,

00:43:26.077 --> 00:43:27.518
that's more of an issue in the US.

00:43:27.719 --> 00:43:28.679
But again...

00:43:29.867 --> 00:43:31.608
It's something you should look at.

00:43:32.009 --> 00:43:33.010
Try Googling yourself.

00:43:33.070 --> 00:43:34.291
See what information is out there.

00:43:35.090 --> 00:43:36.932
We also do recommend manual opt-outs.

00:43:36.952 --> 00:43:40.916
We have some links to specific websites

00:43:40.936 --> 00:43:43.137
that you can get removed from that are

00:43:43.197 --> 00:43:44.358
particularly bad.

00:43:45.039 --> 00:43:46.420
And there's also a link to the...

00:43:48.782 --> 00:43:50.463
the big, the bad bull,

00:43:50.503 --> 00:43:53.286
the big ass data broker opt out list,

00:43:54.086 --> 00:43:56.528
which I think is also a really good

00:43:56.568 --> 00:43:57.068
resource.

00:43:58.210 --> 00:43:59.670
And we also do recommend you use,

00:44:00.271 --> 00:44:01.431
it's only for specific people,

00:44:01.472 --> 00:44:03.893
but there's a Google about you search,

00:44:04.275 --> 00:44:05.135
which basically just

00:44:05.916 --> 00:44:07.797
searches your name and information and

00:44:07.838 --> 00:44:09.559
will alert you if something's been listed.

00:44:10.119 --> 00:44:12.501
So that's also another option depending on

00:44:12.521 --> 00:44:14.322
your threat model and if you're okay with

00:44:14.342 --> 00:44:15.543
giving that information to Google.

00:44:15.583 --> 00:44:18.385
But those are like two basic things that

00:44:18.405 --> 00:44:20.347
we kind of do.

00:44:20.907 --> 00:44:23.230
We do recommend people at least give a

00:44:23.289 --> 00:44:25.692
look to reduce the chances of identity

00:44:25.731 --> 00:44:29.295
theft and all of that.

00:44:29.315 --> 00:44:29.494
But yeah,

00:44:29.514 --> 00:44:30.655
I thought we should at least mention that.

00:44:32.079 --> 00:44:33.159
No, yeah, good call for sure.

00:44:33.179 --> 00:44:33.960
Because there's, like you said,

00:44:33.981 --> 00:44:35.001
it's about threat model, right?

00:44:35.021 --> 00:44:36.202
Like, there's so many different, like,

00:44:36.824 --> 00:44:38.385
Google already has my real information

00:44:38.485 --> 00:44:41.007
because I have monetization on my YouTube

00:44:41.027 --> 00:44:41.307
channel.

00:44:41.768 --> 00:44:41.969
So...

00:44:43.257 --> 00:44:44.797
I do have the whole results about you

00:44:44.838 --> 00:44:46.018
thing set up.

00:44:46.038 --> 00:44:47.159
Cause like they already know everything

00:44:47.179 --> 00:44:47.798
about me anyways.

00:44:47.858 --> 00:44:48.059
Right.

00:44:48.259 --> 00:44:49.860
It's to me, it's another layer of defense,

00:44:50.179 --> 00:44:50.981
which I, for the record,

00:44:51.021 --> 00:44:52.260
I know that's like one argument people

00:44:52.300 --> 00:44:53.382
give to not care about privacy.

00:44:53.802 --> 00:44:54.882
I'm just saying in my case,

00:44:55.382 --> 00:44:56.063
I thought about it.

00:44:56.202 --> 00:44:58.123
I weighed the choices and I willingly gave

00:44:58.164 --> 00:45:00.085
Google that information and now they have

00:45:00.144 --> 00:45:00.244
it.

00:45:00.284 --> 00:45:01.385
So I may as well take advantage of

00:45:01.405 --> 00:45:02.166
the results about you.

00:45:02.525 --> 00:45:04.186
But I also totally respect somebody being

00:45:04.226 --> 00:45:04.606
like, no,

00:45:04.766 --> 00:45:06.248
I've gone out of my way for Google

00:45:06.268 --> 00:45:07.168
to not know who I am.

00:45:07.507 --> 00:45:08.688
I'm not going to give them my name

00:45:08.708 --> 00:45:10.148
and like, Hey, that's totally valid.

00:45:10.188 --> 00:45:10.869
I respect that.

00:45:10.909 --> 00:45:11.530
So yeah.

00:45:12.291 --> 00:45:12.550
So yeah,

00:45:12.590 --> 00:45:14.152
lots of different options for different

00:45:14.172 --> 00:45:14.693
people out there.

00:45:14.713 --> 00:45:17.456
What was the one?

00:45:17.538 --> 00:45:17.818
Oh yeah,

00:45:17.878 --> 00:45:19.579
so kind of talking about what we said

00:45:19.599 --> 00:45:19.900
earlier,

00:45:20.280 --> 00:45:22.603
Asus apparently also has some CVEs.

00:45:23.284 --> 00:45:25.186
They said that they left some links on

00:45:25.226 --> 00:45:25.728
the forum.

00:45:28.755 --> 00:45:31.797
Yeah, I think that's all we got.

00:45:31.817 --> 00:45:33.898
I think maybe we can move on to

00:45:34.097 --> 00:45:35.759
some site updates for now.

00:45:35.878 --> 00:45:37.980
So yeah, in a little bit,

00:45:38.119 --> 00:45:40.121
we're going to talk about a possible new

00:45:40.280 --> 00:45:41.862
Celebrate Zero day,

00:45:42.342 --> 00:45:43.402
which should be super exciting.

00:45:43.922 --> 00:45:44.322
But first,

00:45:44.382 --> 00:45:46.184
we will give some quick updates about what

00:45:46.224 --> 00:45:47.704
we've been working on at Privacy Guides

00:45:47.744 --> 00:45:48.164
this week.

00:45:48.485 --> 00:45:49.684
And remember to leave any questions and

00:45:49.724 --> 00:45:50.565
comments in the chat,

00:45:50.626 --> 00:45:52.286
and we'll get to them in a moment.

00:45:52.347 --> 00:45:52.927
But first,

00:45:53.867 --> 00:45:56.009
we have a new video as soon as

00:45:56.068 --> 00:45:56.208
I can

00:45:56.889 --> 00:45:58.010
pull this up here.

00:45:59.030 --> 00:46:00.150
If you guys didn't notice,

00:46:00.311 --> 00:46:03.193
we have released a new video about FISA,

00:46:03.393 --> 00:46:06.436
the Foreign Intelligence Surveillance Act

00:46:06.876 --> 00:46:07.576
and Section.

00:46:09.737 --> 00:46:11.179
I really like doing these history videos

00:46:11.239 --> 00:46:13.260
personally because I'm

00:46:15.389 --> 00:46:17.130
I'm very fascinated by how we got here.

00:46:17.190 --> 00:46:18.911
And I wouldn't say like I study history.

00:46:19.251 --> 00:46:20.492
It's more of a passing interest.

00:46:21.273 --> 00:46:22.454
I listen to a lot of different podcasts

00:46:22.494 --> 00:46:23.574
and some of them talk about history and

00:46:23.614 --> 00:46:23.974
some don't.

00:46:24.454 --> 00:46:25.255
But personally,

00:46:25.394 --> 00:46:26.536
I feel like the more I learn about

00:46:26.596 --> 00:46:26.996
history,

00:46:27.056 --> 00:46:28.876
the more it kind of like explains things.

00:46:28.898 --> 00:46:29.077
You know,

00:46:29.097 --> 00:46:30.838
it's the more I understand it's like, oh,

00:46:31.539 --> 00:46:32.938
This is why things are the way they

00:46:32.958 --> 00:46:33.079
are.

00:46:33.119 --> 00:46:33.960
This is how we got here,

00:46:34.000 --> 00:46:34.440
so to speak.

00:46:34.480 --> 00:46:35.480
So I really like doing this.

00:46:35.579 --> 00:46:35.659
And,

00:46:36.139 --> 00:46:37.221
and I did not grow up in like

00:46:37.240 --> 00:46:37.981
the hacker culture,

00:46:38.001 --> 00:46:38.940
the early hacker culture.

00:46:39.501 --> 00:46:42.521
So pretty much everything like pre nine,

00:46:42.561 --> 00:46:43.842
eleven, to be completely honest,

00:46:43.882 --> 00:46:45.202
kind of didn't happen to me,

00:46:46.722 --> 00:46:48.023
except Oklahoma City, I guess.

00:46:48.063 --> 00:46:48.864
I remember that on the news.

00:46:48.923 --> 00:46:50.664
But so, yeah, for me,

00:46:50.684 --> 00:46:51.684
it's like learning a lot of this.

00:46:51.744 --> 00:46:53.045
Like FISA goes all the way back to

00:46:53.065 --> 00:46:54.266
like nineteen seventy eight, I think,

00:46:54.286 --> 00:46:55.085
is what our research found.

00:46:55.786 --> 00:46:57.987
And so, yeah, it's just, to me,

00:46:58.007 --> 00:46:58.706
it's really interesting.

00:46:58.726 --> 00:47:00.068
And also, personally,

00:47:00.487 --> 00:47:01.708
I feel like it could be my bubble,

00:47:02.389 --> 00:47:04.309
but I feel like whenever there's like news

00:47:04.349 --> 00:47:05.291
headlines about like, oh,

00:47:05.690 --> 00:47:06.811
FISA is going to be reauthorized.

00:47:06.851 --> 00:47:07.512
People are just like,

00:47:07.851 --> 00:47:09.371
they just say like section seven Oh two,

00:47:09.411 --> 00:47:10.753
and it allows the warrantless spying of

00:47:10.793 --> 00:47:11.293
Americans.

00:47:11.353 --> 00:47:11.492
Like,

00:47:11.793 --> 00:47:12.753
and then they just kind of move on.

00:47:12.793 --> 00:47:13.715
And I feel like there's probably a lot

00:47:13.735 --> 00:47:14.175
of people that.

00:47:14.835 --> 00:47:16.414
don't necessarily know what it is or how

00:47:16.454 --> 00:47:17.096
we got here.

00:47:17.175 --> 00:47:17.795
And yeah, so anyway,

00:47:17.815 --> 00:47:19.036
so we made that video and it just

00:47:19.076 --> 00:47:20.677
kind of explains, um,

00:47:21.356 --> 00:47:23.197
how FISA came to be,

00:47:23.257 --> 00:47:25.697
what set the stage for it and why

00:47:25.737 --> 00:47:27.338
it doesn't seem to work and why we're

00:47:27.358 --> 00:47:28.277
still talking about it.

00:47:29.039 --> 00:47:29.159
Uh,

00:47:34.659 --> 00:47:37.021
But yeah, and then we've also, of course,

00:47:37.041 --> 00:47:38.242
we've actually got several videos in

00:47:38.282 --> 00:47:38.784
progress.

00:47:39.284 --> 00:47:41.144
I know Jordan has been working on a

00:47:41.306 --> 00:47:43.106
interview with the Obscura VPN people,

00:47:43.286 --> 00:47:44.268
which should be really cool.

00:47:45.528 --> 00:47:47.871
I just wrapped up a video about Graphene

00:47:47.911 --> 00:47:48.170
OS,

00:47:48.210 --> 00:47:50.052
just kind of giving an overview of what

00:47:50.092 --> 00:47:51.313
it is and why people should use it.

00:47:52.014 --> 00:47:54.635
And I think our next plan is to

00:47:54.675 --> 00:47:56.478
work on a tutorial for Obtanium.

00:47:57.159 --> 00:47:58.440
because I've seen a lot of people say

00:47:58.460 --> 00:47:59.802
that they really don't know how to use

00:47:59.862 --> 00:47:59.961
it.

00:48:00.543 --> 00:48:02.684
And just using it in general is very

00:48:02.704 --> 00:48:03.626
simple and straightforward.

00:48:03.987 --> 00:48:05.748
But there's also all kinds of power tools

00:48:05.768 --> 00:48:06.949
and stuff to get more out of it.

00:48:07.030 --> 00:48:09.152
So yeah,

00:48:10.653 --> 00:48:11.876
I think that's kind of all we got

00:48:11.916 --> 00:48:12.777
going on for now.

00:48:13.318 --> 00:48:14.579
And I will turn it over to Jordan

00:48:14.619 --> 00:48:16.481
for anything I missed and any site

00:48:16.501 --> 00:48:16.862
changes.

00:48:18.262 --> 00:48:18.563
Yeah, no,

00:48:18.623 --> 00:48:20.324
definitely stay tuned for some more

00:48:20.364 --> 00:48:22.125
exciting videos that are coming out soon.

