Speaker 1: Welcome to Tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I am an executive producer with I Heart
Speaker 1: Radio and I love all things tech. And originally I
Speaker 1: had intended to bring you a third installment on our
Speaker 1: home theater basics, but stuff got got piled up. I
Speaker 1: had to record episodes of a couple of other podcasts,
Speaker 1: one of which is a spooky podcast that will be
Speaker 1: coming out later this year. UH can't say a whole
Speaker 1: lot about it, except it's not twelve days of Halloween
Speaker 1: and it's not fourteen days of Halloween somewhere in between. Anyway,
Speaker 1: Because of that, I got a little bit behind. So
Speaker 1: we're going to have a rerun today of an episode
Speaker 1: that published on Christmas Day in two thousand nineteen. UH
Speaker 1: Spend guest Shannon Morrise joined the show to talk about
Speaker 1: the dangers of public WiFi. So I hope you enjoy
Speaker 1: this episode. Let's sit back and listen. There's a topic
Speaker 1: that I really wanted to cover because as I record this,
Speaker 1: we're in the holiday season. A lot of people are traveling,
Speaker 1: They're going through airports, maybe you're visiting family and occasionally
Speaker 1: you need to find a place to be elsewhere, like
Speaker 1: maybe a coffee shop or something. That typically means we're
Speaker 1: carrying our devices with us, and then we want to
Speaker 1: connect to different networks. But that might not always be
Speaker 1: a great idea, and so I decided I was going
Speaker 1: to do an episode all about the best ways to
Speaker 1: browse the Internet with privacy and safety in mind, going
Speaker 1: from the least private and the least secure to perhaps
Speaker 1: the most private and most secure. And then I thought, hey,
Speaker 1: you dumb, dumb You know people who are extremely well
Speaker 1: versed in this topic, and that's why I invited my
Speaker 1: good friend, the phenomenal Shannon More to join this episode
Speaker 1: to come back. So welcome back to Tech Stuff, Shannon.
Speaker 1: Thank you so much. Jonathan. I'm so excited to be
Speaker 1: back on the show. How are you doing. I'm tired.
Speaker 1: But it's at the end of the year, so that
Speaker 1: always happens, right like, And here's the thing, you know,
Speaker 1: Shannon can tell you. In fact, we were just talking
Speaker 1: about it before we went on to the record that
Speaker 1: the tech journalists life does not get easier at the
Speaker 1: end of the year because you immediately turn around and
Speaker 1: head off to Vegas for ce S and that's where
Speaker 1: you're gonna be in early January, as I understand it, right, Shannon, Yes,
Speaker 1: I will. I'll be there all week covering everything over
Speaker 1: on my channel, so make sure to link everybody to
Speaker 1: my channel later, absolutely, because I ain't going folks. So
Speaker 1: Shannon's your your your destination for finding all the really
Speaker 1: cool stuff. And uh, Shannon, I can say from experience
Speaker 1: because I've watched her work does amazing work. Not just
Speaker 1: at c yes, but we were, but particularly like under
Speaker 1: a high stress situation like c e S, certain people
Speaker 1: can light up under the camera. And uh, I'm frankly
Speaker 1: envious of your ability to do so. So um, that's
Speaker 1: me be nice. Yeah, well, I mean I could be
Speaker 1: more caddy about it, but I'm gonna be nice. The
Speaker 1: Caddy would be like, how dare she? How dare she
Speaker 1: show me up? But no, we're gonna talk about browsing safely.
Speaker 1: So the first thing I wanted to do before we
Speaker 1: get into the spectrum of browsing the Internet, because you
Speaker 1: could argue that there's like the least safe, secure, naive
Speaker 1: way to do it to what is perhaps the most
Speaker 1: secure but not perfect. There's no perfect solution spoiler alert.
Speaker 1: Before we get into any of that, I wanted to
Speaker 1: talk about some stats, and these come from a few
Speaker 1: different sources. Uh. One was a survey that was conducted
Speaker 1: by one World Identity back in about public wi fi.
Speaker 1: So this was just asking people about their perception and
Speaker 1: their use of public WiFi. And Shannon, I kind of
Speaker 1: wanted to get your reaction to this because being someone
Speaker 1: who has been so entrenched in data security in the
Speaker 1: hacker culture in you know, everything from how do we
Speaker 1: make these systems more secure, to the white hat approach
Speaker 1: of how do we find any vulnerability so that they
Speaker 1: can be patched, to even the black hat culture where
Speaker 1: people are exploiting this for their own gain. I wanted
Speaker 1: to see what you thought about these stats. So the
Speaker 1: first one was they asked a question to people in
Speaker 1: the United States, in Germany and in France, and the
Speaker 1: question they asked was do you ever use unsecured public
Speaker 1: WiFi networks in the United States? So nearly half said,
Speaker 1: you know, if there's no other option, sure, I'll do it.
Speaker 1: Thirty two percent actually said I prefer using public WiFi
Speaker 1: to using my cellular plan. Uh. Person sumably because they
Speaker 1: would not be billed for data usage right because they're
Speaker 1: using WiFi instead of their cell data only said they
Speaker 1: never did it. One percent said they do it, but
Speaker 1: only with a VPN. But we'll cover VPNs a little
Speaker 1: bit later. So, Shannon, you've you've talked with hackers. What
Speaker 1: do you think their reaction initially would be hearing that
Speaker 1: nearly fifty of people in the United States said yeah,
Speaker 1: you know, if there's no other connection, I'll I'll connect
Speaker 1: to public WiFi, and another thirty two percent and I said, oh, heck, yeah,
Speaker 1: sign me up. Well, I'm definitely in the one percent
Speaker 1: of only with a VPN, and and that's assuming that
Speaker 1: I have absolutely no other option. So I'm kind of
Speaker 1: a mix of the and the one percent, but only
Speaker 1: only if I have a vp n UM. I would
Speaker 1: say from my experience, all of my friends would probably
Speaker 1: not be surprised by the tent that prefer public WiFi
Speaker 1: over their cellular plants, specifically because of what you said,
Speaker 1: they'll be able to save money, especially if they don't
Speaker 1: have an unlimited plan through their mobile carriers. So in
Speaker 1: that way, it makes sense, uh that say yes, if
Speaker 1: there's no other option, there's always another option. Come on, folks,
Speaker 1: what are you doing? Where are you at? Yeah? I
Speaker 1: mean we we have such good cellular coverage now there's
Speaker 1: always another option, even if you just have three G
Speaker 1: like that's manageable from most tasks. So what what are
Speaker 1: they doing? I'm just my draw My job kind of
Speaker 1: dropped a little bit when I heard that number. I
Speaker 1: just thought it was I thought that I'm doing a
Speaker 1: much better job of educating people about the importance of
Speaker 1: not using public WiFi, and apparently I'm not doing my
Speaker 1: job as well as I should have been, or or
Speaker 1: the people who are already kind of hip to it
Speaker 1: are the ones watching you, going yeah, she gets it,
Speaker 1: she knows, and the people who need to see it
Speaker 1: are like what's on the masked Singer today or whatever?
Speaker 1: You know, Like so, yeah, I I look at this
Speaker 1: and I think, man if I were a black hat,
Speaker 1: I would just be doing the Mr Burns excellent. Just
Speaker 1: you're over and over again just drooling at that opportunity,
Speaker 1: because you know, public WiFi is definitely the most dangerous
Speaker 1: option you can pick when you're talking about protecting your
Speaker 1: own privacy and security, especially if you're not doing something
Speaker 1: like using a VPN. UH spoiler alert will talk more
Speaker 1: about that in a second. And so knowing that you're
Speaker 1: your opportunity for targets is so vast has got to
Speaker 1: be incredibly encouraging to someone who is ready to exploit that.
Speaker 1: And that's really, you know, that's what we're trying to
Speaker 1: protect everyone against, is you know, it's the likelihood of
Speaker 1: you running into these situations is not necessarily high on
Speaker 1: a day to day basis, but the opportunity is so
Speaker 1: huge that you need to take it into account no
Speaker 1: matter where you happen to be. So you you want
Speaker 1: to make yourself the hard target. You want to be
Speaker 1: the person that makes people work really hard to get
Speaker 1: access to your data. You don't want to be the
Speaker 1: easy target, because the easier target you are, the more
Speaker 1: often you're going to be targeted. You don't want that. No, no,
Speaker 1: And I was actually talking to a co worker today
Speaker 1: and I said, honestly, when you look at data security,
Speaker 1: even when you're talking like you always get naysayers who
Speaker 1: will say, oh, sure you can use this, but it
Speaker 1: doesn't protect you against everything, And they may technically be right,
Speaker 1: but my answer is the harder you make it. Effectively,
Speaker 1: what that means is you're making it more expensive for
Speaker 1: someone to successfully target you. So if you price yourself
Speaker 1: out where it would cost them more to break your security,
Speaker 1: then they would get from whatever they took from you.
Speaker 1: You win, because no one's going to lose money on that.
Speaker 1: Uh exactly. It's when you've made it so convenient that
Speaker 1: it's like it's like it's like when someone says about
Speaker 1: a sale, I would lose money if I didn't buy that.
Speaker 1: That's when you're in Yeah, yes, exactly, it's they're looking
Speaker 1: for the bargain deal. And a lot of times when
Speaker 1: a black hat is looking at public WiFi as a
Speaker 1: way to access information, they're in tending to profit off
Speaker 1: of that information, whether by stealing an idea, identity, or
Speaker 1: reselling that data on the black market, like on the
Speaker 1: dark web. So making yourself the hard target is absolutely
Speaker 1: crucial to helping to protect you. Yeah. And and just
Speaker 1: so that you guys out there, no, I mean I
Speaker 1: mentioned the United States numbers. It's not like Germany and
Speaker 1: France were shining examples of data privacy and security among
Speaker 1: the public. In Germany, in fact, of respondents said they'd
Speaker 1: used unsecured, unsecured public WiFi over their cellular data, So
Speaker 1: it was even a larger percentage than the United States.
Speaker 1: And the United States it was that it said, oh yeah,
Speaker 1: I've got a choice, I'll use public over my cellular data.
Speaker 1: In Germany it was fort um and and said they
Speaker 1: would use it if they could not get a cellular option.
