Firewalls Don't Stop Dragons Podcast

The bad guys are having a field day with all the coronavirus hubbub, using our fears and anxieties to trick us into clicking bad links, downloading infected files, or installing malware. While the topic is new, the techniques are the same: phishing. Using cleverly disguised emails and text messages, bad guys trick us into giving up credit card and social security numbers, login credentials, and other sensitive information. In today's show, I'll give you several ways to spot these scams. In other news: a new massive data breach contains records on 1.2 billion people; Microsoft released a new version of Windows Defender which is broken for some people; there's been an attack on some Linksys routers; and as if regular ransomware wasn't bad enough, the bad guys are now using a new "double extortion" tactic that really puts you in a bind. Further Info: Flatten the Curve Summit: https://flattenthecurve.tech/

As health services and society in general struggle to cope with the coronavirus pandemic, people are desperately seeking new and inventive ways to curb the spread of the disease. A tried and true tool of epidemiologists is contact tracing: interviewing infected subjects in order to create lists of people they've had contact with in recent days and weeks. But people's memories are notoriously sketchy and they may not even know all the names, let alone contact information. Google and Apple have united to propose a technical solution. Android phones and iPhones will silently record anonymous identifiers of every other device they come near, in hopes of eventually notifying those device owners if a person later tests positive for COVID-19. But doing this in a way that preserves privacy and resists mass surveillance is difficult. I'll walk through the technical and social implications of their proposal. In other news: Zoom is working hard to fix their privacy and security issues (and repair their reputation); bad guys are capitalizing on Zoom's popularity to trick users into installing malware along with the app; smart locks can actually be pretty stupid (and insecure); and now that we're all working from home, it's a good time to review standard security practices to keep your company's data and devices secure. (And by the way, this is good practice for your personal stuff, too.) Further Info: Remote working security checklist: https://doist.com/blog/security-checklist-remote-workers/ VeraCrypt hard drive encryption app: https://www.veracrypt.fr/

During our global COVID-19 self-quarantining, video conferencing usage has exploded. I've tried to find hard statistics, but they're rising so fast that anything I post now will be stale tomorrow. That said, I've seen usage growth figures as high as 400%. And since we're all staying home now (right?), video chatting is a great way to get some some social time with friends and family. But many of the most popular video chat services are lacking in security, privacy, or both (I'm looking at you, Zoom). I'll give you a handful of good options that are all end-to-end encrypted. In other news: over 12,000 Android apps were found to have some sort of backdoor; Cloudflare introduces 1.1.1.1 for Families; Marriott announces yet another major data breach; Google is using its vast hoard of location data to track our social distancing success (or failure); EFF issues some timely warnings about guarding our civil liberties when responding to this crisis; and the FBI is warning us to watch out for coronavirus-related scams. Further Info: Zoom alternatives and online gaming: https://firewallsdontstopdragons.com/secure-private-zoom-alternatives/Flatten the Curve Summit: https://flattenthecurve.tech/1.1.1.1 for Families: https://blog.cloudflare.com/introducing-1-1-1-1-for-families/

Wouldn't it be nice if privacy wasn't an afterthought? What if user privacy was built in from the get go? What if the entire design assumed that you didn't want anyone selling your data - and respected those wishes? That's the world of Privacy by Design - a concept pioneered in the mid-1990's by Dr. Ann Cavoukian. This may seem like an unattainable Utopian future, but Ann's infectious optimism may just convince you otherwise. Adding privacy doesn't mean sacrificing security or functionality, if done properly. Today we discuss the concepts of Privacy by Design and how we can achieve it. Dr. Ann Cavoukian is recognized as one of the world’s leading privacy experts. Dr. Cavoukian served an unprecedented three terms as the Information & Privacy Commissioner of Ontario, Canada. There she created Privacy by Design, a framework that seeks to proactively embed privacy into the design specifications of information technologies. In 2010, International Privacy Regulators unanimously passed a Resolution recognizing Privacy by Design as an International Standard. Since then, PbD has been translated into 40 languages! In 2018, PbD was included in a sweeping new law in the EU: the General Data Protection Regulation. Dr. Cavoukian is now the Executive Director of the Global Privacy & Security by Design Centre. Further Info: Global Privacy & Security: https://gpsbydesigncentre.com/about-us/Fight the EARN IT Act: https://act.eff.org/action/protect-our-speech-and-security-online-reject-the-graham-blumenthal-bill

Never let a good crisis go to waste. Though normally applied to politics, it can be equally applied to opportunistic cyber criminals. With the world transfixed by and anxious about this nasty virus, bad guys are seizing on our fears to make a quick buck. From ransomware-laden virus tracking apps to actually threatening to infect families directly with the actual virus, COVID-19 is becoming a gold mine for unscrupulous hackers. We need to be extra vigilant and warn our loved ones to do the same. In other news... connected cars are tapping into your driving data to make more money; a $3 robot lawyer can help you exercises your CCPA rights; the Brave browser will be implementing some novel fingerprinting protections; Firefox had created a privacy container for Facebook; and not to miss a good crisis, the US government is looking to weaken our civil liberties in the name of virus tracking.