00:48:22.224 --> 00:48:23.146
But yeah,

00:48:23.346 --> 00:48:25.467
jumping into some site changes this week,

00:48:26.208 --> 00:48:28.568
we did have a couple of small changes

00:48:29.028 --> 00:48:29.409
this week.

00:48:29.750 --> 00:48:32.630
We had a change that was pushed by

00:48:32.690 --> 00:48:34.932
Freya where we removed just simply the

00:48:34.952 --> 00:48:38.014
word alternative from Linux's description

00:48:38.554 --> 00:48:39.936
on the Linux overview page.

00:48:39.996 --> 00:48:42.097
So we originally said Linux is an open

00:48:42.137 --> 00:48:44.018
source privacy focused desktop operating

00:48:44.057 --> 00:48:45.458
system alternative,

00:48:45.539 --> 00:48:46.960
but we removed the word alternative.

00:48:46.980 --> 00:48:47.119
So

00:48:47.559 --> 00:48:48.179
Quick fix there.

00:48:49.000 --> 00:48:52.280
We added a quote to we kind of

00:48:52.360 --> 00:48:53.460
reworked, I guess,

00:48:53.561 --> 00:48:57.501
a little bit of the Android verified boot

00:48:57.541 --> 00:48:58.782
documentation page.

00:48:59.762 --> 00:49:01.521
So we basically included more quotes from

00:49:01.882 --> 00:49:05.362
the AOSP documentation,

00:49:05.382 --> 00:49:06.643
which made it a bit more clear and

00:49:06.663 --> 00:49:08.003
a bit more accurate as well,

00:49:08.744 --> 00:49:11.103
because previously it wasn't quite

00:49:12.083 --> 00:49:12.603
correct.

00:49:12.804 --> 00:49:13.784
So now it is correct.

00:49:14.425 --> 00:49:15.585
That was a great change again.

00:49:16.023 --> 00:49:18.286
from freer and i reviewed that one as

00:49:18.346 --> 00:49:20.768
well and there was also another small

00:49:20.809 --> 00:49:24.572
change where we basically updated some of

00:49:24.612 --> 00:49:28.556
the systemd networkd dhcp anonymity

00:49:28.797 --> 00:49:33.822
guidance so just a small change there um

00:49:34.554 --> 00:49:35.295
Not really a whole lot,

00:49:35.315 --> 00:49:39.159
just some small corrections on that page.

00:49:39.800 --> 00:49:40.440
So yeah,

00:49:40.760 --> 00:49:42.882
overall kind of a small amount of changes

00:49:42.922 --> 00:49:43.322
this week,

00:49:43.382 --> 00:49:45.806
but still we are trying to make sure

00:49:45.826 --> 00:49:46.887
that everything is up to date on the

00:49:46.907 --> 00:49:47.987
website and correct.

00:49:48.208 --> 00:49:49.590
So thank you to everyone that made

00:49:49.650 --> 00:49:50.891
contributions there.

00:49:51.391 --> 00:49:51.811
And again,

00:49:51.871 --> 00:49:54.375
we had more news updates this week.

00:49:54.815 --> 00:49:55.655
So that's something that...

00:49:56.376 --> 00:49:58.358
both Nate and Freya both work on.

00:49:58.538 --> 00:49:59.918
And there was, as usual,

00:50:00.018 --> 00:50:01.639
a data breach roundup from October

00:50:01.679 --> 00:50:06.199
sixteenth to the twenty-second of October.

00:50:06.860 --> 00:50:08.559
So that was a big week this week.

00:50:08.820 --> 00:50:11.181
Lots of big ones there from Nate.

00:50:12.021 --> 00:50:13.641
And we also had some posts here.

00:50:13.681 --> 00:50:15.722
Signal vulnerability allows audio and

00:50:15.742 --> 00:50:17.182
video, possibly video,

00:50:17.483 --> 00:50:19.182
to continue after hanging up.

00:50:19.304 --> 00:50:20.804
Websites down due to critical

00:50:21.204 --> 00:50:22.184
code execution,

00:50:22.304 --> 00:50:24.045
PHP security vulnerabilities,

00:50:25.467 --> 00:50:27.047
thousands of Android phones shipped with

00:50:27.088 --> 00:50:27.547
malware,

00:50:27.887 --> 00:50:30.170
Metafix is a bug in smart glasses causing

00:50:30.190 --> 00:50:32.610
them to record conversations without user

00:50:32.630 --> 00:50:33.052
consent.

00:50:33.072 --> 00:50:35.092
So all really interesting things to keep

00:50:35.132 --> 00:50:35.532
an eye on.

00:50:35.873 --> 00:50:38.894
Definitely keep an eye on the

00:50:38.914 --> 00:50:41.697
privacyguides.org slash news page for more

00:50:42.577 --> 00:50:44.338
cybersecurity and privacy updates.

00:50:45.492 --> 00:50:46.291
But as usual,

00:50:46.713 --> 00:50:48.233
all this is made possible by our

00:50:48.273 --> 00:50:48.853
supporters.

00:50:48.873 --> 00:50:50.373
You can sign up for a membership or

00:50:50.434 --> 00:50:52.715
donate at privacyguides.org or pick up

00:50:52.735 --> 00:50:55.615
some swag at shop.privacyguides.org.

00:50:56.016 --> 00:50:58.057
Privacy Guides is a non-profit which

00:50:58.137 --> 00:51:00.217
researches and shares privacy-related

00:51:00.297 --> 00:51:02.760
information and facilitates a community on

00:51:02.800 --> 00:51:05.900
our forum and matrix and also Fluxenau.

00:51:06.240 --> 00:51:07.882
But people can ask questions and get

00:51:07.922 --> 00:51:10.322
advice about staying private online and

00:51:10.362 --> 00:51:11.702
preserving their digital rights.

00:51:12.043 --> 00:51:14.965
So now let's talk about the eMudra story

00:51:15.005 --> 00:51:15.125
first.

00:51:15.286 --> 00:51:16.992
Many of you have seen Making the Rounds.

00:51:17.438 --> 00:51:18.898
Remember to leave your questions in the

00:51:18.938 --> 00:51:20.719
chat and we'll get back to them in

00:51:20.780 --> 00:51:22.181
between stories.

00:51:22.661 --> 00:51:25.103
So I feel like this is definitely the

00:51:25.242 --> 00:51:27.565
biggest or one of the biggest stories this

00:51:27.605 --> 00:51:30.347
week that kind of had the entire internet

00:51:30.407 --> 00:51:30.987
exploding.

00:51:32.447 --> 00:51:33.989
The title of this one is the internet

00:51:34.028 --> 00:51:36.351
goes on high alert after discovery of

00:51:36.451 --> 00:51:38.231
eight compromised TLS certs.

00:51:38.692 --> 00:51:40.474
Security personnel around the world are on

00:51:40.514 --> 00:51:43.014
high alert Tuesday following the discovery

00:51:43.074 --> 00:51:45.117
of eight TLS certificates with private

00:51:45.157 --> 00:51:45.637
keys secured.

00:51:45.878 --> 00:51:47.983
so weak they could allow anyone to mint

00:51:48.043 --> 00:51:50.409
trusted browser and app credentials for

00:51:50.509 --> 00:51:51.731
any site on the internet.

00:51:53.128 --> 00:51:55.650
Eight intermediary certificates belong to

00:51:55.750 --> 00:51:58.550
India-based certificate authority eMudra

00:51:58.889 --> 00:51:59.329
Limited.

00:51:59.750 --> 00:52:01.791
An informal advisory published to

00:52:01.891 --> 00:52:05.931
eMudra.wehaveaproblem.com over on Tuesday

00:52:06.032 --> 00:52:06.831
posted the message,

00:52:07.132 --> 00:52:08.811
we have a problem here, Wayne.

00:52:09.032 --> 00:52:11.393
The words were digitally signed using the

00:52:11.432 --> 00:52:13.333
private key of one of eMudra's

00:52:13.393 --> 00:52:16.054
certificates with proof that the reporting

00:52:16.114 --> 00:52:17.873
party had control of the key.

00:52:18.215 --> 00:52:20.295
Defenders scrambled because the same key

00:52:20.635 --> 00:52:22.518
could be used to sign unauthorized

00:52:22.557 --> 00:52:24.519
certificates that would be trusted by

00:52:24.579 --> 00:52:26.682
millions of servers worldwide.

00:52:28.012 --> 00:52:30.574
So quoting from the article,

00:52:30.655 --> 00:52:32.416
this will be a massive cleanup job,

00:52:32.596 --> 00:52:34.438
bigger than Heartbleed.

00:52:35.097 --> 00:52:36.518
Philippo Valsorda,

00:52:36.659 --> 00:52:39.840
a cryptography engineer and cryptography

00:52:40.201 --> 00:52:41.842
maintainer for the open source Go

00:52:41.882 --> 00:52:43.423
programming language, told Ars,

00:52:43.744 --> 00:52:46.005
there will be a very, very long trail.

00:52:46.425 --> 00:52:48.286
IoT devices, Docker containers,

00:52:48.586 --> 00:52:49.728
forgotten Linux machines,

00:52:50.728 --> 00:52:52.969
unmaintained CLI tools that ship their own

00:52:53.010 --> 00:52:54.530
copy of the roots,

00:52:54.630 --> 00:52:55.512
which is a common mistake.

00:52:55.612 --> 00:52:57.594
which is common in some ecosystems like

00:52:57.653 --> 00:52:58.094
Python.

00:52:58.454 --> 00:52:58.695
Also,

00:52:58.755 --> 00:53:00.356
Linux distributions are still rolling out

00:53:00.416 --> 00:53:00.858
updates.

00:53:01.237 --> 00:53:02.458
Some of them are not ready yet,

00:53:02.539 --> 00:53:04.300
and then system administrators will need

00:53:04.320 --> 00:53:06.264
to apply them to a lot of machines.

00:53:07.492 --> 00:53:09.152
Heartbleed is the name of a critical

00:53:09.193 --> 00:53:11.956
vulnerability in the open SSL cryptography

00:53:12.155 --> 00:53:12.596
library.

00:53:12.996 --> 00:53:15.197
In twenty twenty in twenty fourteen,

00:53:15.318 --> 00:53:17.039
it came under mass exploitation.

00:53:17.519 --> 00:53:19.942
Exploits let unaffiliated hackers decrypt

00:53:20.021 --> 00:53:22.884
TLS protected exchanges between parties.

00:53:23.164 --> 00:53:25.126
They also recovered private TLS

00:53:25.146 --> 00:53:27.047
certificates, keys,

00:53:27.387 --> 00:53:28.989
session cookies and passwords.

00:53:29.228 --> 00:53:31.530
The attacks compromised thousands of

00:53:31.590 --> 00:53:32.012
servers,

00:53:32.152 --> 00:53:34.032
some belonging to large companies and

00:53:34.072 --> 00:53:35.934
government agencies around the world.

00:53:36.335 --> 00:53:38.615
Recovery required a long series of steps

00:53:39.135 --> 00:53:40.036
that took years.

00:53:40.416 --> 00:53:42.498
The compromised e-mudra keys were

00:53:42.518 --> 00:53:44.599
defective at a level that's challenging to

00:53:44.659 --> 00:53:45.119
imagine

00:53:47.677 --> 00:53:49.077
Challenging the imagination of many

00:53:49.137 --> 00:53:50.719
engineers studying the incident,

00:53:51.139 --> 00:53:53.360
a normal size for a NIST

00:53:53.681 --> 00:53:56.842
P-th-three-eight-four elliptic curve

00:53:57.003 --> 00:53:59.284
cryptography private key contains three

00:53:59.324 --> 00:54:01.005
hundred and eighty-four bits of entropy,

00:54:01.445 --> 00:54:04.268
a size allowing almost two thousand three

00:54:04.307 --> 00:54:05.088
hundred and eighty-four,

00:54:05.447 --> 00:54:06.949
or a number with one hundred and sixteen

00:54:06.989 --> 00:54:07.409
digits.

00:54:08.090 --> 00:54:09.371
different possibilities.

00:54:09.431 --> 00:54:11.273
The key sizes of the compromised keys

00:54:11.614 --> 00:54:14.195
ranged from three to eight bits.

00:54:14.717 --> 00:54:17.599
Astonishingly, the private keys were four.

00:54:17.880 --> 00:54:19.501
No, like literally the number four.

