1 00:00:00,000 --> 00:00:04,060 You found the backup wrap up your go-to podcast for all things 2 00:00:04,080 --> 00:00:06,699 backup recovery and cyber recovery. 3 00:00:07,480 --> 00:00:11,620 In this episode, we tackle a critical security topic that every 4 00:00:11,620 --> 00:00:17,390 backup admin needs to understand, passwords versus pass keys. 5 00:00:18,200 --> 00:00:21,445 Listen, if you're still protecting your backup system with just 6 00:00:21,965 --> 00:00:23,125 usernames and passwords. 7 00:00:24,029 --> 00:00:25,249 You are asking for trouble. 8 00:00:26,150 --> 00:00:30,289 Bad actors are targeting backup systems first, and they know 9 00:00:30,360 --> 00:00:31,970 exactly what they're doing. 10 00:00:32,970 --> 00:00:37,179 Persona and I will break down the what, why traditional passwords 11 00:00:37,179 --> 00:00:38,179 aren't cutting it anymore. 12 00:00:38,800 --> 00:00:44,300 Why MFA is better but not perfect, and why pakis are probably 13 00:00:44,399 --> 00:00:45,780 the future of authentication. 14 00:00:46,640 --> 00:00:49,730 Your backup system is your last line of defense. 15 00:00:50,610 --> 00:00:53,160 Let's make sure that you're protecting it right. 16 00:00:54,260 --> 00:00:59,200 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 17 00:00:59,259 --> 00:01:04,080 Backup, and I've been passionate about backup and recovery for over 30 years. 18 00:01:04,670 --> 00:01:05,239 Ever since. 19 00:01:05,399 --> 00:01:09,240 I had to tell my boss that we had no backups of the production 20 00:01:09,479 --> 00:01:10,759 database that we had just lost. 21 00:01:11,660 --> 00:01:14,620 I don't want that to happen to you, and that's why I do this. 22 00:01:15,420 --> 00:01:20,440 On this podcast, we turn unappreciated backup admins into cyber recovery heroes. 23 00:01:21,070 --> 00:01:23,040 This is the backup wrap up. 24 00:01:36,053 --> 00:01:36,953 Welcome to the show. 25 00:01:37,373 --> 00:01:39,443 Hi, I am w Curtis Preston, AKA. 26 00:01:39,443 --> 00:01:40,343 Mr. Backup. 27 00:01:40,343 --> 00:01:46,733 I have with me a guy that I think might now be working on cars more than Me. 28 00:01:47,013 --> 00:01:48,923 Prasanna Malaiyandi, how's it going? 29 00:01:48,923 --> 00:01:49,713 Prasanna, 30 00:01:49,733 --> 00:01:51,323 am doing well, Curtis. 31 00:01:51,323 --> 00:01:54,713 Yeah, no, it, so two things. 32 00:01:55,133 --> 00:01:58,223 One, it's not my own cars, but I am learning about cars. 33 00:01:58,433 --> 00:02:01,883 I have taken an auto shop class at the local community college, which is 34 00:02:01,883 --> 00:02:07,553 amazing because as a lot of longtime listeners know, I tend to be, uh. 35 00:02:08,153 --> 00:02:12,833 I attend, or I used to attend YouTube University, which is 36 00:02:12,833 --> 00:02:14,093 what my instructor calls it. 37 00:02:14,183 --> 00:02:16,223 Basically watch a bunch of things on YouTube, 38 00:02:16,553 --> 00:02:17,093 BMA, 39 00:02:17,108 --> 00:02:17,768 that's funny. 40 00:02:17,993 --> 00:02:21,353 learn about it, but never actually do anything with that knowledge. 41 00:02:21,353 --> 00:02:25,223 So I decided to mix things up and so I decided sign up for auto class. 42 00:02:25,223 --> 00:02:27,623 So this is my second quarter doing 43 00:02:27,623 --> 00:02:28,343 chassis stuff. 44 00:02:28,343 --> 00:02:29,453 So learning how to. 45 00:02:30,158 --> 00:02:35,408 Uh, Mount Unmount tires, balance tires, patch tires, take apart 46 00:02:35,408 --> 00:02:38,558 differentials and axles in a solid axle. 47 00:02:38,978 --> 00:02:43,238 Uh, did ball joints and control arm bushings. 48 00:02:43,268 --> 00:02:47,828 Going to learn how to take, uh, remove and replace, uh, shock absorber in the truck. 