Firewalls Don't Stop Dragons Podcast

I can’t believe I’ve been doing this for 300 weeks – almost 6 years now! And returning for his 3rd “podcentennial” episode is world-renowned security guru Bruce Schneier! Today we’ll discuss hacking – not just in the realm of computers, but in legal, political, social and economic spaces. And then we’ll talk about how artificial intelligence and comp...

Black Friday is just around the corner, which marks the unofficial launch of the holiday shopping season. As you’re considering what gifts to give to your loved ones this year, I want to make sure you’re thinking about the privacy and security aspects. To that end, I have updated my annual Best and Worst Gift Guide and I will go over the highlights in this episode for my Tip of the Wee...

Connected computers have changed the world perhaps more than any other single invention. The impacts of nearly instant global communication and effectively infinite, perfect storage of information are at once undeniable and difficult to fully comprehend. And yet, technologists, bureaucrats and corporate leaders make decisions on a daily basis that should be considering the repercussions. Just beca...

QR codes are not inherently dangerous. They’re effectively links we can click in the real world using the camera app on our phone. Like hyperlinks on a web page, QR code “links” can take you to good websites or bad websites. They can also disguise their ultimate destination by using URL shortening services like bitly or owly. But now “free” QR code generator websites...

It’s easy to tell people to use this or that privacy tool, but this always assumes that you trust the service that is providing that tool. How can mere mortals ever hope to obtain sufficient knowledge of the inner workings of these products and service providers that would allow them to make an informed decision? Today, I’ll ask Adrianus Warmenhoven from Nord VPN that question, along w...

This is going to sound bonkers, even though you’re used to so many things tracking you… web pages, emails, and apps… but I’m here to tell you that while you’re watching your TV, your TV is also watching you. Or I guess more accurately, your TV is watching what you’re watching. Even if you’re not using the built-in smart apps, if you’re just piping pi...

We talk a lot about security and privacy on my show, but we don’t talk enough about these subjects in relation to students and schools. Schools are tragically underfunded and can’t afford to hire cybersecurity experts, let alone privacy experts. Students are minors who lack the legal rights and life experience to push back against horrific privacy invasions brought on by remote learnin...

Cold hard cash is becoming more and more rare these days. People just don’t carry it around much any more. So how do you split a bill at a restaurant or buy from a street vendor? Many people today use mobile payment apps like Venmo, Apple Pay, PayPal, the Cash App, or a service promoted by many US banks called Zelle. While convenient, are these payment systems safe? Most of them actually are...

Cybersecurity is the only technical, professional occupation I know of where practitioners routinely sharpen their skills through open competitions. The contests are based on the classic capture the flag game – except the flags are all virtual and capturing them involves hacking computers. Also unlike most other technical careers, cybersecurity is a high-paying profession that doesn’t...

Apple just released a major update to its iPhone operating system, iOS 16. This release has some really important security and privacy features, including Passkeys, Lockdown Mode and Safety Check. I’ll give you an overview of these features. In other news: D-Link routers have a major vulnerability that’s being actively exploited; Uber was completely pwned by a cocky 18-year old hacker; Morgan Stan...

You may not be into cryptocurrency, but a recent incident involving a so-called “cryptocurrency mixer” has some important implications for privacy and free speech. Today we’ll examine the relative anonymity of cryptocurrency transactions, tools that can be used to enhance that anonymity, and why the code that created these tools – and the services that might host them &#821...

A little over 20 years ago, Charles Petzold wrote what would become a classic book on understanding modern computers and the software that drives them. Computers have become essential to daily life and inhabit more and more of the devices we use every day. Every “smart” device you own contains a computer running software. While these little silicon chips and the binary code running the...

Password manager software maker LastPass suffered a data breach last week, which understandably made their customers very nervous – and caused some people to question the decision to put all their passwords in one digital basket. In today’s show, I’ll explain why this particular breach was not a threat to anyone’s passwords and why you should still use a high quality passwo...

Thirty years ago, a young hacker named Jeff Moss (aka The Dark Tangent) threw a party in the desert of Nevada to commemorate the demise of a bulletin board system called PlatinumNet. Unlike the other handful of hacker conferences in that time, this one would be on the West Coast and open to everyone. Over the next three decades, DEF CON would become the preeminent hacker convention for the US (pos...

If it’s August in Las Vegas, it’s time for Hacker Summer Camp. There are three hacker conferences that coordinate to happen next to each other every year: BSides Las Vegas, Black Hat and DEF CON. My first trip to DEF CON was last year and I was hooked – I hope to go back every year. This was the big 30th anniversary of DEF CON and several of the news stories this week came from o...

There’s no doubt that the internet has enabled criminals to share illicit and vile content with ease. The advent of high-quality end-to-end encrypted communications has made sharing this material harder for law enforcement to police. But the solution is not to cripple this technology, which is essential for security, privacy and even democracy. Today I’ll discuss this thorny issue with...

All software has bugs, so the more software you have installed, the more bugs you have. It’s not just the bugs in any individual application, but it’s also magnified by interactions between some applications. Thankfully, the converse is also true: the less software you have installed, the fewer bugs you have (statistically, anyway). How many apps have you installed because they were fr...

Cameras are everywhere. Every person you pass on the street has a camera on their phone and security cameras are everywhere. They’re so cheap and small now, and most of them are connected to the cloud. Not only does that mean they basically have unlimited storage, but it also opens the door for computers to process those images and footage looking for faces. Today, I’ll speak with Nate...

The “rolling code” technology used to remotely open and lock your car is supposed to prevent hacking. Unfortunately, Honda has a pretty serious vulnerability in their cars that apparently allows anyone with a little talent and cheap hacking tools to get into your car – and maybe even start it (though not actually drive it away). If correct, this vulnerability affects probably all...

We take that little box that connects our home to the internet for granted. But in reality, it’s often the only thing hiding our computers and vulnerable IoT devices from automated, remote attacks. This “internet background radiation” is ever present – a massive network of malicious or compromised devices, constantly scanning the internet for exposed and ill-protected syste...

This week we’ll talk about three significant new data breaches. Each of these data leaks are important in different ways, but the trend is clear: data wants to be free. First of all, we need to stop collecting so damn much of it. But second, we need to make it more expensive for data-collectors who are criminally negligent with the protection of our data. Right now, it’s cheaper to let...

While many of us prefer order in our lives, at least most of the time, we sometimes need a little chaos. Specifically, we need a source of true randomness in order to properly drive many of our cryptographic systems – to secure our digital communications, for example. And while computers are very good at doing what we tell them to do, they suck at being unpredictable. Therefore we have to fi...

Firefox officially rolled out its Total Cookie Protection feature last week, which is a clever and elegant solution for blocking tracking using third party cookies. Unfortunately… it doesn’t seem to be working for me when I tested it. There are at least a couple reasons for why this might be, and a workaround, both of which I will discuss in today’s Tip of the Week. Also: A drunk...

Everyone hates dealing with passwords, and yet they’ve been the de facto standard of computer authentication for decades. But there’s light at the end of this long tunnel. There is a passwordless future where we can log in to our accounts using just our smartphones. In this future, it won’t matter if websites are breached because there will be no password databases to steal. Even...

I preach about using password managers constantly – because they really are a fantastic tool for increasing your security. Humans suck at creating memorable passwords that are not also easy to guess. But the idea of putting all your juicy secrets into a digital vault that is controlled by a third party and synchronizing through the cloud may not sit well with you. And I totally get that. It&...