00:54:20.121 --> 00:54:22.423
Um, fifty-six, sixty-six,

00:54:22.864 --> 00:54:24.967
one hundred and fifteen, one five six,

00:54:25.507 --> 00:54:30.309
So Ben Cartwright-Cox,

00:54:30.391 --> 00:54:32.692
director of BGP Tools, said that,

00:54:32.751 --> 00:54:34.552
my guess, it's an example of,

00:54:35.713 --> 00:54:37.655
it's example code that accidentally leaked

00:54:37.916 --> 00:54:39.476
to production, but hard to know,

00:54:39.556 --> 00:54:41.318
but it's bonkers that no one noticed.

00:54:41.739 --> 00:54:42.699
At this early stage,

00:54:42.998 --> 00:54:46.141
the most immediate threat appears to be

00:54:46.161 --> 00:54:47.463
for those using VPNs,

00:54:47.822 --> 00:54:49.224
especially in countries with governments

00:54:49.244 --> 00:54:51.885
that likely maliciously intercept traffic.

00:54:52.246 --> 00:54:54.507
There are likely many other cases for

00:54:54.547 --> 00:54:55.007
concern.

00:54:55.481 --> 00:54:58.003
End users likely have no recourse other

00:54:58.023 --> 00:55:00.507
than to hold off using many non-browser

00:55:00.527 --> 00:55:02.811
forms of TLS communication until they

00:55:02.851 --> 00:55:05.313
receive assurances updates are in place.

00:55:05.894 --> 00:55:07.757
Most browsers have already blocked the

00:55:07.856 --> 00:55:10.621
intermediate certificates and the

00:55:10.760 --> 00:55:13.083
exception appears to be Edge running on

00:55:13.123 --> 00:55:13.423
Windows

00:55:14.224 --> 00:55:16.465
which at the time of this article went

00:55:16.525 --> 00:55:16.844
live,

00:55:16.965 --> 00:55:19.666
was still connecting to twelve vulnerable

00:55:19.706 --> 00:55:20.186
hosts.

00:55:20.405 --> 00:55:22.766
In response to questions asking why and if

00:55:22.806 --> 00:55:24.527
the company had plans to do so,

00:55:24.927 --> 00:55:26.646
a Microsoft representative said the

00:55:26.686 --> 00:55:28.467
company will be in touch if it has

00:55:28.527 --> 00:55:31.188
anything to, and I quote, share.

00:55:31.447 --> 00:55:32.847
Meanwhile, Signal, WhatsApp,

00:55:32.987 --> 00:55:34.728
WireGuard and other apps that don't rely

00:55:34.768 --> 00:55:36.809
on TLS for confidentiality aren't

00:55:36.829 --> 00:55:37.289
affected.

00:55:37.829 --> 00:55:38.268
eMudra,

00:55:38.329 --> 00:55:41.130
wehaveaproblem.com site also shows apps

00:55:41.230 --> 00:55:42.550
known to be patched so far.

00:55:44.166 --> 00:55:46.947
And one caveat to this is exploiting

00:55:47.007 --> 00:55:48.909
compromised certificates requires an

00:55:49.028 --> 00:55:51.630
active adversary in the middle attack,

00:55:51.791 --> 00:55:54.751
meaning the attacker must act as a proxy

00:55:54.791 --> 00:55:57.333
between two TLS parties and receive

00:55:57.393 --> 00:55:58.974
encrypted traffic, decrypt it,

00:55:59.273 --> 00:55:59.853
re-encrypted,

00:56:00.213 --> 00:56:01.454
and send it to the other party.

00:56:01.815 --> 00:56:03.936
Such capabilities in some cases are

00:56:04.056 --> 00:56:05.916
usually limited to only the most

00:56:06.097 --> 00:56:07.297
well-resourced attacks

00:56:08.117 --> 00:56:08.599
attackers.

00:56:08.818 --> 00:56:10.900
People with control of a local network,

00:56:11.000 --> 00:56:12.481
at a coffee shop, university,

00:56:12.822 --> 00:56:16.244
or other organization face much less of a

00:56:16.304 --> 00:56:16.824
challenge.

00:56:17.405 --> 00:56:19.126
So after all of this,

00:56:20.047 --> 00:56:21.527
it kind of was, you know,

00:56:21.568 --> 00:56:23.210
this was looking pretty bad for eMudra.

00:56:24.351 --> 00:56:25.150
And in fact,

00:56:25.251 --> 00:56:27.572
they decided after this entire predicament

00:56:27.813 --> 00:56:30.534
that they would just throw the towel in.

00:56:31.115 --> 00:56:33.637
Disgraced eMudra drops out of TLS business

00:56:34.057 --> 00:56:36.639
after using a cert private key of four.

00:56:36.659 --> 00:56:36.780
And

00:56:36.920 --> 00:56:38.181
I think probably the funniest thing about

00:56:38.221 --> 00:56:40.081
this whole situation is the amount of

00:56:40.141 --> 00:56:41.862
memes and jokes people were making about

00:56:41.902 --> 00:56:42.143
this.

00:56:43.123 --> 00:56:44.684
There was a lot of, you know,

00:56:45.045 --> 00:56:47.286
people making fun of them for just how

00:56:47.326 --> 00:56:48.606
badly this happened.

00:56:49.407 --> 00:56:51.068
I think we could... Yeah,

00:56:51.108 --> 00:56:51.809
someone said here,

00:56:51.849 --> 00:56:53.789
you wouldn't use four as a private key.

00:56:54.130 --> 00:56:54.670
Yeah, you know,

00:56:54.791 --> 00:56:57.132
this is pretty negligent from them.

00:56:58.132 --> 00:56:59.534
So I guess quoting from this article,

00:57:00.313 --> 00:57:02.536
the chairman of the India-based eMudra

00:57:02.576 --> 00:57:05.097
Limited cited increasing costs and

00:57:05.137 --> 00:57:05.737
complexities...

00:57:06.277 --> 00:57:07.858
compliance requirements paired with the

00:57:07.898 --> 00:57:09.920
business generating just one percent of

00:57:09.981 --> 00:57:10.521
its revenue.

00:57:11.001 --> 00:57:12.882
He also said that the emergence of

00:57:12.943 --> 00:57:15.023
organizations providing TLS certificates

00:57:15.063 --> 00:57:17.485
free of charge further reduced returns on

00:57:17.525 --> 00:57:19.567
investment when compared to other products

00:57:19.708 --> 00:57:21.568
and services the company offers.

00:57:23.202 --> 00:57:23.623
However,

00:57:24.003 --> 00:57:25.903
the level of social media application

00:57:25.943 --> 00:57:28.806
around this incident has brought scrutiny

00:57:28.925 --> 00:57:31.686
that is out of proportion to SSL slash

00:57:31.726 --> 00:57:33.628
TLS's place in our business.

00:57:33.969 --> 00:57:36.050
The company continued in a Thursday post.

00:57:36.670 --> 00:57:37.349
In view of this,

00:57:37.550 --> 00:57:39.090
after detailed deliberations,

00:57:39.431 --> 00:57:41.393
our board has concluded that withdrawing

00:57:41.432 --> 00:57:44.434
from global SSL and TLS is the right

00:57:44.454 --> 00:57:47.056
decision for Imudra and its shareholders.

00:57:47.715 --> 00:57:48.255
On Wednesday,

00:57:48.596 --> 00:57:50.797
Imudra provided a brief explanation for

00:57:50.838 --> 00:57:51.318
the debacle.

00:57:51.757 --> 00:57:53.358
The certificates were created under

00:57:53.438 --> 00:57:56.139
eMudra's ECC route in a key generation

00:57:56.219 --> 00:57:59.920
ceremony, KGC, held on April, April,

00:58:12.284 --> 00:58:15.208
Generation Ceremony caused a wrap-unwrap

00:58:15.228 --> 00:58:17.592
step to produce a second set of weak

00:58:17.612 --> 00:58:20.554
keys alongside the original strong keys.

00:58:20.936 --> 00:58:22.777
The weak keys were the ones published to

00:58:22.818 --> 00:58:23.938
the browser root stores.

00:58:24.420 --> 00:58:26.802
Imudra is working to establish the root

00:58:26.822 --> 00:58:27.242
cause."

00:58:28.063 --> 00:58:30.045
With the immediate certificates blocked by

00:58:30.085 --> 00:58:32.925
browsers, much of the threat is gone,

00:58:33.045 --> 00:58:35.045
but plenty of other devices that rely on

00:58:35.065 --> 00:58:37.086
the same certificates require much longer

00:58:37.106 --> 00:58:38.847
windows to take the same action.

00:58:39.206 --> 00:58:40.288
Still, other devices,

00:58:40.327 --> 00:58:41.668
such as embedded devices,

00:58:42.068 --> 00:58:43.469
may never be able to block them.

00:58:44.009 --> 00:58:45.809
So, yeah,

00:58:46.550 --> 00:58:47.929
this was kind of a huge story this

00:58:47.949 --> 00:58:48.190
week.

00:58:48.889 --> 00:58:50.190
A lot of people were talking about this,

00:58:50.391 --> 00:58:52.271
and I guess kind of to throw it

00:58:52.291 --> 00:58:53.371
back to you, Nate, what...

00:58:54.271 --> 00:58:55.657
What is the defense against this?

00:58:55.737 --> 00:58:57.342
Like this was kind of, you know,

00:58:57.382 --> 00:58:58.545
this was kind of a big story this

00:58:58.585 --> 00:58:58.746
week.

00:58:59.047 --> 00:59:00.030
Is there anything people can do?

00:59:00.050 --> 00:59:01.155
Do you have any more thoughts that you

00:59:01.175 --> 00:59:01.496
want to share?

00:59:02.440 --> 00:59:04.081
Yeah, this was kind of our headline story,

00:59:04.181 --> 00:59:05.782
and then the PHP thing happened,

00:59:05.882 --> 00:59:08.304
so our headline still fits.

00:59:08.324 --> 00:59:09.304
I kind of bumped it up.

00:59:09.945 --> 00:59:11.125
A lot of things went wrong this week.

00:59:11.925 --> 00:59:12.965
I think it kind of highlights the

00:59:13.005 --> 00:59:15.568
importance of keeping updates and

00:59:15.588 --> 00:59:16.088
defenses.

00:59:17.449 --> 00:59:17.728
Again,

00:59:17.789 --> 00:59:18.929
I'll go ahead and get on my soapbox.

00:59:19.329 --> 00:59:21.190
I remember when Google started rolling out

00:59:21.311 --> 00:59:22.731
AI stuff to the Android phone,

00:59:23.331 --> 00:59:25.012
and a lot of people were like, oh,

00:59:25.052 --> 00:59:26.652
I'm just not going to update my Android

00:59:26.672 --> 00:59:27.634
to Android whatever.

00:59:28.313 --> 00:59:28.855
And it's like, okay,

00:59:28.875 --> 00:59:30.376
but that'll only work for so long.

00:59:30.476 --> 00:59:31.038
After a while,

00:59:31.057 --> 00:59:32.641
they're not going to be updated.

00:59:32.661 --> 00:59:34.103
They're not going to be supported anymore.

00:59:34.623 --> 00:59:35.985
And then there's things like this that

00:59:36.005 --> 00:59:36.806
you're running the risk of.

00:59:36.907 --> 00:59:37.568
And I mean, yeah,

00:59:37.708 --> 00:59:39.210
most of it was like the browser, right?

00:59:39.291 --> 00:59:40.693
So, you know,

00:59:40.713 --> 00:59:42.135
keeping your browsers updated and stuff

00:59:42.155 --> 00:59:42.514
like that.

00:59:42.615 --> 00:59:43.697
But yeah,

00:59:44.815 --> 00:59:46.177
Yeah, I mean, it really depends.

00:59:46.898 --> 00:59:47.137
Again,

00:59:47.858 --> 00:59:49.141
there's things other than the browser,

00:59:49.161 --> 00:59:49.300
right?

00:59:49.320 --> 00:59:50.663
Like we said, there's Linux distros,

00:59:50.702 --> 00:59:51.925
there's Docker containers,

00:59:52.324 --> 00:59:53.806
there's IoT devices.

00:59:54.387 --> 00:59:55.128
I mean, some things,

00:59:56.170 --> 00:59:57.952
I think that second story said some things

00:59:58.012 --> 01:00:00.695
might never get updated because

01:00:02.230 --> 01:00:02.610
IOT,

01:00:02.630 --> 01:00:04.291
which actually that is another thing I

01:00:04.311 --> 01:00:05.032
wrote down here is like,

01:00:05.072 --> 01:00:06.472
make sure that you're buying devices that

01:00:06.512 --> 01:00:07.094
get updated.

