How to protect yourself from being hacked | Chris Tarbell and Lex Fridman

[@LexClips]

Full podcast episode: kzbin.info/www/bejne/anzMgGt9h8yqes0 Lex Fridman podcast channel: kzbin.info Guest bio: Chris Tarbell is a former FBI special agent and cybercrime investigation specialist who brought down Ross Ulbricht and Silk Road, and Hector Monsegur (aka Sabu) of LulzSec and Anonymous.

[@GentlemenMonkey]

1) Putting your phone in a glass of water is pretty pointless, ruining your hardware is rarely the answer. Just turn it off, then use another device to look up how to factory reset your particular handset. Guy ruined his moms phone for no rational purpose. Your phone "making noises" isn't an indication someone is stealing your information. 2) "we're figuring out how people generate their password and it's easier to crack their password" Rainbow tables and other predictive databases haven't been a thing worth using for a hot minute. What makes a password worthwhile presently is length. 3) The Yahoo hack I presume he's talking about was done through spear phising of a Yahoo employee. Having a 16 character password with upper and lower case, numbers, special characters, a hieroglyph and the blood of a virgin wouldn't have saved anyone. Absolutely nothing the consumer side could have realistically done about this, the fault lies squarely on Yahoo. The only thing notable about this is the size of the breach, the volume of user data compromised and the inexcusable lack of security structure at Yahoo. 4) Ring wasn't hacked, not in any conventional sense. What happened was people were compromised on other services and used the same password for Ring (credential stuffing). Blaming Ring for this, in any regard, just isn't right. While Ring is certainly in the security business, they have every incentive to give people what they want and not piss off their customer. Forcing 2FA would have solved the problem but also is the least convenient option for most people, meaning they would turn it off and/or switch to a different service. Login attempt restrictions likely wouldn't have accomplished much (especially at 10 attempts) unless they were actively monitoring for a spike in incorrect user logins, which if they had monitoring like that they should have noticed the issue when it occurred anyway due to the traffic. Chris's characterization of Ring's logic is spot on, they didn't force the account security on people because it would have hurt them financially. His taking them to task for not forcing account security on people, however, is misplaced. The market drives these things, if Ring didn't accommodate then it would just be another company. 5) Again numbers and special characters are brought up. No. This is myth from a bygone era. While you could argue that technically by doing so it increases the character set, it's also so standard now that nobody running actual brute force attacks are attempting without them and the hash rate is so high that it's not meaningful in strengthening the password. Again, length is the solution. Use whatever wacky character string you want, your 8 character password can be cracked in under an hour. 6) Keyloggers: the "black market" he's referring to isn't very black. There's nothing inherently illegal about keyloggers and many other penetration "testing" devices. There are numerous places you can buy things of this nature very openly, and if you don't want to do that it's not particularly hard to make one. 7) Brief note on the OS and Mac thing. Chris is way off talking like the saving grace was kids not having access to Macs. (On a personal note, the first computer I ever "hacked" was a Macintosh 512k in 1993. I was a kid. Just saying.) The only thing helping Mac in the past still helps it now, it's security through obscurity. Mac is just repackaged Unix, there's nothing particularly wild or clever about it. What makes Mac users more safe than the average PC is that they're a minority of the market. Anyone in any kind of business given the choice of targeting most of the market or small portion of the market, same work either way, will almost always choose the larger market option. As the market share grows, so too does the incentive to attack it. The smaller it is, the less attractive it is. Chris is a likable guy and I think it's commendable that he's communicating about infosec in a non technical way but you have to get it right and he's off the mark a lot, or at least not up to date with what's going on in cybersec. Most of the time the details aren't going to meaningfully matter in a situation like this but then there's things that do, like going on about special characters making passwords stronger. That kind of misinformation creates security theater, people think they're more protected than they are. I'll have to watch the full podcast now, I'm curious if this guy is more competent than he appears in this clip, kind of feel bad nitpicking him this bad but hey, it's my industry. I get he had some big wins in catching cybercriminals but catching criminals is a different animal than defending from them. Guess he at least knew enough to get the job done and good on him for that.

[@cabanford]

Phones are generally waterproof. Quick fix for mom until he can get there and sort out properly

[@GentlemenMonkey]

@@cabanford Just turning it off is pretty quick too and doesn't require waterproofing.

