Speaker 1: Welcome to Tech Stuff, a production of I Heart Radios
Speaker 1: How Stuff Works. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. Forgot my own name for
Speaker 1: a second. I'm an executive producer at iHeart Radio and
Speaker 1: I love all things tech. And you know, uh, there's
Speaker 1: a there's a topic that I really wanted to cover
Speaker 1: because as I record this, we're in the holiday season.
Speaker 1: A lot of people are traveling, They're going through airports,
Speaker 1: maybe you're visiting family, and occasionally you need to find
Speaker 1: a place to be elsewhere, like maybe a coffee shop
Speaker 1: or something. That typically means we're carrying our devices with us,
Speaker 1: and then we want to connect to different networks, but
Speaker 1: that might not always be a great idea, And so
Speaker 1: I decided I was going to do an episode all
Speaker 1: about the best ways to browse the Internet with privacy
Speaker 1: and safety in mind, going from the least private and
Speaker 1: the least secure to perhaps the most private and most
Speaker 1: secure here. And then I thought, hey, you dumb, dumb.
Speaker 1: You know people who are extremely well versed in this topic,
Speaker 1: and that's why I invited my good friend, the phenomenal
Speaker 1: Shannon Morris to join this episode. To come back so
Speaker 1: welcome back to Tech Stuff, Shannon. Thank you so much. Jonathan.
Speaker 1: I'm so excited to be back on the show. How
Speaker 1: are you doing. I'm tired. But it's at the end
Speaker 1: of the year, so that always happens, right, like, And
Speaker 1: here's the thing, you know, Shannon can tell you. In fact,
Speaker 1: we were just talking about it before we went on
Speaker 1: to the record, that the tech journalists life does not
Speaker 1: get easier at the end of the year because you
Speaker 1: immediately turned around and head off to Vegas for c
Speaker 1: E S. And that's where you're gonna be in early January,
Speaker 1: as I understand it, right, Shannon, Yes, I will. I'll
Speaker 1: be there all week covering everything over on my channel,
Speaker 1: So make sure to link everybody to my channel later, absolutely,
Speaker 1: because I ain't going folks. So Shannon's your your destination
Speaker 1: for finding all the really cool stuff. And uh, Shannon,
Speaker 1: I can say from experience because I've watched her work
Speaker 1: does amazing work, not just at CES but everywhere, but
Speaker 1: particularly like under a high stress situation like CES, certain
Speaker 1: people can light up under the camera. And uh, I'm
Speaker 1: frankly envious of your ability to do so. So um
Speaker 1: that's me being nice. Yeah, well, I mean, I could
Speaker 1: be more caddy about it, but I'm gonna be nice.
Speaker 1: The caddy would be like, how dare she? How dare
Speaker 1: she show me up? But no, we're gonna talk about
Speaker 1: browsing safely. So the first thing I wanted to do
Speaker 1: before we get into the spectrum of browsing the Internet,
Speaker 1: because you could argue that there's like the least safe, secure,
Speaker 1: naive way to do it to what is perhaps the
Speaker 1: most secure but not perfect. There's no perfect solution spoiler alert.
Speaker 1: Before we get into any of that, I wanted to
Speaker 1: talk about some stats, and these come from a few
Speaker 1: different sources. Uh. One was a survey that was conducted
Speaker 1: by one World Identity back in eighteen about public WiFi.
Speaker 1: So this was just asking people about their perception and
Speaker 1: their use of public WiFi. And Shannon, I kind of
Speaker 1: wanted to get your reaction to this because being someone
Speaker 1: who has been so entrenched in data security, in the
Speaker 1: hacker culture, in you know, everything from how do we
Speaker 1: make these systems more secure? To the white hat approach
Speaker 1: of how do we find any vulnerability so that they
Speaker 1: can be patched, to even the black hat culture where
Speaker 1: people are exploiting this for their own gain. I wanted
Speaker 1: to see what you thought about these stats. So the
Speaker 1: first one was they asked a question to people in
Speaker 1: the United States, in Germany, and in France, and the
Speaker 1: question they asked was, do you ever use unsecured public
Speaker 1: WiFi networks? In the United States? Forty percent, so nearly
Speaker 1: half said, you know, if there's no other option, sure,
Speaker 1: I'll do it. Thirty two percent actually said I prefer
Speaker 1: using public WiFi to using my cellular plan, presumably because
Speaker 1: they would not be billed for data usage right because
Speaker 1: they're using WiFi instead of their cell data only said
Speaker 1: they never did it. One percent said they do it,
Speaker 1: but only with a VPN. But we'll cover VPNs a
Speaker 1: little bit later. So, Shannon, you've you've talked with hackers.
Speaker 1: What do you think their reaction initially would be hearing
Speaker 1: that nearly fifty of people in the United States said yeah,
Speaker 1: you know, if there's no other connection, I'll I'll connect
Speaker 1: to public WiFi, and another thirty two percent and I said, oh, heck, yeah,
Speaker 1: sign me up. Well, I'm definitely in the one percent
Speaker 1: of only with a VPN, and and that's assuming that
Speaker 1: I have absolutely no other option. So I'm kind of
Speaker 1: a mix of the and the one percent, but only
Speaker 1: only if I have a VP n UM. I would
Speaker 1: say from my experience, all of my friends would probably
Speaker 1: not be surprised by the that prefer public WiFi over
Speaker 1: their cellular plants, specifically because of what you said. They'll
Speaker 1: be able to save money, especially if they don't have
Speaker 1: an unlimited plan through their mobile carrier. So in that way,
Speaker 1: it makes sense, uh that say yes, if there's no
Speaker 1: other option, there's always another option. Come on, folks, what
Speaker 1: are you doing? Where are you at? I mean, we
Speaker 1: we have such good cellular coverage now there's always another option,
Speaker 1: even if you just have three G like that's manageable
Speaker 1: from most tasks. So what what are they doing? I'm
Speaker 1: just my draw My job kind of dropped a little
Speaker 1: bit when I heard that number. I just thought it
Speaker 1: was I thought that I'm doing a much better job
Speaker 1: of educating people about the importance of not using public WiFi,
Speaker 1: and apparently I'm not doing my job as well as
Speaker 1: I should have been, or or the people who are
Speaker 1: already kind of hip to it are the ones watching you, going, yeah,
Speaker 1: she gets it, she knows, and the people who need
Speaker 1: to see it are like, what's on the masked Singer
Speaker 1: today or whatever, you know, like, so, yeah, I I
Speaker 1: look at this and I think, man if I were
Speaker 1: a black hat, I would just be doing the Mr
Speaker 1: Burns excellent gesture over and over again, just drooling at
Speaker 1: that opportunity, because you know, public WiFi is definitely the
Speaker 1: most dangerous option you can pick when you're talking about
Speaker 1: protecting your own privacy and security, especially if you're not
Speaker 1: doing something like using a VPN uh spoiler alert will
Speaker 1: talk more about that in a second. And so knowing
Speaker 1: that you're your opportunity for targets is so vast has
Speaker 1: got to be incredibly encouraging to someone who is ready
Speaker 1: to exploit that. And that's really, you know, that's what
Speaker 1: we're trying to protect everyone against, is you know, it's
Speaker 1: the likelihood of you running into these situations is not
Speaker 1: necessarily hot on a day to day basis, but the
Speaker 1: opportunity is so huge that you need to take it
Speaker 1: into account no matter where you happen to be. So
Speaker 1: you you want to make yourself the hard target. You
Speaker 1: want to be the person that makes people work really
Speaker 1: hard to get access to your data. You don't want
Speaker 1: to be the easy target, because the easier target you are,
Speaker 1: the more often you're going to be targeted. You don't
Speaker 1: want that. No, No, And I was actually talking to
Speaker 1: a co worker today and I said, honestly, when you
Speaker 1: look at data security, even when you're talking like, you
Speaker 1: always get naysayers who will say, oh, sure you can
Speaker 1: use this, but it doesn't protect you against everything. And
Speaker 1: they may technically be right, but my answer is the
Speaker 1: harder you make it effectively, what that means is you're
Speaker 1: making it more expensive for someone to successfully target you.
Speaker 1: So if you price yourself out where it would cost
Speaker 1: them more to break your security, then they would get
Speaker 1: from whatever they took from you. You win, because no
Speaker 1: one's going to lose money on that. Uh exactly. It's
Speaker 1: when you've made it so convenient that it's like it's
Speaker 1: like it's like when someone says about a sale, I
Speaker 1: would lose money if I didn't buy that. That's when
Speaker 1: you're in trouble. Yes, exactly. It's they're looking for the
Speaker 1: bargain deal. And a lot of times when a black
Speaker 1: hat is looking at public WiFi as a way to
Speaker 1: access information, they're in tending to profit off of that information,
Speaker 1: whether by stealing an idea, identity or reselling that data
Speaker 1: on the black market, like on the dark web. So
Speaker 1: making yourself the hard target is absolutely crucial to helping
Speaker 1: to protect you. Yeah, and and just so that you
Speaker 1: guys out there, no, I mean I mentioned the United
Speaker 1: States numbers. It's not like Germany and France were shining
Speaker 1: examples of data privacy and security among the public. In Germany,
Speaker 1: in fact of respondent said they'd used unsecured, unsecured public
Speaker 1: WiFi over their cellular data. So it was even a
Speaker 1: larger centers than the United States and the United United States,
Speaker 1: it was that thirty two percent it said, oh yeah,
Speaker 1: if I've got a choice, I'll use public over my
Speaker 1: cellular data. In Germany it was forty six percent um
Speaker 1: and percent said they would use it if they could
Speaker 1: not get a cellular option. And then in France it
Speaker 1: was closer to what the United States said, said they
Speaker 1: preferred using public WiFi to using their cellular data and
Speaker 1: forty percent said they'd used it if they couldn't get
Speaker 1: any other option. So again that mirrored very closely what
Speaker 1: the folks in the United States said. So this is
Speaker 1: a trend that goes beyond the US. I know that
Speaker 1: because I'm centered in the US. I often get very
Speaker 1: US centric, and I also tend to harp on how
Speaker 1: American citizens in particular seemed to come across to me
Speaker 1: as being security illiterate. For in a in large part,
Speaker 1: I mean, I just see it all the time, but
Speaker 1: I don't know if it's not exactly reassuring to see
Speaker 1: that's that way in other parts of the world. That
Speaker 1: doesn't film me with confidence. I think a lot of
Speaker 1: times people either don't know where to look for the information,
Speaker 1: for accessible information that's that that's explained in a way
Speaker 1: that isn't scary, or doesn't you know, create create emotions
Speaker 1: of paranoia, or just close people down so that they
Speaker 1: just get lose interest insecurity. Uh. And you also have
Speaker 1: a lot of folks out there that just don't care.