Speaker 1: And then in France it was closer to what the
Speaker 1: United States said, said they preferred using public WiFi to
Speaker 1: using their cellular data, and forty percent said they'd used
Speaker 1: it if they couldn't get any other option. So again
Speaker 1: that mirrored very closely what the folks in the United
Speaker 1: States said. So this is a trend that goes beyond
Speaker 1: the US. I know that because I'm centered in the US,
Speaker 1: I often get very US centric, And I also tend
Speaker 1: to harp on how American citizens in particular seemed to
Speaker 1: come across to me as being security illiterate for in
Speaker 1: a in large part, I mean, I just see it
Speaker 1: all the time, But I don't know if it's not
Speaker 1: exactly reassuring to see that that way in other parts
Speaker 1: of the world. That doesn't fill me with confidence. I
Speaker 1: think a lot of times people either don't know where
Speaker 1: to look for the information, for accessible information that's that
Speaker 1: that's explained in a way that is it's scary, or
Speaker 1: doesn't you know, create create emotions of paranoia or just
Speaker 1: close people down so that they just get lose interest insecurity. Uh.
Speaker 1: And you also have a lot of folks out there
Speaker 1: that just don't care. But I think a lot of
Speaker 1: people do care, they just don't know where to look
Speaker 1: for this kind of information. So I'm glad that you, Jonathan,
Speaker 1: as well as myself on my channel, we're putting that
Speaker 1: information out there in a way that's easy to understand,
Speaker 1: and I'm hoping that even if it just helps one
Speaker 1: person understand a little bit better security and privacy, hopefully
Speaker 1: we change that percentage over time. Absolutely, I agree. I think, uh,
Speaker 1: it can be one of those situations where you get
Speaker 1: overwhelmed by the scope of something. And when you get overwhelmed,
Speaker 1: it's almost like there's a defense mechanism in your brain, right,
Speaker 1: It's like this is too hard, so I can't worry
Speaker 1: about it. And I have seen this in action when
Speaker 1: trying to tell people about like password managers, for example,
Speaker 1: and lead shut down. They have no interest. They get
Speaker 1: glassy eyed, and they just say, well, I don't see
Speaker 1: what the point is on I try to explain the point.
Speaker 1: But as after that point, it's just it's just like
Speaker 1: talking through talking through the air. They just don't want
Speaker 1: anything to do with it. And and as someone who
Speaker 1: relies heavily on a password manager like it is, it's
Speaker 1: it's fundamentally one of the most important tools in my
Speaker 1: toolbox to make certain that I don't do rookie mistakes
Speaker 1: like using the same password for multiple accounts. Right because
Speaker 1: as as we'll discuss as we get into this discussion
Speaker 1: about safely browsing the Internet, one of the big dangers
Speaker 1: is that if you, through accident or or your tricked
Speaker 1: or whatever, if you somehow share your log in information
Speaker 1: for one service. Let's say that you have one service
Speaker 1: that isn't using uh secure encryption for some reason. First
Speaker 1: of all, don't do that, But if you are, if
Speaker 1: you're using that same password anywhere else, it's like you
Speaker 1: just handed a skeleton key to somebody, because now they
Speaker 1: can access everything you've used that password with. I mean,
Speaker 1: this is this is blatantly obvious. So that's why it's
Speaker 1: so important to have unique, strong passwords for all the
Speaker 1: different services you use. That way, if one if worst
Speaker 1: case scenario one gets compromised, it doesn't compromise everything else. Yes, absolutely,
Speaker 1: I'm glad you mentioned that because the more different things
Speaker 1: that you use that help your security and privacy, every
Speaker 1: single step you take absolutely helps. And that's just one
Speaker 1: of the many steps that you can take. Every single
Speaker 1: consumer in the world does not have to take all
Speaker 1: of these steps all at once, because that would be
Speaker 1: quite mind boggling. But if you do take steps towards
Speaker 1: these over time, you can increase your privacy and security
Speaker 1: two fold times fold. Yeah, it's fantastic. Yeah, I mean
Speaker 1: and and and to be fair, like like I'm going
Speaker 1: to be upfront guys, like I used to be the
Speaker 1: dude who had like three passwords and for everything. Yeah,
Speaker 1: I was like that for years until until I finally
Speaker 1: like woke up to how dangerous that was. I was
Speaker 1: fortunate in that I was never knowingly anyway targeted for
Speaker 1: a specific like intrusion. Uh, as far as I know,
Speaker 1: I never none of my stuff ever got compromised because
Speaker 1: of that. Stuff has been compromised because of data breaches
Speaker 1: that are beyond our control. But we're really focusing on
Speaker 1: the stuff that we as end users can do to
Speaker 1: improve our security as best we can knowing that we
Speaker 1: live in a world where that's just one point of vulnerability.
Speaker 1: That's one point of attack, but it's it's one that
Speaker 1: we have some control over another. Another scary statistic, or
Speaker 1: at least I thought it was scary, is that Kaspersky
Speaker 1: did a UH survey back in ten and are They
Speaker 1: did an analysis of thirty two million hot spots, hot
Speaker 1: spots being points of contact where your device connects over
Speaker 1: to the Internet at large, and a hot spot can
Speaker 1: be everything from the router in a like a coffee
Speaker 1: shop to your own cell phone you might be using
Speaker 1: that as a portable hot spot. Out of the thirty
Speaker 1: two million hot spots they examined, one quarter of them
Speaker 1: had no encryption in use at all, meaning everything is
Speaker 1: being sent in plain text, which means that if anyone
Speaker 1: has any method of eavesdropping on those communications, they see
Speaker 1: it all, which again blows my mind that there would
Speaker 1: be that many networks that have no encryption in place
Speaker 1: at all, not even bad encryption. Yeah, that's a very
Speaker 1: scary number. That's extremely high and is a lot higher
Speaker 1: than what I thought it would be. UH. If if
Speaker 1: they're not using any sort of encryption whatsoever, for a
Speaker 1: hot spot. That means that anybody within that vicinity, within
Speaker 1: range of that device would be able to see everything
Speaker 1: you're doing. It's very, very mind boggling, and this is
Speaker 1: one of the reasons why I wanted to have you
Speaker 1: on the show because we say these things, right, we
Speaker 1: say that when you use public WiFi, you're using if
Speaker 1: you're using an unsecured public WiFi hot spot, especially one
Speaker 1: that is unencrypted, that you are in danger of this.
Speaker 1: And a lot of people say, all right, but exactly
Speaker 1: what's going on? Right? How are they doing this? And
Speaker 1: it's that there are various pieces of software out there
Speaker 1: that allow people who are who get onto a network
Speaker 1: to monitor traffic that's going across that network. I mean,
Speaker 1: their entire groups out there that make different software and
Speaker 1: hardware uh solutions to do just this. Right. Yeah, not
Speaker 1: gonna lie. Um. I used to solder and sell some
Speaker 1: of these products at a company that I used to
Speaker 1: work with called hack five. So I'll definitely share some
Speaker 1: of that information once we get closer to those those
Speaker 1: topics with today's discussion. But yeah, those products exist, They're
Speaker 1: very inexpensive, and some of the software is free, and
Speaker 1: there's tutorials made by yours truly on YouTube that show
Speaker 1: you how to use these things. It's definitely a thing
Speaker 1: that pretty much anybody can introduce themselves to and then
Speaker 1: they will be able to see what's going on on
Speaker 1: a network. And there are different reasons to even do this.
Speaker 1: There's obviously there's the nefarious ones that were concerned about,
Speaker 1: but there's also like if you're a network administrator, being
Speaker 1: able to do things like monitor network traffic and see
Speaker 1: points of congestion education as well. Yeah, there's like there's
Speaker 1: there are legit reasons to use that sort of technology
Speaker 1: that don't that don't immediately point to to the to
Speaker 1: the road of I'm here to steal all your infos.
Speaker 1: It's like there's stuff that where this is used in
Speaker 1: quote unquote legitimate purposes. I mean like packet sniffers. That's
Speaker 1: something that sounds like it's underhanded and shady, but they
Speaker 1: were invented not to try and sniff out what's someone
Speaker 1: else was doing, but literally to help network administrators see
Speaker 1: how network how network traffic was moving across so that
Speaker 1: they could make sure that everything was working properly. So
Speaker 1: but it doesn't mean that you can't think a tool.
Speaker 1: A tool is either a tool or a weapon, depending
Speaker 1: upon how you want to use it. And so the
Speaker 1: same stuff that was used to help networks is also
Speaker 1: used to exploit them. Um, exactly, you could say the
Speaker 1: same thing about a kitchen knife. I mean kitchen knives
Speaker 1: to to you know, cut up fruits and veggies. Some
Speaker 1: nefarious people might use one to murder somebody part of me.
Speaker 1: But I used the exact same sort of analogy except
Speaker 1: when I was talking to someone earlier today. But it
Speaker 1: was a hammer. But same thing, Like a hammer is
Speaker 1: either something that you're using to to build stuff with
Speaker 1: or it could be used to bludgeon somebody. And it
Speaker 1: all comes down to it's not that the tool itself
Speaker 1: is bad, it's the intent and use of the person
Speaker 1: wielding that tool. And the same is true of technology.
Speaker 1: Uh So, one other stat that I wanted to mention
Speaker 1: that's pretty alarming. Norton found out this was in so
Speaker 1: it's a few years ago, but Americans had had their
Speaker 1: email hacked at some point, and that twelve percent had
Speaker 1: their financial data stolen while they were shopping online, and
Speaker 1: that in four million people globally had been a victim
Speaker 1: of some sort of cyber crime, and that kind of
Speaker 1: shows us the scale of why this is an important topic.
Speaker 1: It's not just because the opportunity is there, it's because
Speaker 1: people are actually actively taking advantage of those opportunities, and
Speaker 1: you could be the victim of one of those actions
Speaker 1: if you're not careful. And we love you absolutely, we
Speaker 1: do love you very much. I'm kind of I'm kind
Speaker 1: of thinking that all of those numbers have probably increased
Speaker 1: given that it's been about four years since they were
Speaker 1: they analyzed the data and had those those too sticks available,
Speaker 1: because in the past couple of years we've seen hacks
Speaker 1: go from a few hundred million people to almost a
Speaker 1: billion people get hacked online. So it's entirely possible that
Speaker 1: those numbers have increased quite a bit since, especially in
Speaker 1: the realm of the mobile app becoming king right, because
Speaker 1: there's there's such a proliferation of apps out there that
Speaker 1: either through a conscious effort, are creating vulnerabilities or because
Speaker 1: of poor design, create vulnerabilities that can later be exploited.