49 00:02:47,828 --> 00:02:48,248 So 50 00:02:48,643 --> 00:02:49,988 That's all so cool. 51 00:02:50,588 --> 00:02:52,058 Yeah, very, very cool. 52 00:02:52,808 --> 00:02:54,818 Um, I'm a little, I'm a little jelly. 53 00:02:55,058 --> 00:03:00,638 Um, I, I, I don't have the, I don't have the time right now to, to, to do that. 54 00:03:00,638 --> 00:03:01,898 I just got too much going on. 55 00:03:01,898 --> 00:03:05,288 But, uh, uh, you know, the big thing right now, of course, all 56 00:03:05,288 --> 00:03:09,248 of my spare time is being used to try to finish my, the next book 57 00:03:09,248 --> 00:03:11,408 that, uh, uh, Dr. 58 00:03:11,408 --> 00:03:15,398 Mike Saylor and I are writing on, uh, responding to and 59 00:03:15,398 --> 00:03:17,018 recovering from ransomware. 60 00:03:17,678 --> 00:03:18,968 Um, there are. 61 00:03:19,748 --> 00:03:21,398 I, I think dozens of books 62 00:03:21,398 --> 00:03:23,408 on how to prevent from getting ransomware. 63 00:03:23,858 --> 00:03:27,068 I think we're gonna be the first book that's just about 64 00:03:27,068 --> 00:03:28,358 responding and recovering. 65 00:03:28,928 --> 00:03:32,438 And, uh, so I'm, I'm excited about that, but it is taking up all my spare time 66 00:03:32,528 --> 00:03:32,768 Yeah. 67 00:03:33,668 --> 00:03:34,748 of which I didn't have a bunch 68 00:03:34,838 --> 00:03:36,188 of anyway, you know, so, 69 00:03:36,698 --> 00:03:38,858 And, and, and and just a quick question though, uh, 70 00:03:39,038 --> 00:03:42,968 the initial comment, you're like a guy who's working more on cars than you do. 71 00:03:43,238 --> 00:03:46,058 You used to work on cars all the time 72 00:03:46,058 --> 00:03:46,298 on 73 00:03:46,403 --> 00:03:46,823 did. 74 00:03:46,823 --> 00:03:47,243 Yeah. 75 00:03:47,573 --> 00:03:47,993 You did. 76 00:03:47,993 --> 00:03:49,973 all the work on your cars before. 77 00:03:50,453 --> 00:03:53,363 It's just now your current vehicle does not require much 78 00:03:53,363 --> 00:03:54,683 maintenance, if any at all. 79 00:03:55,223 --> 00:03:56,333 Yeah. 80 00:03:56,423 --> 00:04:02,603 Um, I like the first thing that it might need me to do, I'm still 81 00:04:02,603 --> 00:04:06,803 like 120,000 miles away from probably my first break job. 82 00:04:06,833 --> 00:04:07,193 Right. 83 00:04:07,253 --> 00:04:11,153 Because, 'cause I, I have a Tesla and you don't use the brakes a lot. 84 00:04:11,153 --> 00:04:14,123 And so the brakes tend to last like 200,000 miles right now, all 85 00:04:14,123 --> 00:04:19,883 I have to do is, uh, water, uh, windshield washer and, uh, tires. 86 00:04:20,093 --> 00:04:23,093 And, uh, I do the windshield washer, but I do not do the tires. 87 00:04:23,603 --> 00:04:24,923 Um, I, yeah. 88 00:04:25,223 --> 00:04:27,653 Anyway, so, um. 89 00:04:28,823 --> 00:04:29,245 What are we talking about today? 90 00:04:29,543 --> 00:04:35,423 Yeah, today I, I've been spending a lot of time with, again, with the cyber 91 00:04:35,483 --> 00:04:42,263 side of things, and I've been learning a little bit more about the, you know, those 92 00:04:42,263 --> 00:04:46,523 those that have listened to the podcast we're like, we're like, uh, immutable 93 00:04:46,523 --> 00:04:50,993 storage, pa, password management, um, uh. 94 00:04:51,683 --> 00:04:52,313 What, what do you call it? 95 00:04:52,313 --> 00:04:53,423 Security updates and 96 00:04:53,423 --> 00:04:54,683 MFA th These 97 00:04:54,683 --> 00:04:57,653 are the things, if you did these things, then things would be so 98 00:04:57,653 --> 00:04:58,823 much, so much easier for you. 99 00:04:58,823 --> 00:04:59,183 Right. 100 00:04:59,213 --> 00:05:05,123 And, and, and, and I'm, I'm, I'm still down with that, but I'm, I think time 101 00:05:05,213 --> 00:05:10,043 enough time has passed with the new way of doing that, that I think it's 102 00:05:10,043 --> 00:05:13,463 time for us to spend a little bit of time talking about the new way 103 00:05:14,033 --> 00:05:16,793 to manage logins to a system. 