Speaker 1: But I think a lot of people do care, they
Speaker 1: just don't know where to look for this kind of information.
Speaker 1: So I'm glad that you, Jonathan, as well as myself
Speaker 1: on my channel, we're putting that information out there in
Speaker 1: a way that's easy to understand, and I'm hoping that
Speaker 1: even if it just helps one person understand a little
Speaker 1: bit better security and privacy, hopefully we change that percentage
Speaker 1: over time. Absolutely, I agree. I think, uh, it can
Speaker 1: be one of those situations where you get overwhelmed by
Speaker 1: the scope of something. And when you get overwhelmed, it's
Speaker 1: almost like there's a defense mechanism them in your brain, right,
Speaker 1: it's like this is too hard, so I can't worry
Speaker 1: about it. And I have seen this in action when
Speaker 1: trying to tell people about like password managers, for example,
Speaker 1: and they just shut down. They have no interest, They
Speaker 1: get glassy eyed, and they just say, well, I don't
Speaker 1: see what the point is. And I try to explain
Speaker 1: the point, but as after that point, it's just it's
Speaker 1: just like talking through talking through the air. They just
Speaker 1: don't want anything to do with it. And and as
Speaker 1: someone who relies heavily on a password manager like it is,
Speaker 1: it's it's fundamentally one of the most important tools in
Speaker 1: my toolbox to make certain that I don't do rookie
Speaker 1: mistakes like using the same password for multiple accounts. Right.
Speaker 1: Because as as we'll discuss as we get into this
Speaker 1: discussion about safely browsing the Internet, one of the big
Speaker 1: dangers is that if you through accident or or your
Speaker 1: tricked or whatever, if you somehow share your log in
Speaker 1: information for one service. Let's say that you have one
Speaker 1: service that isn't using uh secure encryption for some reason.
Speaker 1: First of all, don't do that. But if you are,
Speaker 1: if you're using that same password anywhere else, it's like
Speaker 1: you just handed a skeleton key to somebody, because now
Speaker 1: they can access everything you've used that password with. I mean,
Speaker 1: this is this is blatantly obvious. So that's why it's
Speaker 1: so important to have unique, strong passwords for all the
Speaker 1: different services you use. That way, if one, if worst
Speaker 1: case scenario one gets compromised, it doesn't compromise everything else. Yes, absolutely,
Speaker 1: I'm glad you mentioned that because the more different things
Speaker 1: that you use that help your security and privacy, every
Speaker 1: single step you take absolutely helps. And that's just one
Speaker 1: of the many steps that you can take. Every single
Speaker 1: consumer in the world does not have to take all
Speaker 1: of these steps all at once, because that would be
Speaker 1: quite mind boggling. But if you do take steps towards
Speaker 1: these over time, you can increase were privacy and security
Speaker 1: two fold. Yeah, it's fantastic. Yeah, I mean and and
Speaker 1: and to be fair, like like I'm gonna be upfront guys,
Speaker 1: like I used to be the dude who had like
Speaker 1: three passwords and for everything. Yeah, I was like that
Speaker 1: for years until until I finally like woke up to
Speaker 1: how dangerous that was. I was fortunate in that I
Speaker 1: was never knowingly anyway targeted for a specific like intrusion. Uh,
Speaker 1: as far as I know, I never None of my
Speaker 1: stuff ever got compromised because of that. Stuff has been
Speaker 1: compromised because of data breaches that are beyond our control.
Speaker 1: But we're really focusing on the stuff that we as
Speaker 1: end users can do to improve our security as best
Speaker 1: we can, knowing that we live in a world where
Speaker 1: that's just one point of vulnerability. That's one point of attack,
Speaker 1: but it's it's one that we have some control over another.
Speaker 1: Another scary statistic, or at least I thought it was scary,
Speaker 1: is that Kaspersky did a UH survey back in seventeen
Speaker 1: and are They did an analysis of thirty two million
Speaker 1: hot spots. Hot spots being points of contact where your
Speaker 1: device connects over to the Internet at large, and a
Speaker 1: hot spot can be everything from the router in a
Speaker 1: like a coffee shop to your own cell phone. You
Speaker 1: might be using that as a portable hot spot. Out
Speaker 1: of the thirty two million hot spots they examined, twenty
Speaker 1: one quarter of them had no encryption in use at all,
Speaker 1: meaning everything is being sent in plain text, which means
Speaker 1: that if anyone has any method of eavesdropping on those communications,
Speaker 1: they see it all, which again blows my mind that
Speaker 1: there would be that many networks that have no encryption
Speaker 1: in place at all, not even bad encryption. Yeah, that's
Speaker 1: a very scary number. That's extremely high and is a
Speaker 1: lot higher than what I thought it would be. Uh.
Speaker 1: If if they're not using any sort of encryption whatso
Speaker 1: ever for a hot spot, that means that anybody within
Speaker 1: that vicinity, within range of that device would be able
Speaker 1: to see everything you're doing. It's very very mind boggling. Yeah,
Speaker 1: and this is one of the reasons why I wanted
Speaker 1: to have you on the show, because we say these things, right,
Speaker 1: We say that when you use public WiFi, you're using it.
Speaker 1: If you're using an unsecured public WiFi hot spot, especially
Speaker 1: one that is unencrypted, that you are in danger of
Speaker 1: this And a lot of people say, all right, but
Speaker 1: exactly what's going on? Right? How are they doing this?
Speaker 1: And it's that there are various pieces of software out
Speaker 1: there that allow people who are who get onto a
Speaker 1: network to monitor traffic that's going across that network. I
Speaker 1: mean their entire groups out there that make different software
Speaker 1: and hardware, uh solutions to do just this, right, Yeah,
Speaker 1: not gonna lie. Um. I used to solder and sell
Speaker 1: some of these products at a company that I used
Speaker 1: to work with called hack five, So I'll definitely share
Speaker 1: some of that information once we get closer to those
Speaker 1: those topics with today's discussion. But yeah, those products exist,
Speaker 1: They're very inexpensive, and some of the software is free,
Speaker 1: and there's tutorials made by yours truly on YouTube that
Speaker 1: show you how to use these things. So it's definitely
Speaker 1: a thing that pretty much anybody can introduce themselves too,
Speaker 1: and then they will be able to see what's going
Speaker 1: on on a network. And there are different reasons to
Speaker 1: even do this. There's obviously there's the nefarious ones that
Speaker 1: we're concerned about, but there's also like if you're a
Speaker 1: network administrator being able to do things like monitor network
Speaker 1: traffic and see points of co education as well. Yeah,
Speaker 1: there's like there's there are legit reasons to use that
Speaker 1: sort of technology that don't that don't immediately point you
Speaker 1: to the to the road of I'm here to steal
Speaker 1: all your infos. It's like there's stuff that where this
Speaker 1: is used in quote unquote legitimate purposes. I mean like
Speaker 1: packet sniffers. That's something that sounds like it's underhanded and shady,
Speaker 1: but they were invented not to try and sniff out
Speaker 1: what someone else was doing, but literally to help network
Speaker 1: administrators see how network how network traffic was moving across,
Speaker 1: so they could make sure that everything was working properly.
Speaker 1: So but it doesn't mean that you can't a tool.
Speaker 1: A tool is either a tool or a weapon, depending
Speaker 1: upon how you want to use it, And so the
Speaker 1: same stuff that was used to help networks is also
Speaker 1: used to exploit them. Um exactly, you could say the
Speaker 1: same thing about a kitchen knife. I mean kitchen knives
Speaker 1: to to you know, cut up fruits and veggies. Some
Speaker 1: nefarious people might use one to murder somebody part of me.
Speaker 1: But the thing I used the exact same sort of analogy,
Speaker 1: except when I was talking to someone earlier today, but
Speaker 1: it was a hammer, But same thing, Like a hammer
Speaker 1: is either something that you're using to to build stuff
Speaker 1: with or it could be used to bludgeon somebody, And
Speaker 1: it all comes down to it's not that the tool
Speaker 1: itself is bad, it's the intent and use of the
Speaker 1: person wielding that tool. And the same is true of technology.
Speaker 1: Uh So, one other stat that I wanted to mention
Speaker 1: that's pretty alarming. Norton found out this was in so
Speaker 1: it's a few years ago, but Americans had had their
Speaker 1: email hacked at some point, and that twelve percent had
Speaker 1: their financial data stolen while they were shopping online, and
Speaker 1: that in million people globally had been a victim of
Speaker 1: some sort of cyber crime. And that kind of shows
Speaker 1: us the scale of why this is an important topic.