Speaker 1: You know, we've seen so many examples of that where
Speaker 1: an a p I didn't take everything into account and
Speaker 1: then someone was able to exploit it, famous one being
Speaker 1: Facebook and Cambridge Analytica, where you had an app that
Speaker 1: if you installed the app, like you would voluntarily install
Speaker 1: it within your Facebook and you're voluntary lee sharing your
Speaker 1: own information. All of that is fine, right if you've
Speaker 1: agreed to do it such a good not a good idea,
Speaker 1: such a good example, good example, Yeah, good example, not
Speaker 1: a good idea to do. But it's fine if you
Speaker 1: if you are knowingly doing that, that's fine. But the
Speaker 1: problem that the Cambradge Analytica story brought to bears that
Speaker 1: they took advantage of a loophole in Facebook's API and
Speaker 1: they were able to to phish out a ton of
Speaker 1: information about all the contacts of the people who had
Speaker 1: installed the app. These are people who did not, uh,
Speaker 1: you know, give permission to share their information, but the
Speaker 1: app collected all that information regardless. And that's where we see, like,
Speaker 1: you know, there were countless victims of this app because
Speaker 1: none of them opted in to share that information. It
Speaker 1: was just taken from them. And uh, that's just one
Speaker 1: little example of the world we live in where you know,
Speaker 1: even when you are being careful, there are there are
Speaker 1: these opportunities for your information to get out there, which
Speaker 1: is why we're like this is why you need to
Speaker 1: take the steps necessary to protect yourself as best you can,
Speaker 1: because we live in a world where there are numerous
Speaker 1: attack vectors that point back to us. All right, I
Speaker 1: mean just mid December, the New York Times discussed location
Speaker 1: tracking on phones and how ping pings to local towers
Speaker 1: can basically give you a map of a certain phone
Speaker 1: I D and you can track that and figure out
Speaker 1: who that phone belongs to based on what residents and
Speaker 1: what office they go to every day. It's extremely scary,
Speaker 1: and the more information we have about it as consumers,
Speaker 1: the better we can protect ourselves. Yeah, and again, like, uh,
Speaker 1: back to what you were just saying, Shannon, Facebook send
Speaker 1: a letter to Congress just a couple of days before
Speaker 1: we record this episode where they said, yeah, even if
Speaker 1: you opted out of location tracking, we actually know where
Speaker 1: you are, partly because of the information people are voluntarily sharing.
Speaker 1: Like if I tag If I take a photo while
Speaker 1: I'm at a party and I tagged the location and
Speaker 1: I tag people are in the photo, well, I'm voluntarily
Speaker 1: sharing a lot of information. Maybe those people haven't given
Speaker 1: me permission to do that, but I'm I'm sharing the information.
Speaker 1: So yeah, of course, Facebook knows where I am, when
Speaker 1: I when I'm there, and who I'm with because I
Speaker 1: shared the information. But they also admitted, yeah, we also
Speaker 1: use a lot of other methods where we can suss
Speaker 1: out where you were and who you were with at
Speaker 1: what time that aren't as obvious and aren't examples of
Speaker 1: the user voluntarily handing over information. So yeah, scary stuff. Um.
Speaker 1: One of the things I wanted to mention is sort
Speaker 1: of the bird's eye view of the process of what
Speaker 1: it's like just connecting to WiFi, so we can kind
Speaker 1: of understand, uh, you know, what's going on, because I
Speaker 1: think a lot of people if they think that if
Speaker 1: they see that, for example, that there's a WiFi hotspot
Speaker 1: that requires a password, they immediately think that that is
Speaker 1: inherently more secure here than a public WiFi spot that
Speaker 1: has no password, which is not necessarily true. Um. So
Speaker 1: connecting to WiFi is really you can think of it
Speaker 1: as a series of handshakes between whatever device you're using
Speaker 1: and the hot spot, whether it's a router or something else.
Speaker 1: And this series of handshakes is not meant to secure
Speaker 1: the data. It's not meant to encrypt a channel necessarily,
Speaker 1: it's not meant to protect it. What's meant to do
Speaker 1: is to identify the device and the hot spot so
Speaker 1: that they know where the data needs to go. Right. Otherwise,
Speaker 1: if if we all connected to a public WiFi hot
Speaker 1: spot and there wasn't this handshake thing going on, it
Speaker 1: would be as if we were all listening to an
Speaker 1: open broadcast of everything all at once, and it would
Speaker 1: just be meaningless garbage and we would just get we
Speaker 1: would just get everyone's data simultaneously, and we're like, I
Speaker 1: don't even I don't know what this we could I
Speaker 1: don't think it would go well. But so this was
Speaker 1: this was literally the solution into that problem. Like, you know,
Speaker 1: if you're using wired connections, that's one thing, right, you
Speaker 1: can wire things to specific ports, you have physical hardware.
Speaker 1: When you go wireless, you have to create a virtual
Speaker 1: version of that. That's sort of what the handshake processes for.
Speaker 1: It's saying, hey, there's this device that wants to connect
Speaker 1: to the network. The network says, okay, I'm giving you permission.
Speaker 1: The device is okay, this is who I am, and
Speaker 1: the network devices all right, I I see who you are,
Speaker 1: and now we can send information back and forth. You
Speaker 1: can send requests out to the internet. I'll go out
Speaker 1: and grab whatever it is you wanted, and I'll return
Speaker 1: it just to you. That's the idea. That's actually a
Speaker 1: great explanation without using any of the terminology. So I
Speaker 1: thank you for the doing that. Yeah, I tried. I tried.
Speaker 1: At one point I had a spoiler alert or well
Speaker 1: not even spoiler, look behind the curtain, folks. I had
Speaker 1: originally started this episode as a solo show, and that's
Speaker 1: when it struck me that it would be way easier
Speaker 1: if I brought Shannon on, because she's much smarter than
Speaker 1: I am. And so as I was doing it, I
Speaker 1: was trying to describe this process, and I think I
Speaker 1: went through two or three drafts when I said, you
Speaker 1: know what, I can just step back and not get
Speaker 1: so technical, because the technical parts aren't really what's important.
Speaker 1: What's important is just sort of understanding the concept of
Speaker 1: the process and why it is not inherently tied to
Speaker 1: security and privacy. It's inherently tied to just what does
Speaker 1: it take so that you can have these two devices
Speaker 1: communicate with one another and not have them confused with
Speaker 1: all the other devices that hook into the same network.
Speaker 1: And once I figured that out, was like, I'm going
Speaker 1: to go with that because I'm tired of trying to
Speaker 1: figure out how to explain this handshake process. Um, it
Speaker 1: totally works. I mean I like the handshake terminology because
Speaker 1: it is kind of like that, like in person, whenever
Speaker 1: you meet somebody, you acknowledge each other, you shake each
Speaker 1: other's hands, you kind of authenticate each other by name
Speaker 1: and by face. And that's very similar to what a
Speaker 1: router does with a device like your smartphone or a laptop.
Speaker 1: It's basically doing the same thing where you're you're looking
Speaker 1: for somebody to introduce yourself to. You go in, you
Speaker 1: acknowledge each other, you shake hands with each other, you
Speaker 1: kind of authenticate each other by name, and then you
Speaker 1: have that connection. Yeah, and you have that connection forever
Speaker 1: until you break it off. Yes, And if if you're
Speaker 1: at c S, it probably also requires you to hand
Speaker 1: over a business card because that's like, yeah, most likely
Speaker 1: that's that's the current I guess that would be your password, right, yeah,
Speaker 1: I guess so yeah. All right, Well when we come back,
Speaker 1: we're going to talk about the how how information is
Speaker 1: sent through packets, just so that we can understand why
Speaker 1: did that packet sniffing thing mean earlier. But first let's
Speaker 1: take a quick break to thank our sponsor Shannon and
Speaker 1: I have a lot more to say about the dangers
Speaker 1: of public WiFi, but first let's take a quick break.
Speaker 1: All right, then we're back. So I promised that we
Speaker 1: were going to talk about pack it's packets is pretty
Speaker 1: simple concept. So a packet switching network. You've probably heard
Speaker 1: that term before, uh the Internet. When the pioneers of
Speaker 1: the Internet were sort of designing this thing, they thought, well,
Speaker 1: how do we make it so that information can be
Speaker 1: sent from one computer to another in such a way
Speaker 1: that if something happens, the information can continue to make
Speaker 1: its way to its destination even if there's some sort
Speaker 1: of interruption. And if it were just an uninterrupted string
Speaker 1: of data and there was an interruption, then you would
Speaker 1: have a corrupt file or you know, things would not
Speaker 1: work right. You wouldn't get what you were wanting. So
Speaker 1: they said, what if we bundled data into uh certain sizes,
Speaker 1: We'll call it packets. The packets will have information on
Speaker 1: them that will tell the data where it needs to go,
Speaker 1: where it came from, and how it fits within all
Speaker 1: the other packets. To make whatever the thing is. And
Speaker 1: since we're talking about the Internet, let's be honest, chances
Speaker 1: are it's a picture of a cat. So that cat
Speaker 1: picture is going to be a lot of different data packets,
Speaker 1: and they have to put the packets together kind of
Speaker 1: like a puzzle in order to recreate that image of
Speaker 1: a cat. So that's that's what a packet is. Well,
Speaker 1: the packet because it has that information on it about
Speaker 1: where it's going and where it's from. That's what we
Speaker 1: would call metadata, right, It's the data about the data,
Speaker 1: or it's data that somehow describes the data that's inside.
Speaker 1: And um and I always always try and say that
Speaker 1: the packets on the other side get reassembled Willy Wonka
Speaker 1: style like Mike TV when he goes across the camera. Um.
Speaker 1: I like that. Yeah, I mean it's a it's a
Speaker 1: nice way of putting it, especially since I mean that's
Speaker 1: one of my favorite films of all time, the Gene
Speaker 1: Wilder version of the Not the not the Johnny version yet.
