Episodes

In the third part of my series on securing your home network, we’ll assess your security and privacy vulnerabilities. In prior weeks, we’ve exhaustively listed our network devices (Scan) and removed any devices that we no longer need or don’t need to be “smart” (Simplify). Now it’s time to investigate the remaining devices and think about what we need to do to secure them. In other news: an old Mac malware info stealer is back; thousands of Android apps are evading detection using an interestin...

Unless you’ve been living under a rock, you’ve seen several news stories about AI, machine learning and so-called Large Language Models. While tools like ChatGPT hold a lot of promise, many are deeply concerned about AI replacing jobs, generating potent malware, and being used in phishing and disinformation campaigns. Today I will ask AI expert Michael Littman to explain clearly what AI is and what it isn’t, how the technology actually works, and what we should and maybe shouldn’t be worried abo...

Every summer, hackers from around the US and around the globe descend on Las Vegas, Nevada, for a series of computer security conferences which are lovingly referred to as hacker summer camp. These conferences – BSides Las Vegas, BlackHat and DEF CON – run for over a week, each overlapping the other. They bring top tier security researchers, government and industry leaders, and eager hackers to learn about new vulnerabilities, new defense mechanisms, and everything in between. There are contests...

In the early 1980s, personal computers started entering our homes. Prior to the internet and services like America On Line (AOL), there were online bulletin board systems (BBS) where people could share text files via phone modem connections. Of course, if you wanted to connect to a BBS outside your home area code, you would have to dial long distance – which at the time could be prohibitively expensive. Necessity is the mother of invention and it’s no coincidence that some of the earliest hackin...

Last time, I told you how to enumerate all the devices on your home network. Before we go to the trouble of analyzing and mitigating their vulnerabilities, we should take the opportunity to cull the inventory. Do you really need all of these devices? Or could you forego the “smart” features that require them to be connected to your network? Today we’ll talk about reducing your attack surface before we bother trying to secure it. In other news: the White House announces new cybersecurity labelin...

Despite growing demand from US citizens for privacy protections, the federal government has failed repeatedly to enact basic privacy laws. However, one US state – California – has led the charge on privacy and passed regulations that have benefited people outside the state. Today I’ll speak with Ernesto Falcon who is currently running for California State Senate in District 7. He has decades of experience in public policy, particularly in the realm of privacy rights, both in politics and with th...

The Internet of Things (IoT) has added internet connections to lots of home devices. Each and every one of those devices runs software on a computer chip. Almost all software has bugs and those bugs may be exploitable by bad guys. We’re going to take another look at protecting our home networks using a simple, logical methodology. Step one: SCAN. That is, first of all, we need to understand the scope of the problem by enumerating all of the devices on your home network. I’ll explain how to do th...

After lengthy negotiations and revisions, the White House has finally released its National Cybersecurity Strategy document, outlining it’s priorities and goals. It’s a wide-ranging and ambitious document consisting of five major areas of focus, or “pillars”. What’s new here? What will it mean for businesses and critical infrastructure? And what does this mean for you and I? Today I’ll cover all of that and more with Josh Corman from I Am the Cavalry and formerly with the US Cybersecurity and In...

You’re using a password manager. You’re even using two-factor authentication. Great! When done properly, this will keep the bad guys out. Unfortunately, if you’re not careful, it may also keep you out. If you forget your master password or lose access to your 2FA device, you’ll be in real trouble… unless you have an access backup plan. This same plan can also help your spouse or next of kin to access your accounts should you die or become incapacitated. In the news: CISA issues a DDoS warning a...

Right now there are thousands of satellites orbiting above our heads performing crucial tasks. At the end of the day, they’re just computers running software – albeit at thousands of miles up and thousands of miles per hour. Can they be hacked? What are the dangers? Aaron Myrick and the Hack-A-Sat team are trying to answer those questions. And they’re doing it by launching an actual satellite into low earth orbit for this year’s DEF CON hacking contest and asking talented hackers from around the...

I launched my mission to improve people’s privacy and security almost ten years ago now. It’s been quite a journey and I’ve learned a lot in that time. One thing I’ve realized is that there’s only so much I can do on my own. And so I’ve encouraged the more technically savvy members of my audience to help others where they can. One downside to being a podcaster is that I don’t have much insight into the effectiveness of my exhortations. I have no idea how many people are going forth to do good de...

At some point, when you care enough about a particular cause, you shift from following the issue to actually trying to advance the issue – to make a difference. The easiest way to do this is to find groups that are already working for this cause and supporting them with donations of your time and/or money. But what do you do if you can’t find such a group, or maybe there’s no local chapter? Well, you can start your own! It’s not as hard as it sounds – and in fact, there exist organizations that ...