Speaker 1: It's not just because the opportunity is there. It's because
Speaker 1: people are actually actively taking advantage of those opportunities, and
Speaker 1: you could be the victim of one of those actions
Speaker 1: if you're not careful. And we love you absolutely, we too,
Speaker 1: love you very much. I'm kind of I'm kind of
Speaker 1: thinking that all of those numbers have probably increased given
Speaker 1: that it's been about four years since they were they
Speaker 1: analyzed the data and had those those statistics available, because
Speaker 1: in the past couple of years we've seen hacks go
Speaker 1: from a few hundred million people to almost a billion
Speaker 1: people get hacked online. So it's entirely possible that those
Speaker 1: numbers have increased quite a bit since, especially in the
Speaker 1: realm of the mobile app becoming king right, because there's
Speaker 1: there's such a proliferation of apps out there that either
Speaker 1: through a conscious effort, are creating vulnerabilities or because of
Speaker 1: poor design, create vulnerabilities that can later be exploited. You know,
Speaker 1: we've seen so many examples of that where an a
Speaker 1: p I didn't take everything into account and then someone
Speaker 1: was able to exploit it. Famous one being Facebook and
Speaker 1: Cambridge Analytica, where where you had an app that if
Speaker 1: you installed the app like you would voluntarily install it
Speaker 1: within your Facebook and you're voluntary a lee sharing your
Speaker 1: own information. All of that is fine, right if you've
Speaker 1: agreed to do it such a god not a good idea,
Speaker 1: such a good example. Good example. Yeah, good example, not
Speaker 1: a good idea to do. But it's fine if you
Speaker 1: if you are knowingly doing that, that's fine. But the
Speaker 1: problem that the Cambrage Analytica story brought to bears that
Speaker 1: they took advantage of a loophole in Facebook's API and
Speaker 1: they were able to to phish out a ton of
Speaker 1: information about all the contacts of the people who had
Speaker 1: installed the app. These are people who did not, uh,
Speaker 1: you know, give permission to share their information, but the
Speaker 1: app collected all that information regardless. And that's where we see, like,
Speaker 1: you know, there were countless victims of this app because
Speaker 1: none of them opted in to share that information. It
Speaker 1: was just taken from them. And uh, that's just one
Speaker 1: little example of the world we live in where you know,
Speaker 1: even when you are being careful, there are there are
Speaker 1: these opportunities for your information to get out there, which
Speaker 1: is why we're like, this is why you need to
Speaker 1: take the steps necessary to protect yourself as best you can,
Speaker 1: because we live in a world where there are numerous
Speaker 1: attack vectors that point back to us. All right, I
Speaker 1: mean just mid December, the New York Times discussed location
Speaker 1: tracking on phones and how ping pings to local towers
Speaker 1: can basically give you a map of a certain phone
Speaker 1: I D and you can track that and figure out
Speaker 1: who that phone belongs to based on what residents and
Speaker 1: what office they go to every day. It's extremely scary,
Speaker 1: and the more information we have about it as consumers,
Speaker 1: the better we can protect ourselves. Yeah, and again like, uh,
Speaker 1: back to what you were just saying, Shannon. Facebook send
Speaker 1: a letter to Congress just a couple of days before
Speaker 1: we record this episode where they said, Um, even if
Speaker 1: you opted out of location tracking, we actually know where
Speaker 1: you are, partly because of the information people are voluntarily sharing.
Speaker 1: Like if I tag if I take a photo while
Speaker 1: I'm at a party and I tagged the location and
Speaker 1: I tag people are in the photo, well, I'm voluntarily
Speaker 1: sharing a lot of information. Maybe those people haven't given
Speaker 1: me permission to do that, but I'm sharing that information.
Speaker 1: So yeah, of course Facebook knows where I am when
Speaker 1: I when I'm there, and who I'm with because I
Speaker 1: shared the information. But they also admitted yeah, we also
Speaker 1: use a lot of other methods where we can suss
Speaker 1: out where you were and who you were with at
Speaker 1: what time that aren't as obvious and aren't examples of
Speaker 1: the user voluntarily handing over information. So yeah, scary stuff. Um.
Speaker 1: One of the things I wanted to mention is sort
Speaker 1: of the bird's eye view of the process of what
Speaker 1: it's like just connecting to WiFi, so we can kind
Speaker 1: of understand, uh, you know, what's going on, because I
Speaker 1: think a lot of people if they think that if
Speaker 1: they see that, for example, that there's a Wi Fi
Speaker 1: hot spot that requires a password, they immediately think that
Speaker 1: that is inherently more secure than a public WiFi spot
Speaker 1: that has no password, which is not necessarily true. Um,
Speaker 1: So connecting to WiFi is really you can think of
Speaker 1: it as a series of handshakes between whatever device you're
Speaker 1: using and the hot spot, whether it's a router or
Speaker 1: something else. And this series of handshakes is not meant
Speaker 1: to secure the data. It's not meant to encrypt a
Speaker 1: channel necessarily, it's not meant to protect it. What's meant
Speaker 1: to do is to identify the device and the hot
Speaker 1: spot so that they know where the data needs to go. Right. Otherwise,
Speaker 1: if if we all connected to a public WiFi hot
Speaker 1: spot and there wasn't this handshake thing going on, it
Speaker 1: would be as if we were all listening to an
Speaker 1: open broadcast of everything all at once, and it would
Speaker 1: just be meaningless garbage, and we would just get just
Speaker 1: get everyone's data simultaneously, and we're like, I don't even
Speaker 1: I don't know what we could I don't think it
Speaker 1: would go well. But so this was this was literally
Speaker 1: the solution to that problem. Like you know, if you're
Speaker 1: using wired connections, that's one thing, right, you can wire
Speaker 1: things to specific ports. You have physical hardware. When you
Speaker 1: go wireless, you have to create a virtual version of that.
Speaker 1: That's sort of what the handshake processes for. It's saying, hey,
Speaker 1: there's this device that wants to connect to the network.
Speaker 1: The network says, okay, I'm giving you permission. The device
Speaker 1: is okay. This is who I am, and the network
Speaker 1: devices all right, I see who you are, and now
Speaker 1: we can send information back and forth. You can send
Speaker 1: a requests out to the internet. I'll go out and
Speaker 1: grab whatever it is you wanted, and I'll return it
Speaker 1: just to you. That's the idea. That's actually a great
Speaker 1: explanation without using any of the terminology. So I thank
Speaker 1: you for the doing that. Yeah, I tried. I tried.
Speaker 1: At one point, I had a spoiler alert or we'll
Speaker 1: not even spoiler. Look behind the curtain, folks. I had
Speaker 1: originally started to episode as a solo show, and that's
Speaker 1: when it struck me that it would be way easier
Speaker 1: if I brought Shannon on because she's much smarter than
Speaker 1: I am. And so as I was doing it, I
Speaker 1: was trying to describe this process, And I think I
Speaker 1: went through two or three drafts when I said, you
Speaker 1: know what, I can just step back and not get
Speaker 1: so technical because the technical parts aren't really what's important.
Speaker 1: What's important is just sort of understanding the concept of
Speaker 1: the process and why it is not inherently tied to
Speaker 1: security and privacy. It's inherently tied to just what does
Speaker 1: it take so that you can have these two devices
Speaker 1: communicate with one another and not have them confused with
Speaker 1: all the other devices that hook into the same network.
Speaker 1: And once I figured that, I was like, I'm gonna
Speaker 1: go with that because I'm tired of trying to figure
Speaker 1: out how to explain this handshake process. Um, it totally works.
Speaker 1: I mean, I like the handshake terminology because it is
Speaker 1: kind of like that, like in person, whenever you meet somebody,
Speaker 1: you acknowledge each other, you shake each other's hands, you
Speaker 1: kind of enticate each other by name and by face.
Speaker 1: And that's very similar to what a router does with
Speaker 1: a device like your smartphone or a laptop. It's basically
Speaker 1: doing the same thing where you're you're looking for somebody
Speaker 1: to introduce yourself to. You go in, you acknowledge each other,
Speaker 1: you shake hands with each other, you kind of authenticate
Speaker 1: each other by name, and then you have that connection. Yeah,
Speaker 1: and you have that connection forever until you break it off. Yes,
Speaker 1: And if if you're at CES, it probably also requires
Speaker 1: you to hand over a business card because that's like, yeah,
Speaker 1: most likely that's that's the current I guess that would
Speaker 1: be your password, right, yeah, I guess so yeah. All right, Well,
Speaker 1: when we come back, we're going to talk about the
Speaker 1: how how information is sent through packets, just so that
Speaker 1: we can understand why did that packet sniffing thing mean earlier?
Speaker 1: But first, let's take a quick break to thank our sponsor. Recently,
Speaker 1: more than one million people had their personal information stolen
Speaker 1: in a major data breach. Social security numbers, contact details,
Speaker 1: credit scores, and more, all taken from Capital One customers.
Speaker 1: There's a good chance you were affected. These kinds of
Speaker 1: attacks are getting more frequent and more severe. It's not
Speaker 1: just Capital One. Equifax, Facebook, eBay, Uber, PlayStation, and Yahoo
Speaker 1: have all leaked passwords, credit card info, and bank numbers
Speaker 1: belonging to billions of users. And if you think hackers
Speaker 1: only target large companies to get your information, you're wrong.
Speaker 1: I use Express VPN to safeguard my personal data online.
Speaker 1: According to recent reports, hackers can make up to one
Speaker 1: thousand dollars from selling someone's personal information on the dark web,
Speaker 1: making people like me and you easy lucrative targets. Express
Speaker 1: bb N is an app for your computer and phone
Speaker 1: that secures and encrypts your data so you can have
Speaker 1: peace of mind every time you go online. The app
Speaker 1: connects with just one click. It's lightning fast, and the
Speaker 1: best part is Express b p N costs less than
Speaker 1: seven bucks a month. Listen. If a breach can happen
Speaker 1: to Capital one, it can easily happen to an individual
Speaker 1: like you. Protect yourself with Express VPN, the number one
Speaker 1: VPN rated by tech Radar, c Net, the Verge, and
Speaker 1: countless others. Use my special link Express vpn dot com
Speaker 1: slash tech stuff right now to arm yourself with an
Speaker 1: extra three months of Express VPN for free. Support the
Speaker 1: show and keep your information safe. That's Express vpn dot
Speaker 1: com slash tech stuff for an extra three months free.
Speaker 1: All right, then we're back. So I promised that we
Speaker 1: were going to talk about packets. Packets is pretty simple concept.
Speaker 1: So a packet switching network. You've probably heard that term before. Uh,
Speaker 1: the Internet. When the pioneers of the Internet, we're sort
Speaker 1: of designing this thing. They thought, well, how do we
Speaker 1: make it so that information can be sent from one
Speaker 1: computer to another in such a way that if something happens,
Speaker 1: the information can continue to make its way to its
Speaker 1: destination even if there's some sort of interruption. And if
Speaker 1: it were just an uninterrupted string of data and there
Speaker 1: was an interruption, then you would have a corrupt file
Speaker 1: or you know, things would not work right, you wouldn't
Speaker 1: get what you were wanting. So they said, what if
Speaker 1: we bundled data into uh, certain sizes, We'll call it packets.