Speaker 1: So that's where we get the words for packets. So
Speaker 1: a packet sniffer, as we mentioned earlier, can be software,
Speaker 1: it can be hardware, it can be a combination of
Speaker 1: the two. That is meant to sort of check out
Speaker 1: the packets that are being sent across a network UH
Speaker 1: and get an idea of what's going on there. And
Speaker 1: one of the things someone can do if they have
Speaker 1: a packet sniffer and they know how to do it,
Speaker 1: is they can look for packets that represent essentially an
Speaker 1: unencrypted cookie or a session key, And this is essentially
Speaker 1: where a user has sent a request to log into
Speaker 1: a service of some sort UH and if the hacker
Speaker 1: is able to sniff out that cookie, they might be
Speaker 1: able to step in and pose as that user and
Speaker 1: thus get access to the user's account or services UM.
Speaker 1: And this is sometimes referred to as side jacking. I
Speaker 1: learned a lot of hacker slang while I was doing
Speaker 1: the research. This. I'm so proud of you. I'm not
Speaker 1: good at using it, but I learned it. It's okay.
Speaker 1: You could go to def Con next year and totally fitting. Yeah,
Speaker 1: except I would be like, all right, well, I'm gonna
Speaker 1: leave all of my devices at home. Another great idea
Speaker 1: def con for those who do not know is a
Speaker 1: information security and hacking convention where if you aren't careful,
Speaker 1: they will let you know about it. Oh yeah, they do.
Speaker 1: Usually they're nice about it, and you just end up
Speaker 1: on this thing called the wall of shame. But luckily
Speaker 1: generally people don't nefariously hack each other there. It's just
Speaker 1: kind of to pop your name up on a wall
Speaker 1: of shame and that's about it. Yeah, essentially, essentially they're saying, hey,
Speaker 1: you need to have a heads up, like whatever you're
Speaker 1: doing is not sufficient. Yeah, it's it's really more like
Speaker 1: it's really more like saying like, listen, we want you
Speaker 1: to be safe, and right now you're not being safe.
Speaker 1: So but but yeah, but still there's also the shame factor.
Speaker 1: And the more the more known you are in the sphere,
Speaker 1: I imagine, the greater the shame would be to appear
Speaker 1: on that wall. Oh yeah, definitely. So this was never
Speaker 1: been on the wall of shame, and I hope I
Speaker 1: never congratulations. Yeah, I've never been on the wall of
Speaker 1: shame either, but that's because I haven't gone. I am
Speaker 1: certain I would end up doing something bone headed and
Speaker 1: mess up. So you were talking earlier about how you
Speaker 1: have actually actively worked on technologies that do this this
Speaker 1: packet sniffing uh approach. Yes, yes, I have. I used
Speaker 1: to work at a company called Hack five. I still
Speaker 1: do shows on that channel, j K five, and our
Speaker 1: our premise for that channel is educating people who are
Speaker 1: interested in security and privacy and might want to go
Speaker 1: into information technology or penetration testing or infosec info security
Speaker 1: as a profession. So we teach young hackers how to
Speaker 1: legally use their talents to actually get a job that
Speaker 1: will help them spur the economy, help them protect companies,
Speaker 1: h and help them really get involved with their passion. Um. So,
Speaker 1: one of the products that we created is something called
Speaker 1: called the WiFi Pineapple. It's a little hardware device. It's
Speaker 1: basically a round outer, but the software that's built into
Speaker 1: the WiFi Pineapple allows us to do things like get
Speaker 1: people to connect to a WiFi Pineapple as opposed to
Speaker 1: a regular router and allow us to sniff packets just
Speaker 1: like you were saying. Um. The the product has been
Speaker 1: around for half a decade at this point. No, actually
Speaker 1: it's been almost a decade. Wow, I can't believe it's
Speaker 1: been so long. But we've gone through various revisions of it,
Speaker 1: and as security has gotten stronger, there's always been new
Speaker 1: vulnerabilities available in wireless network technology, so we've always been
Speaker 1: able to update the WiFi Pineapple to continue to educate
Speaker 1: people why it's still a good idea to not connect
Speaker 1: to public WiFi or open hotspots. And uh, it's been
Speaker 1: a wonderful education tool since we can use it as
Speaker 1: this kind of man in the middle attack for for
Speaker 1: you know, helping people understand and I mean, like the
Speaker 1: thing that I see people sometimes and I know you've
Speaker 1: seen it sometimes protests they're like, why are you making
Speaker 1: this thing? And the argument I would make to them,
Speaker 1: and I'm sure it's an argument that you guys have
Speaker 1: made numerous times, is you know that people who have
Speaker 1: bad intentions are making stuff like this already. They're they're
Speaker 1: they're doing it all the time. They're doing and they're
Speaker 1: not talking about it. They're not upfront about it because
Speaker 1: they want to take advantage of it. The reason why
Speaker 1: you guys do it is to raise awareness, to teach
Speaker 1: people how it works, and presumably they can then take
Speaker 1: that knowledge and better protect whatever their future clients might
Speaker 1: be if they end up working as a white hat hacker.
Speaker 1: And yeah, straight up, people have made their own WiFi
Speaker 1: pineapples using you know, different types of hardware and different
Speaker 1: kind of software that they've made their own, but our
Speaker 1: our products are well. Hack fives products are listed in MIST,
Speaker 1: which is the National Institute of Standards and Technologies as
Speaker 1: a wireless penetration testing device. So a lot of companies
Speaker 1: see it as a professional tool and they get their
Speaker 1: employees to purchase these items to use and make sure
Speaker 1: that their networks are protected. Because as much as you
Speaker 1: could use a WiFi Pineapple to hack somebody, you can
Speaker 1: also use it to protect yourself because you're still doing
Speaker 1: the same kind of tracking on your known network. So
Speaker 1: if I had a WiFi Pineapple on a company's network
Speaker 1: that I'm legally have access to as since that's my profession,
Speaker 1: for example, hypothetically, uh, then I could see what employees
Speaker 1: are doing on that network. So if somebody is visiting
Speaker 1: Facebook when they shouldn't be, I could see that and
Speaker 1: I could tell them, hey, you need to, you know,
Speaker 1: cut that off or you're going to get written up.
Speaker 1: Or if there was an attacker trying to gain access
Speaker 1: to a wireless network, I would be able to see
Speaker 1: those packets because they would not be what I normally see,
Speaker 1: and I would be able to protect my network because
Speaker 1: I could blacklist them then, So there's so many different
Speaker 1: ways that you can use these tools, not just nefariously
Speaker 1: like you had mentioned, but in like these amazing ways
Speaker 1: that help protect so much more than just companies but
Speaker 1: also the employees that are working there as well. Yeah. Yeah,
Speaker 1: and that. And I've always been the type to say,
Speaker 1: if if someone's outwardly talking about what their technology can do,
Speaker 1: then those are the people you should trust. It's the
Speaker 1: ones who aren't talking that you have to worry about.
Speaker 1: So yeah, it's the same thing for me when people
Speaker 1: are talking about security vulnerabilities that they found in systems,
Speaker 1: where they might come forward and say, yeah, I reported
Speaker 1: this like three months ago, the company still hasn't done
Speaker 1: anything about it. The only reason I'm coming forward is
Speaker 1: because that puts the pressure on the company to definitely
Speaker 1: make a change, because that vulnerability exists, whether they talk
Speaker 1: about it or not. Now they have to do something
Speaker 1: because the public knows about it, and and they're I'm
Speaker 1: I'm fully on board with that too. I mean, I
Speaker 1: think that you always give the entity the chance to
Speaker 1: address it, but if they haven't shown any movement towards that,
Speaker 1: I think it's the responsibility of someone who's found a
Speaker 1: vulnerability to come forward with it, because otherwise it's just
Speaker 1: it's just a ticking time bomb. Someone's going to take
Speaker 1: advantage of it, and then it becomes a problem far
Speaker 1: bigger than coming forward and saying, hey, guys, need to
Speaker 1: fix your stuff. And it's it's not just you know,
Speaker 1: devices like the WiFi Pineapple, but as we had mentioned,
Speaker 1: it's also software that's involved too that can do very
Speaker 1: similar type of tracking on networks. There's a technology called
Speaker 1: wire Shark, which I'll bring up not just because you know,
Speaker 1: I have no financial responsibility via hack five. So like
Speaker 1: if if you know, somebody purchases a WiFi Pineapple when
Speaker 1: they hear this talk, I don't get anything from that,
Speaker 1: no compensation whatsoever. I just do a show on that channel,
Speaker 1: So don't worry. I'm not. I don't get referrals or anything.
Speaker 1: But there's also software like wire shark, which is a
Speaker 1: free service online that anybody can download and that allows
Speaker 1: you to do packets niffing. I've used it to test
Speaker 1: my own home network and make sure that my smart
Speaker 1: coot devices are secure and they're encrypted, and that has luckily, luckily,
Speaker 1: all of my devices are you know, totally secure, which
Speaker 1: is wonderful. But back in the day when I first
Speaker 1: started using wire shark, I discovered that when I was
Speaker 1: using Instagram on my phone, I could see links to
Speaker 1: the pictures that I was liking as I liked them,
Speaker 1: So as I gave them the little hearts, uh, it
Speaker 1: would pull up a little HTTP link and I could
Speaker 1: click on that through wire Shark, and I could see
Speaker 1: exactly which pictures I was liking, which was so creepy.
Speaker 1: I mean, definitely something that you should be aware of
Speaker 1: is what kind of data is being passed through with
Speaker 1: no encryption whatsoever, and what kind of data is being
Speaker 1: encrypted too. Yeah, totally, and you means crazy. You mentioned
Speaker 1: the man in the middle attack. That's that's kind of
Speaker 1: another step up, where you have a hacker that sets
Speaker 1: their machine in between a user and some other computer
Speaker 1: that might be a router. So you might actually have
Speaker 1: a man in the middle of attack where someone say
Speaker 1: at the coffee shop, and they set up uh their
Speaker 1: computer so that it appears to be the coffee shops network.
