Firewalls Don't Stop Dragons Podcast

In times of great fear and anxiety, we need to be especially vigilant against snail oil salesmen. Never letting a good crisis go to waste, the bad guys are capitalizing on the chaos to lure us into downloading malware and buying fraudulent (or even harmful) advice and products. In part one of my interview with Malwarebyte's David Ruiz, we talk about the explosion of COVID-19-related phishing scams and malware campaigns, including tips on how to avoid being a victim. David Ruiz is a content writer for Malwarebytes, covering online privacy, cybersecurity, and the laws - and proposed legislation - that regulate how data is stored, shared and accessed. He previously worked for Electronic Frontier Foundation, where he wrote and analyzed policy about NSA surveillance, encryption, and cross-border data transfer. Further Info: Malwarebytes blog: https://blog.malwarebytes.com/author/davidruiz/Malwarebytes antivirus: https://www.malwarebytes.com/for-home/products/

Every time there's a data breach at a company or service where you do business, there's a chance that the bad guys will reverse engineer your password. And once they do that, they will almost surely try to use that email and password combination to log into dozens of other sites - a hacking technique called credential stuffing. And why do they do this? Because they know most people reuse the same password over and over again. Troy Hunt has created a free service called "Have I Been Pwned" that collects information from all of these breaches so that we can find out whether our email address has been included in any of these hacks. I originally interviewed Troy over a year ago on the topic of database breaches and how to protect yourself against them, and sadly this is just as relevant today as it was then. So I brought this back as an encore performance! Troy Hunt is an Australian Microsoft Regional Director and Microsoft Most Valuable Professional for Developer Security. You'll regularly find Troy in the press talking about security and even testifying before US Congress on the impact of data breaches. Further Info HaveIBeenPwned.comEthics of running a data breach search service: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/Authentication evolved: https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/

The bad guys are having a field day with all the coronavirus hubbub, using our fears and anxieties to trick us into clicking bad links, downloading infected files, or installing malware. While the topic is new, the techniques are the same: phishing. Using cleverly disguised emails and text messages, bad guys trick us into giving up credit card and social security numbers, login credentials, and other sensitive information. In today's show, I'll give you several ways to spot these scams. In other news: a new massive data breach contains records on 1.2 billion people; Microsoft released a new version of Windows Defender which is broken for some people; there's been an attack on some Linksys routers; and as if regular ransomware wasn't bad enough, the bad guys are now using a new "double extortion" tactic that really puts you in a bind. Further Info: Flatten the Curve Summit: https://flattenthecurve.tech/

As health services and society in general struggle to cope with the coronavirus pandemic, people are desperately seeking new and inventive ways to curb the spread of the disease. A tried and true tool of epidemiologists is contact tracing: interviewing infected subjects in order to create lists of people they've had contact with in recent days and weeks. But people's memories are notoriously sketchy and they may not even know all the names, let alone contact information. Google and Apple have united to propose a technical solution. Android phones and iPhones will silently record anonymous identifiers of every other device they come near, in hopes of eventually notifying those device owners if a person later tests positive for COVID-19. But doing this in a way that preserves privacy and resists mass surveillance is difficult. I'll walk through the technical and social implications of their proposal. In other news: Zoom is working hard to fix their privacy and security issues (and repair their reputation); bad guys are capitalizing on Zoom's popularity to trick users into installing malware along with the app; smart locks can actually be pretty stupid (and insecure); and now that we're all working from home, it's a good time to review standard security practices to keep your company's data and devices secure. (And by the way, this is good practice for your personal stuff, too.) Further Info: Remote working security checklist: https://doist.com/blog/security-checklist-remote-workers/ VeraCrypt hard drive encryption app: https://www.veracrypt.fr/

During our global COVID-19 self-quarantining, video conferencing usage has exploded. I've tried to find hard statistics, but they're rising so fast that anything I post now will be stale tomorrow. That said, I've seen usage growth figures as high as 400%. And since we're all staying home now (right?), video chatting is a great way to get some some social time with friends and family. But many of the most popular video chat services are lacking in security, privacy, or both (I'm looking at you, Zoom). I'll give you a handful of good options that are all end-to-end encrypted. In other news: over 12,000 Android apps were found to have some sort of backdoor; Cloudflare introduces 1.1.1.1 for Families; Marriott announces yet another major data breach; Google is using its vast hoard of location data to track our social distancing success (or failure); EFF issues some timely warnings about guarding our civil liberties when responding to this crisis; and the FBI is warning us to watch out for coronavirus-related scams. Further Info: Zoom alternatives and online gaming: https://firewallsdontstopdragons.com/secure-private-zoom-alternatives/Flatten the Curve Summit: https://flattenthecurve.tech/1.1.1.1 for Families: https://blog.cloudflare.com/introducing-1-1-1-1-for-families/

