WEBVTT - Tech Friday w/ Dave Hatter - Sponsored by Intrust IT - 11/06/2026

0:00:01.379 --> 0:00:07.010
<v Speaker 1>629-55-KERCETY-TALK-STATION. Friday, appointment listening. Podcast listening, too. Later, you can

0:00:07.310 --> 0:00:11.190
<v Speaker 1>cut and paste and forward it to your friends. 55-KERCETY.IHEART.COM.

0:00:11.250 --> 0:00:15.590
<v Speaker 1>InTrustIT.COM to find Dave Hatter and his crew. Employee-owned company

0:00:15.610 --> 0:00:17.980
<v Speaker 1>looking out for your business needs, especially, I mean, with

0:00:18.020 --> 0:00:21.040
<v Speaker 1>regard to computers. They'll keep you, get best practices, fix

0:00:21.120 --> 0:00:23.360
<v Speaker 1>stuff that's broken and look out for your best interest.

0:00:23.940 --> 0:00:26.459
<v Speaker 1>And Well, Dave will show up today and scare the

0:00:26.500 --> 0:00:29.230
<v Speaker 1>living crap out of at least me. Dave Hatter, welcome back, man.

0:00:29.270 --> 0:00:33.630
<v Speaker 1>I appreciate IntrustIT.com sponsoring this segment, and I always heed

0:00:33.650 --> 0:00:36.129
<v Speaker 1>your advice, and this is something that's really, really, really

0:00:36.170 --> 0:00:40.010
<v Speaker 1>been worrying me for a long time. AI agents getting

0:00:40.110 --> 0:00:42.570
<v Speaker 1>into bank accounts. Dave, welcome back.

0:00:43.390 --> 0:00:45.979
<v Speaker 2>Hey, Brian. Always good to be here. Yeah, I'm concerned

0:00:46.020 --> 0:00:51.200
<v Speaker 2>about this as well. The good news is large banks have...

0:00:51.790 --> 0:00:53.990
<v Speaker 2>been paying attention to this, have been talking about this.

0:00:54.070 --> 0:00:57.450
<v Speaker 2>It looks like several have banned this. And the real

0:00:57.550 --> 0:01:00.330
<v Speaker 2>issue here, and I think I can just summarize this

0:01:00.390 --> 0:01:05.920
<v Speaker 2>very easily. It's now possible with AI agents to have

0:01:05.959 --> 0:01:09.000
<v Speaker 2>an agent that will just go do things on your

0:01:09.040 --> 0:01:11.539
<v Speaker 2>behalf or on behalf of whatever credentials that are given

0:01:11.580 --> 0:01:13.520
<v Speaker 2>to it. And what I mean by that is you

0:01:13.540 --> 0:01:17.600
<v Speaker 2>give it a username and password credentials. It assumes that

0:01:17.700 --> 0:01:21.330
<v Speaker 2>identity and it does stuff. You've seen stories here in

0:01:21.350 --> 0:01:25.000
<v Speaker 2>the recent past about agents that have gone rogue and

0:01:25.060 --> 0:01:27.560
<v Speaker 2>done things they weren't supposed to do, things they weren't

0:01:27.740 --> 0:01:31.360
<v Speaker 2>asked to do. So what the banks are saying is

0:01:31.420 --> 0:01:35.110
<v Speaker 2>it appears that there's activity like this in their networks.

0:01:36.610 --> 0:01:39.140
<v Speaker 2>I've seen stories where someone is like, oh, hey, it

0:01:39.240 --> 0:01:41.979
<v Speaker 2>might be a great idea if I set my AI

0:01:42.080 --> 0:01:44.780
<v Speaker 2>agent loose and let it act on my behalf to

0:01:44.819 --> 0:01:47.380
<v Speaker 2>buy me things or something. Now, I don't think this

0:01:47.440 --> 0:01:48.860
<v Speaker 2>is going to come as a shock to you or

0:01:48.920 --> 0:01:51.810
<v Speaker 2>anyone that's ever heard me talk about this before. There

0:01:51.830 --> 0:01:54.770
<v Speaker 2>was absolutely no way I would give any kind of

0:01:54.830 --> 0:01:59.070
<v Speaker 2>AI agent the capability to act as me in any

0:01:59.110 --> 0:02:03.990
<v Speaker 2>sort of financial way. Because as a reminder, folks, AI

0:02:04.050 --> 0:02:08.730
<v Speaker 2>still hallucinates. It makes things up. It's probabilistic, not deterministic.

0:02:09.290 --> 0:02:12.450
<v Speaker 2>So there is literally no chance I would allow something

0:02:12.490 --> 0:02:12.889
<v Speaker 2>to do this.

0:02:13.030 --> 0:02:16.139
<v Speaker 1>Okay. Well, walk me, the ignorant person that I am,

0:02:16.190 --> 0:02:19.880
<v Speaker 1>pretend I'm seven. And you're trying to explain how this

0:02:19.940 --> 0:02:22.320
<v Speaker 1>goes about. Because what you just said to me suggests

0:02:22.340 --> 0:02:26.120
<v Speaker 1>that I, a logical, reasonable thinking human being, would give

0:02:26.240 --> 0:02:31.390
<v Speaker 1>artificial intelligence like what, Grok or ChatGPT, my account information

0:02:31.450 --> 0:02:33.910
<v Speaker 1>along with instructions to act on my behalf? Is that

0:02:33.930 --> 0:02:34.850
<v Speaker 1>what I heard you say?

0:02:34.870 --> 0:02:37.450
<v Speaker 2>Yes, that's exactly what I'm talking about.