104 00:05:16,913 --> 00:05:17,093 Why 105 00:05:17,093 --> 00:05:18,593 are you, you're, you're doing your thing. 106 00:05:18,923 --> 00:05:23,543 the new way is basically things that started 11 years ago or 12 years 107 00:05:23,603 --> 00:05:28,313 Yeah, but, but it's, but it's still, it's still not, for example, 108 00:05:28,313 --> 00:05:30,743 it's still not available in many 109 00:05:31,013 --> 00:05:34,583 systems and products and in other systems. 110 00:05:34,583 --> 00:05:36,443 It's only available as a third 111 00:05:36,653 --> 00:05:39,533 like a third party add-on to that product. 112 00:05:40,013 --> 00:05:40,193 And 113 00:05:40,193 --> 00:05:41,543 so it's still pretty freaking 114 00:05:41,543 --> 00:05:41,843 new. 115 00:05:42,173 --> 00:05:46,283 and I know we'll talk about it, but this is also useful because I've started seeing 116 00:05:46,283 --> 00:05:48,593 this pop up in many places and always been 117 00:05:48,593 --> 00:05:50,333 like, what is this thing? 118 00:05:50,333 --> 00:05:50,843 Why is it 119 00:05:50,843 --> 00:05:51,143 different? 120 00:05:51,143 --> 00:05:52,013 How is it different? 121 00:05:52,013 --> 00:05:55,943 So hopefully this episode, we can dive into some of those differences 122 00:05:55,943 --> 00:05:59,393 and understand, is this really good for you and should you be using it? 123 00:05:59,948 --> 00:06:00,338 Yeah. 124 00:06:00,338 --> 00:06:04,268 And, and by the way, you know, just, just to not completely bury the lead, 125 00:06:04,268 --> 00:06:05,918 we're talking about PAs keys, right? 126 00:06:05,918 --> 00:06:11,138 We're talking about Fido, um, you know, PAs keys, which fall under Fido, 127 00:06:11,438 --> 00:06:15,398 which is basically a whole other way to do authentication and authorization, 128 00:06:15,428 --> 00:06:15,788 right? 129 00:06:15,998 --> 00:06:21,248 Or, uh, would it, would it be IAM Would IAM would be the, the 130 00:06:21,248 --> 00:06:22,958 overarching term that would cover that? 131 00:06:22,958 --> 00:06:23,258 Yeah, 132 00:06:23,738 --> 00:06:24,068 Yeah. 133 00:06:25,178 --> 00:06:25,568 Okay. 134 00:06:25,568 --> 00:06:25,988 So. 135 00:06:26,513 --> 00:06:33,233 Um, we, we've made a lot of talk about that. 136 00:06:34,463 --> 00:06:39,533 If you, basically, your, your backup system is all powerful. 137 00:06:39,533 --> 00:06:43,223 Your backup system is, is I often say that your backup system is helms deep. 138 00:06:43,223 --> 00:06:44,213 Do you get that reference? 139 00:06:44,368 --> 00:06:45,203 Lord, the rings. 140 00:06:45,683 --> 00:06:46,043 Yeah. 141 00:06:46,133 --> 00:06:46,523 Yeah. 142 00:06:46,583 --> 00:06:47,453 What was Helm's deep? 143 00:06:47,453 --> 00:06:47,993 Do you remember? 144 00:06:48,158 --> 00:06:54,638 It is in the, it is basically a fortress inside of a mountain that's 145 00:06:54,638 --> 00:06:59,678 supposed to be impenetrable by pretty much anything, and it's 146 00:06:59,678 --> 00:07:02,048 supposed to be like you lock it down and no one's coming to get you. 147 00:07:02,048 --> 00:07:02,678 You will survive, 148 00:07:03,518 --> 00:07:03,908 is the, 149 00:07:03,908 --> 00:07:04,358 goal. 150 00:07:04,568 --> 00:07:04,838 Yeah. 151 00:07:04,958 --> 00:07:07,988 you watch the return of the king, like basically the battle gets 152 00:07:07,988 --> 00:07:09,398 all the way down to Helms deep. 153 00:07:09,398 --> 00:07:11,738 And like, if they get in there like the, but the battle's 154 00:07:11,738 --> 00:07:12,488 over, right? 155 00:07:12,848 --> 00:07:16,238 And the same kind of thing here that it, it's, it's the last defense. 