Wouldn't it be nice if privacy wasn't an afterthought? What if user privacy was built in from the get go? What if the entire design assumed that you didn't want anyone selling your data - and respected those wishes? That's the world of Privacy by Design - a concept pioneered in the mid-1990's by Dr. Ann Cavoukian. This may seem like an unattainable Utopian future, but Ann's infectious optimism may just convince you otherwise. Adding privacy doesn't mean sacrificing security or functionality, if done properly. Today we discuss the concepts of Privacy by Design and how we can achieve it. Dr. Ann Cavoukian is recognized as one of the world’s leading privacy experts. Dr. Cavoukian served an unprecedented three terms as the Information & Privacy Commissioner of Ontario, Canada. There she created Privacy by Design, a framework that seeks to proactively embed privacy into the design specifications of information technologies. In 2010, International Privacy Regulators unanimously passed a Resolution recognizing Privacy by Design as an International Standard. Since then, PbD has been translated into 40 languages! In 2018, PbD was included in a sweeping new law in the EU: the General Data Protection Regulation. Dr. Cavoukian is now the Executive Director of the Global Privacy & Security by Design Centre. Further Info: Global Privacy & Security: https://gpsbydesigncentre.com/about-us/Fight the EARN IT Act: https://act.eff.org/action/protect-our-speech-and-security-online-reject-the-graham-blumenthal-bill

Never let a good crisis go to waste. Though normally applied to politics, it can be equally applied to opportunistic cyber criminals. With the world transfixed by and anxious about this nasty virus, bad guys are seizing on our fears to make a quick buck. From ransomware-laden virus tracking apps to actually threatening to infect families directly with the actual virus, COVID-19 is becoming a gold mine for unscrupulous hackers. We need to be extra vigilant and warn our loved ones to do the same. In other news... connected cars are tapping into your driving data to make more money; a $3 robot lawyer can help you exercises your CCPA rights; the Brave browser will be implementing some novel fingerprinting protections; Firefox had created a privacy container for Facebook; and not to miss a good crisis, the US government is looking to weaken our civil liberties in the name of virus tracking.

In part 1 of this interview, Hayley Tsukayama walked us through the details of the new California Consumer Privacy Act (CCPA). In part 2, we discuss how this law will affect many of us who are not California residents and how it's influencing potential legislation in other states and even at the federal level. We also discuss how CCPA can synergize with other state laws and be used as a tool for journalists to expose data brokers to the light of scrutiny. Hayley Tsukayama is a legislative activist for the Electronic Frontier Foundation, focusing on state legislation. Prior to joining EFF, she spent nearly eight years as a consumer technology reporter at The Washington Post writing stories on the industry's largest companies. Hayley has an MA in journalism from the University of Missouri and a BA in history from Vassar College. She was a 2010 recipient of the White House Correspondents' Association scholarship. Further Info Donate to the EFF: https://supporters.eff.org/donate/ Robot Lawyer to sue data hoarders: https://fortune.com/2020/03/05/delete-location-data-privacy-personal-information-donotpay/ My book is on sale for $18: https://www.apress.com/us/book/9781484238516

On January 1st, 2020, the California Consumer Privacy Act (CCPA) went into effect. While not perfect, the CCPA is a landmark piece of legislation for the United States, even though legally it only protect California residents. I will dig into the details of this bill - both the good and the bad - in part one of my delightful interview with Hayley Tsukayama from the EFF. Hayley Tsukayama is a legislative activist for the Electronic Frontier Foundation, focusing on state legislation. Prior to joining EFF, she spent nearly eight years as a consumer technology reporter at The Washington Post writing stories on the industry's largest companies. Hayley has an MA in journalism from the University of Missouri and a BA in history from Vassar College. She was a 2010 recipient of the White House Correspondents' Association scholarship. Further Info Donate to the EFF: https://supporters.eff.org/donate/ Robot Lawyer to sue data hoarders: https://fortune.com/2020/03/05/delete-location-data-privacy-personal-information-donotpay/

A few weeks ago, the New York Times published a bombshell article about a small startup called Clearview AI who was using a massive database of three billion faces scraped from several social media sites to offer a creepy facial recognition app. Just one snapshot of some stranger's face could immediately identify that person - not just name, but potential location, age, other images, social media pages, and even a list of friends and family. Clearview claimed to only sell this service to law enforcement agencies, mostly in the US and Canada. However, this week Buzzfeed News obtained the company's client list, and it contained several non-law enforcement agencies and dozens of clients outside of North America. In other news: the latest Windows 10 update has caused many serious problems; leaked documents show how big companies are buying our credit card data; up to a billion WiFi devices have a critical security bug; the FCC says it will fine the four big US cellular carriers $200M for selling your location data; and several news bits about browsers: Brave, Chrome and Firefox. Further Info: The Secretive Company That Might End Privacy as We Know It: https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html Public DNS providers supporting DNS over HTTPS: https://github.com/curl/curl/wiki/DNS-over-HTTPS WaPo: The Intelligence Coup of the Century: https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ WNCU Livestream (Sun Mar 8, 6:30pm ET): http://www.wncu.org/listen-live/ The Measure of Everyday Life podcast: https://podcasts.apple.com/us/podcast/the-measure-of-everyday-life/id956844695