Firewalls Don't Stop Dragons Podcast

Our Constitutional rights were written without any concept of modern technology such as cell phones and the internet. Much of our privacy laws are still geared towards the pre-digital age. Even though the internet is many decades old now, the era of traveling with smartphones and laptops is still relatively new and the laws around privacy have not kept up. Today I’ll be speaking with Nathan...

With the 500th podcast and America’s 250th anniversary approaching, I’ve been doing a lot of thinking about how we can be better digital neighbors and digital citizens. We’re all in this together. Your security and privacy overlaps the security and privacy of many others. It’s important to improve our own situation, but we need to also realize that failing to do so can put...

Most of the chatbots in the news today are trained on public data (often including copyrighted data). But it doesn’t have to be that way. What if you had a chatbot that could access all of your personal or company data, but hosted locally so that all the data was secure and private? You could ask it all sorts of interesting questions about that data, run helpful reports, and tease out import...

In the final part of my series on downloading all of your historical emails from the cloud, we’ll make backups of your archive and make sure we store them in multiple places, following the 3-2-1 backup rule. I’ll also tell you about an interesting open source email archive project that you might find interesting. In the news: the FCC wants to kill burner phones; the WeedHack malware targets Minecr...

What would you do if you suddenly lost your bank account – and potentially access to all your funds? What about your credit cards? How long could your business stay afloat if you could no longer receive payments? Most of us take financial services for granted, but they can be taken away at any time – for almost any reason. And sometimes the reason is just that they don’t like you...

As part of my ongoing series on creating a full backup of all your old emails, we want to take some time to verify that we got everything okay. In today’s Tip of the Week, I’ll give you several pointers on how to go about doing this. In the last installment, we’ll make a couple backups and (optionally) delete everything from your email provider. In the news: AI firms want your fi...

When you’re working for your employer, no matter where you are, you’re on company time, using company equipment. Your employer has a responsibility to protect their assets – not just their equipment and facilities, but their data, as well. That gives employers several reasons to monitor you and any devices you might be using for work – including your mobile phone, potential...

In the next phase of withdrawing our email data from the cloud, we’re going to download a complete archive of every email we’ve ever sent. It’s not as easy as it should be, but it’s also not that difficult. I’ll give you an overview in today’s Tip of the Week, but you should read the full blog for detailed steps. In the news: Venmo finally makes transactions pri...

Cindy Cohn has been on the front lines, defending your digital rights, for three decades. With the Electronic Frontier Foundation (EFF), she has litigated several seminal legal cases that have directly impacted the lives of all Americans. As she retires from her role as Director of the EFF, she’s written a memoir about her time there and documents several of these legal fights called Privacy...

Probably the oldest online data you have – like, still have out there right now – is your emails. Did you have an AOL account? Or email through your internet service provider (ISP)? Statistically speaking, you probably have a Gmail, Yahoo Mail or Outlook (previously HotMail) account. Unless you explicitly closed those accounts or deleted those emails, they’re still there. Emails...

We have relied on prophets and seers for most of human history, largely because humans are obsessed with the future – specifically their own. But prophecy has often been used to determine or at least influence the future, not just predict it. In her new book, Prophecy, Carissa Véliz explains the power and perils of prediction, from the Oracle of Delphi to modern AI, giving us some much-neede...

Artificial Intelligence – in particular, Large Language Models (LLMs) or “chatbots” – are increasing in power at an astonishing pace. In fact, the latest models from Anthropic (Claude Mythos) and OpenAI (ChatGPT 5.4 Cyber) are so good at reading software code and finding vulnerabilities, that their makers have strictly limited initial access to manufacturers of the most pop...

There are all sorts of things that can be used to identify us online and in the real world, beyond our names, addresses, and phone numbers. But data brokers are desperate to tie all of these unique pieces of information together, building a valuable marketing dossier. It’s become a massive industry – being able to map one supposedly anonymous or pseudonymous piece of data to the a pers...

The US is planning to ban all foreign-made or foreign-designed home WiFi routers… which is basically all routers. It’s true that many consumer routers are pretty crappy when it comes to security. TP-Link just fixed some bad vulnerabilities (which you need to patch ASAP). But what does this mean for anyone wanting to upgrade to a new router? I’ll try to explain. In other news: Wal...

Nate Bartram and Jonah Aragon have been advocating for privacy for a long time. Their sites, The New Oil and Privacy Guides, have a ton of fabulous resources for anyone interested in guarding their data and defending their digital rights. Ever wonder what it’s like being a privacy advocate in an increasingly privacy-hostile world? Today, I’ll take you behind the scenes of these sites a...

When we think about improving security and privacy, we tend to add things: password managers, VPNs, encrypted communication apps. But one of the most effective ways to protect yourself is much simpler: remove what you don’t need. Safety through subtraction . Every app you install exposes you to more data collection and security vulnerabilities. Over time, these apps can automatically update, colle...

When you shop online or through an app, do you ever wonder if you’re being charged the same as someone else for the same thing? Even controlling for things like shipping address and local taxes, it turns out that today it’s not uncommon for pricing to dynamically change based on factors that may not seem fair. This is called surveillance pricing. Justin Brookman (Consumer Reports) and...

Bad guys have found a willing accomplice for installing malware: YOU. This very effective malware delivery mechanism, dubbed ClickFix, accounted for over half of all infections last year. I’ll tell you how to avoid it, but also explain why you shouldn’t have to. In other news: Amazon’s change to wishlists may expose your address; a new government-grade iOS exploit kit is spreading to crimina...

Cellular providers need to know your location in order to deliver calls and text message to your phone. But it turns out that they really don’t need to know who you are to give you that service. They only need to know how to bill you – and that information can be at little as knowing your ZIP+4 code. Why do we give so much personal information to our mobile service providers when we do...

In my seemingly never-ending quest to replace all things Google, I’ve finally found some solid, private alternatives to Google Sheets and Google Forms. And we’ll also talk about how the EU is looking to create competing products to reduce their dependence on Big Tech from Silicon Valley. In the news: Australian drivers’ info exposed in breach; school admissions website leaked stu...

Today I speak with Yahoo CISO Sean Zadig – aka, the Chief Paranoid. Sean has had a long and varied career in cybersecurity, working both in law enforcement (at NASA!) and working security for Big Tech. I’ll ask Sean how we can teach our kids about cybersecurity, and how to protect them from the worst of the internet without compromising anyone’s privacy. I’ll also get his p...

The latest craze with artificial intelligence is agentic AI – exhibited most recently in the viral AI project called ClawdBot… or Moltbot… or OpenClaw. (The name has changed two times in less than a week.) You download this software, give it access to your AI chatbot accounts, and then give it full and complete access to your computer and online accounts. Why? So you can have an...

We’re all busy people with busy lives. We only have so much time and energy. So when security people dole out to-do lists, we really need to focus on the tips with the most bang for the buck. Conversely, we need to avoid wasting people’s precious resources on advice that is no longer valid or worth the effort. Today, we’ll debunk several of these “Hacklore” tips with...

There exist many interesting technical tools which can greatly improve our privacy while still allowing us to use very personal data. In the next installment of my series on Privacy Enhancing Technologies, we’ll look at zero-knowledge proofs – what they are, how they work and what types of privacy problems they can address. Specifically, we’ll show how you can prove that you know...

Having data privacy laws are great. But if those laws can’t be practically enforced or your rights easily asserted, they’re not very useful. Modern cars are chock full of sensors, many of which are used to monitor the passengers and collect personal data. But cars are subject to privacy laws, too. Opting out of data collection or requesting data deletion should be straightforward. Andr...