156 00:07:16,898 --> 00:07:19,868 If you lose your backup and recovery system, your disaster 157 00:07:19,868 --> 00:07:22,328 recovery system, why even do it? 158 00:07:22,418 --> 00:07:22,838 Right? 159 00:07:23,018 --> 00:07:23,888 And so. 160 00:07:24,253 --> 00:07:29,263 I spend a lot of time trying to explain to people that, you know, sort of two things. 161 00:07:29,263 --> 00:07:34,213 One, that your backup system is absolutely a target for cyber attacks. 162 00:07:34,213 --> 00:07:38,023 In fact, uh, last night, I, I went to very cool. 163 00:07:38,023 --> 00:07:41,298 It's first, it's been going on pretty regularly and I I haven't 164 00:07:41,298 --> 00:07:47,058 gone and, but now it's my first time and it's this big cyber event in San Diego. 165 00:07:47,238 --> 00:07:48,078 It was great. 166 00:07:48,078 --> 00:07:50,418 I, I kind of like forced myself to go. 167 00:07:50,568 --> 00:07:52,308 I don't know why, because I don't know 168 00:07:52,878 --> 00:07:53,328 I didn't know 169 00:07:53,393 --> 00:07:53,873 you don't want to Yeah. 170 00:07:54,378 --> 00:07:58,128 I had very low expectations and I got there and I'm just gonna 171 00:07:58,128 --> 00:08:02,958 say this, lots of people, lots of fascinating people to talk to. 172 00:08:03,468 --> 00:08:07,278 Um, some of them thought I was one of those fascinating people to talk to. 173 00:08:07,343 --> 00:08:08,693 You just have a lot of stories. 174 00:08:08,903 --> 00:08:09,533 And more. 175 00:08:09,653 --> 00:08:10,793 Yeah, I do have a lot of stories. 176 00:08:11,183 --> 00:08:15,203 More importantly, um, uh, free food and free beer. 177 00:08:15,353 --> 00:08:18,173 So why, why did I wait so long? 178 00:08:18,293 --> 00:08:18,713 Right. 179 00:08:19,763 --> 00:08:26,603 Um, and, uh, I guess so you only got one free drink, but I managed to just 180 00:08:26,603 --> 00:08:32,753 serendipitously be standing next to the guy that had the tickets and so he was 181 00:08:32,753 --> 00:08:34,253 like, you guys want some more tickets? 182 00:08:34,373 --> 00:08:35,303 Nice. 183 00:08:35,468 --> 00:08:37,208 So I got three free beers. 184 00:08:37,838 --> 00:08:43,358 Uh, and, um, no, no, I got two free beers and then I had one that I paid for. 185 00:08:44,018 --> 00:08:48,068 And the craziest part was when they handed me the little, they 186 00:08:48,068 --> 00:08:49,868 had the little, um, the payment 187 00:08:50,438 --> 00:08:50,948 thing. 188 00:08:51,878 --> 00:08:57,728 The choices for TIP were three, five, and 7%. 189 00:08:58,358 --> 00:08:58,868 What 190 00:09:00,763 --> 00:09:01,358 I, I, I 191 00:09:01,358 --> 00:09:02,378 chose not to ask. 192 00:09:02,378 --> 00:09:03,398 I was like, okay. 193 00:09:03,608 --> 00:09:06,908 Um, anyway, I just thought that was interesting. 194 00:09:07,268 --> 00:09:11,798 But it was great and, and I got a chance to talk to some people and I, and I 195 00:09:11,798 --> 00:09:17,333 made this same comment about how much I. Um, the backup system is a target for 196 00:09:17,333 --> 00:09:21,143 ransomware, and the guy's like, oh yeah, that's, uh, he's like, I have clients. 197 00:09:21,143 --> 00:09:22,373 He goes, it happens all the time. 198 00:09:22,613 --> 00:09:25,523 They get in there and they, they, he goes, they immediately, they 199 00:09:25,523 --> 00:09:27,323 look for, and he named a vendor. 200 00:09:27,743 --> 00:09:30,323 Uh, he's like, they immediately look for this vendor and if they find 201 00:09:30,323 --> 00:09:31,403 it, they know what to do and they 202 00:09:31,403 --> 00:09:31,913 take it out. 203 00:09:31,973 --> 00:09:32,303 Right. 