Speaker 1: The packets will have information on them that will tell
Speaker 1: the data where it needs to go, where it came from,
Speaker 1: and how it fits within all the other packets to
Speaker 1: make whatever the thing is. And since we're talking about
Speaker 1: the Internet, let's be honest, chances are it's a picture
Speaker 1: of a cat. So that cat picture is going to
Speaker 1: be a lot of different data packets and they have
Speaker 1: to put the packets together kind of like a puzzle
Speaker 1: in order to recreate that image of a cat. So
Speaker 1: that's that's what a packet is. Well, the packet because
Speaker 1: it has that information on it about where it's going
Speaker 1: and where it's from. That's what we would call metadata, right,
Speaker 1: that's the data about the data, or it's data that
Speaker 1: somehow describes the data that's inside and um and I
Speaker 1: always always try and say that the packets on the
Speaker 1: other side get reassembled Willy Wonka style like Mike TV
Speaker 1: when he goes across the camera. UM like that. Yeah,
Speaker 1: I mean it's a it's a nice way of putting it,
Speaker 1: especially since I mean that's one of my favorite films
Speaker 1: of all time, the Gene Wilder version of the not
Speaker 1: the Johnny not the Johnny Den version yet. So that's
Speaker 1: where we get the words for packets. So, a packet sniffer,
Speaker 1: as we mentioned earlier, can be software, it can be hardware,
Speaker 1: it can be a combination of the two. That is
Speaker 1: meant to sort of check out the packets that are
Speaker 1: being sent across a network, uh and get an idea
Speaker 1: of what's going on there. And one of the things
Speaker 1: someone can do if they have a packet sniffer and
Speaker 1: they know how to do it, is they can look
Speaker 1: for packets that represent essentially an unencrypted cookie or a
Speaker 1: session key. And this is essentially where a user has
Speaker 1: sent a request to log into a service of some
Speaker 1: sort uh, and if the hacker is able to sniff
Speaker 1: out that cookie, they might be able to step in
Speaker 1: and pose as that user and thus get access to
Speaker 1: the user's account or services. Um and this is sometimes
Speaker 1: referred to as side jacking. I learned a lot of
Speaker 1: hacker slang while I was doing the research. This. I'm
Speaker 1: so proud of you. I'm not good at using it,
Speaker 1: but I learned it. It's okay. You could go to
Speaker 1: def Con next year and totally fitting. Yeah, except I
Speaker 1: will be like, all right, well, I'm gonna leave all
Speaker 1: of my devices at home. Another great idea def Con
Speaker 1: for those who do not know is a information security
Speaker 1: and hacking convention where if you aren't careful, they will
Speaker 1: let you know about it. Oh yeah they do. Usually
Speaker 1: they're nice about it, and you just end up on
Speaker 1: this thing called the wall of shame. But luckily generally
Speaker 1: people don't nefariously hack each other there. It's just kind
Speaker 1: of to pop your name up on a wall of
Speaker 1: shame and that's about it. Yeah. Essentially, essentially they're saying, hey,
Speaker 1: you need to have a heads up, like whatever you're
Speaker 1: doing is not sufficient. Yeah, it's it's really more like
Speaker 1: it's really more like saying like, listen, we want you
Speaker 1: to be safe, and right now you're not being safe.
Speaker 1: So but but yeah, but still there's also the shame factor.
Speaker 1: And the more the more known you are in the sphere,
Speaker 1: I imagine, the greater the shame would be to appear
Speaker 1: on that wall. Oh yeah, definitely. So this was I've
Speaker 1: never been on the wall of shame, and I hope
Speaker 1: I never congratulations. Yeah, I've never been on the wall
Speaker 1: of shame either, But that's because I haven't gone. I
Speaker 1: am certain I would end up doing something bone headed
Speaker 1: and mess up. So you were talking earlier about how
Speaker 1: you have actually actively worked on technologies that do this
Speaker 1: this packet sniffing uh approach. Yes, yes, I have. I
Speaker 1: used to work at a company called hack five. I
Speaker 1: still do show on that channel, j K five, And
Speaker 1: our our premise for that channel is educating people who
Speaker 1: are interested in security and privacy and might want to
Speaker 1: go into information technology or penetration testing or infosec info
Speaker 1: security as a profession. So we teach young hackers how
Speaker 1: to legally use their talents to actually get a job
Speaker 1: that will help them spur the economy, help them protect
Speaker 1: companies h and help them really get involved with their passion. Um. So,
Speaker 1: one of the products that we created is something called
Speaker 1: called the WiFi Pineapple. It's a little hardware device. It's
Speaker 1: basically a router, but the software that's built into the
Speaker 1: WiFi Pineapple allows us to do things like get people
Speaker 1: to connect to a WiFi Pineapple as opposed to a
Speaker 1: regular router and allow us to sniff packets just like
Speaker 1: you were saying, um it. The product has been around
Speaker 1: for half a decade at this point. No, actually it's
Speaker 1: been almost a decade. Wow, I can't believe it's been
Speaker 1: so long. But we've gone through various revisions of it,
Speaker 1: and as security has gotten stronger, there's always been new
Speaker 1: vulnerabilities available in wireless network technology, so we've always been
Speaker 1: able to update the WiFi Pineapple to continue to educate
Speaker 1: people why it's still a good idea to not connect
Speaker 1: to public WiFi or open hotspots. And uh, it's been
Speaker 1: a wonderful education tool since we can use it as
Speaker 1: this kind of man in the middle attack for for
Speaker 1: you know, helping people understand. Yeah, and I mean, like
Speaker 1: the thing that I see people sometimes and I know
Speaker 1: you've seen it sometimes protests that like why are you
Speaker 1: making this thing? And the argument I would make to them,
Speaker 1: and I'm sure it's an argument that you guys have
Speaker 1: made numerous times, is you know that people who have
Speaker 1: bad intentions are making stuff like this already. They're they're
Speaker 1: they're doing it all the time. They're doing and they're
Speaker 1: not talking about it. They're not upfront about it because
Speaker 1: they want to take advantage of it. The reason why
Speaker 1: you guys do it is to raise awareness, to teach
Speaker 1: people how it works, and presumably they can then take
Speaker 1: that knowledge and better protect whatever their future clients might
Speaker 1: be if they end up working as a white hat hacker.
Speaker 1: And yeah, straight up, people have made their own WiFi
Speaker 1: pineapples using you know, different types of hardware and different
Speaker 1: kind of software that they've made their own. But our
Speaker 1: our products are well. Hack fives products are listed in MIST,
Speaker 1: which is the National Institute of Standards and Technologies as
Speaker 1: a wireless penetration testing device. So a lot of companies
Speaker 1: see it as a professional tool and they get their
Speaker 1: employees to purchase these items to use and make sure
Speaker 1: that their networks are protected. Because as much as you
Speaker 1: could use a WiFi Pineapple to hack somebody, you can
Speaker 1: also use it to protect yourself because you're still doing
Speaker 1: the same kind of tracking on your known network. So
Speaker 1: if I had a WiFi Pineapple on a company's network
Speaker 1: that I'm legally have access to as since that's my profession,
Speaker 1: for example, hypothetically, uh, then I could see what employees
Speaker 1: are doing on that network. So if somebody is visiting
Speaker 1: Facebook when they shouldn't be, I could see that, and
Speaker 1: I could tell them, hey, you need to you know,
Speaker 1: cut that off or you're going to get written up.
Speaker 1: Or if there was an attacker trying to gain access
Speaker 1: to a wireless network, I would be able to see
Speaker 1: those packets because they would not be what I normally see,
Speaker 1: and I would be able to protect my network because
Speaker 1: I could blacklist them then. So there's so many different
Speaker 1: ways that you can use these tools, not just nefariously
Speaker 1: like you had mentioned, but in like these amazing ways
Speaker 1: that help protect so much more than just companies, but
Speaker 1: also the employees that are working there as well. Yeah,
Speaker 1: and that, and I've always been the type to say,
Speaker 1: if if someone's outwardly talking about what their technology can do,
Speaker 1: then those are the people you should trust. It's the
Speaker 1: ones who aren't talking that you have to worry about.
Speaker 1: So yeah, it's the same thing for me when people
Speaker 1: are talking about security vulnerabilities that they found in systems,
Speaker 1: where they might come forward and say, yeah, I reported
Speaker 1: this like three months ago, the company still hasn't done
Speaker 1: anything about it. The only reason I'm coming forward is
Speaker 1: because that puts the pressure on the company to definitely
Speaker 1: make a change, because that vulnerability exists, whether they talk
Speaker 1: about it or not. Now they have to do something
Speaker 1: because the public knows about it, and and they're you know,
Speaker 1: I'm I'm fully on board with that too. I mean,
Speaker 1: I think that you always give the entity the chance
Speaker 1: to address it, but if they haven't shown any movement
Speaker 1: towards that, I think it's the responsibility of someone who's
Speaker 1: found a vulnerability to come forward with it because otherwise
Speaker 1: it's just it's just a ticking time bomb. Someone's going
Speaker 1: to take advantage of it, and then it becomes a
Speaker 1: problem far bigger than coming forward and saying, hey, guys,
Speaker 1: need to fix your stuff. And it's it's not just
Speaker 1: you know, devices like the WiFi Pineapple, but as we
Speaker 1: had mentioned, it's also software that's involved too that can
Speaker 1: do very similar type of tracking on networks. There's a
Speaker 1: technology called wire Shark, which I'll bring up not just
Speaker 1: because you know, I have no financial responsibility via hack five.
Speaker 1: So like if if you know, somebody purchases a WiFi
Speaker 1: Pineapple when they hear this talk, I don't get anything
Speaker 1: from that, no compensation whatsoever. I just do a show
Speaker 1: on that channel, So don't worry. I'm not. I don't
Speaker 1: get referrals or anything. But there's also software like wire shark,
Speaker 1: which is a free service online that anybody can download
Speaker 1: and that allows you to do packet sniffing. I've used
Speaker 1: it to test my own home network and make sure
Speaker 1: that my smart coot devices are secure and they're encrypted,
Speaker 1: and that has luckily, luckily, all of my devices are,
Speaker 1: you know, totally secure, which is wonderful. But back in
Speaker 1: the day when I first started using wire Shark, I
Speaker 1: discovered that when I was using Instagram on my phone,
Speaker 1: I could see links to the pictures that I was
Speaker 1: liking as I liked them, so as I gave them
Speaker 1: the little hearts, it would pull up a little HTTP
Speaker 1: link and I could click on that through wire Shark,
Speaker 1: and I could see exactly which pictures I was liking,
Speaker 1: which was so creepy. I mean, definitely something that you
Speaker 1: should be aware of is what kind of data is
Speaker 1: being passed through with no encryption whatsoever, and what kind
Speaker 1: of data is being encrypted too. Yeah, totally and you
Speaker 1: means crazy. You mentioned the man in the middle attack.