01:00:07.434 --> 01:00:08.414
I've told this story before,

01:00:08.514 --> 01:00:09.956
but when my wife and I moved in

01:00:09.996 --> 01:00:12.338
together, I didn't even own a TV,

01:00:12.657 --> 01:00:14.239
but she loves streaming.

01:00:14.259 --> 01:00:15.460
She loves to watch shows and stuff.

01:00:15.981 --> 01:00:17.762
And so the compromise we reached was we

01:00:17.782 --> 01:00:18.603
would buy a smart TV,

01:00:18.623 --> 01:00:19.762
but I got to pick the TV.

01:00:20.364 --> 01:00:21.204
And at the time,

01:00:22.425 --> 01:00:23.465
hopefully it's a little better now.

01:00:23.887 --> 01:00:24.266
At the time,

01:00:24.306 --> 01:00:25.228
there weren't really a lot of

01:00:25.268 --> 01:00:27.289
manufacturers that would even update their

01:00:27.329 --> 01:00:27.688
TVs.

01:00:27.728 --> 01:00:28.070
So like,

01:00:28.750 --> 01:00:30.371
It really wasn't that hard because I just

01:00:30.391 --> 01:00:31.532
did my research on like, okay,

01:00:31.833 --> 01:00:32.554
who doesn't have a camera?

01:00:32.855 --> 01:00:33.695
Who doesn't have a microphone?

01:00:33.976 --> 01:00:35.237
Who actually updates their crap?

01:00:35.657 --> 01:00:35.757
Oh,

01:00:35.777 --> 01:00:37.519
there's like four options or like two

01:00:37.599 --> 01:00:38.101
options.

01:00:38.201 --> 01:00:39.641
So yeah,

01:00:39.663 --> 01:00:41.043
like try to get things that actually get

01:00:41.123 --> 01:00:42.965
updates, which can be really hard to tell.

01:00:43.367 --> 01:00:45.007
I know Kerry has mentioned in the past

01:00:45.028 --> 01:00:45.208
that,

01:00:46.449 --> 01:00:47.471
in his opinion, and I agree,

01:00:47.490 --> 01:00:49.353
there should be laws where at very least

01:00:49.393 --> 01:00:50.693
they have to tell you how long they're

01:00:50.713 --> 01:00:51.855
going to support the product for or

01:00:51.936 --> 01:00:52.596
something like that.

01:00:53.177 --> 01:00:53.637
And then, of course,

01:00:53.677 --> 01:00:55.059
I just obligatory have to throw it out

01:00:55.099 --> 01:00:55.298
there.

01:00:55.719 --> 01:00:57.041
You could just avoid smart devices if you

01:00:57.061 --> 01:00:57.981
don't need them, right?

01:00:58.081 --> 01:00:58.302
I mean...

01:01:00.679 --> 01:01:02.460
I admit I bought a smart thermostat just

01:01:02.500 --> 01:01:03.661
to try it out and see if it

01:01:03.681 --> 01:01:04.742
brought enough value to my life that it

01:01:04.762 --> 01:01:05.181
was worth it.

01:01:05.581 --> 01:01:06.021
Not really.

01:01:06.742 --> 01:01:07.182
It's okay.

01:01:07.262 --> 01:01:08.402
It's kind of nice being able to check

01:01:08.463 --> 01:01:08.744
on it.

01:01:08.784 --> 01:01:11.385
And maybe like if I go to the

01:01:11.405 --> 01:01:13.585
next town over to go see family and

01:01:13.626 --> 01:01:15.007
then on the way home,

01:01:15.047 --> 01:01:16.567
we can start the AC cooling off or

01:01:16.586 --> 01:01:16.867
whatever.

01:01:16.927 --> 01:01:17.668
Like, yeah, that's cool.

01:01:17.728 --> 01:01:19.849
But I don't know.

01:01:19.889 --> 01:01:20.869
To me, it wasn't really worth it.

01:01:20.909 --> 01:01:21.510
Whenever it dies,

01:01:21.550 --> 01:01:22.710
I'm probably not going to buy another one.

01:01:22.730 --> 01:01:24.771
I'll just buy like a regular programmable

01:01:24.791 --> 01:01:25.291
thermostat.

01:01:25.311 --> 01:01:27.592
So I think that's about all I got.

01:01:29.070 --> 01:01:30.251
And to viewers,

01:01:30.291 --> 01:01:31.771
please share your favorite four memes in

01:01:31.791 --> 01:01:33.132
the chat because I've seen some good ones

01:01:33.152 --> 01:01:33.411
today.

01:01:33.711 --> 01:01:34.773
And yeah, I'm with you.

01:01:35.092 --> 01:01:36.373
That's probably the silver lining in all

01:01:36.413 --> 01:01:40.094
this is all the four memes.

01:01:40.114 --> 01:01:40.333
Yeah,

01:01:40.574 --> 01:01:42.315
lots of memes about the internet literally

01:01:42.335 --> 01:01:45.114
being on fire and about the number four.

01:01:45.315 --> 01:01:46.896
Just lots of memes about the number four,

01:01:46.996 --> 01:01:48.655
which has been kind of entertaining at

01:01:48.675 --> 01:01:48.916
least.

01:01:49.476 --> 01:01:51.896
At least we get some positive from such

01:01:51.916 --> 01:01:52.677
an awful incident.

01:01:53.557 --> 01:01:55.217
They want it to be the Danish ID

01:01:55.257 --> 01:01:57.159
database with password one, two, three,

01:01:57.199 --> 01:01:57.978
four, five, six.

01:01:58.597 --> 01:02:00.059
Yeah, no, that was quite wild.

01:02:00.139 --> 01:02:01.719
I do think we covered that at some

01:02:01.760 --> 01:02:02.041
point.

01:02:03.021 --> 01:02:03.541
But yeah, no,

01:02:03.601 --> 01:02:05.742
that is kind of it for that story.

01:02:05.764 --> 01:02:07.724
There's not really much to add like on

01:02:07.764 --> 01:02:08.985
top of what happened.

01:02:09.385 --> 01:02:10.186
It's kind of messed up.

01:02:10.646 --> 01:02:11.967
They kind of did a really bad thing.

01:02:12.688 --> 01:02:14.429
Things are trying to be fixed.

01:02:14.809 --> 01:02:15.391
That's kind of it.

01:02:15.411 --> 01:02:16.871
So yeah,

01:02:17.371 --> 01:02:19.054
we could just dive into the next topic

01:02:19.094 --> 01:02:19.253
here.

01:02:20.764 --> 01:02:21.385
Yeah, for sure.

01:02:21.525 --> 01:02:23.347
So our next topic is going to be

01:02:23.427 --> 01:02:26.748
one of our forum discussions, which is,

01:02:27.009 --> 01:02:29.231
does Google's plan for your digital legacy

01:02:29.391 --> 01:02:30.931
actually delete your account?

01:02:31.331 --> 01:02:34.494
So this came from a beginner on our

01:02:34.514 --> 01:02:36.155
forum who said,

01:02:37.335 --> 01:02:38.835
I'm de-Googling, but no matter what I do,

01:02:38.956 --> 01:02:40.197
I can't delete my Google account.

01:02:40.277 --> 01:02:41.556
I consistently get hit with the,

01:02:41.617 --> 01:02:43.157
we couldn't verify it's you message and it

01:02:43.177 --> 01:02:43.976
won't let me do anything.

01:02:44.416 --> 01:02:45.217
So as a last resort,

01:02:45.318 --> 01:02:46.538
I set up this plan for your digital

01:02:46.577 --> 01:02:47.217
legacy option,

01:02:47.478 --> 01:02:48.777
which supposedly deletes your account

01:02:48.838 --> 01:02:50.079
after three months of inactivity.

01:02:50.418 --> 01:02:51.978
It also lets trusted contacts download

01:02:51.998 --> 01:02:53.278
your data, but I didn't add anyone.

01:02:53.619 --> 01:02:54.438
Does this actually work?

01:02:54.458 --> 01:02:55.800
And has anyone deleted their account this

01:02:55.820 --> 01:02:55.980
way?

01:02:56.599 --> 01:02:58.159
Um, so two people chimed in and said,

01:02:58.199 --> 01:02:59.500
yes, I've tried it.

01:02:59.639 --> 01:03:00.460
It works for me.

01:03:01.121 --> 01:03:01.300
Um,

01:03:02.481 --> 01:03:04.101
they did say to uh you know make

01:03:04.141 --> 01:03:05.422
sure that you're totally signed out of

01:03:05.442 --> 01:03:07.001
anything because if you're like if you're

01:03:07.061 --> 01:03:09.242
signed into like an old android phone that

01:03:09.262 --> 01:03:11.244
you forgot about every time it pings

01:03:11.284 --> 01:03:12.603
google that's going to count as activity

01:03:12.643 --> 01:03:14.364
and it's going to reset the timer so

01:03:14.545 --> 01:03:16.204
um you know to be aware of stuff

01:03:16.224 --> 01:03:19.306
like that but um yeah i think this

01:03:19.326 --> 01:03:20.306
is kind of a quick one but the

01:03:20.346 --> 01:03:21.666
the the big thing i thought was

01:03:21.706 --> 01:03:23.766
interesting here was two things first of

01:03:23.806 --> 01:03:25.788
all um thinking outside of the box right

01:03:25.847 --> 01:03:26.068
like

01:03:28.806 --> 01:03:29.626
Can't believe I need to say this.

01:03:30.547 --> 01:03:31.469
Don't do anything illegal.

01:03:31.568 --> 01:03:32.610
We're not telling you to break the law

01:03:32.630 --> 01:03:33.530
and impersonate anybody,

01:03:33.931 --> 01:03:35.371
but just kind of thinking outside the box.

01:03:35.411 --> 01:03:36.994
If you're trying to delete data somewhere

01:03:37.094 --> 01:03:38.074
and they're like, oh, we can't do that.

01:03:38.394 --> 01:03:39.675
Sometimes they genuinely can't, right?

01:03:39.715 --> 01:03:41.177
Like financial institutions have very

01:03:41.217 --> 01:03:42.438
strict laws about they have to keep your

01:03:42.478 --> 01:03:43.639
data for a certain number of years or

01:03:43.659 --> 01:03:43.900
whatever.

01:03:44.420 --> 01:03:45.260
But then there's other times.

01:03:45.280 --> 01:03:49.284
I actually remember years ago,

01:03:49.385 --> 01:03:50.306
I took one of my cats to the

01:03:50.346 --> 01:03:51.626
vet and

01:03:52.972 --> 01:03:54.972
They sent me a reminder that, oh,

01:03:54.992 --> 01:03:57.175
it's time to get their physical done or

01:03:57.195 --> 01:03:57.454
whatever.

01:03:58.054 --> 01:03:58.835
And I wrote them back.

01:03:58.856 --> 01:03:59.476
I was like, actually,

01:03:59.596 --> 01:04:00.396
I've moved out of state,

01:04:00.436 --> 01:04:01.177
so I'm not going to go back to

01:04:01.197 --> 01:04:01.757
you guys anymore.

01:04:02.318 --> 01:04:04.579
Can you please delete all my information?

01:04:05.119 --> 01:04:05.920
And they were like, oh,

01:04:06.000 --> 01:04:07.380
we can't do that because of state law,

01:04:07.400 --> 01:04:08.081
blah, blah, blah, blah, blah.

01:04:08.141 --> 01:04:10.463
And I'm like, it's a cat.

01:04:11.063 --> 01:04:11.822
So I emailed them back.

01:04:11.862 --> 01:04:13.364
I'm like, what state laws?

01:04:13.583 --> 01:04:15.244
Where can I look into this more and

01:04:15.385 --> 01:04:16.106
find out my rights?

01:04:16.885 --> 01:04:18.106
And then they emailed me back and they're

01:04:18.126 --> 01:04:18.827
like, we've deleted your data.

01:04:18.847 --> 01:04:19.268
And I'm like,

01:04:20.409 --> 01:04:20.829
ridiculous,

01:04:20.909 --> 01:04:22.791
but that's not really thinking outside the

01:04:22.831 --> 01:04:23.512
box, but just, you know,

01:04:23.652 --> 01:04:24.273
it's the point of like,

01:04:24.313 --> 01:04:25.594
sometimes you try to delete something and

01:04:25.614 --> 01:04:27.394
people like push back on you and just

01:04:27.434 --> 01:04:28.735
being able to think outside the box like

01:04:28.755 --> 01:04:30.077
that and come up with creative solutions.