0:02:37.470 --> 0:02:38.810
<v Speaker 1>Oh, man, you're going to get me to break the

0:02:38.910 --> 0:02:42.370
<v Speaker 1>FCC rules. That is blanking insane, Dave. Why would I

0:02:42.490 --> 0:02:43.190
<v Speaker 1>ever do that?

0:02:44.110 --> 0:02:47.750
<v Speaker 2>Well, I don't know. Maybe because you don't understand the risk.

0:02:47.850 --> 0:02:51.419
<v Speaker 2>Maybe because you think this is cool. This all sort

0:02:51.460 --> 0:02:53.579
<v Speaker 2>of started, the first article I saw about it anyway

0:02:53.620 --> 0:02:57.740
<v Speaker 2>was from Axios. Unvetted AI agents are accessing bank accounts, right?

0:02:58.540 --> 0:03:00.700
<v Speaker 2>And then it goes on to say, you know, banks

0:03:00.820 --> 0:03:05.720
<v Speaker 2>detecting unauthorized activity from third-party agents operating within customers' online accounts.

0:03:07.419 --> 0:03:09.760
<v Speaker 2>Some of the biggest financial institutions in the U.S. say

0:03:09.820 --> 0:03:14.350
<v Speaker 2>customers have given their personal agents, which are unvetted by banks,

0:03:14.470 --> 0:03:19.790
<v Speaker 2>access to their financial accounts. Yeah. And so here's the thing.

0:03:20.680 --> 0:03:25.510
<v Speaker 2>I wouldn't do this in general, okay? And if I

0:03:25.570 --> 0:03:27.630
<v Speaker 2>were going to use an AI agent in this way,

0:03:27.650 --> 0:03:29.990
<v Speaker 2>I would make sure it had the least amount of

0:03:30.050 --> 0:03:34.660
<v Speaker 2>permissions possible. Because here's the real issue, Brian. Besides the hallucination,

0:03:34.780 --> 0:03:37.900
<v Speaker 2>besides the fact that these things will do things you

0:03:37.920 --> 0:03:40.900
<v Speaker 2>didn't necessarily want them or expect them to do, If

0:03:40.960 --> 0:03:42.980
<v Speaker 2>and when it goes wrong, if you wake up tomorrow

0:03:43.100 --> 0:03:45.040
<v Speaker 2>and you've done something like this and all of your

0:03:45.060 --> 0:03:47.700
<v Speaker 2>money's gone, well, whose fault is it? Is it the

0:03:47.720 --> 0:03:51.280
<v Speaker 2>bank's fault? Is it your fault? Your fault. Is it

0:03:51.300 --> 0:03:53.839
<v Speaker 2>the AI company's fault? Well, I would agree it's your fault.

0:03:53.880 --> 0:03:57.160
<v Speaker 2>But when your money's gone from a legal perspective, because

0:03:57.240 --> 0:03:59.780
<v Speaker 2>as you know, this stuff is all still relatively new

0:04:00.280 --> 0:04:04.320
<v Speaker 2>and relatively immature, you know, there's no legal framework around

0:04:04.380 --> 0:04:04.850
<v Speaker 2>any of this.

0:04:05.070 --> 0:04:08.450
<v Speaker 1>Well, artificial intelligence companies at least prudent enough to give

0:04:08.530 --> 0:04:10.950
<v Speaker 1>some sort of, you know, I'll even call it half-assed

0:04:11.010 --> 0:04:14.720
<v Speaker 1>warning ahead of time that bad things can happen and

0:04:14.920 --> 0:04:18.240
<v Speaker 1>use at your own risk, caveat emptor kind of stuff, Dave.

0:04:18.260 --> 0:04:25.150
<v Speaker 2>One would hope. One would hope. And, you know, again,

0:04:25.190 --> 0:04:27.789
<v Speaker 2>you can make a distinction here between, again, like some

0:04:28.089 --> 0:04:32.270
<v Speaker 2>rogue thing versus you giving an agent like a Muse

0:04:32.330 --> 0:04:35.029
<v Speaker 2>or something, Grokbot, other things folks have probably heard of,

0:04:36.650 --> 0:04:38.800
<v Speaker 2>the access to your bank account.

0:04:39.060 --> 0:04:43.210
<v Speaker 1>Who's smart enough to know the restrictive parameters sufficiently enough

0:04:43.230 --> 0:04:45.490
<v Speaker 1>that they could prevent it from going outside of them?

0:04:46.470 --> 0:04:50.029
<v Speaker 2>Well, I would argue, even if you knew how to

0:04:50.089 --> 0:04:54.760
<v Speaker 2>set the guardrails correctly, the idea of them going rogue,

0:04:54.779 --> 0:04:58.920
<v Speaker 2>the idea of hallucination, again, it comes up with something

0:04:58.960 --> 0:05:01.780
<v Speaker 2>that's wrong. Well, if that's only 1% of the time,

0:05:02.060 --> 0:05:05.020
<v Speaker 2>but it's catastrophic, well, then what?

0:05:05.710 --> 0:05:08.050
<v Speaker 1>Well, and aren't you also putting into the ether, not

0:05:08.070 --> 0:05:11.050
<v Speaker 1>that it doesn't exist out there somewhere else, but the

0:05:11.110 --> 0:05:13.370
<v Speaker 1>information you'd need to access an account, which would include

0:05:13.390 --> 0:05:15.659
<v Speaker 1>the account information along with passwords to get it, that

0:05:15.720 --> 0:05:17.260
<v Speaker 1>goes out into the world, I guess.