Speaker 1: That's that's kind of another step up, where you have
Speaker 1: a hacker that sets their machine in between a user
Speaker 1: and some other computer that might be a router. So
Speaker 1: you might actually have a man in the middle of
Speaker 1: attack where someone say at the coffee shop, and they
Speaker 1: set up uh their computer so that it appears to
Speaker 1: be the coffee shops network. There's actually ways where you
Speaker 1: can force a reboot of a system and then pose
Speaker 1: as that system so that when it does reboot, you
Speaker 1: are effectively a middleman in that relationship, and meanwhile you
Speaker 1: see all the stuff that goes across that because your
Speaker 1: computer is acting as the network spot for where where
Speaker 1: everybody's connecting through UH. So that's that's one way, but
Speaker 1: there's also ways of began doing a man in the
Speaker 1: middle of attack between a like a client and an
Speaker 1: actual service, like you know, directing people to fake bank
Speaker 1: log in pages and things. Of that nature. Um, So
Speaker 1: those are things you also have to be aware of,
Speaker 1: although that can happen pretty much in every scenario we're
Speaker 1: going to talk about. That requires you to pay close
Speaker 1: attention to what you are doing as you're browsing. UM.
Speaker 1: And I mentioned earlier about the idea that if you
Speaker 1: are using public WiFi that is password protected. Let's say
Speaker 1: you're at us coffee shop where yeah, you can log
Speaker 1: into their their WiFi, but you have to first go
Speaker 1: up to the cash regis her and find out what
Speaker 1: the password is, and then you find that out and
Speaker 1: you log in. Some people feel like that gives them
Speaker 1: that extra area of security. Honestly, that doesn't, because there's
Speaker 1: nothing stopping a hacker going into that same coffee shop
Speaker 1: getting that same password and like that. It doesn't add
Speaker 1: any like by itself, it doesn't add any extra security.
Speaker 1: It just as one extra little step. Yeah, it's true.
Speaker 1: Uh yeah, anybody even in the vicinity, if they've ever
Speaker 1: had access to that wireless password and the coffee shop,
Speaker 1: for example, has never changed the password, Like they could
Speaker 1: easily get access again with a long range antenna on
Speaker 1: the other side of a parking lot and be able
Speaker 1: to sniff what everybody in that coffee shop is doing.
Speaker 1: So yeah, I don't even use coffee shop WiFi or
Speaker 1: airport WiFi if we want to use that example. Those
Speaker 1: aren't even trustworthy exactly, and I think that those are
Speaker 1: perfect examples, especially as people are traveling a lot for
Speaker 1: the holidays. Like I that's why I think of seeing
Speaker 1: people whipping out their computers the most is airports and
Speaker 1: coffee shops. That's it, um. But yeah, if you have
Speaker 1: an encrypted network, that's better. It's again like this is
Speaker 1: another step where we're getting into uh more secure area,
Speaker 1: and we'll talk about different types of encryption in a second,
Speaker 1: but before we get to that, there's actually also a
Speaker 1: difference in the types of browsers, right. Different browsers offer
Speaker 1: different levels of features that either uh enable security and
Speaker 1: privacy or they make it really difficult to protect. So
Speaker 1: on the bad end of the scale. As the Internet
Speaker 1: Explorer for multiple reasons, it was never the best browser
Speaker 1: when it comes to security and privacy. But it's really
Speaker 1: not great now because Microsoft no longer actively supports it. UM.
Speaker 1: They will push out a security update on occasion, but
Speaker 1: it's not frequent, which means that there are a lot
Speaker 1: more opportunities for people to discover and exploit vulnerabilities and
Speaker 1: and be fairly sure that those vulnerabilities will stick around
Speaker 1: for a while. So it's not even like a rush
Speaker 1: because Microsoft isn't updating it that frequently with security patches,
Speaker 1: So that's a bad one. Don't use it. Microsoft. Microsoft
Speaker 1: Edge only slightly better than the completely unsupported Internet Explorer. Um,
Speaker 1: at least as far as privacy is concerned. Uh, I
Speaker 1: use Google Chrome a lot, but admittedly Google Chrome not
Speaker 1: great either. It's kind of on the bottom half of
Speaker 1: the middle of the pack. So, uh, they're better about security,
Speaker 1: but they are the pets when it comes to privacy.
Speaker 1: Also not a big surprise, because I mean, what's Google's business, right,
Speaker 1: Google owns you? Yeah, your data is Google's That's what
Speaker 1: Google buys and sells. It's your information, that's that's Google's currency.
Speaker 1: So clearly it does not behoove Google too lockdown privacy
Speaker 1: super tight. They want to know all the information about
Speaker 1: you they make that's how they make their money. Um. So,
Speaker 1: of all the common browsers, like the ones that are
Speaker 1: frequently used out there, the one that that tends to
Speaker 1: rank the highest is Firefox, higher than Opera higher than Chrome,
Speaker 1: higher than safari Um. So it does really well, especially
Speaker 1: for security and privacy. It can support a lot of
Speaker 1: features that protect you when you're when you're surfing stuff
Speaker 1: that will end up cutting down on things like targeted
Speaker 1: advertising because you can really limit the information that's being
Speaker 1: shared by the sites that you're visiting. UM and you
Speaker 1: can also enhance it with various add ons that you
Speaker 1: can find, although obviously anytime you're going to be adding
Speaker 1: anything to UH an ext a sting program, it pays
Speaker 1: to do your research to make sure that it is
Speaker 1: offered by a reputable and dependable app developer. Yeah, Firefox
Speaker 1: is an excellent choice UH and two fold. If you
Speaker 1: download something like Firefox, you also get a very fast
Speaker 1: browser because they have worked very hard to make that
Speaker 1: browser quick. So even if you don't care about the
Speaker 1: security and you just want to access your sites really fast,
Speaker 1: you should use Firefox. Yeah. Yeah, I got Firefox. I
Speaker 1: got stuck on Chrome because for a while Chrome was
Speaker 1: super fast and then it got super bloated. And also
Speaker 1: there's the more tabs you have opening Chrome. Anyone who's
Speaker 1: done this with Chrome knows that even though it are
Speaker 1: all supposed to be distinct instances that don't bleed over
Speaker 1: into each other. Uh, there gets to be some memory
Speaker 1: issues if you happen to be really a heavy user,
Speaker 1: and everyone here at this company is a heavy user.
Speaker 1: So Firefox is definitely going to be my browser of
Speaker 1: choice moving forward after I did this research. I also,
Speaker 1: I should point out, before I did this research, I
Speaker 1: did not know this. I was just a happy, blithe,
Speaker 1: naive Chrome user handing handing over reams of personal data
Speaker 1: to Google, which I mean, granted, I'm sure that company's
Speaker 1: board with me by now, but still there's some value
Speaker 1: there um. And then that brings us to encryption. And
Speaker 1: this encryption it gets This is sort of like complicated,
Speaker 1: like the handshake thing. But encryption, when you boil it down,
Speaker 1: is all about scrambling messages so that the only people
Speaker 1: who can access it are the ones who have the
Speaker 1: key to decode it. Right, So you have the key
Speaker 1: to encode and the key to decode. There are various
Speaker 1: implementations of that technology, different ways to have the public
Speaker 1: key and private key operations. I don't need to get
Speaker 1: into all of that because it gets way too technical. Obviously,
Speaker 1: encrypted is better than unencrypted, but not all encryption schemes
Speaker 1: are created equal and it pays use. So yes, that's
Speaker 1: very true. There's there's even like there's symmetrical keys and
Speaker 1: asymmetrical keys, and then there's like SHAW one and be
Speaker 1: crypt and r s A. There's all these different terminologies
Speaker 1: for encryption. But for what it's worth, all of them
Speaker 1: jumble up your information into some kind of format that
Speaker 1: will hopefully hopefully encrypted, so that anybody who does gain
Speaker 1: access to the encrypted version of your information will not
Speaker 1: be able to reverse engineer it or change it back
Speaker 1: to its original plain text formats, so they can't read
Speaker 1: it in like English speak, right, it would just be
Speaker 1: meaningless garbage to them, hopefully, and its ideal, ideal implementation.
Speaker 1: So one of the things that you may have encountered
Speaker 1: if you've ever set up any sort of wireless network.
Speaker 1: I think most people have, or at least they've they've
Speaker 1: had to connect to one where they've seen the different
Speaker 1: types of network security protocols. These are certifications that the
Speaker 1: WiFi Security Alliance creates, and the earliest one was the
Speaker 1: Wired Equivalent Privacy Protocol or w e p H. That
Speaker 1: one is decrepit, it's old, it's vulnerable as heck, so
Speaker 1: don't use it. Yeah, if you have the if if
Speaker 1: your router tells you, like asks you which one you
Speaker 1: want to use, don't use w ep UM. It is
Speaker 1: not secure. It is it's I mean, you could argue
Speaker 1: it's better than nothing, but not by much because the
Speaker 1: vulnerabilities have been known for a long time, in fact,
Speaker 1: so long that even before the nineties were up, you
Speaker 1: had people developing the next generation, which would have been
Speaker 1: the WiFi Protected Access or w p A. So w
Speaker 1: p A came out. Then you get w p A two,
Speaker 1: which was trying to address some of the shortcomings of
Speaker 1: w p A UH. Both of those also still have vulnerabilities.