In part 1 of this interview, Hayley Tsukayama walked us through the details of the new California Consumer Privacy Act (CCPA). In part 2, we discuss how this law will affect many of us who are not California residents and how it's influencing potential legislation in other states and even at the federal level. We also discuss how CCPA can synergize with other state laws and be used as a tool for journalists to expose data brokers to the light of scrutiny. Hayley Tsukayama is a legislative activist for the Electronic Frontier Foundation, focusing on state legislation. Prior to joining EFF, she spent nearly eight years as a consumer technology reporter at The Washington Post writing stories on the industry's largest companies. Hayley has an MA in journalism from the University of Missouri and a BA in history from Vassar College. She was a 2010 recipient of the White House Correspondents' Association scholarship. Further Info Donate to the EFF: https://supporters.eff.org/donate/ Robot Lawyer to sue data hoarders: https://fortune.com/2020/03/05/delete-location-data-privacy-personal-information-donotpay/ My book is on sale for $18: https://www.apress.com/us/book/9781484238516

On January 1st, 2020, the California Consumer Privacy Act (CCPA) went into effect. While not perfect, the CCPA is a landmark piece of legislation for the United States, even though legally it only protect California residents. I will dig into the details of this bill - both the good and the bad - in part one of my delightful interview with Hayley Tsukayama from the EFF. Hayley Tsukayama is a legislative activist for the Electronic Frontier Foundation, focusing on state legislation. Prior to joining EFF, she spent nearly eight years as a consumer technology reporter at The Washington Post writing stories on the industry's largest companies. Hayley has an MA in journalism from the University of Missouri and a BA in history from Vassar College. She was a 2010 recipient of the White House Correspondents' Association scholarship. Further Info Donate to the EFF: https://supporters.eff.org/donate/ Robot Lawyer to sue data hoarders: https://fortune.com/2020/03/05/delete-location-data-privacy-personal-information-donotpay/

A few weeks ago, the New York Times published a bombshell article about a small startup called Clearview AI who was using a massive database of three billion faces scraped from several social media sites to offer a creepy facial recognition app. Just one snapshot of some stranger's face could immediately identify that person - not just name, but potential location, age, other images, social media pages, and even a list of friends and family. Clearview claimed to only sell this service to law enforcement agencies, mostly in the US and Canada. However, this week Buzzfeed News obtained the company's client list, and it contained several non-law enforcement agencies and dozens of clients outside of North America. In other news: the latest Windows 10 update has caused many serious problems; leaked documents show how big companies are buying our credit card data; up to a billion WiFi devices have a critical security bug; the FCC says it will fine the four big US cellular carriers $200M for selling your location data; and several news bits about browsers: Brave, Chrome and Firefox. Further Info: The Secretive Company That Might End Privacy as We Know It: https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html Public DNS providers supporting DNS over HTTPS: https://github.com/curl/curl/wiki/DNS-over-HTTPS WaPo: The Intelligence Coup of the Century: https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/ WNCU Livestream (Sun Mar 8, 6:30pm ET): http://www.wncu.org/listen-live/ The Measure of Everyday Life podcast: https://podcasts.apple.com/us/podcast/the-measure-of-everyday-life/id956844695

it's not cheap or easy to get your iPhone repaired - largely because there's not a lot of real competition in the iPhone repair market. That's no accident. Owners of modern John Deere tractors have really only one option: John Deere. Why? There's no good technical reason. There's really no good legal reason either, but laws like the Digital Millennium Copyright Act (DMCA) and the Computer Fraud and Abuse Act (CFAA) have been abused to give these companies inordinate say over who can perform repairs on their products. In part 2 of my interview with the EFF's Cory Doctorow, we discuss the right to repair and wrap up our overall discussion with possible solutions and action items for the concerned consumer. Cory Doctorow is a science fiction author, activist, journalist and blogger. He’s the author of several novels including HOMELAND, LITTLE BROTHER and WALKAWAY. He is the former European director of the Electronic Frontier Foundation and co-founded the UK Open Rights Group. Further Info: Adversarial Interoperability: https://www.eff.org/deeplinks/2019/10/adversarial-interoperability Donate to EFF: https://supporters.eff.org/donate Electronic Frontier Alliance: https://www.eff.org/fight

Here's a riddle for you: when does something you paid good money not actually belong to you? Answer: when that device is part of the Internet of Things. Why? Because without the express permission and continued support of the company that sold you that device, it becomes a worthless piece of junk. All of our modern "smart" devices are inextricably tied to their cloud-based services and automatic software updates. In part 1 of my interview with Cory Doctorow, we'll talk about how we got into this situation, including several shocking examples. Cory Doctorow is a science fiction author, activist, journalist and blogger. He’s the author of several novels including HOMELAND, LITTLE BROTHER and WALKAWAY. He is the former European director of the Electronic Frontier Foundation and co-founded the UK Open Rights Group. Further Info: Adversarial Interoperability: https://www.eff.org/deeplinks/2019/10/adversarial-interoperability Donate to EFF: https://supporters.eff.org/donate