0:05:17.400 --> 0:05:17.779
<v Speaker 2>I don't know.

0:05:18.360 --> 0:05:22.039
<v Speaker 1>Dave, it troubles me that anybody would consider doing this

0:05:22.080 --> 0:05:22.919
<v Speaker 1>in the first instance.

0:05:22.980 --> 0:05:23.420
<v Speaker 2>I don't know.

0:05:23.560 --> 0:05:25.240
<v Speaker 1>Maybe I've just learned too much from you to know

0:05:25.279 --> 0:05:28.190
<v Speaker 1>that that just sounds like an extraordinarily dumb idea.

0:05:29.270 --> 0:05:32.310
<v Speaker 2>Know it would be one thing to say okay if

0:05:32.370 --> 0:05:34.610
<v Speaker 2>it had read-only access and you wanted to know like

0:05:34.630 --> 0:05:37.789
<v Speaker 2>your spending patterns or whatever but if it has full

0:05:38.210 --> 0:05:40.570
<v Speaker 2>read write access if it can truly act on your

0:05:40.630 --> 0:05:46.020
<v Speaker 2>behalf transfer money make purchases etc um in my mind

0:05:46.060 --> 0:05:49.320
<v Speaker 2>the risk of that is way way way too high

0:05:49.400 --> 0:05:53.219
<v Speaker 2>now some banks so again Banks are talking about this.

0:05:53.420 --> 0:05:57.560
<v Speaker 2>Jamie Dimon, the CEO of J.P. Morgan, recently expressed concern

0:05:57.580 --> 0:06:00.500
<v Speaker 2>about this. This is a quote from him. We're not

0:06:00.540 --> 0:06:02.729
<v Speaker 2>going to allow just any outside agents to come inside

0:06:02.760 --> 0:06:04.770
<v Speaker 2>the company because it's just too risky for clients and

0:06:04.810 --> 0:06:09.510
<v Speaker 2>for J.P. Morgan, unquote. Charles Schwab, CEO, said they're just

0:06:09.529 --> 0:06:12.950
<v Speaker 2>going to block it outright, at least for now. So again,

0:06:13.089 --> 0:06:16.270
<v Speaker 2>the good news is people are, banks are paying attention

0:06:16.290 --> 0:06:19.250
<v Speaker 2>to this. Hopefully they're warning customers. I think it's an

0:06:19.290 --> 0:06:22.640
<v Speaker 2>important topic to talk about. At some future point, when

0:06:22.660 --> 0:06:25.300
<v Speaker 2>this stuff is more mature and it's more proven to

0:06:25.339 --> 0:06:29.089
<v Speaker 2>work right in a consistent deterministic type fashion, okay, I

0:06:29.130 --> 0:06:32.599
<v Speaker 2>might consider something like this. Literally no chance I would

0:06:32.620 --> 0:06:35.040
<v Speaker 2>do something. Absolutely no chance I would give any kind

0:06:35.080 --> 0:06:38.419
<v Speaker 2>of agent access to anything with my credentials, my identity

0:06:38.779 --> 0:06:42.159
<v Speaker 2>that could do anything financial. And that would be my

0:06:42.200 --> 0:06:44.880
<v Speaker 2>advice to anyone listening to this. You are taking enormous

0:06:44.960 --> 0:06:46.440
<v Speaker 2>risk if you do something like this.

0:06:47.120 --> 0:06:49.700
<v Speaker 1>And my life is not complicated by the fact that

0:06:49.720 --> 0:06:51.700
<v Speaker 1>I have to do things like this myself. It hasn't

0:06:51.839 --> 0:06:54.560
<v Speaker 1>ever been a problem. It's not difficult. It's not time consuming.

0:06:55.040 --> 0:06:58.400
<v Speaker 1>I just don't understand people's gravitating, gravitating toward this kind

0:06:58.420 --> 0:06:59.560
<v Speaker 1>of just because it's there.

0:07:00.460 --> 0:07:02.810
<v Speaker 2>I think they just don't understand the risk. It sounds cool,

0:07:03.060 --> 0:07:05.050
<v Speaker 2>and they think they're going to save time or be

0:07:05.089 --> 0:07:10.130
<v Speaker 2>more productive, and I think they just don't understand the risk.

0:07:10.410 --> 0:07:11.730
<v Speaker 2>That's my best guess.

0:07:12.010 --> 0:07:13.770
<v Speaker 1>I guess that's a good guess, man. It sounds to

0:07:13.810 --> 0:07:18.110
<v Speaker 1>me stupid. 637 more with Dave Hatter, including the Ohio

0:07:18.170 --> 0:07:19.740
<v Speaker 1>Auditor's website, apparently got hacked.

0:07:20.100 --> 0:07:20.480
<v Speaker 2>Super.

0:07:21.600 --> 0:07:25.760
<v Speaker 1>It is 640, interestit.com. That's where you find Dave Hatter.

0:07:25.940 --> 0:07:29.060
<v Speaker 1>Also a Rush fan. Dave Hatter, they played trees at

0:07:29.120 --> 0:07:31.960
<v Speaker 1>Rush when I saw them the other night. And I

0:07:32.000 --> 0:07:34.020
<v Speaker 1>thought of you immediately and actually took photographs and a

0:07:34.040 --> 0:07:35.620
<v Speaker 1>little bit of video from that, which I'll pass along

0:07:35.640 --> 0:07:38.020
<v Speaker 1>to you at some point. Rush is going to be

0:07:38.080 --> 0:07:41.720
<v Speaker 1>performing at the Sphere in May. So out in Vegas,

0:07:42.000 --> 0:07:42.700
<v Speaker 1>wouldn't that be great?