Speaker 1: W p A two is general talked about as being
Speaker 1: one of the more secure UH certifications these days. There
Speaker 1: is a w p A three also has vulnerabilities that
Speaker 1: have pointed out within the year already. Yeah. So, but
Speaker 1: w p I, I don't think I've even seen a
Speaker 1: lot of stuff that's certified w p A three yet,
Speaker 1: Like we've we've started to see some wireless routers come
Speaker 1: out with w p A three, but they there's still
Speaker 1: a little expensive and they haven't really gotten widespread adoption
Speaker 1: by consumers quite yet so w P A two is
Speaker 1: fine for most consumers to use. You just have to
Speaker 1: make sure that you set it up correctly and you
Speaker 1: don't give the entire world access to your password for
Speaker 1: your account. Yeah that, because then there's what what were
Speaker 1: you even thinking? There's no point then? Yeah? So so
Speaker 1: w P A three on w P A two. All
Speaker 1: these are our designations. And what happens is a manufacturer
Speaker 1: will make a piece of equipment or uh either it's
Speaker 1: a computer or a handset or maybe it's a router,
Speaker 1: and then they submit it to this WiFi security alliance
Speaker 1: that then makes sure that that technology meets whatever the
Speaker 1: requirements are for the particular designation. Then they put the
Speaker 1: stamp on it and they say, yes, this is w
Speaker 1: P A two compliant or w P A three compliant.
Speaker 1: So that just tells you that compliance really there. It
Speaker 1: gets more granular than that. For example, w P A
Speaker 1: two has two different types of encryption standards that can
Speaker 1: be used. There's the bad one. It's Temporal key Integrity
Speaker 1: Protocol or t k i P, and I call it
Speaker 1: bad because yeah, t KIP. T KIP is no longer safe.
Speaker 1: Skip the t KIP. If you skip the t KIP
Speaker 1: like that. Yeah, it's nice mnemonic device. And then there's
Speaker 1: Advanced Encryption Standard or a e S, and that's the
Speaker 1: more secure of the two. So don't rely on te KIP,
Speaker 1: rely on a s U. So that will end up
Speaker 1: protecting you quite a bit as well. The encryption will
Speaker 1: end up helping a great deal because you've just made
Speaker 1: it more difficult for someone to get anything meaningful from
Speaker 1: your browsing activity. It does not mean that you are immune.
Speaker 1: But again, the harder you make it for somebody, the
Speaker 1: less chance they're gonna put forth the effort to break
Speaker 1: through whatever protections you put up. So just general note um.
Speaker 1: And then that also brings us to secure browsing. So
Speaker 1: back in the day, which was the Thursday, I don't
Speaker 1: know if you know that, Uh, there was the the
Speaker 1: Secure Sockets Layer SSL. This whenever you went to a
Speaker 1: website that had the little padlock and the lock on
Speaker 1: it and the HTTPS like, the original version of that
Speaker 1: was SSL. In fact, a lot of people still refer
Speaker 1: to SSL, even though that technically has been and has
Speaker 1: before a while been replaced by the Transport Layer Security
Speaker 1: or TLS, but the same order of purpose it's too.
Speaker 1: It's meant to create the secure channel of communication between
Speaker 1: you and a specific UH website U r L address.
Speaker 1: So if you see HTTPS, or you see that little
Speaker 1: locked padlock in the address bar of your browser, then
Speaker 1: you know you are in a secure channel between you know,
Speaker 1: your your device, and that browser, at least as far
Speaker 1: as information going between those two points are. I mean, obviously,
Speaker 1: if you're on a public WiFi hotspot that's unsecured, you've
Speaker 1: got other issues. But it means that when you're browsing,
Speaker 1: you want to make sure that that HTTPS is showing up.
Speaker 1: You don't you don't want the h T t P
Speaker 1: you want you want to make sure that S is there.
Speaker 1: So one thing I've noticed very rarely, but it has
Speaker 1: happened on occasion is where a website that requires you
Speaker 1: to log in somewhere like their main page there dot
Speaker 1: com address will be encrypted with HTTP. Yes, but as
Speaker 1: soon as you go over to the log in page
Speaker 1: or go through any tree of different sites that they
Speaker 1: have created on their dot com domain, all the rest
Speaker 1: of their pages are h T t P. They are unencrypted.
Speaker 1: So if you go to the log in page and
Speaker 1: my cat agrees, she's mewing behind me and you put
Speaker 1: in your user name and password. Those would be copied
Speaker 1: through plain text, and if anybody was, you know, tracking
Speaker 1: or sniffing your packets, they would be able to see
Speaker 1: that plane text user name and passwords. So, for example,
Speaker 1: if my password was my cat's name is Starbuck, and
Speaker 1: that was a plain text, unencrypted website just using HTTP,
Speaker 1: then if somebody was sniffing those packets, they could see
Speaker 1: that passwords show up in their software through whatever hardware
Speaker 1: device they might be using, and just be able to see, oh,
Speaker 1: she entered Starbuck, and then they could go to the
Speaker 1: website type that in and gain access to my login
Speaker 1: account information. Yeah, and that is what we call no bueno, right,
Speaker 1: like yeah, yeah and ho and more and more sites
Speaker 1: are getting better about making certain that their entire presence
Speaker 1: is being secure, but you can it's actually harder and
Speaker 1: harder to find examples websites doing that, so which I'm
Speaker 1: happy to see because that makes my job harder and
Speaker 1: that means people are listening. Uh, So, I am happy
Speaker 1: to see that less sites are doing that, but we
Speaker 1: still have issues. There's still some out there. And then
Speaker 1: occasionally you have browsers that will alert you if you
Speaker 1: try to navigate to a site that is not secure,
Speaker 1: it'll give you a little alert, which is good too,
Speaker 1: because you know, if the people on the website aren't
Speaker 1: being diligent, it at least gives the user on the
Speaker 1: other end the heads up of, Hey, you probably thought
Speaker 1: this was secure, but turns out it's not. Maybe you
Speaker 1: want to rethink that. Are you sure you want to
Speaker 1: go ahead? You will probably be eaten by a group,
Speaker 1: and then you decide what you can do it. Um Now,
Speaker 1: when we come back, we're going to talk about one
Speaker 1: other topic before we get into like the super secret stuff,
Speaker 1: and that is what the heck is incognito mode for.
Speaker 1: But before we do that, let's take another quick break. So, Shannon,
Speaker 1: I have I've I've gone to a private network, right,
Speaker 1: I'm it's not maybe mine, but it's a private ones
Speaker 1: not open to the public. It's encrypted password access. I've
Speaker 1: done all those wonderful things. And then I think, you
Speaker 1: know what, I'm gonna look at some so like your
Speaker 1: friend's house or something. Yeah, yeah, yeah, And uh, I decided,
Speaker 1: you know what I want to do. I wanna I'm
Speaker 1: gonna look at some I'm gonna look at some some
Speaker 1: stuff that I don't think my friends would really understand.
Speaker 1: Maybe maybe I'm gonna look into this that my little
Speaker 1: pony fan fiction. Uh, and I don't want my friends
Speaker 1: to know about it. So I'm like, well, I'm gonna
Speaker 1: be super sneak, gay, I'm gonna go into incognito mode. Now,
Speaker 1: no one's ever done to know. So I click on
Speaker 1: that little incognito mode and little bitty shadow Man pops up,
Speaker 1: and I'm like, oh, yeah, I'm totally safe and totally secret.
Speaker 1: Nobody knows it's me. And I start looking at my
Speaker 1: browny fan fiction. Oh you know the term. Hey, look,
Speaker 1: I wouldn't listen. Listen, you just give yourself away. Listen.
Speaker 1: Princess Celestia and I have an understanding. Okay, so we
Speaker 1: are not going to go down that road. We're not
Speaker 1: gonna go there. Like, yeah, Fluttershy and I we're like,
Speaker 1: we're tight, so we're not. It's fine, Okay, it's acceptable behavior,
Speaker 1: but no, it is acceptable, but I don't want my
Speaker 1: friend to know that. Now here's the sad thing folks
Speaker 1: on the podcast. One one, whoops, I guess there should
Speaker 1: be more secure with my data. And secondly, secondly, incognito mode.
Speaker 1: That's not how that works. It doesn't protect you from
Speaker 1: anyone who has any access to the network from seeing
Speaker 1: what you're doing, right right, that's correct. Um. Yeah, so
Speaker 1: incognito mode. Uh, you you've probably seen it on your
Speaker 1: own computer. If you go up into the menu for
Speaker 1: your regular browser and go into like the dropdown menu,
Speaker 1: there's usually an option to choose incognito mode or like
Speaker 1: secret mode or something like private browsing or whatever. Yeah,
Speaker 1: private browsing, Yeah, that's another one. Uh. So if you
Speaker 1: click that, it opens up a completely different window on
Speaker 1: your computer or on your phone as well. You can
Speaker 1: do it on your phone. Uh, and you start to browse.
Speaker 1: But basically the only thing that incognito mode is really
Speaker 1: doing is uh not putting anything into your local history
Speaker 1: or your your web browsing history, So if somebody else
Speaker 1: got it on your computer, they would not know what
Speaker 1: you were doing in incognito mode. Uh. And it also
Speaker 1: doesn't store the cookies on your computer, so any information
Speaker 1: that you were sharing with a website during your incognito
Speaker 1: mode would not be stored afterwards, So all those cookies
Speaker 1: that might have happened during a session, they'll just be erased,
Speaker 1: like you never existed that that can actually be very useful.
Speaker 1: For example, if you're looking for a fun hack, if
Speaker 1: you want to save some money on airplane flights, you
Speaker 1: can track them. You can look up airplane flight prices
Speaker 1: in incognito mode and compare them to your regular browser.
Speaker 1: And sometimes on occasion you can find cheaper prices in
Speaker 1: incognito mode because it doesn't see how much you are searching,
Speaker 1: It doesn't see how how many websites you've gone to.
Speaker 1: Those cookies just aren't it there, So the website is
Speaker 1: going to give you the best price through that that
Speaker 1: private browsing mode. Uh, that's pretty much like the most
Speaker 1: interesting thing that I use for incognito mode for But
Speaker 1: it can be used to secretly access websites without anybody
Speaker 1: else knowing that you're accessing those websites at the time.
Speaker 1: For example, if you are a Brownie. Yeah, so this
Speaker 1: works on the device level, but not the network level.
Speaker 1: So yeah, so if my friend gets hold of my
Speaker 1: phone or my computer, there would be no record of
Speaker 1: me having gone on the Browny fan fiction community site,
Speaker 1: uh where I post by q d mark. They would
Speaker 1: not be able to see that. But if they were
Speaker 1: to look at the network traffic. They'd say, huh, this
Speaker 1: I P address is going to this brownie site a lot,
Speaker 1: and it's not my computer, so it's obviously your device
Speaker 1: and so and so this is why, Like, if you
Speaker 1: were to use let's say that you're at work. Let's
Speaker 1: say you're what the example I like to give is
Speaker 1: your Let's say you are stuck in a crappy job.