204 00:09:32,783 --> 00:09:33,953 Um, and so. 205 00:09:34,173 --> 00:09:37,353 I'm saying you need to understand the degree to which your backup 206 00:09:37,353 --> 00:09:42,663 system is 100% a target of ransomware and that they want to take it out. 207 00:09:42,663 --> 00:09:45,363 Because if they can take it out, then the, and, and, and this guy would, 208 00:09:45,363 --> 00:09:49,953 and, and he clarified that, that they want to do this before they do the 209 00:09:49,953 --> 00:09:52,353 payload of the actual attack. 210 00:09:52,353 --> 00:09:52,713 Right. 211 00:09:52,973 --> 00:09:53,963 Remove all the defenses. 212 00:09:54,683 --> 00:09:55,823 Exactly right. 213 00:09:56,633 --> 00:10:04,943 And so one of the things that you want to do is to make it really, really hard 214 00:10:05,663 --> 00:10:07,553 to be able to log into your backup system 215 00:10:07,943 --> 00:10:09,263 for, for an outsider, 216 00:10:09,353 --> 00:10:12,203 you don't wanna make it really, really hard for you, but you made it a little bit 217 00:10:12,203 --> 00:10:15,023 harder for you, but make it much, much harder. 218 00:10:15,533 --> 00:10:17,573 And what is, 219 00:10:17,933 --> 00:10:19,493 if people aren't doing the things. 220 00:10:20,273 --> 00:10:23,033 That we're talking about either of the things that we're talking about 221 00:10:23,033 --> 00:10:25,673 in this episode, what's the worry? 222 00:10:25,733 --> 00:10:26,453 Uh, 223 00:10:26,573 --> 00:10:27,533 Well, they'll come 224 00:10:27,533 --> 00:10:27,833 into your 225 00:10:27,948 --> 00:10:28,308 people do? 226 00:10:28,823 --> 00:10:30,083 they'll delete your backups. 227 00:10:30,083 --> 00:10:32,573 They'll set a retention time to zero days or one day, 228 00:10:33,158 --> 00:10:33,448 Yeah. 229 00:10:33,503 --> 00:10:36,653 now all your backups, your ability to recover from ransomware are gone. 230 00:10:37,013 --> 00:10:40,973 They'll disable policies, so now you're not even backing up anything anymore. 231 00:10:41,213 --> 00:10:42,773 They'll lock you out of the system. 232 00:10:42,773 --> 00:10:44,753 So they'll reset all the access. 233 00:10:45,773 --> 00:10:50,153 And then the other thing is they now know, like they could look and 234 00:10:50,153 --> 00:10:52,973 say, okay, what are the important systems in your environment? 235 00:10:53,423 --> 00:10:55,403 Because your backup system knows where everything is. 236 00:10:55,763 --> 00:10:56,093 yep. 237 00:10:56,633 --> 00:10:57,083 yep. 238 00:10:57,803 --> 00:11:01,463 Yeah, it's great for exfiltration, it's great for all kinds of things that, uh, 239 00:11:01,793 --> 00:11:03,083 by the way, that was a great answer. 240 00:11:03,083 --> 00:11:04,583 It wasn't the question I was asking, 241 00:11:04,738 --> 00:11:04,958 Oh. 242 00:11:07,223 --> 00:11:10,163 the question that I was asking, and I, and I'll, I'll answer it myself then. 243 00:11:10,673 --> 00:11:11,963 Fine, I'll do it myself. 244 00:11:12,383 --> 00:11:17,453 Uh, what I would say was the problem is if you're not using either MFA or pass 245 00:11:17,578 --> 00:11:17,798 Oh, 246 00:11:18,203 --> 00:11:21,233 Right is that someone ulti. 247 00:11:21,293 --> 00:11:24,623 Ultimately the security of your entire backup system rests on 248 00:11:24,983 --> 00:11:29,933 every single person who has super user access to that backup system. 249 00:11:30,353 --> 00:11:32,393 All it takes is one click, 250 00:11:32,963 --> 00:11:35,153 one, you know, wrong email, whatever. 251 00:11:35,298 --> 00:11:38,028 And boom, your password is exposed, 252 00:11:38,028 --> 00:11:38,268 right? 253 00:11:38,268 --> 00:11:39,498 Your username and password. 254 00:11:39,498 --> 00:11:44,988 And if all that's stopping a threat actor from logging into your backup system is 255 00:11:44,988 --> 00:11:48,048 a username and password, you are just 256 00:11:48,428 --> 00:11:48,878 asking, 257 00:11:48,878 --> 00:11:49,298 for, 258 00:11:49,728 --> 00:11:50,658 asking for it. 259 00:11:50,658 --> 00:11:51,078 Right? 