0:07:43.540 --> 0:07:45.340
<v Speaker 2>That would be very cool. I'm sure it will be

0:07:45.360 --> 0:07:48.540
<v Speaker 2>an amazing show. Oh, my word. That is the backdrop. Yes.

0:07:48.860 --> 0:07:51.660
<v Speaker 1>Anyhow, since you're a fellow Rush geek like me, thought

0:07:51.700 --> 0:07:53.300
<v Speaker 1>I'd pass that along to you as we pivot over

0:07:53.380 --> 0:07:57.660
<v Speaker 1>to the Ohio Auditor's website getting attacked. What's going on here?

0:07:59.120 --> 0:08:02.850
<v Speaker 2>Well, Brian, to me, this just illustrates nicely the things

0:08:02.870 --> 0:08:04.820
<v Speaker 2>that we talk about all the time. And I'm not

0:08:04.880 --> 0:08:07.270
<v Speaker 2>here to throw the Ohio Auditor under the bus, just

0:08:07.310 --> 0:08:10.310
<v Speaker 2>to be clear. I just want to point out, especially

0:08:10.370 --> 0:08:13.290
<v Speaker 2>for local governments, since you know I'm involved in this myself,

0:08:13.810 --> 0:08:17.220
<v Speaker 2>local governments are increasingly under attack. Now, interestingly enough, And

0:08:17.260 --> 0:08:19.800
<v Speaker 2>I say this all the time. Ohio, in my opinion,

0:08:20.280 --> 0:08:23.080
<v Speaker 2>is a real leader in this space, just across the board.

0:08:23.690 --> 0:08:26.910
<v Speaker 2>Ohio has a law that requires local governments to do

0:08:26.970 --> 0:08:29.250
<v Speaker 2>certain things. You'll see how this ties in a second.

0:08:29.890 --> 0:08:32.950
<v Speaker 2>Ohio has something called the Ohio Cyber Collaboration Committee that

0:08:33.860 --> 0:08:36.630
<v Speaker 2>It's the home for the Ohio Cyber Reserve and other

0:08:36.910 --> 0:08:40.490
<v Speaker 2>organizations and agencies trying to raise awareness, trying to provide support,

0:08:40.990 --> 0:08:44.470
<v Speaker 2>trying to keep these sorts of jobs in Ohio, and frankly,

0:08:44.510 --> 0:08:48.340
<v Speaker 2>trying to protect the Ohio community through the Cyber Reserve,

0:08:48.380 --> 0:08:51.640
<v Speaker 2>which is a public-private partnership between civilians and the Ohio

0:08:51.679 --> 0:08:56.439
<v Speaker 2>National Guard. So in almost every way, certainly compared to

0:08:56.480 --> 0:08:59.349
<v Speaker 2>your neighbors, like us down here in Kentucky, Ohio is

0:08:59.410 --> 0:09:01.910
<v Speaker 2>leading on a lot of these things. But to me,

0:09:02.030 --> 0:09:05.530
<v Speaker 2>this is just illustrative of the fact that A, any

0:09:05.590 --> 0:09:09.809
<v Speaker 2>sort of government agency is increasingly under attack. And B,

0:09:10.090 --> 0:09:14.270
<v Speaker 2>the Ohio auditor's office under Ohio revised code 9.64, the

0:09:14.309 --> 0:09:18.110
<v Speaker 2>law that requires Ohio governments to implement a cybersecurity program

0:09:18.210 --> 0:09:21.800
<v Speaker 2>amongst other things, is the office responsible for enforcing it.

0:09:22.700 --> 0:09:25.500
<v Speaker 2>So here is the office that is supposed to ensure

0:09:25.700 --> 0:09:28.760
<v Speaker 2>that your village, your township, your city, your county, whatever,

0:09:29.720 --> 0:09:34.640
<v Speaker 2>is doing what the ohio 9.64 rules call for has

0:09:34.679 --> 0:09:38.230
<v Speaker 2>been hacked now think about that for a second and

0:09:38.270 --> 0:09:40.310
<v Speaker 2>again i'm not here to throw them under the bus

0:09:40.490 --> 0:09:44.370
<v Speaker 2>sadly these kinds of hacks are increasing everywhere every day

0:09:44.510 --> 0:09:47.309
<v Speaker 2>on every type of organization i think we talked about

0:09:47.380 --> 0:09:52.100
<v Speaker 2>the refrigerator thing out of france physical world yes more

0:09:52.140 --> 0:09:55.880
<v Speaker 2>of these attacks in the eu Our physical and digital

0:09:55.920 --> 0:09:59.010
<v Speaker 2>world are now increasingly interconnected. One of the reasons why

0:09:59.030 --> 0:10:03.480
<v Speaker 2>the AI agent banking story is concerning to me. Again,

0:10:03.679 --> 0:10:06.890
<v Speaker 2>no chance, no chance I would do that, Brian, at

0:10:06.920 --> 0:10:11.850
<v Speaker 2>this point. But the auditor's office website has been down

0:10:12.250 --> 0:10:19.429
<v Speaker 2>for some time now. Yeah. If you look, as best

0:10:19.510 --> 0:10:22.109
<v Speaker 2>I can tell, it still is down, right? I'm going

0:10:22.150 --> 0:10:25.330
<v Speaker 2>to try it while I'm talking to you. And assuming

0:10:25.370 --> 0:10:27.350
<v Speaker 2>I'm typing it in right, because it's early and I'm

0:10:27.470 --> 0:10:33.490
<v Speaker 2>old and blind now, Brian. It's still down, I believe.