Speaker 1: You're doing your job, but you're miserable and you would
Speaker 1: really love to be able to get something else, but
Speaker 1: you don't have any time outside of your job where
Speaker 1: you can really dedicate towards things like searching for job openings.
Speaker 1: So on your lunch break, you slip into incognito mode
Speaker 1: and you go on a job search website. Well, just
Speaker 1: because you're an incognito mode doesn't me that at the
Speaker 1: network level, they can't see exactly what's going on, So
Speaker 1: it doesn't actually protect what you're doing or how you're
Speaker 1: doing it. So one thing you might want to use
Speaker 1: incognito mode for if you're someone like me who does
Speaker 1: a lot of research. Let's say I'm researching into something
Speaker 1: that you know, it's it's just not my bag, you know,
Speaker 1: it's I need to do an episode about it, but
Speaker 1: it's not something I'm particularly interested in on a personal level,
Speaker 1: or might even be something that I would find very awkward.
Speaker 1: Let's say that I was doing an episode about uh,
Speaker 1: dating websites, and so I have to do a whole
Speaker 1: bunch of research on dating websites. Well, then I might
Speaker 1: want to use incognito mode so it doesn't build up
Speaker 1: this cookie history that relates back to me personally, so
Speaker 1: that maybe I log onto something like Facebook and then
Speaker 1: suddenly all the ads are for dating sites. That would
Speaker 1: be awkward, right, That would be super awkward, especially if
Speaker 1: you were married. Yes, I'm not a good thing. Yeah.
Speaker 1: I had a similar occasion with I was looking up
Speaker 1: pregnancy and birth information for somebody in my family. I'm
Speaker 1: nowhere near any time soon giving you know, birth to
Speaker 1: any children in my life except for my beautiful for
Speaker 1: babies that I have in my house with me. So
Speaker 1: I was looking up this information and I was just like,
Speaker 1: do I want Twitter on Instagram to start promoting like
Speaker 1: baby items to me or do I want them to
Speaker 1: keep on promoting like makeup in sailor moon items, which
Speaker 1: I'm actually into. So I looked up the information about
Speaker 1: pregnancy and birth for the other person through incognito mode,
Speaker 1: so that that information wouldn't actually be tracked and identified
Speaker 1: as a part of my online personality. So that way,
Speaker 1: I was able to keep the same ads that I actually,
Speaker 1: you know, sometimes kind of enjoy looking at because they
Speaker 1: do pertain to my lifestyle, but nothing that had to
Speaker 1: do with pregnancy, right. And and that's a great example too,
Speaker 1: because there was that famous example a few years ago
Speaker 1: of a retailer. Want to say it was Target, but
Speaker 1: I could be wrong, but it was a retailer Target. Yeah,
Speaker 1: and they had identified through the browsing history of a
Speaker 1: user that she was pregnant because of the things she
Speaker 1: was searching for, so they proactively sent her through the
Speaker 1: snail mail a package of coupons for pregnancy related items.
Speaker 1: And her father was the one who intercepted the letter
Speaker 1: the coupons, and she had not told him that she
Speaker 1: was pregnant, and he had assumed that Target had made
Speaker 1: this assumption and got super mad, and then turned out
Speaker 1: that he was mad about something that actually had happened.
Speaker 1: She just had not she had not had the occasion,
Speaker 1: she had not found the way to tell him. And
Speaker 1: that's awful. Uh, yeah, it's such a breach of privacy,
Speaker 1: to be honest, is when they start tracking you like
Speaker 1: that and sending you information. It's like unsolicited advertising. I
Speaker 1: hate it. We deal with it every single day. Line. Yeah,
Speaker 1: it's it's it's even worse than unsolicited advice, Like that's bad,
Speaker 1: but unsolicited advertising is even worse because they're like, yeah,
Speaker 1: they're so eager to make that sale that they can
Speaker 1: overstep very easily. Well, let's wrap up by talking about
Speaker 1: some of the more secure ways you can browse if
Speaker 1: you have to connect, and we mentioned this at the
Speaker 1: very top of the show, where VPNs are virtual private networks,
Speaker 1: and we mentioned that sort of man in the middle
Speaker 1: attack where you are logging into a hackers machine thinking
Speaker 1: that that's a legit hotspot, and then the hackers kind
Speaker 1: of relaying information and sniffing the entire time and learning
Speaker 1: all about you. Vp ns are kind of like that,
Speaker 1: but on the legit side, where you are logging into
Speaker 1: a remote server somewhere far away, probably through an encrypted connection,
Speaker 1: and then when you browse, it's as if you're browsing
Speaker 1: from the servers location, not your personal device. So if
Speaker 1: I were to blog into a VPN and then log
Speaker 1: into a web service. The web service would see my
Speaker 1: location as the location of the VPN server, not my
Speaker 1: gadget that's actually in front of me, right and not
Speaker 1: necessarily just for if you want to look at your
Speaker 1: my little pony browny fan fix. But VPNs can be
Speaker 1: extremely useful if you're trying to access a website that's
Speaker 1: only available in select countries. So if you choose to
Speaker 1: purchase like a consumer facing VPN product, and there's many
Speaker 1: out there, I could make recommendations, but they're constantly changing
Speaker 1: as far as their privacy and security terms and policies go,
Speaker 1: so I won't make any major recommendations here. But if
Speaker 1: you choose a VPN that has a a uh, for example,
Speaker 1: a country facing server that's in Japan, that means that
Speaker 1: I could download this VPN, log into it, connect through Japan,
Speaker 1: and be able to access a website that's only available
Speaker 1: to Japanese residences. UH. So I I had to do
Speaker 1: that a few years ago when I wanted to purchase
Speaker 1: tickets for the Studio Ghibli Museum through the Japanese website.
Speaker 1: It wouldn't let you access it through an American server
Speaker 1: or an American connection, so I logged in through my
Speaker 1: VPN through the Japanese server UH and I was able
Speaker 1: to purchase those tickets through the Japanese website. It thought
Speaker 1: that I was in Japan, so it let me do it,
Speaker 1: and that way I was able to save myself so
Speaker 1: much money. It was wonderful. So you can do it
Speaker 1: for you know, buying goods, buying tickets for you know,
Speaker 1: going to a concert in a different country, or a
Speaker 1: museum or something like that in a different country. You
Speaker 1: can use it to access online streaming portals that are
Speaker 1: only available in specific countries. You can use it to
Speaker 1: download specific things that are only available in specific countries.
Speaker 1: Like the list goes on and on, as far as
Speaker 1: different ways that you can use VPNs that aren't necessarily
Speaker 1: just directed for security and privacy, but are also directed
Speaker 1: at manipulating where the website thinks that you are coming from. Yeah,
Speaker 1: and this can be a matter of life and death
Speaker 1: for some people. Like here in the United States, we
Speaker 1: largely use it for the purposes of things like privacy, security,
Speaker 1: and convenience. But in other places where you might be
Speaker 1: UH in a country with a more authoritarian government, one
Speaker 1: that is far more restrictive in access to certain services.
Speaker 1: If you're able to connect through a VPN, which you know, granted,
Speaker 1: that means that that government agency hasn't been paying very
Speaker 1: close attention. But if we're able to do that, then
Speaker 1: you can log in two different things as if you
Speaker 1: were from some other part of the world and maybe
Speaker 1: get access to vital information or services that otherwise you
Speaker 1: would not have at your disposal. So they play a
Speaker 1: very important role. In fact, I gave an example today
Speaker 1: with a friend of mine about how I would see
Speaker 1: VPNs and incognito mode together being incredibly important. So imagine
Speaker 1: that this is a terrible scenario and I put that
Speaker 1: out there first, but imagine that you are in some
Speaker 1: form of abusive situation at home, and whether it's a
Speaker 1: spouse of a parent, a parent, some sort of authority figure,
Speaker 1: whatever it may be. But you're in that abusive experience,
Speaker 1: You're going to feel like you are helpless and you
Speaker 1: want to look for resources that can help you get
Speaker 1: out of that situation. But at the same time, you
Speaker 1: have a very legitimate fear of being found out for
Speaker 1: seeking out those resources and the fear of reprisal that
Speaker 1: you might face as a result of that. Well, using
Speaker 1: something like a VPN and incognito mode would mean that
Speaker 1: you're not leaving a trace on the network of what
Speaker 1: you're doing, because as far as the network is concerned,
Speaker 1: all you're doing is visiting this VPN server. It's not
Speaker 1: seeing what else you're doing. All he knows you went
Speaker 1: to that VPN server. Incognito mode means you're not leaving
Speaker 1: the trace on whatever device you're actually using to do
Speaker 1: that sort of search. So these are the sort of
Speaker 1: tools that can literally mean life or death scenario eos
Speaker 1: for people. And you know, thatsraically together and it yeah,
Speaker 1: and once you start combining those different security and privacy
Speaker 1: products together that are very consumer friendly, then you can
Speaker 1: end up having a much more secure experience online, especially
Speaker 1: if you're dealing with some kind of like like an
Speaker 1: abusive relationship or something like that that can be uh
Speaker 1: something that you seriously have to worry about, So definitely
Speaker 1: take those into consideration. Using an incognito mode and VPNs
Speaker 1: together is so easy too. It's just as simple as
Speaker 1: opening up that browser window in private browsing mode and
Speaker 1: turning on your VPN, which is usually with a lot
Speaker 1: of software nowadays, is the click of a switch in
Speaker 1: your computer and there are a lot of VPN apps
Speaker 1: out there, like there are a lot of the services
Speaker 1: where if you subscribe to the service, you can use
Speaker 1: uh your computer, or you can use a mobile device,
Speaker 1: or you can use some combination of multiples. And there
Speaker 1: are even ones where you can have it set as
Speaker 1: a fault that as soon as you connect to Wi
Speaker 1: Fi networks, you connect through the VPN, so you don't
Speaker 1: even have to think about it in that case, which
Speaker 1: is definitely good. If you're using like a mobile device
Speaker 1: and you're connecting to public WiFi frequently, you definitely want
Speaker 1: to have that that that turned on, because if you
Speaker 1: ever forget about it, that's when you're going to have
Speaker 1: the opportunities for people to take advantage of you. The
Speaker 1: last examples go ahead, I'm sorry. There's also the option
Speaker 1: to build your own VPN, but that gets very much
Speaker 1: into the nitty gritty UH since there are a lot
Speaker 1: of consumer facing ones that are generally fine for the
Speaker 1: average consumer. That's what I wouldn't normally recommend. But when
Speaker 1: I go to Defcon, for example, I bring like my
Speaker 1: own certificate, my own VPN, and my own little o
Speaker 1: VPN basically file, and I stick that on my phone
Speaker 1: to actually run my own VPN. When you do that,
Speaker 1: you're basically creating your own secure profile as opposed to
Speaker 1: trusting a VPN company with your information and hoping that
Speaker 1: they are doing it for you. Yeah. Then that's a
Speaker 1: great point, Shannon, because a lot of these solutions actually
Speaker 1: ultimately require you to put trust in another entity. And
Speaker 1: you know, there have been cases where even VPNs have
Speaker 1: suffered data breaches in recent past, where you know, you
Speaker 1: have to worry about that kind of stuff too. There
Speaker 1: does come a point where you have, ultimately you have
Speaker 1: to say to yourself, at what point am I comfortable
Speaker 1: handing over control or handing over you know, some of
Speaker 1: my data, because either you're doing that or you're doing nothing.