260 00:11:51,468 --> 00:11:55,698 Um, and, and, and honestly, you know, 261 00:11:57,843 --> 00:12:00,078 I'm, I'm gonna have like a little bit of sympathy. 262 00:12:00,458 --> 00:12:02,288 If you get hacked because of that. 263 00:12:02,738 --> 00:12:08,168 But it's hard, it's hard for me to, to dredge up sympathy for 264 00:12:08,268 --> 00:12:08,708 Here's my 265 00:12:08,708 --> 00:12:09,668 little violin. 266 00:12:10,058 --> 00:12:10,628 what's that 267 00:12:10,748 --> 00:12:11,648 my little violin. 268 00:12:11,888 --> 00:12:12,488 pilot? 269 00:12:13,298 --> 00:12:13,778 Yeah. 270 00:12:14,048 --> 00:12:17,288 So like, like I, I do believe strong, and we've talked about this 271 00:12:17,288 --> 00:12:22,178 before, what's, what's our, we have a strong opinion on password managers. 272 00:12:22,208 --> 00:12:22,718 What are they? 273 00:12:22,778 --> 00:12:23,258 What is it? 274 00:12:23,798 --> 00:12:24,248 Use. 275 00:12:24,248 --> 00:12:24,668 Used. 276 00:12:24,668 --> 00:12:25,088 Use. 277 00:12:27,728 --> 00:12:28,058 one more. 278 00:12:28,058 --> 00:12:28,538 Use. 279 00:12:29,198 --> 00:12:31,418 You should be using a password manager if you're 280 00:12:31,418 --> 00:12:31,718 not. 281 00:12:31,718 --> 00:12:32,408 Something's wrong. 282 00:12:33,008 --> 00:12:33,398 Yeah. 283 00:12:33,578 --> 00:12:38,168 By the way, I, I, I saw a great, um, in researching for this episode, I saw a 284 00:12:38,168 --> 00:12:44,738 great quote and it was, I've never known anyone that got hacked because they 285 00:12:44,743 --> 00:12:49,448 used a password manager, but I knew all kinds of people that got hacked because 286 00:12:49,448 --> 00:12:51,248 they didn't use a password manager. 287 00:12:55,433 --> 00:12:55,883 Think about it. 288 00:12:56,033 --> 00:13:03,413 There have been password managers that have been hacked, but the, um, but for 289 00:13:03,413 --> 00:13:05,003 example, like the, the worst of course 290 00:13:05,003 --> 00:13:07,103 was the LastPass. 291 00:13:08,393 --> 00:13:12,773 It, even with that one, you had to severely misuse LastPass 292 00:13:12,953 --> 00:13:16,523 to be attacked via LastPass 293 00:13:16,793 --> 00:13:20,513 because the problem was that basically their, their, their vault got. 294 00:13:21,248 --> 00:13:21,758 Got 295 00:13:22,268 --> 00:13:26,438 accessed, compromised, but that didn't mean people got access to your 296 00:13:26,438 --> 00:13:29,948 passwords, but what they got was access to encrypted versions of your passwords. 297 00:13:30,938 --> 00:13:35,498 So as long as you had a decent password for your passwords, right, 298 00:13:35,528 --> 00:13:39,758 if you didn't have like a six, a six digit password as your you're, 299 00:13:40,358 --> 00:13:40,808 you know. 300 00:13:40,943 --> 00:13:41,933 so I will fault them. 301 00:13:41,933 --> 00:13:45,863 I know this is a long time episode ago, but one thing I will fault 302 00:13:45,863 --> 00:13:49,553 them for right, is they did use weak encryption in the initial versions. 303 00:13:50,033 --> 00:13:50,543 They did. 304 00:13:50,843 --> 00:13:53,663 an old password vault that you've had for years, right. 305 00:13:54,053 --> 00:13:57,083 It was using a weaker algorithm, which could potentially be broken 306 00:13:58,463 --> 00:13:59,993 EP potentially. 307 00:13:59,993 --> 00:14:00,293 Yeah. 308 00:14:00,323 --> 00:14:00,653 Yeah. 309 00:14:00,773 --> 00:14:04,313 But we still don't know, we don't know anybody that, yeah. 310 00:14:04,343 --> 00:14:07,253 Anyway, but, but the, so don't do that. 311 00:14:07,253 --> 00:14:09,203 Don't have a weak password and don't, you know, 312 00:14:09,233 --> 00:14:13,823 I, I would investigate that, but, and, and you know, and not all 313 00:14:13,823 --> 00:14:16,613 password managers are equal and all, that's all this kind of stuff, right. 