01:04:30.617 --> 01:04:31.898
And the other thing that stuck out to

01:04:31.918 --> 01:04:33.480
me is leveraging the community, you know,

01:04:33.619 --> 01:04:35.260
and like I just mentioned, like, Hey,

01:04:35.280 --> 01:04:36.262
I'm trying to delete this.

01:04:36.422 --> 01:04:37.202
I've checked online.

01:04:37.242 --> 01:04:38.483
I can't find any way to do it.

01:04:38.844 --> 01:04:40.585
Does anybody have any ideas that again are

01:04:40.664 --> 01:04:40.965
legal?

01:04:41.085 --> 01:04:41.925
I want to stress that enough.

01:04:42.005 --> 01:04:42.766
So yeah.

01:04:43.487 --> 01:04:43.726
Yeah.

01:04:44.367 --> 01:04:45.768
And I think I just wanted to throw

01:04:45.788 --> 01:04:46.407
that over to viewers.

01:04:46.427 --> 01:04:46.547
Like,

01:04:46.568 --> 01:04:47.807
what's your favorite legal trick that

01:04:47.827 --> 01:04:49.447
you've done to remove your data when you

01:04:49.467 --> 01:04:50.248
have had a hard time?

01:04:50.789 --> 01:04:51.628
Do you have anything to add to that

01:04:51.668 --> 01:04:51.949
one, Jordan?

01:04:53.108 --> 01:04:55.210
I mean, one trick I have used before,

01:04:55.289 --> 01:04:56.550
I'm not exactly sure if it's...

01:04:57.090 --> 01:04:57.869
I don't think it's illegal.

01:04:58.050 --> 01:05:00.851
But, you know, I said, I'm a miner.

01:05:01.150 --> 01:05:02.530
You can't process my information.

01:05:02.751 --> 01:05:04.512
So you need to delete it.

01:05:05.431 --> 01:05:05.891
And they did.

01:05:06.152 --> 01:05:06.311
So...

01:05:07.713 --> 01:05:09.074
It's a white lie, but, you know,

01:05:09.514 --> 01:05:09.994
it's fine.

01:05:10.255 --> 01:05:11.876
I think that's not technically illegal.

01:05:11.916 --> 01:05:12.356
But, you know,

01:05:12.755 --> 01:05:14.757
I think you've got to use different ways

01:05:14.777 --> 01:05:16.737
to get people to respond, right?

01:05:16.777 --> 01:05:18.179
I think people are much more concerned

01:05:18.199 --> 01:05:19.260
about, you know,

01:05:19.420 --> 01:05:22.380
possible regulatory breaches and things.

01:05:22.420 --> 01:05:23.422
So, you know, if you can, like...

01:05:24.081 --> 01:05:26.202
point at something that, like you said,

01:05:26.242 --> 01:05:28.103
you know, oh, this is against, like,

01:05:28.143 --> 01:05:29.483
state law or this is, like, you know,

01:05:29.523 --> 01:05:30.985
against federal law or something,

01:05:31.605 --> 01:05:33.606
they'll probably be a lot more likely to

01:05:33.646 --> 01:05:36.306
cave and just do it than deal with

01:05:36.347 --> 01:05:37.007
someone like you.

01:05:38.126 --> 01:05:39.688
Also, just being really annoying as well,

01:05:40.447 --> 01:05:42.989
you know, message them every day,

01:05:43.248 --> 01:05:45.130
you know, just keep sending messages.

01:05:45.530 --> 01:05:47.951
They will probably do it eventually if you

01:05:47.971 --> 01:05:48.990
be persistent enough.

01:05:49.572 --> 01:05:50.012
I think it's

01:05:51.324 --> 01:05:56.806
It kind of depends on the actual service

01:05:56.827 --> 01:05:57.746
that you're trying to get it removed.

01:05:57.806 --> 01:05:58.987
But I do think that is like a

01:05:59.027 --> 01:06:01.327
fun little trick for Google at least.

01:06:02.108 --> 01:06:04.389
I will say you will probably have better

01:06:04.409 --> 01:06:06.070
luck if you sign into a device and

01:06:06.090 --> 01:06:07.409
leave it signed in for like a decent

01:06:07.429 --> 01:06:09.371
amount of time and then you delete it.

01:06:09.851 --> 01:06:11.492
Because I have had that issue before,

01:06:12.012 --> 01:06:13.572
but it did go away eventually after I

01:06:13.612 --> 01:06:14.592
left it logged in for...

01:06:15.472 --> 01:06:16.813
I think probably like a month or two

01:06:17.293 --> 01:06:18.414
and then it allowed me to delete it

01:06:18.434 --> 01:06:18.855
myself.

01:06:19.074 --> 01:06:20.835
So you might better try that too.

01:06:21.556 --> 01:06:21.856
Um,

01:06:21.876 --> 01:06:24.818
but usually Google is decent with allowing

01:06:24.838 --> 01:06:26.280
you to delete your accounts and stuff.

01:06:26.380 --> 01:06:29.161
So, um, good luck.

01:06:30.842 --> 01:06:34.005
Yeah, I will say, um,

01:06:34.065 --> 01:06:34.945
not that I disagree with you,

01:06:34.965 --> 01:06:35.646
but as far as like the,

01:06:35.726 --> 01:06:36.646
the be annoying part,

01:06:36.726 --> 01:06:37.967
I'd say make that a last resort.

01:06:38.626 --> 01:06:39.027
Um,

01:06:39.047 --> 01:06:40.327
cause I see a lot of people in

01:06:40.369 --> 01:06:40.849
the, uh,

01:06:42.213 --> 01:06:43.715
I see a lot of people online go

01:06:43.795 --> 01:06:44.755
straight to like the privacy.

01:06:44.956 --> 01:06:46.177
Like I actually wrote a blog about it

01:06:46.237 --> 01:06:46.637
last year.

01:06:47.257 --> 01:06:48.798
Naomi Brockwell released that video where

01:06:48.838 --> 01:06:49.559
she shared somebody,

01:06:49.599 --> 01:06:51.440
like they ordered a guitar and they use

01:06:51.481 --> 01:06:53.641
privacy.com and then it tripped the fraud

01:06:53.681 --> 01:06:54.103
flags.

01:06:54.242 --> 01:06:55.403
So the person called them and they're

01:06:55.423 --> 01:06:56.184
like, yeah,

01:06:56.204 --> 01:06:57.585
I just need to confirm some information.

01:06:57.985 --> 01:06:59.005
And the person just went through this

01:06:59.045 --> 01:07:00.867
whole, like was too honest.

01:07:01.487 --> 01:07:02.889
to the point where they're like, oh,

01:07:02.929 --> 01:07:04.032
that's a privacy.com card.

01:07:04.052 --> 01:07:04.291
And oh,

01:07:04.311 --> 01:07:05.393
that's just a name I made up.

01:07:05.434 --> 01:07:06.856
And oh, that, that, and it's just like,

01:07:06.876 --> 01:07:07.996
dude, just a little, like you said,

01:07:08.016 --> 01:07:08.998
like a little white lie,

01:07:09.079 --> 01:07:10.940
like something I've had a lot of success

01:07:10.960 --> 01:07:11.181
with.

01:07:11.842 --> 01:07:12.864
I think I've said this on the podcast

01:07:12.884 --> 01:07:14.306
before is, you know, when you call,

01:07:15.027 --> 01:07:16.168
when you're trying to find out the laws

01:07:16.628 --> 01:07:18.231
for here in the U S for, um,

01:07:18.711 --> 01:07:19.893
Some states will allow you to put like

01:07:19.913 --> 01:07:21.994
a PO box on your driver's license instead

01:07:22.014 --> 01:07:22.596
of your real address.

01:07:23.217 --> 01:07:24.637
And when I call to ask them about

01:07:24.677 --> 01:07:24.878
that,

01:07:25.318 --> 01:07:26.800
instead of being the weirdo who's like,

01:07:26.880 --> 01:07:28.242
I really care about my privacy and this,

01:07:28.262 --> 01:07:28.722
that, and the other,

01:07:29.023 --> 01:07:29.882
what I say is like,

01:07:30.184 --> 01:07:31.465
my wife and I are thinking about becoming

01:07:31.505 --> 01:07:32.826
digital nomads, which...

01:07:34.125 --> 01:07:34.284
I mean,

01:07:34.304 --> 01:07:35.326
if you want to be technical is not

01:07:35.365 --> 01:07:35.646
a lie.

01:07:35.666 --> 01:07:36.706
We've talked about it before.

01:07:36.766 --> 01:07:38.088
Like, would we like to do that someday?

01:07:38.128 --> 01:07:39.530
Maybe, you know, it's,

01:07:39.630 --> 01:07:41.150
it's like just that little white lie of

01:07:41.170 --> 01:07:42.052
like, yeah, we're thinking about it.

01:07:42.072 --> 01:07:42.992
Like what's the laws on this?

01:07:43.012 --> 01:07:44.213
How would we go about doing that?

01:07:44.773 --> 01:07:45.193
And you know,

01:07:45.213 --> 01:07:46.494
they'll tell you what your options are and

01:07:46.514 --> 01:07:47.596
they're not going to treat you as some

01:07:47.615 --> 01:07:48.916
weirdo if you just call in and you're

01:07:48.956 --> 01:07:49.117
like,

01:07:49.197 --> 01:07:51.199
I'm concerned about data brokers and they

01:07:51.219 --> 01:07:51.599
don't care.

01:07:51.699 --> 01:07:53.101
So, um, yeah,

01:07:53.121 --> 01:07:55.742
sometimes like finding an excuse can be

01:07:55.802 --> 01:07:57.103
helpful to make yourself sound a little

01:07:57.123 --> 01:07:58.626
bit less insane.

01:07:58.865 --> 01:07:59.025
Um,

01:07:59.795 --> 01:08:00.876
Like Universe Middle Productions here

01:08:00.916 --> 01:08:01.076
said,

01:08:01.315 --> 01:08:02.617
it's like tell the bank your information

01:08:02.637 --> 01:08:03.757
has been compromised and you want a new

01:08:03.797 --> 01:08:04.157
card.

01:08:05.239 --> 01:08:07.539
So yeah.

01:08:07.559 --> 01:08:07.920
Unfortunately,

01:08:07.940 --> 01:08:08.561
that one doesn't always work.

01:08:08.641 --> 01:08:09.802
I've heard rumors now that a lot of

01:08:09.862 --> 01:08:11.202
companies, when you get a new card,

01:08:11.623 --> 01:08:13.304
they have some system for automatically

01:08:13.403 --> 01:08:15.105
updating it in their end.

01:08:15.164 --> 01:08:17.426
So the idea is that way you don't

01:08:17.466 --> 01:08:18.908
have to go to all these different services

01:08:18.948 --> 01:08:20.069
and update your subscriptions.

01:08:20.368 --> 01:08:21.909
They just automatically get your new card

01:08:21.930 --> 01:08:22.170
number.

01:08:22.569 --> 01:08:22.890
But yeah,

01:08:22.909 --> 01:08:24.110
it's also a real pain if it's like,

01:08:24.171 --> 01:08:24.451
okay,

01:08:24.551 --> 01:08:26.853
but they're not honoring my request to

01:08:26.953 --> 01:08:28.533
cancel my subscription and that's what I'm

01:08:28.573 --> 01:08:29.255
trying to do here.

01:08:30.496 --> 01:08:33.578
yeah, I digress.

01:08:34.759 --> 01:08:35.920
I think with that,

01:08:36.000 --> 01:08:38.721
we can probably move into our last story

01:08:38.761 --> 01:08:39.481
here about Celebrite,

01:08:39.502 --> 01:08:41.703
unless you've got anything to add.

01:08:41.743 --> 01:08:42.083
No, yeah,

01:08:42.104 --> 01:08:45.006
let's dive into this last story here about

01:08:45.067 --> 01:08:45.466
Celebrite.

01:08:45.506 --> 01:08:47.368
But just a reminder to everyone,

01:08:47.708 --> 01:08:48.769
if you have any questions,

01:08:49.109 --> 01:08:49.850
drop them in the chat.

01:08:49.890 --> 01:08:51.612
We'll try and get to them after this

01:08:51.671 --> 01:08:52.072
story.

01:08:52.492 --> 01:08:55.274
So this story here is from Justin.sh.

01:08:56.314 --> 01:08:58.657
It's, is Celebrite sitting on a

01:08:59.572 --> 01:09:02.172
an iPhone radio zero day.