Speaker 1: But you know, deciding where that point is is a
Speaker 1: very personal choice. Uh. The very last one I want
Speaker 1: to talk about, and we can do this very briefly,
Speaker 1: is Tour, the Tour browser. Tour initially was an acronym
Speaker 1: instead for the Onion router. And the reason it's called
Speaker 1: Onion is because it does encryption in layers, each outer
Speaker 1: layer being another layer of encryption. And I gave a
Speaker 1: very simple analogy. Imagine that you are trying to ship
Speaker 1: a present. Let's say I'm shipping a present to Shannon,
Speaker 1: but you're welcome, But I don't want you to know
Speaker 1: where I live um for some reason, and I don't
Speaker 1: want anyone to know that I'm sending a present specifically
Speaker 1: to you for some reason. So what I've done is
Speaker 1: I've nested your package that has your present in it
Speaker 1: inside another package that's gonna go to a totally different address.
Speaker 1: And I've nested that. What's that Is it a brown package?
Speaker 1: There's probably some you know, my little Pony temporary tattoo
Speaker 1: sheets there, So that's in there, and then that's in
Speaker 1: a second package. The second package is in a third,
Speaker 1: the third packages in the fourth. Each package has a
Speaker 1: different address on it. So I've got a really big
Speaker 1: package that ultimately is just holding a bunch of boxes
Speaker 1: and a couple of sheets of temporary tattoos and the
Speaker 1: innermost box. I ship that to the first address. The
Speaker 1: person at the first address opens up this big box
Speaker 1: and they see that there's a lightly smaller box inside
Speaker 1: with a different address on it. So they plopped that
Speaker 1: back into the post office. Post office takes that to
Speaker 1: the second destination. They opened up the package. Well, Destination
Speaker 1: number two. They know that the package came from destination
Speaker 1: number one, but they don't know anything further back from that.
Speaker 1: They don't know that I was the person who originally
Speaker 1: put the package in the mail, and they don't know
Speaker 1: where the package is ultimately going to. They just see
Speaker 1: Destination three on the shipping label of that inner package,
Speaker 1: so they send it to Destination three. Destination three gets it.
Speaker 1: They opened it up. They know it came from destination too.
Speaker 1: They don't know about Destination one. They definitely don't know
Speaker 1: about me, and they see that they need to send
Speaker 1: on the next package to Destination four, and so on
Speaker 1: and so forth, until finally you get to the innermost package,
Speaker 1: which has Shannon's address on it. She gets it. She
Speaker 1: knows it came from the previous site, but doesn't know
Speaker 1: any of the rest of the history, including where it
Speaker 1: came from, except I probably put a note in the
Speaker 1: inside of the package saying, hey, it's from me, Brownie Joe,
Speaker 1: and then then she gets the package. You would probably
Speaker 1: want to make sure that your message is encrypted. Yes,
Speaker 1: there's like a you know, I tell you that you
Speaker 1: need to use your super secret Captain Crusader decoder ring
Speaker 1: or whatever to decrypt the message and then and then
Speaker 1: she would be able to to use a similar process
Speaker 1: to send information to me. Uh. Now, this is a
Speaker 1: very secure way typically of sending information. There are ways
Speaker 1: to try and sniff out things, just as there are
Speaker 1: with any network communication, but it's hard. It's very hard
Speaker 1: to get anything meaningful through this process. It is possible,
Speaker 1: it's not fool proof, but it's real hard and uh.
Speaker 1: And so this is generally considered the most secure way
Speaker 1: to browse the Internet. However, with that security there comes
Speaker 1: a tradeoff, and that tradeoff is mainly felt in the
Speaker 1: form of speed. Yes, because it's having to go through
Speaker 1: it's definitely slower. Uh. And there has been talk on
Speaker 1: on the Internet many years ago that govern ment agencies
Speaker 1: had access to some of the UM end notes, the
Speaker 1: very last place that your package would hit before it
Speaker 1: went on to whoever it was supposed to go to. UM.
Speaker 1: So you do have to consider where where is this
Speaker 1: information being sent and who has access to the very
Speaker 1: end of that tunnel that you're sending that information through
Speaker 1: UM And if that's protected, then yeah, it's great option. UM.
Speaker 1: But of course with tour as well as with VPNs
Speaker 1: and incognito mode. You shouldn't use just one of these options,
Speaker 1: you should use all of them if they are at
Speaker 1: your disposal. But again, do you want to deal with
Speaker 1: the slowness that you're going to experience when you add
Speaker 1: these additional tunnels and additional nodes onto whatever you're trying
Speaker 1: to gain access to, or are you going to deal
Speaker 1: with the security um uh minimal experience and add that
Speaker 1: additional convenience to your experience by just not using it.
Speaker 1: So there are trade offs either way, and you've summarized
Speaker 1: it perfectly, Shannon. I mean, this is like we said
Speaker 1: at the beginning, this is a spectrum, and the important
Speaker 1: thing is to be educated to that spectrum so you
Speaker 1: can make your own educated decisions and not just trust
Speaker 1: to the fates. I have a tattoo on my back
Speaker 1: of the fool tarot card, the eternal Optimist. Don't be
Speaker 1: the fool. You get the tattoo who wants pretty awesome,
Speaker 1: It's dope, But don't don't be the don't be the
Speaker 1: fool in life? Right, Don't just trust that you can
Speaker 1: take a step off a cliff and you're not going
Speaker 1: to fall to your death. The fool is taking a
Speaker 1: step off a cliff in the traditional tarot card. So
Speaker 1: you don't want to be like that. You want to
Speaker 1: be informed and make choices, and you know, there might
Speaker 1: be instances where you think, Okay, I'm in a public spot,
Speaker 1: I am going to use WiFi, but I'm using it
Speaker 1: for something that's not related to my personal information. I'm
Speaker 1: literally maybe I'm looking up a restaurant to find out
Speaker 1: what hours it's open and that it's it. You know,
Speaker 1: they're different levels. But if you're thinking i want to
Speaker 1: do some shopping, or I'm going to check my bank statement,
Speaker 1: or I'm going to log into my email or this
Speaker 1: one's a big one for us here at my heart,
Speaker 1: if I'm going to access any of my my work stuff,
Speaker 1: right like anything that's stored on there, any of the
Speaker 1: services that are on here, definitely use a VPN in
Speaker 1: those cases, because you're talking about things that affect not
Speaker 1: just you but other people. Right, You're talking about the
Speaker 1: potential of affecting uh, essentially an entire company if if
Speaker 1: the wrong information were to get out. You know, especially
Speaker 1: if you're talking about things like publicly traded companies, you
Speaker 1: want to make sure that you're being a good steward
Speaker 1: of the information that's been entrusted to you, not just
Speaker 1: your own but others. So uh, Shannon, this has been
Speaker 1: a joy. You have given generously of your time and
Speaker 1: your expertise, and I greatly appreciate it. Please let people
Speaker 1: know where they can find your work well. Thank you
Speaker 1: so much, Jonathan. I love security and privacy and I
Speaker 1: think of it as a habit that you build upon
Speaker 1: over time, and the more that you learn about it,
Speaker 1: the better off you can be in the future. So
Speaker 1: build upon your security for your future self and for
Speaker 1: your family too, because the more secure here you are,
Speaker 1: the more secure they will be as well. Uh. And
Speaker 1: if you're interested in learning more about consumer privacy and security,
Speaker 1: you can check out my YouTube channel. It's YouTube dot
Speaker 1: com slash Shannon Morse uh and that's m O R
Speaker 1: s E just like Morse Code. And I will be
Speaker 1: going to c e S just like Jonathan. Jonathan mentioned.
Speaker 1: I'm very excited, so I will be posting a lot
Speaker 1: of content from the Consumer Electronic Show and I will
Speaker 1: have tons in store through the year of awesome. Shannon's
Speaker 1: always a pleasure. I am so sad that I will
Speaker 1: not be seeing you at c E S. Will have
Speaker 1: to make time for some other tech conference. I'm sure,
Speaker 1: or next time I'm out our way, I'll give you
Speaker 1: a shout and maybe we can, like yeah, we can
Speaker 1: can go grab ramin or something and chat about security.
Speaker 1: That would be awesome. Al Right, guys, Well, if you
Speaker 1: want to reach out to me, you can reach out
Speaker 1: over our social media channels. Were on the facebooks and
Speaker 1: the twitters with text stuff hs W And that wraps
Speaker 1: this up. I hope you guys learned something and that
Speaker 1: you put that information to you. Be safe, We love you,
Speaker 1: and I'll talk to you again really soon. Text Stuff
Speaker 1: is a production of I Heart Radio's How Stuff Works.
Speaker 1: For more podcasts from my heart Radio, visit the I
Speaker 1: heart Radio app, Apple Podcasts, or wherever you listen to
Speaker 1: your favorite shows.