[@cabanford]

@@GentlemenMonkey Sure. Just trying to imagine the tech competence of an older stressed out mum (but I agree, the glass of water trick seemed odd to me as well 🤷🏻)

[@GentlemenMonkey]

@@cabanford Well ok, I'll steel man it. Water is actually really effective at blocking communication from the average handset. In fact, that's one of the reasons we work on 2.4 GHz...as do microwaves. So, if you were ever in a situation where for some bizarre reason you couldn't turn off a phone, couldn't remove the battery and had to disrupt communication right this very second...sure, throwing it in a glass of water will probably work. Lol ok, that's my biggest, wildest positive assumption on the matter I can think of to justify it that I would bet my life savings had no part in the decision making process here. I totally get the stressed out mum notion, I would understand him telling her to do that just to settle the matter and get her to calm down. I'm being judgemental about it because Chris framed it as him overreacting, and that's a wild overreaction for someone who is supposed to be a cybersecurity professional. I appreciate Chris catching the bad guys and all, but as a techy I did a lot of head shaking watching this. I'm probably overly critical given that, but communicating tech correctly is important to me.

[@cabanford]

@@GentlemenMonkey I totally agree. Can't imagine he's nearly as tech savvy as Lex.

[@tylerkarlberg3473]

Living in a fraternity house taught me to sign out of my computer. Even if your just going for a glass of water, log out, or someone might mess with your stuff haha. It's been more than a decade and I haven't shook that habit

[@HandMeDeals]

The MySpace Era helped me learn to logout

[@brettlaw4346]

Hopefully, people are learning not to mess with other people's systems. That was basically what the movie War Games was about. You might think you're playing a game but the consequences can be apocalyptic.

[@PseudoProphet]

90% of hacking is just basic phishing. 😅😅

[@buddystewart2020]

I get phising emails all the damn time.

[@RobertSimons-w5y]

Spearfishing is a lot more advanced

[@PAXch.]

Yeah most hackers wouldn’t put in all the effort to do much else against a random person

[@wartem]

If your phone is already hacked, how is the time difference between putting it in a glass of water VS turning it off and factory reset, going to matter?

[@adriangibbs]

Seriously. Maybe a Faraday bag would help in certain scenarios.

[@TitusAzzurro]

Data doesn't teleport out of the phone. Throwing it into the water is the fastest way to stop the transfer.

[@micomator]

Because putting in a glass is quicker than communicating to your sixty year old mother how to factory reset her phone.

[@wartem]

@@micomator Good point

[@jojojo9240]

@@micomator isnt it about how long it takes to turn it off?

[@ambermullins6158]

Lex is always on point with his emotions, his attire, and his outlook on helping others.

[@akreation]

1:48 bad guys are making portfolios out of people 1:58 We are making a dossier on each person

[@gdgd5194]

Exposed ha ha ha

[@A9GalaxyOfficial]

Imagine being in the FBI and not knowing what a rubber ducky is 🤣 he’s on the level of just calling it a keylogger. This is why learning from a book and having a degree, doesn’t mean jack. Knowledge is key, stay woke!

[@BarisPalabiyik]

Isn't when you log in with your google account, twitter account, by all the providers i mean, the database doesn't hold your connected provider's password, so hacked database would only provide them with your social media e-mail, name, profile picture maybe and that's it. I use those platform authorization/authentication patterns in my apps.

[@cgme9535]

You are correct. With secure databases, the most that will ever be stored is a hashed password of your password. And that password will also be “salted” as to thwart password cracking with something like a rainbow table. While there are ways to get around this, like a Birthday Attack, it is an extremely secure way of “storing” passwords.

[@cgme9535]

Also, if you’re referring to OIDC, which is when you use a Google account, or a similar account, to sign into another website, then you are also correct. Those use tokens between the sites to authenticate. The passwords are not shared.

[@BarisPalabiyik]

@@cgme9535 Yeah, the guy wanted the make it a big deal out of it. I don't wanna say he is full of it, since I appreciate what he's doing, but, that kind of statements shy away people from using these very secure way of auth options.

[@rebornsmith7542]

I thought they whacked Tony in the last episode while Journey was in the second chorus.

[@scottteh3170]

literally no mention of MFA

[@cgme9535]

He did talk about Ring not having 2FA activated by default.

[@harackmw]

At my workplace people laughed at me when I even had a password for my work computer, one guy even said "What you got on there? Porn? LOL"

[@HolyClownFuckarus]

Yes tons bro 😎

[@j.dunlop8295]

Alien porn, NSA stuff, that's AI driven 🎉

[@brozbro]

"Change your password" and then they hack the company and steal ALL the usernames/passwords.

