Firewalls Don't Stop Dragons Podcast

Passwords suck and humans aren’t good at using them. Password managers can help a lot, but to truly improve your account security these days, you need to add defense in depth. The easiest way to do that today is to enable two-factor authentication, or 2FA. Many websites have supported 2FA for years, but as hacking has gotten more aggressive and password databases are being stolen more often,...

Given that we’re using computer algorithms to evaluate humans, can these systems be gamed or fooled? And is it possible that computers are less biased that humans? On any given day, humans can be distracted, tired, sick or just flat out biased against people for any number of reasons. Should these systems be more transparent? How do we know if they’re being fair? Do we need to regulate...

Convincing a human to hire you is hard enough. Can you imagine trying to convince a computer? Artificial intelligence is now being used to automate the screening of job candidates, evaluating cognitive ability, vocabulary, and even emotional intelligence. This new “hiretech” promises to weed out the bad applicants and flag the good ones by analyzing not just the substance of answers to...

Ep210. I’ve recommended LastPass for years – since I wrote my book and every day since. Until now. There are several good (secure and private) password managers out there. But LastPass was the full package: a free tier that had all the functionality most people need and for-pay tiers that had very useful extras. But now they’re hobbling the free version by only allowing you to us...

In the second half of my interview with the Tech Learning Collective, we delve into their course curriculum a bit, and then discuss why they teach what they teach and how they approach these topics in a unique and meaningful way. We also examine the notion of “ethical hacking” and how this term can be used to whitewash some truly unethical and immoral products and services. Finally, we...

I first learned of the Tech Learning Collective at a privacy conference in late 2020. I struck up a conversation with one of its representatives and ended up taking one of their wonderful workshops in January. The TLC offers some top-notch courses on computers with a focus on cybersecurity. Unlike college courses or cybersecurity certification courses, TLC offers eminently practical and affordable...

Ep207 . Clearview AI – the company that has hoovered up every face it can find on the internet to create a creepy person identifying app – is back in the news. Canada and the EU have decided that Clearview has gone too far and needs to allow its users to opt out and even delete all the data they have, upon request. It’s a welcome development, but unfortunately only available to C...

Episode 206 . The social media events around the January 6th storming of the US Capitol have sparked raging, divisive debates in the US. But the banning of individuals and the deplatforming of apps and groups are not new phenomenons. The Right of Free Speech that is enshrined in the First Amendment to the US Constitution is not limitless. It does have legal boundaries. And private companies, even...

Tracking and data mining has gotten way out of hand. We’re not only being tracked online, we’re now being tracked around the real world, too. We’re truly living in a panopticon – and it’s not good for us as individuals or as a democratic society. Today I’ll cover several stories that make it clear that we’ve hit a tipping point. It has to stop. And it&#821...

We all love to beat up on Facebook over user privacy, but the real granddaddy of them all is Google. Google is everywhere . And they almost surely know way more about you than any other company on the planet. In addition to all the “G” apps and services that you know about, Google also owns Android, Chrome browser, Waze, Nest and YouTube. It’s extremely hard to avoid using Google...

So I want to switch to a new, privacy-respecting email service. How do I even do that? What happens to all the email I have now? What about my calendar and contacts? Am I going to have to change my email address every time I change email providers? In part 2 of my interview with Fastmail’s COO Helen Horstmann-Allen, we’ll answer these questions and also address the thorny issue of priv...

What could I learn about you if I read all your emails? Like, all of them. Since you started sending email. Beyond private conversations, I would also likely know every web site you have a relationship or account with, every online purchase you’ve made, every club or organization you’ve been a part of, and all the appointments you’ve made. I can also make a pretty comprehensive l...

The Russian SVR has had backdoor access to hundreds if not thousands of government and corporate networks for nearly nine months. And if not for private security firm FireEye, we might never have known. The SolarWinds supply chain hack may be the biggest, most consequential cybersecurity event ever. And it will literally be years before we understand the full impacts. However, from what we know so...

The dumpster fire that was 2020 is almost behind us, and it’s time to look forward to a brighter future in 2021! By a stroke of fortuitous coincidence, this is also my 200th podcast! To celebrate these two important milestones, we have a world-renowned security guru for our guest, Bruce Schneier , and I’ll be giving away over $1800 worth of great stuff to help you improve your privacy...

I’ve painstakingly scoured the last 50 episodes to select the best of the best, the cream of the crop, the top tips for the year 2020! If you’re already a subscriber, this will be a great refresher – and maybe give you a chance to do some of those things you had meant to do but somehow never got around to doing it! And if you’re a new subscriber, then you can catch up on so...

One today’s show, Ben Moskowitz from Consumer Reports will tell us about an extremely useful tool they’ve created to help you improve your personal security and privacy, customized to your particular needs, called the Security Scanner. Just answer a few simple questions and it will give you a checklist of specific ways to be more secure, ranked by time, effort and cost. Consumer Report...

Are consumers really concerned about security and privacy in the products they buy? And if so, how could manufacturers capitalize on these attributes to sell more of their products? Consumer Reports has recently published an important, comprehensive study of consumer attitudes towards privacy and security, including the historical evolution of these feelings. The result is a roadmap which companie...

Looking for fun gifts that won’t also be gifts to hackers and data miners? In today’s show, I’ll list off the top products and services from my annual Naughty & Nice gifts guide! Every year, I review several popular gifts and give you my recommendations on which ones to buy and which ones to avoid like the plague (or the pandemic?). In other news: Spotify has been hacked and...

So, what can we do about these dark patterns? Are there technical solutions to this problem? Or will this require regulations? Or perhaps we just need to train our engineers and consumers better? In part 2 of my interview with Dr. Colin Gray of Purdue University, we talk about some possible solutions to the dark patterns problem, as well as tips and tricks for avoiding them. Colin also shares seve...

Are you tired of being pestered to allow notifications or access to your location? Do you wonder why you have to give your credit card number in order to sign up for “free” trials? Why weren’t you told about the shipping costs until the very last screen in the purchase process? Are you sure that you didn’t intend to sign up for all those newsletters? You’re not alone,...

Zoom went from an obscure teleconferencing company to a household word when the pandemic hit. Zoom wasn’t the best videoconferencing app by any means. But it was dead simple to use and kinda fun to say. For better or worse, it became the de facto tool for many of us to keep in touch. Over that time, Zoom has made many important improvements. This week it has finally rolled out what appears to be t...

For better or for worse, the internet today is funded by advertising. While ads can be annoying, the real issue isn’t having to watch ads – it’s when then ads watch us. AdTech today is premised on invasive personal data collection. Companies like Google and Facebook amass voluminous dossiers on each of us, and sell highly-targeted ads based on our income, gender, age, location, b...

In the second half of my interview with the EFF’s Lindsay Oliver and Jason Kelley, we talk about how these draconian surveillance systems put several students at a distinct disadvantage and how the teacher themselves feel about all of this. How might all of this normalize surveillance for young people? Can the invisible hand of the market resolve some of these issues? What should the policies be a...

In this time of COVID19, we’ve all had to learn to work and learn from home. But how do our bosses know we’re not screwing around instead of working? How do our teachers know we’re not cheating? It turns out that they’re both willing to go to extremely intrusive measures to try to figure that out. Home and mobile device surveillance technology is booming thanks to this glob...

October is National Cybersecurity Awareness Month ! The theme this year is: if you connect it, protect it! And given how popular IoT devices are these days, and also how horrid their security usually is, this advice has never been more important. In today’s show, I’ll walk through some top cyber tips for protecting your devices and your home network. And there’s a TON of news, as...