Speaker 1: There's actually ways where you can force a reboot of
Speaker 1: a system and then pose as that system so that
Speaker 1: when it does reboot, you are effectively a middleman. In
Speaker 1: that relationship, and meanwhile you see all the stuff that
Speaker 1: goes across that because your computer is acting as the
Speaker 1: network spot for where where everybody's connecting through. Uh So
Speaker 1: that's that's one way, But there's also ways of doing
Speaker 1: a man in the middle of attack between a like
Speaker 1: a client and an actual service, like you know, directing
Speaker 1: people to fake bank log in pages and things of
Speaker 1: that nature. UM So those are things you also have
Speaker 1: to be aware of. Although that can happen pretty much
Speaker 1: in every scenario we're going to talk about. That requires
Speaker 1: you to pay close attention to what you are doing
Speaker 1: as you're browsing. Um And I mentioned earlier about the
Speaker 1: idea that if you are using public WiFi that is
Speaker 1: password protected, Let's say you're at a coffee shop where yeah,
Speaker 1: you can log into their their WiFi, but you have
Speaker 1: to first go up to the cash register and find
Speaker 1: out what the password is, and then you find that
Speaker 1: out and you log in. Some people feel like that
Speaker 1: gives them that extra area of security. Honestly, that doesn't
Speaker 1: because there's nothing stopping a hacker going into that same
Speaker 1: coffee shop getting that same password and like that. It
Speaker 1: doesn't add any like by itself. It doesn't add any
Speaker 1: extra security. It just is one extra little step. Yeah,
Speaker 1: it's true. Uh yeah, anybody even in the vicinity, if
Speaker 1: they've ever had access to that wireless password and the
Speaker 1: coffee shop, for example, has never changed the password, like
Speaker 1: they could easily get access again with a long range
Speaker 1: antenna on the other side of a parking lot and
Speaker 1: be able to sniff what everybody in that coffee shop
Speaker 1: is doing. So yeah, I don't even use coffee shop
Speaker 1: WiFi or airport WiFi if we want to use that example,
Speaker 1: those even trustworthy exactly, and I think that those are
Speaker 1: perfect examples, especially as people are traveling a lot for
Speaker 1: the holidays. Like that's where I think of seeing people
Speaker 1: whipping out their computers the most is airports and coffee shops.
Speaker 1: That's it. Um. But yeah, if you have an encrypted network,
Speaker 1: that's better. It's again like this is another step where
Speaker 1: we're getting into uh more secure area. And we'll talk
Speaker 1: about different types of encryption in a second, but before
Speaker 1: we get to that, there's actually also a difference in
Speaker 1: the types of browsers, right. Different browsers offer different levels
Speaker 1: of features that either uh enable security and privacy or
Speaker 1: they make it really difficult to protect, so on the
Speaker 1: bad end of the scale as an Internet explorer for
Speaker 1: multiple reasons. It was never the best browser when it
Speaker 1: comes to security and privacy, but it's really not great
Speaker 1: now because Microsoft no longer actively supports it. UM. They
Speaker 1: will push out a security update on occasion, but it's
Speaker 1: not frequent, which means that there are a lot more
Speaker 1: opportunities for people to discover and exploit vulnerabilities and and
Speaker 1: be fairly sure that those vulnerabilities will stick around for
Speaker 1: a while. So it's not even like a rush because
Speaker 1: Microsoft isn't updating it that frequently with security patches, So
Speaker 1: that's a bad one. Don't use it. Microsoft Microsoft Edge
Speaker 1: only slightly better than the completely unsupported Internet Explorer UM,
Speaker 1: at least as far as privacy is concerned. Uh. I
Speaker 1: use Google Chrome a lot, but admittedly Google Chrome not
Speaker 1: great either. It's kind of on the bottom half off
Speaker 1: of the middle of the pack. So uh, they're better
Speaker 1: about security, but they are the pets when it comes
Speaker 1: to privacy. Also not a big surprise, because I mean,
Speaker 1: what's Google's business, right? Google owns you? Yeah, your data
Speaker 1: is Google's That's what Google buys and sells. Like it's
Speaker 1: your information. That's that's Google's currency. So clearly it does
Speaker 1: not behoove Google too lockdown privacy super tight. They want
Speaker 1: to know all the information about you they make that's
Speaker 1: how they make their money. UM. So, of all the
Speaker 1: common browsers, like the ones that are frequently used out there,
Speaker 1: the one that UH that tends to rank the highest
Speaker 1: is Firefox, higher than Opera, higher than Chrome, higher than Safari. UM.
Speaker 1: So it does really well, especially for security and privacy.
Speaker 1: It can support a lot of features that protect you
Speaker 1: when you're when you're surfing stuff that will end up
Speaker 1: cutting down on things like targeted advertise because you can
Speaker 1: really limit the information that's being shared by the sites
Speaker 1: that you're visiting. UM And you can also enhance it
Speaker 1: with various add ons that you can find, although obviously
Speaker 1: anytime you're going to be adding anything to an existing program,
Speaker 1: it pays to do your research to make sure that
Speaker 1: it is offered by a reputable and dependable app developer. Yeah,
Speaker 1: Firefox is an excellent choice UH and two fold. If
Speaker 1: you download something like Firefox, you also get a very
Speaker 1: fast browser because they have worked very hard to make
Speaker 1: that browser quick. So even if you don't care about
Speaker 1: the security and you just want to access your sites
Speaker 1: really fast, you should use Firefox. Yeah, yeah, I got Firefox.
Speaker 1: I got stuck on Chrome because for a while Chrome
Speaker 1: was super fast and then it got super bloated. And
Speaker 1: also there's the more tabs you have opening Chrome. Anyone
Speaker 1: who's done this with Chrome knows. Even though it are
Speaker 1: all supposed to be distinct instances that don't bleed over
Speaker 1: into each other, Uh, there gets to be some memory
Speaker 1: issues if you happen to be really a heavy user,
Speaker 1: and everyone here at this company is a heavy user.
Speaker 1: So uh, Firefox is definitely going to be my browser
Speaker 1: of choice moving forward after I did this research. I also,
Speaker 1: I should point out, before I did this research, I
Speaker 1: did not know this. I was just a happy, blithe,
Speaker 1: naive Chrome user handing handing over reams of personal data
Speaker 1: to Google, which I mean, granted, I'm sure that company's
Speaker 1: board with me by now, but still there's some value
Speaker 1: there um. And then that brings us to encryption. And
Speaker 1: this encryption it gets this is sort of like complicated,
Speaker 1: like the handshake thing, but encryption, when you boil it down,
Speaker 1: is all about scrambling messages so that the only people
Speaker 1: who can access it are the ones who have the
Speaker 1: key to decode it, right, So you have the key
Speaker 1: to encode and the key to decode. There are various
Speaker 1: implementations of that technology, different ways to have the public
Speaker 1: key and private key operations. I don't need to get
Speaker 1: into all of that because it gets way too technical. Obviously,
Speaker 1: encrypted is better than unencrypted, but not all encryption schemes
Speaker 1: are created equal, and it pays which ones are in use.
Speaker 1: So yes, that's very true. There's there's even like there's
Speaker 1: symmetrical keys and asymmetrical keys, and then there's like SHAW
Speaker 1: one and be crypt and r s A. There's all
Speaker 1: these different terminologies for encryption. But for what it's worth,
Speaker 1: all of them jumble up your information into some kind
Speaker 1: of format that will hopefully hopefully encrypted, so that anybody
Speaker 1: who does gain access to the encrypted version of your
Speaker 1: information will not be able to reverse engineer it or
Speaker 1: change it back to its original plain text formats, so
Speaker 1: they can't read it in like English speak, right, it
Speaker 1: would just be mean less garbage to them, hopefully in
Speaker 1: its ideal, ideal implementation. So one of the things that
Speaker 1: you may have encountered if you've ever set up any
Speaker 1: sort of wireless network. I think most people have, or
Speaker 1: at least they've they've had to connect to one where
Speaker 1: they've seen the different types of UH network security protocols.
Speaker 1: These are certifications that the WiFi Security Alliance creates, and
Speaker 1: the earliest one was the Wired Equivalent Privacy Protocol or
Speaker 1: w e p H. That one is decrepit, it's old,
Speaker 1: it's vulnerable as heck, so don't use it. Yeah, if
Speaker 1: you have the if if your router tells you, like
Speaker 1: asks you which one you want to use, don't use
Speaker 1: w ep UM. It is not secure. It is it's
Speaker 1: I mean, you could argue it's better than nothing, but
Speaker 1: not by much because the vulnerabilities have been known for
Speaker 1: a long time. In fact, so long that even before
Speaker 1: the nineties were up, you had people developing the next generation,
Speaker 1: which would have been the WiFi Protected Access or w
Speaker 1: p A. So w p A came out. Then you
Speaker 1: get w p A two, which was trying to address
Speaker 1: some of the shortcomings of w p A UH. Both
Speaker 1: of those also still have vulnerabilities. W p A two
Speaker 1: is generally talked about as being one of the more
Speaker 1: secure UH certifications these days. There is a w p
Speaker 1: A three also has vulnerabilities that have pointed out within
Speaker 1: the year of coming out. Yeah so, but w P I,
Speaker 1: I don't think I've even seen a lot of stuff
Speaker 1: that's certified w P A three yet. Like we've we've
Speaker 1: started to see some wireless routers come out with w
Speaker 1: P A three, but they there's still a little expensive
Speaker 1: and they haven't really gotten widespread adoption by consumers quite yet.
Speaker 1: So w P A two is fine for most consumers
Speaker 1: to use. Uh, you just have to make sure that
Speaker 1: you set it up correctly and you don't give the
Speaker 1: entire world access to your password for your account. Yeah that,
Speaker 1: because then there's what what were you even thinking? There's
Speaker 1: no point then? Yeah. So, so w P A three
Speaker 1: on w P A two. All these are our designations.
Speaker 1: And what happens is a manufacturer will make a piece
Speaker 1: of equipment or uh either it's a computer or handset
Speaker 1: or maybe it's a router, and then they submit it
Speaker 1: to this WiFi Security alliance that then makes sure that
Speaker 1: that technology meets whatever the requirements are for the particular designation.
