Episodes

Today, we’re surrounded by strong encryption. Thanks to efforts like Let’s Encrypt, almost all web communications today at encrypted. And thanks to wonderful privacy communications tools like Signal, we can share private thoughts instantly and securely with anyone on the planet. But this was not always the case. This secure, private, encryption-enabled future we’re living now was far from certain 30 years ago when Phil Zimmermann created and freely released his email encryption tool Pretty Good ...

Facebook had a horrible, no-good, very bad week. Not only did Facebook, Instagram and WhatsApp go completely offline for about six hours, a whistleblower came forward to show the world what most of us already knew: Facebook values money over its users’ well being. And I have another story that backs that up, as well – one that you almost surely did not hear about. In other news: the FTC tells app makers to fess up when users private data gets loose; the governor of Missouri wants to sue a newsp...

Today I have the great honor and pleasure of speaking with two luminaries in the field of privacy: Michelle Finneran Dennedy and Melanie Ensign. Between them, they have decades of experience managing privacy processes, policies, technology and communications within dozens of big name tech companies. I get their unique perspective on data privacy and the evolution of how these companies approach the problem of collecting and managing your data. Are things getting better or worse? How can companie...

I admit it. I’m an Apple fan. Are they perfect? Definitely not. But in most cases, they’re actually trying to be good. And at the end of the day, their business model doesn’t rely on hoovering up your personal data. Apple just released a big update to its devices, iOS 15, and it’s got some really cool security and privacy features. I’ll tell you all about them in today’s show. In other news: thousands of Netgear routers can be hacked via a Disney parental control feature even if you didn’t ask ...

Apple was set to roll out controversial new on-device scanning technology in iOS 15 last week, but thanks to pushback from groups like the Electronic Frontier Foundation and people like you, Apple has since thought better of it and backed down. It’s not clear when or if these “child safety” features will come to iPhones, but in the meantime we can hope that Apple will listen carefully to our concerns before proceeding. Today I’ll speak with Jason Kelley from the EFF about Apple’s proposed techno...

It’s really easy to complain about the sadly insecure state of many of our products and services, but the fact is that doing security right is hard – even when you’re trying to get it right. Part of the problem is that there are just so many things to secure, even on a single product or service. Today we’re going to discuss several recent security issues with popular products, and why getting it right can be such a daunting task. In today’s show: a universal decryption key for all REvil ransomw...

Ever paired your phone to a rental car? Did you erase all the data from the last car you sold or turned in at the end of your lease? Do you know what data you car is sending to the cloud wireless right now? Cars have become a privacy nightmare. Andrea Amico is the founder of a company called Privacy 4 Cars and today he’ll help us understand all the data you car is hoovering up – from your phone, your driving habits, your location, and even your facial expressions (no, really). And thankfully, hi...

For many people, privacy is just a vague concept. But it can literally be a matter of life and death. It deserves your attention, your consideration and (crucially) your support. Technology has vastly improved our daily lives, but some of it also threatens to undermine our basic human rights and even our democracy/society. We need to understand the implications of the laws we pass – and the laws we aren’t passing. Today, I’ll talk about several stories with a common theme: privacy matters. Of c...

Computers are supposed to be completely predictable. When you tell it to do something, it should do exactly that – over and over again, if necessary – in the same way, with the same result. This is the nature of computer programming. But this predictability can allow computer criminals to interrupt a computer’s processing and divert it to do nefarious things. If you know exactly where to poke the system, predicting where and how it does it’s processing, you can effectively rewire it to do your b...

How far would you go to protect your children from sexual predators? How much privacy would you give up to try to prevent the sharing of child pornography? We are now faced squarely with those questions because Apple has just announced some new initiatives that it believes will curb the viewing and sharing of pornographic images. But we need to be extremely careful here. The Four Horsemen of the Infocalypse are pedophiles, terrorists, drug dealers and organized crime. When someone asks you what ...

Are hackers born or are they made? What is the essence of a true hacker? Today I explore these topics and more with the founder of both DEFCON and Black Hat, Jeff Moss – also known as The Dark Tangent. I also ask Jeff why we seem to suck at cybersecurity, what his top tips are for staying safe online, when DEFCON evolved to be bigger than its founder, how DEFCON has managed to stay focused on its attendees all these years, and how he plans to find a worthy successor to run the DEFCON conference ...

What is a hacker, exactly? What does it mean to hack something? With all the ransomware attacks and election meddling in the headlines, it’s easy to paint all hackers with a broad brush as malicious, self-serving computer criminals. And to be clear, many computer criminals are definitely hackers (some aren’t). But the real definition of hacker, the original notion of hacking itself, is something quite different. Nowhere is this more evident than at DEFCON, one of the world’s largest hacking conf...