314 00:14:16,943 --> 00:14:22,403 Um, but I do believe strongly in having a separate password for everything, 315 00:14:22,433 --> 00:14:24,053 using a separate password manager. 316 00:14:24,233 --> 00:14:26,123 I also believe strongly in not. 317 00:14:26,618 --> 00:14:30,308 And having your backup system use a completely separate IAM system 318 00:14:30,308 --> 00:14:32,678 than your production network. 319 00:14:32,738 --> 00:14:33,098 Right. 320 00:14:33,188 --> 00:14:35,648 Not having your backup systems join the domain, 321 00:14:35,648 --> 00:14:36,428 for example. 322 00:14:36,788 --> 00:14:37,178 Right. 323 00:14:37,808 --> 00:14:40,118 Which means that you're going to need something separate. 324 00:14:40,118 --> 00:14:45,908 So I'm saying buy an inexpensive password manager for the backup side, only the 325 00:14:45,908 --> 00:14:50,168 backup side, and have it be completely separate from the, you know, from your 326 00:14:50,168 --> 00:14:50,858 main side. 327 00:14:50,978 --> 00:14:51,758 have a question for you. 328 00:14:52,118 --> 00:14:52,778 Yeah. 329 00:14:52,808 --> 00:14:54,578 So you have a backup system, 330 00:14:54,578 --> 00:14:56,078 you have a password manager. 331 00:14:56,558 --> 00:15:01,598 How do you backup up the password manager for the backup system so you could 332 00:15:01,598 --> 00:15:03,743 eventually restore it if you need to? 333 00:15:04,573 --> 00:15:05,543 It's like inception. 334 00:15:05,693 --> 00:15:10,463 The, the answer, the answer to that question will be dependent 335 00:15:10,463 --> 00:15:11,513 on the password manager. 336 00:15:11,753 --> 00:15:12,173 Right? 337 00:15:14,183 --> 00:15:17,393 and we did have an episode, by the way of the. 338 00:15:17,828 --> 00:15:23,018 The catch 22 situation of how do you, how do you delete, how do you 339 00:15:23,018 --> 00:15:25,868 recover when you've lost everything, including your password manager. 340 00:15:25,898 --> 00:15:26,228 Yep. 341 00:15:27,068 --> 00:15:27,608 Um, 342 00:15:28,358 --> 00:15:28,478 With 343 00:15:28,478 --> 00:15:29,048 Suzy. 344 00:15:29,828 --> 00:15:30,308 what's that? 345 00:15:30,518 --> 00:15:31,358 With Suzy, right? 346 00:15:31,658 --> 00:15:35,438 Yeah, Susie, uh, if we, if we could, uh, if you could help me with that, pull up 347 00:15:35,438 --> 00:15:37,148 the spreadsheet and we'll get the link and 348 00:15:37,148 --> 00:15:38,678 I'll put that in the show description of it. 349 00:15:38,678 --> 00:15:40,448 That was a fascinating episode as well. 350 00:15:41,768 --> 00:15:42,608 Uh, okay. 351 00:15:42,608 --> 00:15:48,038 So generally most people are still using usernames and passwords, 352 00:15:48,398 --> 00:15:51,818 hopefully strong passwords, hopefully with a password management system. 353 00:15:51,818 --> 00:15:55,718 But even with all of that, if they're not using an additional 354 00:15:55,718 --> 00:16:02,258 factor to log in, they are still wide open to all kinds of attacks. 355 00:16:02,348 --> 00:16:02,768 Right. 356 00:16:03,458 --> 00:16:09,158 And, um, vendors, SaaS vendors are starting to see this. 357 00:16:09,818 --> 00:16:10,988 One by one. 358 00:16:10,988 --> 00:16:13,928 They are at it literally. 359 00:16:13,928 --> 00:16:18,998 This is in the last like five years, 10 to five years. 360 00:16:19,868 --> 00:16:23,648 Um, they started number one supporting MFA 361 00:16:23,708 --> 00:16:24,728 of some type. 362 00:16:25,538 --> 00:16:32,858 Number two, the better ones, um, like Google for example, require MFA. 363 00:16:33,458 --> 00:16:33,908 Right? 364 00:16:34,268 --> 00:16:35,648 Um, and um. 365 00:16:35,663 --> 00:16:37,433 And, and, and for MFA right. 