0:10:33.550 --> 0:10:36.429
<v Speaker 2>Let me try to confirm that. It doesn't seem to

0:10:36.470 --> 0:10:38.510
<v Speaker 2>be responding to me. I mean, and this has been

0:10:38.530 --> 0:10:41.000
<v Speaker 2>in the news. Like, here's a story. Ohio Auditor's website

0:10:41.010 --> 0:10:44.220
<v Speaker 2>and online accounts down after cyber attack. That story was

0:10:44.300 --> 0:10:48.320
<v Speaker 2>published on the 27th. And unless this problem was on

0:10:48.380 --> 0:10:51.820
<v Speaker 2>my end somehow, the auditor's website is still not working

0:10:51.860 --> 0:10:54.760
<v Speaker 2>for me. Now, that doesn't mean their other backend services

0:10:54.820 --> 0:10:57.480
<v Speaker 2>are down. And it's not entirely clear to me exactly

0:10:57.600 --> 0:10:59.900
<v Speaker 2>what happened at this point from the reporting I've seen.

0:10:59.920 --> 0:11:03.930
<v Speaker 2>In this article, it says, quote, out of an abundance

0:11:03.950 --> 0:11:06.050
<v Speaker 2>of caution, we took the web server and online accounts

0:11:06.110 --> 0:11:09.990
<v Speaker 2>offline while internal and external experts scrutinized the threat activity, unquote.

0:11:11.170 --> 0:11:14.310
<v Speaker 2>The bigger point I'm trying to make is, to me,

0:11:14.390 --> 0:11:21.460
<v Speaker 2>this just illustrates, again, Governments specifically under attack and as

0:11:21.500 --> 0:11:24.900
<v Speaker 2>an organization of any type, as a business, as a government,

0:11:26.870 --> 0:11:28.689
<v Speaker 2>I just can't stress enough, folks, you got to take

0:11:28.730 --> 0:11:33.120
<v Speaker 2>this stuff seriously. There are defenses against this. You ran

0:11:33.160 --> 0:11:35.960
<v Speaker 2>the commercial where we talk about resilience. Resilience has never

0:11:36.000 --> 0:11:39.780
<v Speaker 2>been more important. Resilience is the idea that things break.

0:11:40.080 --> 0:11:41.839
<v Speaker 2>It doesn't have to be a cyber attack. It could

0:11:41.860 --> 0:11:44.140
<v Speaker 2>be a hard disk failure. It could be your internet

0:11:44.200 --> 0:11:46.560
<v Speaker 2>is taken out. It could be your cloud service provider

0:11:46.900 --> 0:11:48.550
<v Speaker 2>that does X, Y, or Z for you is down

0:11:48.590 --> 0:11:53.820
<v Speaker 2>for some reason. It's thinking about planning for what are

0:11:53.840 --> 0:11:56.570
<v Speaker 2>you going to do when something stops working and understanding

0:11:56.850 --> 0:11:59.910
<v Speaker 2>what's critical in your organization, right? Not everything has to

0:11:59.950 --> 0:12:02.810
<v Speaker 2>have the same level of protection. Not everything has the

0:12:02.850 --> 0:12:05.410
<v Speaker 2>same impact on your organization if it stops working for

0:12:05.450 --> 0:12:09.070
<v Speaker 2>some reason. So, you know, this to me just illustrates, again,

0:12:09.110 --> 0:12:12.830
<v Speaker 2>the idea of resilience. Unfortunately, resilience costs money. It might

0:12:12.870 --> 0:12:15.870
<v Speaker 2>be duplicate systems. It might be three or four different

0:12:15.910 --> 0:12:18.730
<v Speaker 2>backups stored in different locations. There's something called the backup

0:12:18.770 --> 0:12:22.800
<v Speaker 2>rule of three, two, one. There's literally nothing you can

0:12:22.840 --> 0:12:24.670
<v Speaker 2>do at this point, Brian. Nothing that will make you

0:12:24.730 --> 0:12:28.290
<v Speaker 2>completely impervious to these kind of things. And we're seeing

0:12:28.309 --> 0:12:30.449
<v Speaker 2>that more and more. But you can defend against it,

0:12:30.570 --> 0:12:32.790
<v Speaker 2>and you can prepare for something bad happening.

0:12:33.050 --> 0:12:35.010
<v Speaker 1>Well, Christine sent me an email while we were talking

0:12:35.030 --> 0:12:37.439
<v Speaker 1>in the last segment. She said, keep asking about AI

0:12:37.480 --> 0:12:40.800
<v Speaker 1>getting passwords even without permission. It scares her. It scares me.

0:12:40.860 --> 0:12:45.020
<v Speaker 1>And that's why you always emphasize the importance of two-factor authentication.

0:12:45.260 --> 0:12:46.720
<v Speaker 1>Even if they were able to hack in and get

0:12:46.740 --> 0:12:49.660
<v Speaker 1>your password through some nefarious means, They can't do it

0:12:49.679 --> 0:12:51.740
<v Speaker 1>unless they have your cell phone to enter the code

0:12:51.760 --> 0:12:55.640
<v Speaker 1>with a two-factor authentication. Well, that's not as true as

0:12:55.660 --> 0:12:56.180
<v Speaker 1>it used to.