Every time you load a web page, your personal data is being shared with thousands of companies. The ad spaces on the page are being auctioned off to the highest bidder in fractions of a second. The Irish Council for Civil Liberties calls this the biggest data breach in history, and is suing the ad tech companies on your behalf to stop this needlessly invasive and dangerous practice. My guest Johnny Ryan will explain how this real-time bidding process works and has insider documentation on the ty...

Your phone number is arguably as strong a personal identifier as your social security number, passport number or email address. These are things we almost never change any more – meaning that it’s an identifier for life. Our cell phones contain a ton of personal information, including our locations (not just now, but over time). Today I’ll help you understand why it’s so important to protect your cell phone number and digital contact lists. In other news: you need to update everything again… Ap...

The first step to solving any problem is gathering as much information as you can. Unfortunately, today we’re basically flying blind when it comes to identifying and resolving latent software bugs in our systems. Software today is made up of dozens if not hundreds of distinct components. Like automobiles, these piece parts can come from many different vendors. And even the parts from those vendors are likely themselves made up of many sub-components from yet other vendors. But you can bet that F...

Just when you thought it couldn’t get worse, the bad guys say “hold my beer”. The REvil gang has managed to pull off what appears to be the biggest ransomware infection ever through a clever supply chain attack on a company you’ve never heard of called Kaseya. Kaseya is what we call a Managed Service Provider, or MSP. They manage software and IT functions for lots of small-to-medium sized businesses, so that those companies don’t have to. But this also gives MSP’s a very privileged security posi...

Robocalls are the bane of my existence. I get so many spam calls that I’ve just stopped answering my home phone altogether. I’ve given out my cell number to fewer people, so thankfully I get fewer junk calls there. But I still won’t answer any calls unless I recognize the number. Why is it so easy to spoof caller ID? Well, starting July 1st in the US, mobile carriers are now required to implement a new(ish) set of technologies to make that more difficult: “Stir” (“secure telephone identity revis...

Today’s news headlines are littered with stories on massive cybersecurity failures: SolarWinds, Microsoft Exchange, Colonial Pipeline, data breaches, ransomware… Are the bad guys ramping up their game? Or are we just really bad at cybersecurity? (Or both?) How do we fix this? Who can lead the charge to improve our cyber defenses and fend off these attacks? Where do we learn best practices? Can new tools like Artificial Intelligence (AI) help us be more secure – or will these tools benefit the ba...

Are satellites really just IoT devices in space? They’re small computers and connected to the internet, not unlike Nest thermostats, baby video monitors, and smart toasters. You’d think that they’d be a lot more complex and secure… but are they really? My two guests today are running a program to test that very question, and in the process, try to make our military and commercial satellites more secure. We don’t think about it, but satellites play a crucial role in our daily lives. GPS satellite...

Payment apps are fairly secure & very convenient, but NOT private. And Venmo is the worst. Venmo is the only payment app that is primarily a “social” app. That’s shorthand for “share as much info as possible, with as many people as possible”. If you weren’t already aware, all Venmo transactions are public by default. (That might come as an unwelcome surprise to the third of millennials who have used Venmo to pay for drugs.) Your Venmo friends list is also public by default, as Joe Biden recently...

Is it possible for you to view your FLoC ID right now? And if so, can you decode this ID to understand what Google is learning about you from it? Does FLoC require your consent or cooperation from the sites you’re visiting? Are there tools to block this and, if so, how effective are they? In part 2 of my discussion with EFF’s Bennett Cyphers, we’ll answer these questions and many more. Google’s FLoC proposal depends on Google being a “benevolent and omniscient overseer”, which is a bad bet. Eve...

The public has voted and the results are in: people do not want to be tracked. In response, like pop-up ads before them, third party cookies are now being blocked by default by just about every browser – except Chrome. Google (who owns Chrome) is an ad company who relies on web tracking to make 90% of their revenue. With the writing on the wall, they and other ad tech companies are scrambling to find other ways to track people. Google has proposed a new system they call Federated Learning of Coh...

Today is the day we’ve all been waiting for! The super-secret, highly-collectible, security-enhancing device is finally HERE!! For a short period of time, I will be offering a very limited edition challenge coins to my patrons. Not only is the coin itself amazingly cool, it can also help you generate secure passphrases using my brand new website d20key.com! Listen in today for all the details, as well as my tip of the week for how and when to use passphrases (instead of passwords)! In other new...

What is Tor, exactly? How and why would I use it? And what the heck is a Tor node? In part 2 of my talk with Alison from the Library Freedom Project, we’ll discuss why libraries are so important in the fight for privacy and how they’re using technologies like Tor to keep its patron’s (and even other’s) web browsing anonymous. We’ll talk about why it’s important to do a self-assessment of your particular “threat model” and Alison will provide some time-tested tips for improving your security and ...