01:09:03.113 --> 01:09:03.654
Basically,

01:09:03.793 --> 01:09:05.435
this person said they've obtained a

01:09:05.534 --> 01:09:07.975
Celebrite document marked Confidential Two

01:09:08.176 --> 01:09:11.137
that describes a breakthrough method to

01:09:11.278 --> 01:09:14.340
provide AFU, which is after first unlock,

01:09:14.539 --> 01:09:18.322
access to iPhone XI to XVI on iOS

01:09:18.942 --> 01:09:19.881
XXVI to iOS XXVI.IV+.

01:09:21.670 --> 01:09:23.731
with expanded coverage promised.

01:09:24.332 --> 01:09:25.833
According to Celebrite,

01:09:26.694 --> 01:09:29.157
this is a next generation after first

01:09:29.256 --> 01:09:31.198
unlock vector that is more resilient to

01:09:31.298 --> 01:09:32.480
Apple's OS changes.

01:09:32.881 --> 01:09:35.103
It works with stolen device protection

01:09:35.182 --> 01:09:37.905
enabled, which tightens USB restrictions.

01:09:38.386 --> 01:09:41.469
It's enabled by a dedicated appliance with

01:09:41.548 --> 01:09:43.992
a stated range of about eight meters.

01:09:45.207 --> 01:09:48.488
Celebrite calls it Advanced Unlocks AU

01:09:48.708 --> 01:09:49.310
from here on,

01:09:49.590 --> 01:09:51.850
but not to be confused with the advanced

01:09:51.970 --> 01:09:53.591
unlocking services they've marketed for

01:09:53.631 --> 01:09:53.951
years.

01:09:54.351 --> 01:09:56.471
A press release from earlier this year

01:09:56.512 --> 01:09:59.634
confirms Advanced Unlocks is a new product

01:09:59.793 --> 01:10:00.913
for twenty twenty six.

01:10:01.354 --> 01:10:03.255
The document states from March twenty

01:10:03.274 --> 01:10:05.536
twenty six last revised September

01:10:05.555 --> 01:10:08.516
fifteenth conspicuous conspicuously

01:10:08.596 --> 01:10:10.278
missing the iPhone seventeen

01:10:10.717 --> 01:10:11.198
and Air,

01:10:11.677 --> 01:10:14.019
and those have both been out for about

01:10:14.059 --> 01:10:14.378
a year,

01:10:14.479 --> 01:10:16.679
and the ATEM Pro wasn't even out yet.

01:10:16.939 --> 01:10:19.439
So the author basically warns that the

01:10:19.619 --> 01:10:21.439
rest of the blog is speculation,

01:10:21.539 --> 01:10:23.699
but lays out a pretty compelling case for

01:10:23.779 --> 01:10:25.541
why they believe that this is a

01:10:25.621 --> 01:10:28.680
proximity-based radio capability based on

01:10:28.740 --> 01:10:29.301
Bluetooth.

01:10:29.681 --> 01:10:31.202
The post is free to read and not

01:10:31.282 --> 01:10:32.021
overly technical,

01:10:32.162 --> 01:10:34.521
so we do recommend digging into that if

01:10:34.622 --> 01:10:35.842
you are curious to learn more.

01:10:36.523 --> 01:10:36.703
So...

01:10:37.603 --> 01:10:39.163
I guess kind of talking about this more.

01:10:39.484 --> 01:10:41.666
So Apple quietly fixed a nasty

01:10:41.706 --> 01:10:43.726
vulnerability reachable over the air in

01:10:43.846 --> 01:10:45.228
iOS twenty six point five.

01:10:45.328 --> 01:10:47.390
Yet they made no mention of it in

01:10:47.430 --> 01:10:48.690
the security bulletin.

01:10:48.831 --> 01:10:50.992
Sometimes they retroactively update the

01:10:51.011 --> 01:10:53.094
bulletins or mention a patch without

01:10:53.154 --> 01:10:54.435
crediting a researcher.

01:10:54.954 --> 01:10:57.595
presumably because the issue was found

01:10:58.077 --> 01:10:58.777
internally,

01:10:58.957 --> 01:11:01.417
but they did neither of those for this

01:11:01.457 --> 01:11:01.797
fix.

01:11:02.177 --> 01:11:03.099
So why?

01:11:03.578 --> 01:11:04.319
Why did they do that?

01:11:05.260 --> 01:11:06.439
If they wanted to keep it hush-hush,

01:11:06.520 --> 01:11:07.100
it worked.

01:11:07.661 --> 01:11:09.681
They haven't found any public discussion

01:11:09.702 --> 01:11:11.483
of these vulnerabilities or changes.

01:11:12.643 --> 01:11:13.904
Despite their pedigree,

01:11:14.123 --> 01:11:16.284
Celebrite now feels the need to establish

01:11:16.324 --> 01:11:16.845
credibility

01:11:17.265 --> 01:11:19.546
upfront as the average iPhone gets harder

01:11:19.565 --> 01:11:19.966
to break.

01:11:20.126 --> 01:11:22.786
Vague claims about unlocking iPhones stop

01:11:22.865 --> 01:11:23.806
commanding attention.

01:11:24.207 --> 01:11:26.346
Mainstay techniques like the checkmate

01:11:26.447 --> 01:11:28.608
exploit in twenty nineteen are past their

01:11:28.627 --> 01:11:30.387
shelf life in twenty twenty six.

01:11:31.028 --> 01:11:33.448
Apple's hardening efforts are paying off.

01:11:33.628 --> 01:11:35.588
Charging ports have historically been the

01:11:35.708 --> 01:11:37.649
default vector for forensic tools,

01:11:38.010 --> 01:11:40.350
but they've they're becoming less viable.

01:11:40.430 --> 01:11:42.270
Attackers are becoming forced

01:11:42.711 --> 01:11:44.471
onto less appealing paths?

01:11:44.792 --> 01:11:46.833
Has the Bluetooth front now closed too?

01:11:47.213 --> 01:11:48.774
Or are things just getting started?

01:11:49.194 --> 01:11:52.497
Where will the next battle be fought?

01:11:52.976 --> 01:11:54.759
So I guess first thing to mention,

01:11:55.559 --> 01:11:56.560
this has already been fixed,

01:11:56.699 --> 01:11:58.720
so make sure you patch to the latest

01:11:58.881 --> 01:11:59.622
iOS version.

01:12:00.341 --> 01:12:02.403
And I guess also kind of throwing it

01:12:02.422 --> 01:12:03.163
back to you, Nate,

01:12:03.304 --> 01:12:05.085
what can people do to protect against

01:12:05.104 --> 01:12:07.987
these sort of radio attacks that Celebrite

01:12:08.027 --> 01:12:08.386
is using?

01:12:10.376 --> 01:12:12.617
Yeah, I mean,

01:12:13.018 --> 01:12:15.158
it's all speculation and I really

01:12:15.179 --> 01:12:16.439
appreciate that the author was upfront

01:12:16.460 --> 01:12:16.899
about that.

01:12:18.180 --> 01:12:19.981
I have said many times,

01:12:20.082 --> 01:12:21.542
I'm not a programmer, I'm not a developer.

01:12:21.863 --> 01:12:23.224
To me, this looked very sound.

01:12:23.363 --> 01:12:24.243
I was able to read it and I

01:12:24.264 --> 01:12:25.524
was able to follow along enough that I'm

01:12:25.545 --> 01:12:26.765
like, okay, I see your logic.

01:12:26.886 --> 01:12:27.685
I think this makes sense.

01:12:28.627 --> 01:12:29.747
If they're telling the truth and it's a

01:12:29.766 --> 01:12:30.347
Bluetooth thing,

01:12:30.927 --> 01:12:31.908
then I would say the answer is just

01:12:31.948 --> 01:12:33.189
to disable Bluetooth whenever you don't

01:12:33.210 --> 01:12:33.449
need it.

01:12:33.650 --> 01:12:35.431
I've actually started my little pine time

01:12:35.452 --> 01:12:35.652
here,

01:12:36.012 --> 01:12:37.154
which kind of makes it a little useless.

01:12:37.173 --> 01:12:38.494
But I've kind of stopped using it for

01:12:38.515 --> 01:12:39.235
notifications,

01:12:39.296 --> 01:12:42.318
which I'm not too sad about.

01:12:42.358 --> 01:12:42.939
Because to be honest,

01:12:42.958 --> 01:12:43.960
that's the main reason I bought it

01:12:43.979 --> 01:12:44.439
originally.

01:12:44.940 --> 01:12:45.921
At my last job, I've

01:12:46.442 --> 01:12:47.882
I mentioned this before in the past that

01:12:47.922 --> 01:12:49.524
like a lot of the time I had

01:12:49.564 --> 01:12:50.925
my hands full and my phone would start

01:12:50.944 --> 01:12:51.225
ringing.

01:12:51.404 --> 01:12:53.346
And I've actually in recent months,

01:12:53.426 --> 01:12:54.807
I've started really taking advantage of

01:12:54.828 --> 01:12:56.269
like the notification profiles,

01:12:56.309 --> 01:12:57.569
which I should have done back then too.

01:12:58.050 --> 01:12:58.850
But you know,

01:12:59.010 --> 01:13:00.350
my phone would like start ringing or I'd

01:13:00.371 --> 01:13:02.032
get a text message and I wouldn't know

01:13:02.051 --> 01:13:03.372
if it was like an important message,

01:13:03.412 --> 01:13:04.953
like for my wife or my project manager.

01:13:06.274 --> 01:13:07.635
Cause I'm going to drop what I'm doing

01:13:07.654 --> 01:13:08.595
and answer it if it's my wife at

01:13:08.636 --> 01:13:10.256
work or if it was just like one

01:13:10.275 --> 01:13:10.716
of my friends.

01:13:10.775 --> 01:13:11.015
Right.

01:13:11.176 --> 01:13:12.596
And so the pine time was a way

01:13:12.617 --> 01:13:13.716
for me to easily look at it and

01:13:13.737 --> 01:13:15.377
be like, oh, that can wait.

01:13:15.417 --> 01:13:16.297
Let me finish what I'm doing.

01:13:16.398 --> 01:13:17.158
Or I could look at it and be

01:13:17.177 --> 01:13:18.057
like, oh crap, hold on.

01:13:18.118 --> 01:13:18.557
I need a minute.

01:13:18.618 --> 01:13:21.498
So, um, but anyways, yeah, like I've,

01:13:21.658 --> 01:13:23.378
I've started turning that off when I go

01:13:23.460 --> 01:13:24.180
out in public,

01:13:24.239 --> 01:13:25.420
which now means it's literally just

01:13:25.439 --> 01:13:26.659
telling the time and I do have to

01:13:26.680 --> 01:13:27.640
sync it up every now and then for

01:13:27.661 --> 01:13:28.341
updates and stuff.

01:13:28.360 --> 01:13:29.140
But yeah.

01:13:29.981 --> 01:13:30.221
You know,

01:13:30.341 --> 01:13:31.643
one nice thing about Graphene is it has

01:13:31.682 --> 01:13:33.764
that like auto off for Bluetooth.

01:13:33.984 --> 01:13:34.725
If you, you know,

01:13:35.426 --> 01:13:36.586
when I put my headphones away,

01:13:36.706 --> 01:13:38.368
if I'm listening to headphones while I'm

01:13:38.387 --> 01:13:39.569
cleaning the house or whatever,

01:13:39.588 --> 01:13:41.609
and then I put them away in fifteen

01:13:41.630 --> 01:13:42.411
minutes, thirty minutes,

01:13:42.430 --> 01:13:43.251
whatever I set it to,

01:13:43.731 --> 01:13:44.452
it's gonna shut off.

01:13:44.572 --> 01:13:46.332
Or I guess driving is a better example.

01:13:46.353 --> 01:13:48.135
Like, you know, I do use Android Auto,

01:13:48.215 --> 01:13:48.994
I'll be totally honest.

01:13:50.315 --> 01:13:51.476
Mostly just for music and stuff.

01:13:51.917 --> 01:13:53.158
And then when I get to the store,

01:13:53.998 --> 01:13:54.899
the Bluetooth will shut off.

01:13:54.939 --> 01:13:56.240
I think I have it set really,

01:13:56.280 --> 01:13:57.161
really short actually.

01:13:57.240 --> 01:13:59.002
So by the time I get inside,

01:13:59.061 --> 01:13:59.563
it'll shut off,

01:13:59.802 --> 01:14:01.243
which is great because we've seen many,

01:14:01.283 --> 01:14:03.064
many articles about how stores use

01:14:03.104 --> 01:14:04.326
Bluetooth to track people.

01:14:04.886 --> 01:14:06.587
And they're mostly doing it for analytics.

01:14:06.627 --> 01:14:07.627
They want to know like, oh,

01:14:07.688 --> 01:14:09.869
are people stopping at the display we set

01:14:09.949 --> 01:14:10.069
up?