0:12:56.100 --> 0:13:03.250
<v Speaker 2>Be, unfortunately. So multi-factor authentication, a.k.a. two-factor authentication, a.k.a. two-step verification,

0:13:03.290 --> 0:13:07.130
<v Speaker 2>depending on what platform you're on, is still absolutely critical.

0:13:07.429 --> 0:13:09.830
<v Speaker 2>I don't want people to walk away from this understanding.

0:13:09.929 --> 0:13:13.460
<v Speaker 2>You should turn on multi-factor authentication now. on every account,

0:13:13.860 --> 0:13:17.920
<v Speaker 2>certainly any account that has access to sensitive data and

0:13:18.120 --> 0:13:21.400
<v Speaker 2>or your money, your retirement account, your bank accounts, that

0:13:21.440 --> 0:13:24.800
<v Speaker 2>sort of thing. Absolutely critical. However, and we may run

0:13:24.840 --> 0:13:27.020
<v Speaker 2>out of time in this segment, there's a new sort

0:13:27.059 --> 0:13:29.250
<v Speaker 2>of attack called a man in the middle or adversary

0:13:29.270 --> 0:13:31.970
<v Speaker 2>in the middle attack where the bad guys sit between

0:13:32.010 --> 0:13:34.790
<v Speaker 2>you and whatever you're trying to log into and they're

0:13:34.830 --> 0:13:37.990
<v Speaker 2>proxying the communication. So you enter your username and password,

0:13:38.490 --> 0:13:40.850
<v Speaker 2>it goes to them, they send it to your bank

0:13:40.890 --> 0:13:43.780
<v Speaker 2>or Microsoft or whatever. When the request for the one-time

0:13:43.820 --> 0:13:47.459
<v Speaker 2>passcode or the MFA code comes back, they get that request,

0:13:47.500 --> 0:13:50.150
<v Speaker 2>send it to you. You have no idea they're in

0:13:50.170 --> 0:13:52.450
<v Speaker 2>the middle of this. You enter that code. It goes

0:13:52.490 --> 0:13:55.949
<v Speaker 2>to them. They send it to your bank or Microsoft.

0:13:56.090 --> 0:13:59.200
<v Speaker 2>When that clears, they say, here's your session token, the

0:13:59.240 --> 0:14:01.960
<v Speaker 2>thing that tells them you've logged in. Now the bad

0:14:01.980 --> 0:14:04.439
<v Speaker 2>guys have it. This is real. And there are defenses

0:14:04.500 --> 0:14:09.480
<v Speaker 2>against this. Fish-resistant MFA, pass keys, hardware keys. There are

0:14:09.520 --> 0:14:12.600
<v Speaker 2>ways to defeat this, but they require a little more

0:14:12.640 --> 0:14:16.100
<v Speaker 2>knowledge and, frankly, a little more friction. But sadly, that's

0:14:16.140 --> 0:14:19.050
<v Speaker 2>where we're... That's where we are. Fish resistant. Yeah. Fish

0:14:19.070 --> 0:14:21.070
<v Speaker 2>resistant MFA. And that is where we are today.

0:14:21.130 --> 0:14:24.080
<v Speaker 1>Unfortunately, interest it.com to reach Dave and the crew. Don't

0:14:24.100 --> 0:14:29.320
<v Speaker 1>go away. Delta targeted in federal investigation. It's six 50,

0:14:29.300 --> 0:14:32.100
<v Speaker 1>55 care city talk station at the Friday tech Friday

0:14:32.120 --> 0:14:34.500
<v Speaker 1>with Dave Hatter interest it.com. You can find Dave and

0:14:34.620 --> 0:14:37.150
<v Speaker 1>all the articles he relies on for the segment at

0:14:37.230 --> 0:14:40.830
<v Speaker 1>linked in.com. Just search for Dave Hatter and you should

0:14:40.850 --> 0:14:42.990
<v Speaker 1>probably check him out throughout the week. He's always posting

0:14:43.010 --> 0:14:45.800
<v Speaker 1>great stuff. And you know, I don't, I don't like this, Dave,

0:14:45.860 --> 0:14:50.150
<v Speaker 1>but here's one of the reasons they have established and

0:14:50.190 --> 0:14:53.270
<v Speaker 1>created these files on us, hoovering up all the data

0:14:53.310 --> 0:14:55.770
<v Speaker 1>that we give them voluntarily through these free apps and

0:14:55.790 --> 0:14:58.230
<v Speaker 1>every other form. They know who we are, how much

0:14:58.310 --> 0:15:02.480
<v Speaker 1>we make, what we buy, and now these major organizations,

0:15:02.500 --> 0:15:04.720
<v Speaker 1>and there are a lot of allegations about this, are

0:15:04.740 --> 0:15:08.370
<v Speaker 1>adjusting pricing based upon what you can afford. Now, that's

0:15:08.420 --> 0:15:10.330
<v Speaker 1>our tax system, isn't it, Dave? You know, the more

0:15:10.370 --> 0:15:12.430
<v Speaker 1>you make, the more they tax. Well, the more you make,

0:15:12.470 --> 0:15:13.870
<v Speaker 1>the more they're going to charge you for any given

0:15:13.910 --> 0:15:14.690
<v Speaker 1>product or service.

0:15:15.790 --> 0:15:17.690
<v Speaker 2>So what you said about why they want your data

0:15:17.950 --> 0:15:19.990
<v Speaker 2>is absolutely right. That's a big part of it. And

0:15:20.010 --> 0:15:21.910
<v Speaker 2>I also need to get my plug in, Brian, for

0:15:21.930 --> 0:15:26.530
<v Speaker 2>Queen City Con. The premier Midwestern cybersecurity conference starts next Friday.