Speaker 1: Then they put the stamp on it and they say, yes,
Speaker 1: this is w P A two compliant or w P
Speaker 1: A three compliant. So that just tells you that compliance
Speaker 1: really there. It gets more granular than that. For example,
Speaker 1: w P A two has two different types of encryption
Speaker 1: standards that can be used. There's the bad one. It's
Speaker 1: Temporal key Integrity Protocol or t k I P, and
Speaker 1: I call it bad because yeah, t KIP. T KIP
Speaker 1: is no longer safe, skip the tea KIP. If you
Speaker 1: skip the tea KIP, I like that. Yeah, it's nice
Speaker 1: mnemonic device. And then there's Advanced Encryption Standard or a
Speaker 1: e S, and that's the more secure of the two.
Speaker 1: So don't rely on tea KIP, rely on a S uh.
Speaker 1: So that will end up protecting you quite a bit
Speaker 1: as well. The encryption will end up helping a great
Speaker 1: deal because you've just made it more difficult for someone
Speaker 1: to get anything meaningful from your browsing activity. It does
Speaker 1: not mean that you are immune. But again, the harder
Speaker 1: you make it for somebody, the less chance they're gonna
Speaker 1: put forth the effort to break through whatever protections you
Speaker 1: put up. So just general note um, and then that
Speaker 1: also brings us to secure browsing. So back in the day,
Speaker 1: which was the Thursday, I don't know if you know
Speaker 1: that UH, there was the the Secure Sockets Layer SSL,
Speaker 1: whenever you went to a website that had the little
Speaker 1: padlock and the lock on it and the HTTPS like
Speaker 1: the original version of that was SSL. In fact, a
Speaker 1: lot of people still refer to SSL, even though that
Speaker 1: technically has been and has before a while been replaced
Speaker 1: by the Transport Layer Security or TLS. But the same
Speaker 1: sort of purpose it's too. It's meant to create the
Speaker 1: secure channel of communication between you and a specific UH
Speaker 1: website U r L address. So if you see HTTPS
Speaker 1: or you see that little locked padlock in the address
Speaker 1: bar of your browser, then you know you are in
Speaker 1: a secure channel between you know, your your device and
Speaker 1: that browser, at least as far as information going between
Speaker 1: those two points are. I mean, obviously, if you're on
Speaker 1: a public WiFi hotspot that's unsecured, you've got other issues.
Speaker 1: But it means that when you're browsing, you want to
Speaker 1: make sure that that HTTPS is showing up. You don't
Speaker 1: you don't want the h T t P, you you
Speaker 1: want to make sure that S is there. So one
Speaker 1: thing I've noticed very rarely, but it has happened on occasion,
Speaker 1: is where a website that requires you to log in
Speaker 1: somewhere like their main page there dot com address will
Speaker 1: be encrypted with HTTPS, but as soon as you go
Speaker 1: over to the log in page or go through any
Speaker 1: tree of different sites that they have created on their
Speaker 1: dot com domain, all the rest of their pages are
Speaker 1: h T T P. They are unencrypted. So if you
Speaker 1: go to the log in page and my cat agrees
Speaker 1: she's mewing behind me, uh, and you put in your
Speaker 1: user name and password, those would be copied through plain text,
Speaker 1: and if anybody was, you know, tracking or sniffing your packets,
Speaker 1: they would be able to see that plane text user
Speaker 1: name and passwords. So, for example, if my password was
Speaker 1: my cat's name is Starbuck, and that was a plain text,
Speaker 1: unencrypted website just using HTTP, then if somebody was sniffing
Speaker 1: those packets, they could see that passwords show up in
Speaker 1: their software through whatever hardware device they might be using,
Speaker 1: and just be able to see, oh, she entered Starbuck,
Speaker 1: and then they couldn't go to the website type that
Speaker 1: in and gain access to my login account information. Yeah,
Speaker 1: and that is what we call no bueno, right like yeah, yeah,
Speaker 1: And more and more sites are getting better about making
Speaker 1: certain that their entire presence they are is being secure,
Speaker 1: but you can. It's actually harder and harder to find
Speaker 1: examples websites doing that, so which I'm happy to see
Speaker 1: because that makes my job harder and that means people
Speaker 1: are listening. Uh So, I am happy to see that
Speaker 1: less sites are doing that, but we still have issues.
Speaker 1: There's still some out there. And then occasionally you have
Speaker 1: browsers that will alert you if you try to navigate
Speaker 1: to a site that is not secure. It'll give you
Speaker 1: a little alert, which is good too, because you know
Speaker 1: if the people on the website aren't being diligent and
Speaker 1: at gives the user on the other end the heads
Speaker 1: up of hey, you probably thought this was secure, but
Speaker 1: turns out it's not. Maybe you want to rethink that.
Speaker 1: Are you sure you want to go ahead? You will
Speaker 1: probably be eaten by a group, and then you decide
Speaker 1: what you can do it. Um Now, when we come back,
Speaker 1: we're gonna talk about one other topic before we get
Speaker 1: into like the super secret stuff, and that is what
Speaker 1: the heck is incognito mode for. But before we do that,
Speaker 1: let's take another quick break. We've got some more discussion
Speaker 1: about public WiFi and the steps you should take to
Speaker 1: protect yourself But before we get to that, let's take
Speaker 1: another break. So Shannon, I have I've gone to a
Speaker 1: private network, right, I'm it's not maybe mine, but it's
Speaker 1: a private once, not open to the public, it's encrypted,
Speaker 1: it's password access. I've done all those wonderful things. And
Speaker 1: then I think, you know what, I'm gonna look at
Speaker 1: some so like your friend's house or something. Yeah, yeah, yeah,
Speaker 1: And uh, I decided, you know what I want to do.
Speaker 1: I wanna I'm gonna look at some I'm gonna look
Speaker 1: at some some stuff that I don't think my friends
Speaker 1: would really understand. Maybe maybe I'm gonna look into that
Speaker 1: that my little pony fan fiction. Uh, and I don't
Speaker 1: want my friends to know about it. So I'm like, well,
Speaker 1: I'm gonna be super sneaky. I'm gonna go into incognito mode.
Speaker 1: Now no one's ever done to know. So I click
Speaker 1: on that little incognito mode and little bitty shadow Man
Speaker 1: pops up, and I'm like, oh yeah, I'm totally safe
Speaker 1: and totally secret. Nobody knows it's me. And I start
Speaker 1: looking at my brony fan fiction. Oh you know the term. Hey, look,
Speaker 1: I wouldn't listen listen, you just give yourself away. Listen,
Speaker 1: Princess Celestia and I have an understanding. Okay, so we
Speaker 1: are not gonna go down that road. We're not gonna
Speaker 1: go there. Like yeah, Fluttershy and I we're like, we're tight,
Speaker 1: so we're not. It's fine, Okay, it's acceptable behavior. But no,
Speaker 1: it is acceptable, but I don't want my friend to
Speaker 1: know that. Now here's the sad thing folks told everybody
Speaker 1: on the podcast. One one, whoops, I guess I should
Speaker 1: be more secure with my data. And secondly, secondly, incognito mode,
Speaker 1: that's not how that works. It doesn't protect you from
Speaker 1: anyone who has any access to the network from seeing
Speaker 1: what you're doing, right right, that's correct. Um. Yeah, so
Speaker 1: incognito mode. Uh, you you've probably seen it on your
Speaker 1: own computer. If you go up into the menu for
Speaker 1: your regular browser and go into like the dropdown menu,
Speaker 1: there's usually an option to choose incognito mode or like
Speaker 1: secret mode or something like private browsing or whatever. Yeah,
Speaker 1: private browsing, Yeah, that's another one. Uh So if you
Speaker 1: click that, it opens up a completely different window on
Speaker 1: your computer or on your phone as well. You can
Speaker 1: do it on your phone. Uh, and you start to browse.
Speaker 1: But basically the only thing that incognito mode is really
Speaker 1: doing is uh not putting anything into your local history
Speaker 1: for your your web browsing history, so if somebody else
Speaker 1: got it on your computer, they would not know what
Speaker 1: you were doing in incognito mode. Uh. And it also
Speaker 1: doesn't store the cookies on your computer, so any information
Speaker 1: that you were sharing with a website during your incognito
Speaker 1: mode would not be stored afterwards. So all those cookies
Speaker 1: that might have happened during a session, they'll just be
Speaker 1: erased like you never existed. Uh. That that can actually
Speaker 1: be very useful. For example, if you're looking for a
Speaker 1: fun hack, if you want to save some money on
Speaker 1: airplane flights, you can track them. You can look up
Speaker 1: airplane flight prices in incognito mode and compare them to
Speaker 1: your regular browser. And sometimes on occasion you can find
Speaker 1: cheaper prices in incognito mode. Because it doesn't see how
Speaker 1: much you are searching, it doesn't see how how many
Speaker 1: websites you've gone to. Those cookies just aren't it there,
Speaker 1: so the website is going to give you the best
Speaker 1: price through that that private browsing mode. Uh. That's pretty
Speaker 1: much like the most interesting thing that I use for
Speaker 1: incognito mode four, but it can be used to secretly
Speaker 1: access websites without anybody else knowing that you're accessing those
Speaker 1: websites at the time. For example, if you are a Brownie. Yeah,
Speaker 1: so this works on the device level, but not the
Speaker 1: network level. So yeah, so if my friend gets hold
Speaker 1: of my phone or my computer, there would be no
Speaker 1: record of me having gone on the Browny fan fiction
Speaker 1: community site. Uh where I post by q D mark.
Speaker 1: They would not be able to see that. But if
Speaker 1: they were to look at the network traffic, they'd say, huh,
Speaker 1: this I P address is going to this Brownie site
Speaker 1: a lot, and it's not my computer, so it's obviously
Speaker 1: your device and so and so this is why, like,
Speaker 1: if you were to use let's say that you're at work,
Speaker 1: let's hit your what the The example I like to
Speaker 1: give is your Let's say you are stuck in a
Speaker 1: crappy job. You're doing your job, but you're miserable and
Speaker 1: you would really love to be able to get something else,
Speaker 1: but you don't have any time outside of your job
Speaker 1: where you can really dedicate towards things like searching for
Speaker 1: job openings. So on your lunch break, you slip into
Speaker 1: incognito mode and you go on a job search website. Well,
Speaker 1: just because you're an incognito mode doesn't mean that at
Speaker 1: the network level they can't see exactly what's going on,
Speaker 1: So it doesn't actually protect what you're doing or how
Speaker 1: you're doing it. So one thing you might want to
Speaker 1: use incognito mode for if you're someone like me who
Speaker 1: does a lot of research. Let's say I'm researching into
Speaker 1: something that you know, it's it's just not my bag.