01:14:10.109 --> 01:14:11.490
Are people congregating over here?

01:14:11.511 --> 01:14:12.952
Are people having a hard time finding this

01:14:13.032 --> 01:14:13.192
item?

01:14:13.231 --> 01:14:13.612
Whatever.

01:14:14.153 --> 01:14:15.153
But still,

01:14:15.233 --> 01:14:16.533
I don't want to be tracked like that.

01:14:16.554 --> 01:14:18.135
So it's great that I don't even have

01:14:18.154 --> 01:14:18.796
to mess with the phone.

01:14:18.836 --> 01:14:19.536
I just unplug it,

01:14:19.576 --> 01:14:20.197
put it in my pocket.

01:14:20.216 --> 01:14:20.957
And by the time I get in the

01:14:20.976 --> 01:14:21.197
door,

01:14:21.417 --> 01:14:22.698
Bluetooth is off and they can't track me

01:14:22.717 --> 01:14:23.279
that way anymore.

01:14:25.340 --> 01:14:25.640
Yeah, I mean,

01:14:25.661 --> 01:14:29.663
Bluetooth is notoriously insecure.

01:14:29.805 --> 01:14:32.207
I wanna say the new generations of

01:14:32.247 --> 01:14:35.229
Bluetooth are starting to get more privacy

01:14:35.250 --> 01:14:37.492
features built in, but there's still,

01:14:37.771 --> 01:14:39.373
it's gonna take years for that to trickle

01:14:39.413 --> 01:14:40.194
out in new devices.

01:14:40.213 --> 01:14:41.234
And especially if you're not one of those

01:14:41.255 --> 01:14:42.737
people who like buys a new phone every

01:14:42.777 --> 01:14:43.337
year,

01:14:43.797 --> 01:14:44.878
it's gonna take a while for that to

01:14:44.899 --> 01:14:45.418
trickle out.

01:14:45.498 --> 01:14:47.740
So for now your best bet is just

01:14:47.761 --> 01:14:48.983
to avoid it whenever possible.

01:14:50.118 --> 01:14:51.338
Universe Middle said geofencing.

01:14:51.359 --> 01:14:52.539
Geofencing is something different.

01:14:54.001 --> 01:14:56.622
That's when the cops will use your phone.

01:14:56.841 --> 01:14:58.222
If your phone is signed into Google,

01:14:59.423 --> 01:15:00.984
then they can tell Google, hey,

01:15:01.005 --> 01:15:02.085
we want to know all the phones in

01:15:02.104 --> 01:15:03.987
this area between this time and this time,

01:15:04.966 --> 01:15:06.387
which I think some states have outlawed

01:15:06.427 --> 01:15:06.828
that now,

01:15:07.248 --> 01:15:08.368
but it's still kind of a legal gray

01:15:08.429 --> 01:15:08.689
area.

01:15:08.748 --> 01:15:08.949
Yeah.

01:15:10.188 --> 01:15:11.628
But yeah,

01:15:12.609 --> 01:15:13.750
I think we do recommend on the website

01:15:13.770 --> 01:15:14.951
actually to put your phone in airplane

01:15:14.970 --> 01:15:16.652
mode whenever you're on Wi-Fi for that

01:15:16.692 --> 01:15:16.952
reason.

01:15:17.152 --> 01:15:18.233
There's no point in pinging the cell

01:15:18.252 --> 01:15:19.134
towers because you're already getting

01:15:19.173 --> 01:15:19.573
Wi-Fi.

01:15:19.613 --> 01:15:20.895
So I don't know.

01:15:22.916 --> 01:15:23.796
I think that's all I got on that

01:15:23.837 --> 01:15:23.896
one.

01:15:24.795 --> 01:15:26.216
Yeah, no, that's all good points.

01:15:26.277 --> 01:15:29.701
I think also to kind of bring it

01:15:29.720 --> 01:15:31.301
back to the article itself, though,

01:15:31.962 --> 01:15:33.444
there was one interesting thing that we

01:15:33.484 --> 01:15:34.525
didn't really touch on.

01:15:36.028 --> 01:15:37.149
That is, you know,

01:15:37.189 --> 01:15:39.412
Apple's introduction of memory integrity

01:15:39.452 --> 01:15:40.693
enforcement, which basically...

01:15:41.514 --> 01:15:43.735
makes memory corruption bugs a lot harder

01:15:43.756 --> 01:15:44.336
to exploit,

01:15:45.617 --> 01:15:47.698
which it does cover the kernel and

01:15:47.997 --> 01:15:49.899
userland processes like Bluetooth D.

01:15:50.340 --> 01:15:53.702
So basically, you know, it seems like,

01:15:53.742 --> 01:15:55.203
at least from this article,

01:15:55.783 --> 01:15:57.885
devices that were using memory integrity

01:15:58.085 --> 01:16:01.587
enforcement, so that was the XVII and up,

01:16:02.328 --> 01:16:03.668
are not vulnerable to this sort of thing

01:16:03.708 --> 01:16:04.668
because of that.

01:16:06.189 --> 01:16:07.091
It could make, you know,

01:16:07.171 --> 01:16:08.971
exploitation a lot more difficult.

01:16:11.797 --> 01:16:13.099
So it is interesting.

01:16:13.179 --> 01:16:16.400
When we see these changes from Apple,

01:16:16.981 --> 01:16:18.283
it does actually impact things.

01:16:19.444 --> 01:16:20.965
It does actually protect you against some

01:16:20.984 --> 01:16:23.707
sort of... Again, this is theorized.

01:16:23.787 --> 01:16:24.186
Obviously,

01:16:24.207 --> 01:16:25.747
this person has never tested this or

01:16:25.768 --> 01:16:26.108
anything,

01:16:26.529 --> 01:16:29.911
but they've theorized that memory

01:16:29.930 --> 01:16:32.292
integrity enforcement would basically...

01:16:33.313 --> 01:16:35.555
cause this to be less effective on those

01:16:35.574 --> 01:16:36.034
devices.

01:16:36.074 --> 01:16:37.615
So I think that is quite an interesting

01:16:38.077 --> 01:16:40.297
extra tidbit from that article that I did

01:16:40.537 --> 01:16:41.578
find quite interesting.

01:16:41.679 --> 01:16:42.659
So, you know,

01:16:43.260 --> 01:16:45.280
these benefits to security are not just

01:16:45.320 --> 01:16:47.903
like a minor thing.

01:16:47.983 --> 01:16:49.384
They do actually stop exploits.

01:16:49.925 --> 01:16:51.565
So that is pretty cool.

01:16:52.185 --> 01:16:53.587
They also didn't mention anything about

01:16:53.667 --> 01:16:54.328
lockdown mode.

01:16:54.368 --> 01:16:55.889
So I do wonder about that as well.

01:16:55.969 --> 01:16:56.168
But

01:16:58.449 --> 01:16:59.530
it's always kind of left out of these

01:16:59.591 --> 01:16:59.951
posts,

01:17:00.912 --> 01:17:02.613
which is always kind of the weird thing

01:17:02.653 --> 01:17:04.094
for me.

01:17:04.533 --> 01:17:05.975
Does lockdown mode protect against this

01:17:06.015 --> 01:17:06.734
sort of threat?

01:17:07.655 --> 01:17:09.216
Would a device using lockdown mode,

01:17:09.837 --> 01:17:10.978
stolen device protection,

01:17:11.278 --> 01:17:14.399
and also memory integrity enforcement stop

01:17:14.840 --> 01:17:15.720
these sort of attacks?

01:17:15.899 --> 01:17:17.581
And I guess we won't really know,

01:17:17.600 --> 01:17:18.421
at least for now,

01:17:19.101 --> 01:17:20.243
but we'll definitely keep an eye on

01:17:21.122 --> 01:17:23.045
everything that's going on with

01:17:23.564 --> 01:17:24.166
Cellebrite.

01:17:24.466 --> 01:17:26.466
Because we do try and keep people updated

01:17:26.568 --> 01:17:28.849
on if their devices are exploitable by

01:17:28.868 --> 01:17:30.871
this sort of stuff whenever we see leaks

01:17:31.310 --> 01:17:32.091
from Cellebrite.

01:17:32.412 --> 01:17:34.953
So interesting stuff.

01:17:36.835 --> 01:17:37.456
Yeah, for sure.

01:17:37.615 --> 01:17:39.256
I'm trying to load the lockdown mode page

01:17:39.457 --> 01:17:40.978
right now, but my internet is being slow,

01:17:41.018 --> 01:17:41.359
shocker.

01:17:42.619 --> 01:17:43.720
Yeah, kind of related to what you said.

01:17:43.760 --> 01:17:45.962
I thought his little, in this blog post,

01:17:46.002 --> 01:17:47.563
his outro of, you know,

01:17:48.887 --> 01:17:50.627
Like has the Bluetooth front now close to,

01:17:50.648 --> 01:17:51.929
or things just getting started wherever

01:17:51.948 --> 01:17:53.969
the next battlefront or battle be fought.

01:17:54.109 --> 01:17:54.269
It's,

01:17:54.769 --> 01:17:56.909
it is kind of cool to see devices

01:17:56.970 --> 01:17:59.251
getting harder and harder, you know,

01:17:59.270 --> 01:18:00.591
things like SQL injection.

01:18:01.511 --> 01:18:03.912
Every time I see an SQL data breach

01:18:03.952 --> 01:18:05.631
caused by an SQL injection, I'm just like,

01:18:06.032 --> 01:18:06.271
bro, it's,

01:18:06.292 --> 01:18:08.472
that shouldn't even be possible anymore.

01:18:08.613 --> 01:18:10.453
Like all these things are just like,

01:18:10.472 --> 01:18:12.634
things are becoming more secure over time

01:18:12.753 --> 01:18:13.694
in, in some ways.

01:18:14.318 --> 01:18:15.698
So it is pretty cool stuff.

01:18:17.659 --> 01:18:18.199
Okay, here we go.

01:18:18.640 --> 01:18:23.582
Let's see.

01:18:23.603 --> 01:18:23.682
Yeah,

01:18:23.703 --> 01:18:25.564
I'm not seeing anything about Bluetooth

01:18:25.804 --> 01:18:27.625
here on the lockdown page.

01:18:28.564 --> 01:18:30.065
No, there's no mention of Bluetooth.

01:18:30.086 --> 01:18:30.626
That's crazy.

01:18:30.945 --> 01:18:31.145
Huh.

01:18:31.166 --> 01:18:33.407
I wonder why that is.

01:18:33.467 --> 01:18:34.547
I wonder if it's too simple of a

01:18:34.587 --> 01:18:36.849
technology to really harden in that sense

01:18:36.868 --> 01:18:38.310
without just disabling it completely.

01:18:39.403 --> 01:18:41.064
I think the way that lockdown mode would

01:18:41.104 --> 01:18:43.163
protect against that is just by reducing

01:18:43.184 --> 01:18:45.284
the attack surface of the device in

01:18:45.324 --> 01:18:48.286
general.

01:18:48.305 --> 01:18:51.087
A lot of times they use exploit chains,

01:18:51.127 --> 01:18:53.408
they use multiple exploits in one to

01:18:53.448 --> 01:18:55.588
basically gain access to a device.

01:18:56.248 --> 01:18:56.569
you know,

01:18:56.628 --> 01:18:58.510
reducing the attack surface so that one of

01:18:58.529 --> 01:19:02.731
those exploits in a chain is impossible is

01:19:02.811 --> 01:19:03.552
much more likely.

01:19:04.393 --> 01:19:05.694
I would assume that this is more than

01:19:05.833 --> 01:19:06.654
one vulnerability,

01:19:06.734 --> 01:19:09.195
but I guess we don't really know because

01:19:09.235 --> 01:19:10.856
Celebrite is pretty cagey about the

01:19:10.877 --> 01:19:11.417
information.

01:19:11.796 --> 01:19:13.297
The only reason why we're seeing this is

01:19:13.337 --> 01:19:16.219
because someone managed to find a leaked

01:19:16.279 --> 01:19:18.159
Celebrite document marked confidential.

01:19:18.240 --> 01:19:18.400
So...

01:19:19.220 --> 01:19:20.782
Every time we get these sort of leaks,

01:19:20.962 --> 01:19:22.484
it's always super interesting.

01:19:22.923 --> 01:19:24.364
And it does bring up all those questions.

01:19:25.426 --> 01:19:26.527
Does lockdown mode protect us?

01:19:26.567 --> 01:19:29.189
Does this involve multiple

01:19:29.229 --> 01:19:29.769
vulnerabilities?