0:15:26.570 --> 0:15:28.360
<v Speaker 2>In fact, probably when I talk to you and Joe,

0:15:28.510 --> 0:15:31.080
<v Speaker 2>I will be on site there at the Hyatt, November

0:15:31.120 --> 0:15:34.060
<v Speaker 2>13th through 15th, queencitycon.org. Look it up, folks. But yeah,

0:15:34.100 --> 0:15:37.100
<v Speaker 2>this is a thing that Really rubs me the wrong way.

0:15:37.650 --> 0:15:40.440
<v Speaker 2>Surveillance pricing. I wrote an article about this back in

0:15:40.480 --> 0:15:43.420
<v Speaker 2>February when I learned about it. Primarily, I mean, I

0:15:43.440 --> 0:15:46.540
<v Speaker 2>knew it was a thing. Yeah. But because Maryland banned it.

0:15:47.200 --> 0:15:49.300
<v Speaker 2>So I did a little research for this and then

0:15:49.320 --> 0:15:51.160
<v Speaker 2>I want to come back and explain it. But so far,

0:15:51.360 --> 0:15:54.800
<v Speaker 2>from best I can tell, four states have actually banned

0:15:54.840 --> 0:15:59.220
<v Speaker 2>this practice. Maryland, Connecticut, New Jersey and New York.

0:16:00.080 --> 0:16:01.000
<v Speaker 1>All Democrat states.

0:16:02.080 --> 0:16:08.710
<v Speaker 2>Several other states looking to ban it. California, Washington, Pennsylvania, Illinois, Minnesota, Tennessee,

0:16:08.750 --> 0:16:11.810
<v Speaker 2>and Vermont. I can tell you, based on the article

0:16:11.870 --> 0:16:13.730
<v Speaker 2>I wrote and the research I've done into this, I

0:16:13.770 --> 0:16:16.770
<v Speaker 2>have reached out to legislators in Kentucky and I'm working

0:16:16.850 --> 0:16:20.480
<v Speaker 2>to try to get something going here. But that said,

0:16:20.720 --> 0:16:23.420
<v Speaker 2>I mean, as recently as yesterday, Brian, here's an article.

0:16:23.860 --> 0:16:27.560
<v Speaker 2>Digital price tags at grocery stores raise surveillance pricing fears.

0:16:28.080 --> 0:16:30.860
<v Speaker 2>There's always been the concept of dynamic pricing. Yeah.

0:16:31.260 --> 0:16:36.100
<v Speaker 1>Oak Park, River Forest. Listen, we joked about it all

0:16:36.120 --> 0:16:37.760
<v Speaker 1>the time. I lived in Oak Park, and the next

0:16:37.820 --> 0:16:40.220
<v Speaker 1>neighborhood to the west of Oak Park up in Chicago

0:16:40.260 --> 0:16:43.300
<v Speaker 1>was River Forest. River Forest, a much wealthier neighborhood than

0:16:43.370 --> 0:16:45.070
<v Speaker 1>Oak Park. There was the Oak Park price to get

0:16:45.110 --> 0:16:46.810
<v Speaker 1>your furnace fixed, and then there was the River Forest

0:16:46.850 --> 0:16:49.250
<v Speaker 1>price to get your furnace fixed. It was more. Why?

0:16:49.560 --> 0:16:51.500
<v Speaker 1>Because you're in that neighborhood. This is the same damn thing,

0:16:51.560 --> 0:16:53.890
<v Speaker 1>except they do it, well, electronically.

0:16:54.670 --> 0:16:57.210
<v Speaker 2>At a lot larger scale with a lot more detailed

0:16:57.250 --> 0:17:00.590
<v Speaker 2>information to really hone it in. So again, things like

0:17:00.650 --> 0:17:03.370
<v Speaker 2>surge pricing on an Uber would be an example of this, right?

0:17:03.470 --> 0:17:06.609
<v Speaker 2>If you use Amazon or Walmart online, as they collect

0:17:06.650 --> 0:17:08.790
<v Speaker 2>more data about you, they know your zip code, whatever,

0:17:08.890 --> 0:17:11.590
<v Speaker 2>of course they could adjust the price. But in my opinion,

0:17:11.609 --> 0:17:14.689
<v Speaker 2>this goes much deeper than that. Now, thanks to digital

0:17:14.710 --> 0:17:16.699
<v Speaker 2>price tags, as they mentioned in this story, so I'll

0:17:16.720 --> 0:17:18.780
<v Speaker 2>just quote from this article, from websites to brick and

0:17:18.800 --> 0:17:21.020
<v Speaker 2>mortar stores, it's easier than ever for companies to target

0:17:21.060 --> 0:17:24.080
<v Speaker 2>shoppers with prices based on their personal data. Now, a

0:17:24.140 --> 0:17:26.760
<v Speaker 2>recent change at many grocery stores is raising concerns about

0:17:26.800 --> 0:17:28.440
<v Speaker 2>so-called surveillance pricing.

0:17:29.140 --> 0:17:29.380
<v Speaker 1>Right.

0:17:30.420 --> 0:17:34.320
<v Speaker 2>You walk in the store. It it recognizes your phone.

0:17:34.500 --> 0:17:36.699
<v Speaker 2>They have beacons. Your phone is pinging off of them.

0:17:36.820 --> 0:17:39.830
<v Speaker 2>Your phone is connected to you. They know it's you.