Speaker 1: You know, it's I need to do an episode about it,
Speaker 1: but it's not something I'm particularly interested in on a
Speaker 1: personal level, or might even be something that I would
Speaker 1: find very awkward. Let's say that I was doing an
Speaker 1: episode about, uh, dating websites, and so I have to
Speaker 1: do a whole bunch of research on dating websites. Well,
Speaker 1: then I might want to use incognito mode so it
Speaker 1: doesn't build up this cookie history that relates back to
Speaker 1: me personally, so that maybe I log onto something like
Speaker 1: Facebook and then suddenly all the ads are for dating sites.
Speaker 1: That would be awkward, Right, that would be super awkward,
Speaker 1: especially if you were married. Yes, I'm not a good thing. Yeah,
Speaker 1: I had a similar occasion with I was looking up
Speaker 1: pregnancy and birth information for somebody in my family. I'm
Speaker 1: nowhere near any time soon giving you know, birth to
Speaker 1: any children in my life except for my beautiful for
Speaker 1: babies that I have in my house with me. Uh
Speaker 1: So I was looking up this information and I was
Speaker 1: just like, do I want Twitter on Instagram to start
Speaker 1: promoting like baby items to me or do I want
Speaker 1: them to keep on promoting like makeup in sailor moon items,
Speaker 1: which I'm actually into. So I looked up the information
Speaker 1: about pregnancy and birth for the other person through incognito
Speaker 1: mode so that that informa and wouldn't actually be tracked
Speaker 1: and identified as a part of my online personality. So
Speaker 1: that way I was able to keep the same ads
Speaker 1: that I actually, you know, sometimes kind of enjoy looking
Speaker 1: at because they do pertain to my lifestyle, but nothing
Speaker 1: that had to do with pregnancies. Right. And and that's
Speaker 1: a great example too, because there was that famous example
Speaker 1: a few years ago of a retailer I want to
Speaker 1: say it was target, but I could be wrong, but
Speaker 1: it was a retailer target, Yeah, And they had identified
Speaker 1: through the browsing history of a user that she was
Speaker 1: pregnant because of the things she was searching for, so
Speaker 1: they proactively sent her through the snail mail a package
Speaker 1: of coupons for pregnancy related items, and her father was
Speaker 1: the one who intercepted the letter the coupons, and she
Speaker 1: had not told him that she was pregnant, and he
Speaker 1: had assumed that target had made this assumption and got
Speaker 1: super mad, and then turned out that he was mad
Speaker 1: about something that actually had happened. She just had not
Speaker 1: She had not had the occasion, she had not found
Speaker 1: the way to tell him. And that's awful. Uh. Yeah,
Speaker 1: it's such a breach of privacy, to be honest, is
Speaker 1: when they start tracking you like that and sending you information.
Speaker 1: It's like unsolicited advertising, and I hate it. We deal
Speaker 1: with it every single day online. Yeah, it's it's it's
Speaker 1: even worse than unsolicited advice, Like that's bad, but unsolicited
Speaker 1: advertising is even worse because they're like, yeah, they're so
Speaker 1: eager to make that sale that they can overstep very easily. Well,
Speaker 1: let's wrap up by talking about some of the more
Speaker 1: secure ways you can browse if you have to connect him.
Speaker 1: We mentioned this at the very top of the show,
Speaker 1: where VPNs are virtual private networks, and we mentioned that
Speaker 1: sort of man in the middle attack where you are
Speaker 1: logging into a hackers machine thinking that that's a legit spot,
Speaker 1: and then the hackers kind of relaying information and sniffing
Speaker 1: the entire time and learning all about you. VPNs are
Speaker 1: kind of like that, but on the legit side, where
Speaker 1: you are logging into a remote server somewhere far away,
Speaker 1: probably through an encrypted connection, and then when you browse,
Speaker 1: it's as if you're browsing from the server's location, not
Speaker 1: your personal device. So if I were to blog into
Speaker 1: a VPN and then log into a web service, the
Speaker 1: web service would see my location as the location of
Speaker 1: the VPN server, not my gadget that's actually in front
Speaker 1: of me, right and not necessarily just for if you
Speaker 1: want to look at your my little pony browny fan fix,
Speaker 1: but VPNs can be extremely useful if you're trying to
Speaker 1: access a website that's only available in select countries. So
Speaker 1: if you choose to purchase like a consumer facing VPN product,
Speaker 1: and there's many out there, I could make recommendations, but
Speaker 1: they're can instantly changing as far as their privacy and
Speaker 1: security terms and policies go, So I won't make any
Speaker 1: major recommendations here. But if you choose a VPN that
Speaker 1: has a a UH, for example, a country facing server
Speaker 1: that's in Japan, that means that I could download this VPN,
Speaker 1: log into it, connect through Japan, and be able to
Speaker 1: access a website that's only available to Japanese residences. UH.
Speaker 1: So I I had to do that a few years
Speaker 1: ago when I wanted to purchase tickets for the Studio
Speaker 1: Ghibli Museum through the Japanese website. It wouldn't let you
Speaker 1: access it through an American server or an American connection.
Speaker 1: So I logged in through my VPN through the Japanese
Speaker 1: server UH, and I was able to purchase those tickets
Speaker 1: through the Japanese website. It thought that I was in Japan,
Speaker 1: so it let me do it, and that way I
Speaker 1: was able to save myself so much money. It was wonderful.
Speaker 1: So you can do it for you know, buying goods,
Speaker 1: buying tickets for where, you know, going to a concert
Speaker 1: in a different country, or a museum or something like
Speaker 1: that in a different country. You can use it to
Speaker 1: access online streaming portals that are only available in specific countries.
Speaker 1: You can use it to download specific things that are
Speaker 1: only available in specific countries like the list goes on
Speaker 1: and on as far as different ways that you can
Speaker 1: use VPNs that aren't necessarily just directed for security and privacy,
Speaker 1: but are also directed at manipulating where the website thinks
Speaker 1: that you are coming from. Yeah, and this can be
Speaker 1: a matter of life and death for some people. Like
Speaker 1: here in the United States, we largely use it for
Speaker 1: the purposes of things like privacy, security, and convenience, but
Speaker 1: in other places where you might be uh in a
Speaker 1: country with a more authoritarian government, one that is far
Speaker 1: more restrictive in access to certain services. If you're able
Speaker 1: to connect through a VPN, which you know, granted, that
Speaker 1: means that that government agency has have been paying very
Speaker 1: close attention. But if you're able to do that, then
Speaker 1: you can log in two different things as if you
Speaker 1: were from some other part of the world, and maybe
Speaker 1: get access to vital information or services that otherwise you
Speaker 1: would not have at your disposal. So they play a
Speaker 1: very important role. In fact, I gave an example today
Speaker 1: with a friend of mine about how I would see
Speaker 1: VPNs and incognito mode together being incredibly important. So imagine
Speaker 1: this is a terrible scenario and I put that out
Speaker 1: there first. But imagine that you are in some form
Speaker 1: of abusive situation at home, and whether it's a spouse,
Speaker 1: a parent, a parent, some sort of authority figure, whatever
Speaker 1: it may be. But you're in that abusive experience, You're
Speaker 1: going to feel like you are helpless and you want
Speaker 1: to look for resources that can help you get out
Speaker 1: of that situation. But at the same time, you have
Speaker 1: a very legitimate fear of being found out for seeking
Speaker 1: out those resources and the fear of reprisal that you
Speaker 1: might face as a result of that. Well, using something
Speaker 1: like a VPN and incognito mode would mean that you're
Speaker 1: not leaving a trace on the network of what you're doing,
Speaker 1: because as far as the network is concerned, all you're
Speaker 1: doing is visiting this VPN server. It's not seeing what
Speaker 1: else you're doing. All of knows you went to that
Speaker 1: VPN server. Incognito mode means you're not leaving the trace
Speaker 1: on whatever device you're actually using to do that sort
Speaker 1: of search. So these are the sort of tools that
Speaker 1: can literally mean life or death scenarios for people. And
Speaker 1: you know that's dramatically that's together and it yeah, and
Speaker 1: once you start combining those different security and privacy products
Speaker 1: together that are very consumer friendly. Then you can end
Speaker 1: up having a much more secure experience online, especially if
Speaker 1: you're dealing with some kind of like like an abusive
Speaker 1: relationship or something like that that can be uh something
Speaker 1: that you seriously have to worry about, so definitely take
Speaker 1: those into consideration. Using an incognito mode and VPNs together
Speaker 1: is so easy to It's just as simple as opening
Speaker 1: up that browser window in private browsing mode and turning
Speaker 1: on your VPN, which is usually with a lot of
Speaker 1: software nowadays, is the click of a switch on your computer.
Speaker 1: And there are a lot of VPN apps out there,
Speaker 1: like there are a lot of the services where if
Speaker 1: you subscribe to the service, you can use uh your computer,
Speaker 1: or you can use a mobile device, or you can
Speaker 1: use some combination of multiples. And they're even ones where
Speaker 1: you can have it set as a default that as
Speaker 1: soon as you connect to WiFi networks, you connect through
Speaker 1: the VPN, so you don't even have to don't even
Speaker 1: think about it in that case, which is definitely good.
Speaker 1: If you're using like a mobile device and you're connecting
Speaker 1: to public WiFi frequently, you definitely want to have that
Speaker 1: that that turned on, because if you ever forget about it,
Speaker 1: that's when you're going to have the opportunities for people
Speaker 1: to take advantage of you. Uh, the last examples go ahead,
Speaker 1: I'm sorry. There's also the option to build your own VPN,
Speaker 1: but that gets very much into the nitty gritty, uh,
Speaker 1: since there are a lot of consumer facing ones that
Speaker 1: are generally fine for the average consumer. That's what I
Speaker 1: wouldn't normally recommend. But when I go to Deacon, for example,
Speaker 1: I bring like my own certificate, my own VPN, and
Speaker 1: my own little o VPN basically file, and I stick
Speaker 1: that on my phone to actually run my own VPN.