01:19:29.788 --> 01:19:30.510
We don't really know.

01:19:30.710 --> 01:19:33.091
So it's always interesting when that

01:19:33.112 --> 01:19:33.551
happens.

01:19:36.654 --> 01:19:38.175
I actually realized I didn't even look at

01:19:38.194 --> 01:19:38.296
the...

01:19:40.122 --> 01:19:41.644
at the little attachment here.

01:19:41.804 --> 01:19:43.386
I'm scanning it a little bit now.

01:19:44.685 --> 01:19:45.867
I mean, it's Marketing Solutions,

01:19:45.907 --> 01:19:48.789
so you can't always depend on it too

01:19:48.810 --> 01:19:49.029
much.

01:19:49.130 --> 01:19:50.110
Marketing will say anything.

01:19:53.587 --> 01:19:54.047
Yeah, I mean,

01:19:54.108 --> 01:19:55.809
Universe Middle says use RFID bags.

01:19:55.868 --> 01:19:56.329
The thing is, like,

01:19:56.350 --> 01:19:57.890
that's not always feasible for everyone,

01:19:57.930 --> 01:19:58.212
right?

01:19:58.271 --> 01:20:02.496
Like, if I'm going to the grocery store,

01:20:03.337 --> 01:20:04.277
I can't... Like,

01:20:04.337 --> 01:20:05.257
if I'm just going to put my phone

01:20:05.278 --> 01:20:06.038
in an RFID bag,

01:20:06.059 --> 01:20:07.439
then I should just leave my phone at

01:20:07.460 --> 01:20:08.240
home, in my opinion.

01:20:08.280 --> 01:20:08.862
Because, you know,

01:20:08.942 --> 01:20:10.502
if I'm taking it to the store...

01:20:11.163 --> 01:20:11.564
Like I said,

01:20:11.684 --> 01:20:13.104
I'm listening to music on the way to

01:20:13.145 --> 01:20:13.564
the store.

01:20:14.085 --> 01:20:16.065
My grocery list tends to be in the

01:20:16.086 --> 01:20:17.365
phone, which granted, you know, yeah,

01:20:17.386 --> 01:20:18.485
I could just write it down in a

01:20:18.506 --> 01:20:19.065
physical list.

01:20:19.527 --> 01:20:21.546
And also sometimes like there's very

01:20:21.587 --> 01:20:22.568
specific, like, you know,

01:20:22.648 --> 01:20:23.747
it happens both me and my wife,

01:20:23.768 --> 01:20:24.547
whichever one of us goes,

01:20:24.887 --> 01:20:25.667
one of us will have to call the

01:20:25.707 --> 01:20:26.868
other person and be like, Hey,

01:20:26.908 --> 01:20:27.689
do we still need bread?

01:20:27.729 --> 01:20:28.769
Or did you just forget to take that

01:20:28.788 --> 01:20:29.270
out of the list?

01:20:29.310 --> 01:20:30.010
Or like, Hey,

01:20:30.029 --> 01:20:31.289
they don't have like this thing.

01:20:31.350 --> 01:20:32.711
Do you want something else instead?

01:20:32.751 --> 01:20:34.030
Or like how many of this thing do

01:20:34.051 --> 01:20:34.530
you need?

01:20:35.091 --> 01:20:36.292
So I don't know.

01:20:36.412 --> 01:20:36.771
It's, it's,

01:20:37.412 --> 01:20:38.112
It would be nice,

01:20:38.212 --> 01:20:40.613
but it's a little bit overkill in a

01:20:40.653 --> 01:20:41.432
lot of cases, I think.

01:20:41.894 --> 01:20:43.734
It's not practical for everybody in all

01:20:43.774 --> 01:20:46.734
situations, but I digress.

01:20:47.456 --> 01:20:48.676
It's just interesting to know that this

01:20:48.695 --> 01:20:50.396
stuff is out there and how it's growing.

01:20:52.277 --> 01:20:52.777
But yeah,

01:20:52.837 --> 01:20:54.177
I think that was our last story.

01:20:55.722 --> 01:20:55.983
Cool.

01:20:56.162 --> 01:20:56.483
Yeah, no,

01:20:56.523 --> 01:20:58.404
I think coming back to what you said

01:20:58.444 --> 01:20:59.144
about like, you know,

01:20:59.163 --> 01:21:00.524
taking your phone to the grocery store,

01:21:00.564 --> 01:21:01.085
I think we should,

01:21:01.444 --> 01:21:02.805
we should definitely think a little bit

01:21:02.845 --> 01:21:03.826
more about like, you know,

01:21:03.926 --> 01:21:04.685
what's your threat model?

01:21:04.706 --> 01:21:06.046
What are you trying to protect against?

01:21:06.127 --> 01:21:06.606
Like, you know,

01:21:06.646 --> 01:21:08.226
there's probably cameras everywhere when

01:21:08.247 --> 01:21:09.347
you're going to the grocery store,

01:21:09.368 --> 01:21:10.368
they're probably seeing where you're

01:21:10.387 --> 01:21:10.728
going.

01:21:11.728 --> 01:21:12.548
You know, like,

01:21:12.769 --> 01:21:14.109
I'm not really sure that that would be,

01:21:14.649 --> 01:21:16.350
that would make a huge amount of sense,

01:21:16.430 --> 01:21:17.670
especially if you're not like wearing

01:21:18.291 --> 01:21:18.810
really, you know,

01:21:19.863 --> 01:21:21.204
anonymizing clothing.

01:21:21.685 --> 01:21:22.565
I'm like, you know,

01:21:22.666 --> 01:21:23.865
I'm not sure if that would be,

01:21:24.726 --> 01:21:25.726
you know, I know they're joking.

01:21:25.806 --> 01:21:28.048
They did like the joy emoji, but like,

01:21:28.088 --> 01:21:28.288
yeah,

01:21:28.868 --> 01:21:30.090
I think it is important to think about,

01:21:30.149 --> 01:21:30.369
you know,

01:21:30.409 --> 01:21:32.051
what you're trying to protect and if

01:21:32.070 --> 01:21:33.832
that's actually worth doing in that

01:21:33.891 --> 01:21:34.391
instance.

01:21:35.493 --> 01:21:37.373
We did get some comments from Lily Smith

01:21:37.533 --> 01:21:38.494
on Twitter saying,

01:21:38.954 --> 01:21:40.076
They said, hi, I'm new here.

01:21:40.577 --> 01:21:40.837
Hello.

01:21:40.877 --> 01:21:42.358
We don't really usually get comments from

01:21:42.418 --> 01:21:42.698
Twitter.

01:21:42.719 --> 01:21:43.720
So that's nice.

01:21:44.119 --> 01:21:46.743
We also got a comment from ILI,

01:21:47.143 --> 01:21:49.765
a lot of ILI eyes on Twitch.

01:21:50.025 --> 01:21:50.485
Good evening.

01:21:50.525 --> 01:21:51.426
Thanks for streaming here.

01:21:51.747 --> 01:21:52.908
Yeah, we do stream on Twitch.

01:21:53.970 --> 01:21:54.289
Not sure.

01:21:54.350 --> 01:21:55.610
We usually don't have too many people

01:21:55.631 --> 01:21:56.231
watching on Twitch.

01:21:56.271 --> 01:21:58.833
So welcome.

01:21:58.913 --> 01:21:59.614
Yeah, that's pretty cool.

01:22:01.835 --> 01:22:02.274
All righty.

01:22:04.356 --> 01:22:04.577
Well,

01:22:04.657 --> 01:22:07.578
I guess if nobody has any further

01:22:07.637 --> 01:22:08.878
questions, thoughts,

01:22:08.998 --> 01:22:11.341
then we can start wrapping things up.

01:22:11.400 --> 01:22:12.400
Actually, let me check.

01:22:13.681 --> 01:22:15.162
Somebody asked on the forum if we can

01:22:15.203 --> 01:22:16.984
bridge messages across platforms.

01:22:17.104 --> 01:22:18.404
I don't think we would do that on

01:22:18.465 --> 01:22:21.145
the forum because we generally try to

01:22:21.185 --> 01:22:22.487
protect user privacy on the forum,

01:22:22.527 --> 01:22:23.747
even though I know it's publicly visible

01:22:23.768 --> 01:22:24.228
and whatnot.

01:22:24.287 --> 01:22:26.810
But we try not to record it in

01:22:26.829 --> 01:22:27.609
a video format.

01:22:27.829 --> 01:22:29.331
But I don't know.

01:22:30.011 --> 01:22:30.891
I guess that's a Jonah question.

01:22:32.523 --> 01:22:33.583
Yeah, definitely.

01:22:33.663 --> 01:22:35.024
I guess we can dive into the outro

01:22:35.064 --> 01:22:35.404
here, though.

01:22:35.545 --> 01:22:37.685
Oh, my username is a red bull blocker.

01:22:39.387 --> 01:22:40.148
I love it.

01:22:40.268 --> 01:22:41.408
I'm more of a monster rehab guy,

01:22:41.429 --> 01:22:41.929
but I'll take it.

01:22:41.948 --> 01:22:42.590
Yeah.

01:22:42.710 --> 01:22:43.949
All right.

01:22:44.371 --> 01:22:44.551
Yeah.

01:22:44.791 --> 01:22:45.171
On that note,

01:22:45.752 --> 01:22:46.612
do you want to take the outro or

01:22:46.631 --> 01:22:47.112
you want me to?

01:22:47.653 --> 01:22:48.814
We always forget to discuss who's going to

01:22:48.833 --> 01:22:49.253
take the outro.

01:22:49.935 --> 01:22:50.855
I guess I'll take the outro.

01:22:51.596 --> 01:22:53.340
All the updates from this week in privacy

01:22:53.399 --> 01:22:55.082
will be shared on the blog every week.

01:22:55.122 --> 01:22:57.184
So sign up for the newsletter or subscribe

01:22:57.204 --> 01:22:59.466
with your favorite RSS reader if you want

01:22:59.487 --> 01:23:00.247
to stay tuned.

01:23:00.788 --> 01:23:02.952
We also offer a podcast available on all

01:23:02.971 --> 01:23:04.394
platforms and RSS.

01:23:04.720 --> 01:23:06.641
which now includes a video on supported

01:23:06.681 --> 01:23:07.181
platforms.

01:23:07.282 --> 01:23:09.542
And this video will also be synced to

01:23:09.703 --> 01:23:10.283
PeerTube.

01:23:10.622 --> 01:23:12.963
Privacy Guides is a impartial nonprofit

01:23:13.003 --> 01:23:14.904
organization that is focused on building a

01:23:15.005 --> 01:23:17.645
strong privacy advocacy community and

01:23:17.685 --> 01:23:19.447
delivering the best digital privacy and

01:23:19.506 --> 01:23:21.528
consumer technology rights advice on the

01:23:21.587 --> 01:23:22.028
internet.

01:23:22.507 --> 01:23:23.769
If you want to support our mission,

01:23:24.069 --> 01:23:25.550
then you can make a donation on our

01:23:25.590 --> 01:23:26.229
website at

01:23:26.850 --> 01:23:31.252
http privacyguides.org donate you can make

01:23:31.271 --> 01:23:33.273
a donation on any page on the website

01:23:33.313 --> 01:23:36.335
by clicking the red heart icon located in

01:23:36.354 --> 01:23:38.595
the top right hand corner of the page

01:23:38.895 --> 01:23:40.756
you can contribute using standard fiat

01:23:40.777 --> 01:23:43.698
currency via debit or credit card or opt

01:23:43.899 --> 01:23:45.840
to donate anonymously

01:23:46.560 --> 01:23:49.060
using Monero or your favorite

01:23:49.301 --> 01:23:50.201
cryptocurrency.

01:23:50.480 --> 01:23:52.680
Becoming a paid member unlocks exclusive

01:23:52.701 --> 01:23:55.181
perks like early access to video content,

01:23:55.662 --> 01:23:57.082
exclusive video content,

01:23:57.681 --> 01:23:59.962
and priority during the This Week in

01:24:00.023 --> 01:24:02.162
Privacy livestream Q&A.

01:24:02.262 --> 01:24:04.463
You'll also get a cool badge on your

01:24:04.484 --> 01:24:06.984
profile in the Privacy Guides forum and

01:24:07.003 --> 01:24:08.864
the warm fuzzy feeling of supporting

01:24:09.465 --> 01:24:10.765
independent media.

01:24:11.244 --> 01:24:13.265
Thanks for watching and we will see you

01:24:13.666 --> 01:24:14.166
next week.

01:24:58.284 --> 01:24:58.345
Bye.