[@144Donn]

1. Don't "smart home" your home 2. Don't have financial services connected\on to your phone. 3. Don't do financial services\transfer etc on your PC\electronically If you have no PW there is no PW to steal. I amazed at how banks have not only left doors open but they create new electronic pathways through which thieves can enter.

[@koool56]

Thats just not feesiable in todays world, if would take me hours to make a transaction in person

[@theuzlivid]

Procceeds to turn off anti virus and firewall for 3 percent performnace boost😂

[@rightleft4901]

Phone in a glass of water? Sounds like The worst idea ever.

[@cabanford]

Pet peeve - "I'm sorry, but your password can't be more than 8 characters" Grrrr

[@tehf00n]

Funny how he said if you doxx yourself you aren't a target at that point. Because that's what I did for the same reason.

[@PD55_]

Hey Lex, why is Julian Assange still rotting in jail?

[@phaexus]

I wonder how secure two-step authentication is? I this on my important stuff and use different passwords on different sites, but I almost never change my passwords.

[@RCohle452]

The methods of hacking are as diverse as the hackers.

[@astralfluxaf]

Never click a link••• Learn how typical phishing tactics work••• Learn the type of language most hackers use.

[@gdgd5194]

Ok now we know how to not get hacked but what about slashed?

[@buddystewart2020]

Well, at least I do have a different pw for everything I have to log into. Many are generated for me by my pw vault. I do have to keep them in a pw vault because there's no way I can remember them all. So, if I'm away from my desktop, there's no way I'm getting into some of that stuff. I can remember the ones I use the most though.

[@alifnaufal]

aren't there many pw vault apps that support sync between desktop and mobile phones?

[@buddystewart2020]

@@alifnaufal ... there probably are

[@koool56]

@@buddystewart2020 I love Bitwaden , they allow you to include 2FA too. Using password Vault is kind of risky, if it gets hacked all your passwords are known now. However I see the vault being compromised as much less likely scenario then the services I am using being compromised.

[@myprobate1661]

Most secure operating system is probably..... Commodore basic.

[@boso1998]

It’s funny how out of touch these guys are “put your phone inside of water” 😂😂😂😂😂😂 like what?

[@j.dunlop8295]

Old hackers never die, they're just made fun of and ignored, till they arrest you? 😅 LoL! 🎉

[@stellofornia]

Lex has he personality of Siri

[@TonicofSonic]

I once accidentally clicked on a KZbin ad. 😔

[@Mel-px2ru]

This guy is dropping how to hack 101 😂

[@roninstormYT]

yea well how do we protect our emails then i was told from a friend you can protect your phone from a government site it block the spam calls what program can save our emails and protect them this is getting annoying i keep getting my epic games account hacked i have 2fa on and on my email he by pass it dont know how he was able too by pass 2fa on email and epic games account the hell

[@JoakimWesterbring]

Dell (Michael)

[@HumanBeingsRThinkingBeings]

Mind Begs the Question: Pegasus - Hacks into iOS,Android Apple,Google - design iOS,Android Apple,Google - if leave door open,don't fix Apple,Google - not responsible,culpable?

[@vicheakeng6894]

TOO LATE JANUARY 24,2021

[@anFy81]

nice! as a pc user with bot level it skills I appreciate this!

[@boso1998]

“It used to be called google dorking…now it’s called google hacking….” No it’s not 😂😂😂😂 it’s still called google dorking. This is just laughable.

[@br2266]

Secure the shit out of it. - fbi. Good advice.

[@DoNotForget45180]

It never too late 😢😅

[@harankarthick5589]

Yeah great tip from FBI. Sure.

[@skeginaldp1533]

MFA guys.

[@vicheakeng6894]

GOOGLE, SAMSUNG, Microsoft. I want to say but OUTDATED SOFTWARE. 1/24/2021. MI C E TRAP 3.0... ?..BACK UP DESK TOP. SITIN MYLAB TOP. BLACKBERRY, ANDROID. INTERNATIONAL BUSINESS MANAGEMENT SOFTWARE AND....

[@darkmoneybrandon24]

Ok I needed this information the second I knew that Russia is besties with china

[@TheNuscas]

What happens when the passenger manager software itself gets hacked? E.g. LastPass

[@markorodic7531]

🃏

[@ianpatrick23]

Oof

[@draunsk]

How boring is Lex….has to be a tool of the matrix