Speaker 1: When you do that, you're basically creating your own secure profile,
Speaker 1: as opposed to trusting a VPN company with your information
Speaker 1: and hoping that they are doing it for you. Yeah.
Speaker 1: That's a great point, Shannon, because a lot of these
Speaker 1: solutions actually ultimately require you to put trust in another entity,
Speaker 1: and you know, there have been cases where even VPNs
Speaker 1: have suffered data breaches in recent past, where you know,
Speaker 1: you have to worry about that kind of stuff too.
Speaker 1: There does come a point where you ultimately you have
Speaker 1: to say to yourself, at what point am I comfortable
Speaker 1: handing over control or handing over you know, some of
Speaker 1: my data, because either you're doing that or you're doing nothing.
Speaker 1: But you know, deciding where that point is is a
Speaker 1: very personal choice. Uh. The very last one I want
Speaker 1: to talk about, and we can do this very briefly,
Speaker 1: is Tour, the Tour browser. Tour initially was an acronym
Speaker 1: instead for the Onion router. And the reason it's called
Speaker 1: Onion is because it does encryption in layers, each outer
Speaker 1: layer being another layer of encryption. And I gave a
Speaker 1: very simple analogy. Imagine that you are trying to ship
Speaker 1: a present. Let's say I'm shipping a present to Shannon,
Speaker 1: but You're welcome, but I don't want you to know
Speaker 1: where I live, um for some reason. And I don't
Speaker 1: want anyone to know that I'm sending a present specifically
Speaker 1: to you for some reason. So what I've done is
Speaker 1: I've nested your package that has your present in it
Speaker 1: inside another package that's gonna go to a totally different address.
Speaker 1: And I've nested that what's is it a brown package?
Speaker 1: There's probably some you know, my little pony temper tattoo
Speaker 1: sheets in there. So that's in there, and then that's
Speaker 1: in a second package, and the second package is in
Speaker 1: the third, the third packages in the fourth. Each package
Speaker 1: has a different address on it. So I've got a
Speaker 1: really big package that ultimately is just holding a bunch
Speaker 1: of boxes and a couple of sheets of temporary tattoos
Speaker 1: and the innermost box. I ship that to the first address.
Speaker 1: The person at the first address opens up this big
Speaker 1: box and they see that there's a slightly smaller box
Speaker 1: inside with a different address on it. So they plopped
Speaker 1: that back into the post office. Post office takes that
Speaker 1: to the second destination. They open up the package, well,
Speaker 1: destination number two. They know that the package came from
Speaker 1: destination number one, but they don't know anything further back
Speaker 1: from that. They don't know that I was the person
Speaker 1: who originally put the package in the mail, and they
Speaker 1: don't know where the package is ultimately going to. They
Speaker 1: just see destination three on the shipping label of that
Speaker 1: inner package, so they send it to destination three. Destination
Speaker 1: three gets it. They opened it up. They know it
Speaker 1: came from destination too. They don't know about destination one.
Speaker 1: They definitely don't know about me, and they see that
Speaker 1: they need to send on the next package to destination four,
Speaker 1: and so on and so forth until finally you get
Speaker 1: to that innermost package which has Shannon's address on it.
Speaker 1: She gets it, she knows it came from the previous site,
Speaker 1: but doesn't know any of the rest of the history,
Speaker 1: including where it came from, except I probably put a
Speaker 1: note in the inside of the package saying hey, it's
Speaker 1: from me, Brownie Joe. And then then she gets the package.
Speaker 1: You would probably want to make sure that your message
Speaker 1: is encrypted. Yes, Uh, there's like a you know, I
Speaker 1: tell you that you need to use your super secret
Speaker 1: Captain Crusader decode ring or whatever to decrypt the message,
Speaker 1: and then and then she would be able to to
Speaker 1: use a similar process to send information to me. Uh. Now,
Speaker 1: this is a very secure way typically of sending information.
Speaker 1: There are ways to try and sniff out things, just
Speaker 1: as there are with any network communication, but it's hard.
Speaker 1: It's very hard to get anything meaningful through this process.
Speaker 1: It is possible, it's not foolproof, but it's real hard
Speaker 1: and uh. And so this is generally considered the most
Speaker 1: secure way to browse the Internet. However, with that security
Speaker 1: there comes a trade off, and that trade off is
Speaker 1: mainly felt in the form of speed. We're in the
Speaker 1: home stretch. Now we're going to have a little bit
Speaker 1: more talk about public WiFi and safety measures you should
Speaker 1: be observing. But before we get to that, let's take
Speaker 1: one last break. There has been talk on on the
Speaker 1: internet many years ago that government agencies had access to
Speaker 1: some of the UM end notes, the very last place
Speaker 1: that your package would hit before it went on to
Speaker 1: whoever it was supposed to go to. UM. So you
Speaker 1: do have to consider where where is this information being
Speaker 1: sent and who has access to the very end of
Speaker 1: that tunnel that you're sending that information through UM and
Speaker 1: if that's protected, then yeah, it's great option UM. But
Speaker 1: of course with tour as well as with VPNs and
Speaker 1: incognito mode, you shouldn't use just one of these options.
Speaker 1: You should use all of them if they are at
Speaker 1: your disposal. But again, do you want to deal with
Speaker 1: the slowness that you're going to experience when you add
Speaker 1: these additional tunnels and additional nodes onto whatever you're trying
Speaker 1: to gain access to, or are you going to deal
Speaker 1: with the security um UH minimal experience and add that
Speaker 1: additional convenience to your experience by just not using it,
Speaker 1: so there are trade offs either way, and you've summarized
Speaker 1: it perfectly, Shannon. I mean, this is like we said
Speaker 1: at the beginning, this is a spectrum, and the important
Speaker 1: thing is to be educated to that spectrum so you
Speaker 1: can make your own educated decisions and not just trust
Speaker 1: to the fates. I have a tattoo on my back
Speaker 1: of the full Terror card, the Eternal Optimist. Don't be
Speaker 1: the fool. You get the tattoo who wants pretty awesome,
Speaker 1: It's dope, But don't don't be the Don't be the
Speaker 1: fool in life, right, Don't just trust that you can
Speaker 1: take a step off a cliff and you're not going
Speaker 1: to fall to your death. The fool is taking a
Speaker 1: step off a cliff in the traditional tarot card. So
Speaker 1: you don't want to be like that. You want to
Speaker 1: be informed and make choices. And you know there might
Speaker 1: be instances where you think, Okay, I'm in a public spot,
Speaker 1: I am going to use WiFi, but I'm using it
Speaker 1: for something that's not related to my personal information. I'm
Speaker 1: literally maybe I'm looking up a restaurant to find out
Speaker 1: what hours it's open, and that's it. You know, they're
Speaker 1: different levels. But if you're thinking, I want to do
Speaker 1: some shopping, or I'm going to check my bank statement,
Speaker 1: or I'm going to log into my email or this
Speaker 1: one's a big one for us here at my heart.
Speaker 1: If I'm going to access any of my my work stuff, right,
Speaker 1: like anything that's stored on there, any of the services
Speaker 1: that are on your definitely use a VPN in those cases,
Speaker 1: because you're talking about things that affect not just you
Speaker 1: but other people. Right, You're talking about the potential of
Speaker 1: affecting uh, essentially an entire company if if the wrong
Speaker 1: information were to get out, you know, especially for talking
Speaker 1: about things like publicly traded companies. You want to make
Speaker 1: sure that you're being a good steward of the information
Speaker 1: that's been entrusted to you, not just your own but others. So, uh, Shannon,
Speaker 1: this has been a joy. You have given generously of
Speaker 1: your time and your expertise, and I greatly appreciate it.
Speaker 1: Please let people know where they can find your work. Well.
Speaker 1: Thank you so much, Jonathan. I love security and privacy
Speaker 1: and I think of it as a habit that you
Speaker 1: build upon over time, and the more that you learn
Speaker 1: about it, the better off you can be in the future.
Speaker 1: So build upon your security for your future self and
Speaker 1: for your family too, because the more secure cure you are,
Speaker 1: the more secure they will be as well. Uh. And
Speaker 1: if you're interested in learning more about consumer privacy and security,
Speaker 1: you can check out my YouTube channel. It's YouTube dot
Speaker 1: com slash Shannon Morse uh and that's m O R
Speaker 1: s E just like Morse Code and I will be
Speaker 1: going to CS just like Jonathan Jonathan mentioned, I'm very excited,
Speaker 1: so I will be posting a lot of content from
Speaker 1: the Consumer Electronic Show and I will have tons in
Speaker 1: store through the year. Awesome. Shannon's always a pleasure. I
Speaker 1: am so sad that I will not be seeing you
Speaker 1: at c E S. Will have to make time for
Speaker 1: some other tech conference, I'm sure. Or next time i'm
Speaker 1: out your way, I'll give you a shout and maybe
Speaker 1: we can, like please do Yeah, we can can go
Speaker 1: grab ramin or something and chat about security. I would
Speaker 1: love That would be awesome. And that was an episode
Speaker 1: from Christmas Day two thousand nineteen, The Dangers of Public WiFi.
Speaker 1: I hope you enjoyed this look back on the episode.
Speaker 1: That was one of the really epic ones when it
Speaker 1: took a look at the full running time. I thought, wow, um,
Speaker 1: I oe Shannon a really nice lunch or something for
Speaker 1: agreeing to sit on a podcast for so long with me, Because,
Speaker 1: as we all know, that's a big request. I hope
Speaker 1: you are all staying safe and are well. If you
Speaker 1: have suggestions for topics I should cover on future episodes
Speaker 1: of tech Stuff, please reach out to me. The best
Speaker 1: way to do that is on Twitter. The handle for
Speaker 1: the show is text Stuff H s W and I'll
Speaker 1: talk to you again really soon. Yeah. Text Stuff is
Speaker 1: an I Heart Radio production. For more podcasts from my
Speaker 1: Heart Radio, visit the i Heart Radio app, Apple Podcasts,
Speaker 1: or wherever you listen to your favorite shows.