0:17:40.109 --> 0:17:42.129
<v Speaker 2>So you go over and pick up a can of

0:17:42.190 --> 0:17:45.409
<v Speaker 2>spam or whatever. And the price you see on the

0:17:45.450 --> 0:17:48.010
<v Speaker 2>digital price tag is different than the price I get

0:17:48.090 --> 0:17:50.109
<v Speaker 2>because they think you make more money than me.

0:17:50.270 --> 0:17:53.060
<v Speaker 1>Then get a Faraday Faraday bag. What would the default

0:17:53.100 --> 0:17:54.330
<v Speaker 1>pricing be, the lowest price?

0:17:55.630 --> 0:18:00.149
<v Speaker 2>Who knows? Good question, Brian. But again, at one time,

0:18:00.250 --> 0:18:02.070
<v Speaker 2>certainly they could do this if you were only an

0:18:02.150 --> 0:18:05.989
<v Speaker 2>online shopper. And it was called dynamic pricing. That's been

0:18:06.030 --> 0:18:08.990
<v Speaker 2>around for a long time. But now this idea is

0:18:09.320 --> 0:18:12.140
<v Speaker 2>with even more data than ever before. And it's not

0:18:12.180 --> 0:18:15.440
<v Speaker 2>just e-commerce. It's not just online. Now in physical stores,

0:18:15.520 --> 0:18:17.869
<v Speaker 2>because of this technology. And again, when you walk in,

0:18:18.580 --> 0:18:20.879
<v Speaker 2>Your phone, if you have the Wi-Fi turned on, if

0:18:20.900 --> 0:18:23.740
<v Speaker 2>you have the Bluetooth turned on, a Faraday bag is

0:18:23.780 --> 0:18:26.399
<v Speaker 2>a great option. I recommend GoDark. Yes, I have one

0:18:26.420 --> 0:18:29.419
<v Speaker 2>of these for my phone. Shocker option, Brian. Maybe we

0:18:29.460 --> 0:18:31.590
<v Speaker 2>do a whole segment on that and how to find

0:18:31.609 --> 0:18:33.270
<v Speaker 2>these things because they're not all the same. And if

0:18:33.310 --> 0:18:35.950
<v Speaker 2>you go buy one off Timu for $ 5, it probably

0:18:35.970 --> 0:18:39.590
<v Speaker 2>won't do what it purports to do. But yeah, I mean,

0:18:39.810 --> 0:18:42.030
<v Speaker 2>other than states banning this, your only real defense is

0:18:42.070 --> 0:18:44.820
<v Speaker 2>don't take your phone with you. Turn off the Wi-Fi

0:18:44.920 --> 0:18:50.419
<v Speaker 2>and the Bluetooth. Or drop your phone in a Faraday purse, pouch, bag, whatever. But,

0:18:50.500 --> 0:18:53.080
<v Speaker 2>you know, until this is banned, you're only going to

0:18:53.119 --> 0:18:54.659
<v Speaker 2>see more and more of this. And again, folks, I

0:18:54.680 --> 0:18:56.520
<v Speaker 2>want to be clear. This is not just you go

0:18:56.619 --> 0:18:59.200
<v Speaker 2>online and they know your zip code. You go online,

0:18:59.230 --> 0:19:01.510
<v Speaker 2>they know everything about you now. Yes, they do. And

0:19:01.850 --> 0:19:05.050
<v Speaker 2>it's not just online. You walk into a retail store.

0:19:05.530 --> 0:19:08.290
<v Speaker 2>They have these systems installed. You may get a higher

0:19:08.350 --> 0:19:11.470
<v Speaker 2>price than me. Again, four states have banned it. Several

0:19:11.520 --> 0:19:13.300
<v Speaker 2>more are looking at it. I'm going to push this

0:19:13.359 --> 0:19:17.240
<v Speaker 2>as hard as I can in Kentucky. come January, we'll

0:19:17.270 --> 0:19:18.889
<v Speaker 2>see what happens. But, you know, I'll put all this

0:19:18.930 --> 0:19:20.530
<v Speaker 2>in the show notes. Again, I wrote an article about

0:19:20.570 --> 0:19:23.150
<v Speaker 2>this back in February trying to raise the awareness about this.

0:19:23.290 --> 0:19:25.970
<v Speaker 1>This sounds like a Marxist dream. I'm surprised that Democrat

0:19:26.030 --> 0:19:30.709
<v Speaker 1>states have banned it because if poorer people pay less

0:19:31.330 --> 0:19:33.889
<v Speaker 1>and richer people pay more, isn't that what they're pushing

0:19:33.930 --> 0:19:36.550
<v Speaker 1>for constantly with me going back to the tax rates

0:19:36.570 --> 0:19:39.129
<v Speaker 1>that we all pay as a relative argument?

0:19:39.910 --> 0:19:42.449
<v Speaker 2>Well, there's another interesting angle to this, Brian, which is

0:19:42.650 --> 0:19:44.560
<v Speaker 2>at the end of the day... all of your data

0:19:44.780 --> 0:19:46.560
<v Speaker 2>that they've collected about you may not even be right.

0:19:46.700 --> 0:19:47.010
<v Speaker 1>That's true.

0:19:47.050 --> 0:19:49.470
<v Speaker 2>So you might be getting different pricing that's not even

0:19:49.650 --> 0:19:52.119
<v Speaker 2>accurate because the data itself is not correct.

0:19:52.300 --> 0:19:52.980
<v Speaker 1>That is true.

0:19:53.160 --> 0:19:57.670
<v Speaker 2>To me, this is just wrong across the board, and

0:19:57.970 --> 0:20:00.110
<v Speaker 2>hopefully more states will jump on the bandwagon.