Two weeks ago, I told you about the availability of two new top-level domains that also happen to be popular file name extensions: .zip and .mov. The ambiguity will undoubtedly be exploited by ne’er-do-wells to trick people into doing something they shouldn’t do. There are clever ways to manipulate website addresses that would trick even tech-savvy people into clicking malicious links. Today I’ll tell you how these tricks work and explain you can avoid all of these issues by simply blocking thes...

Modern cars are more like smartphones on wheels. Like our cell phones, they are chock full of sensors, computer chips and software, and they’re connected to the internet 24/7 via cellular modems. What data is being collected? Who owns this data? How secure is your data? Who is it being shared with? And most importantly, what – if anything – can you do about it? Since we last spoke with Privacy4Car’s Andrea Amico, his company has released a powerful new Vehicle Privacy Report tool that aims to an...

Everyone hates dealing with passwords. This has led to a mad search for ‘password-killer’ technology. After several failed attempts, there’s finally a worthy contender: passkeys. The technology has been around for years – it’s the basis for hardware keys like YubiKey. But no one wanted to have to carry the little things all the time. With passkeys, you get the same phishing-proof, passwordless goodness but tied to a device you always have: your smartphone. Websites are slowly rolling out the abi...

In the book “1984” (published in 1949), George Orwell envisioned a Big Brother that would control the media and dictate what was “truth”. But Orwell didn’t predict that “telescreens” would fit in our pockets or that we would willingly carry them with us 24/7, even to the bathroom. He also didn’t foresee that we would willingly subscribe to sources of mis- and disinformation in the form of social media. Today I speak with the co-author of the book “Ministry of Truth”, Vincent Hendricks, about the...

Have you noticed Google getting really pushy lately with offers to “sign in with Google”? You’re not alone. Many websites offer the ability to create a free account so that you can “personalize your experience”, but lately Google has been popping up an very annoying window to prompt you to create this account by signing in with your Google account. First of all, you almost never need to create an account to view the site. But second, even if you do want to create an account, you shouldn’t be lin...

There’s a big difference between mass surveillance and targeted surveillance based on a court-approved, limited-scope search warrant. But advances in technology have made warrant-less, dragnet surveillance exceptionally easy and stunningly effective. Local law enforcement agencies have deployed several types of surveillance systems in our communities, but have strongly resisted calls for transparency and oversight. Furthermore, police have simply bypassed the need for a warrant and pesky Fourth ...

Our smartphones have become indispensable tools for our daily lives – so seeing that dreaded red battery indicator can induce some serious anxiety. But before you jack your phone into some public USB charging port, think twice. Those USB connections can pass data as well as power, and it’s actually possible to hack your phone using those ubiquitous and innocent-looking ports. Is this common? Probably not. But it’s also very easy to avoid. I’ll give you several tips for staying safe, particularly...

As cybersecurity experts love to say, the “S” in “IoT” stands for security… meaning there is none. I’ve seen estimates that say there were almost 30 billion IoT devices on the internet in 2022. I have dozens of them on my home network alone. Each of these devices contains at least one computer, which is running potentially hackable software. And because these devices have internet connections, they are vulnerable to cyber attacks from anywhere on the planet. Today I’ll ask Bill Niefert from Core...

Right after releasing my episode on web fingerprinting, highly-respected VPN provider Mullvad teamed up with Tor to release a new web browser, specifically designed to protect your privacy – including attempting to block fingerprinting! Great timing, so I thought I’d give you my review of the Mullvad Browser – the good, the bad, and (yes) the ugly. In other news: Timely tips on spotting IRS phone scams; ultrasound attacks can hijack your smart speakers; brace yourself for a wave of more sophist...

On today’s show, I’ll take you behind the scenes of not one, not two, but three different privacy websites. I ask Nate from The New Oil and Niek from Privacy Guides how they deal with being a public figures advocating for privacy, how they set their personal standards for privacy products, and how they cope with people and product makers who complain about their recommendations (or lack thereof). I ask them about some favorite products that they’ve had to remove from their recommended lists and ...

Marketers are desperately trying to follow us as we traverse the web. Tracking where we go and what we do allows them to better target us with ads. Browsers have built in protections to block older tracking techniques like cookies and tracking pixels, and so ad companies have had find new methods for identifying us across websites. Unfortunately, they’ve settled on a technique that is extremely difficult to defeat: fingerprinting. I’ll explain what is, how it works, and what you can do to mitiga...

If for some reason you haven’t started using a password manager yet, it’s time to make the move. But how can you trust all these important secrets to some unknown company? How can you be sure that your password vault will be safe in a cloud-based service? And finally, how do you figure out which service is best for you? Today I’ll ask Kasey Babcock from Bitwarden all those questions. We’ll also talk about two-factor authentication and newer “passkeys” technology, Argon2 vs PBKDF2, and even how y...