366 00:16:37,433 --> 00:16:39,863 There's sort of the good, better, best. 367 00:16:40,073 --> 00:16:40,433 Right. 368 00:16:40,763 --> 00:16:43,343 Even for MFAs that you need to take into consideration. 369 00:16:45,233 --> 00:16:46,043 yeah, yeah. 370 00:16:46,073 --> 00:16:47,513 Uh uh, so we we're gonna 371 00:16:47,513 --> 00:16:47,873 cover that. 372 00:16:47,873 --> 00:16:48,473 Yeah, yeah, yeah. 373 00:16:48,683 --> 00:16:50,573 I'm just saying that that. 374 00:16:51,608 --> 00:16:54,818 There, there's sort of two things of like, number one, supporting MFA 375 00:16:55,313 --> 00:16:55,553 and they're 376 00:16:55,808 --> 00:16:59,798 I think that any decent product should be requiring it 377 00:16:59,798 --> 00:17:00,458 at this point. 378 00:17:00,998 --> 00:17:01,388 Right. 379 00:17:01,898 --> 00:17:04,808 Um, I pushed hard for that when I worked at Druva. 380 00:17:04,808 --> 00:17:04,958 Right. 381 00:17:04,958 --> 00:17:06,188 They started supporting it. 382 00:17:06,638 --> 00:17:10,028 But they, at the time, they didn't want to like force it on their 383 00:17:10,028 --> 00:17:10,718 customers. 384 00:17:10,958 --> 00:17:16,538 And I was saying force it like what customer is going to complain that 385 00:17:16,538 --> 00:17:19,658 you're forcing security on their backups. 386 00:17:20,798 --> 00:17:23,408 And, and if that, and if that is a customer, like I don't, 387 00:17:23,408 --> 00:17:24,488 I don't want that customer. 388 00:17:24,713 --> 00:17:24,773 Yeah. 389 00:17:25,778 --> 00:17:30,578 Um, but, um, I, I think that you should on anything that matters, 390 00:17:30,728 --> 00:17:32,588 you should be forcing MFA at 391 00:17:32,588 --> 00:17:33,038 this point. 392 00:17:33,068 --> 00:17:33,458 Right. 393 00:17:33,938 --> 00:17:34,418 Um. 394 00:17:34,808 --> 00:17:37,718 So what, what, what, what is MFA, uh, you, you want to just 395 00:17:37,718 --> 00:17:38,768 talk about what does that mean? 396 00:17:38,768 --> 00:17:39,248 What is, 397 00:17:39,743 --> 00:17:44,948 So, so MFA is basically multifactor authentication, so like you said, right? 398 00:17:44,948 --> 00:17:48,488 You know, your, you enter your username and password to log into a 399 00:17:48,488 --> 00:17:53,408 website, but they want to use another method as well to verify it's used. 400 00:17:53,748 --> 00:17:58,728 So it might be something like send you an email to an email address, registered 401 00:17:58,728 --> 00:18:03,948 in the system, send you a text message to a phone number registered call you. 402 00:18:04,188 --> 00:18:09,288 Um, there's also applications, authenticator, applications like 403 00:18:10,128 --> 00:18:13,458 ti, Google Authenticator, and others that you can use in order 404 00:18:13,458 --> 00:18:16,038 to provide that second factor 405 00:18:16,368 --> 00:18:20,508 to prove that, yes, this is me and not some malicious actor out there. 406 00:18:21,218 --> 00:18:21,668 Right. 407 00:18:21,698 --> 00:18:26,228 And, and the, the order, and by the way, the category of the, like the, 408 00:18:26,438 --> 00:18:30,368 the, um, the, the last category that you talked, that's called an OTP 409 00:18:30,368 --> 00:18:32,108 or a one-time password generator. 410 00:18:32,738 --> 00:18:38,348 Um, the Google Authenticator I think was the first freely available one. 411 00:18:38,378 --> 00:18:40,868 And a lot of people still refer to it as Google Authenticator, 412 00:18:40,898 --> 00:18:42,308 even if you're using like Auie, 413 00:18:42,308 --> 00:18:43,418 which is a competitor. 414 00:18:44,258 --> 00:18:45,608 Um, but. 415 00:18:45,953 --> 00:18:50,453 The, the lid, the order in which you listed them, I think would 416 00:18:50,453 --> 00:18:52,343 be the order in of goodness. 417 00:18:52,358 --> 00:18:52,558 Yeah. 418 00:18:53,123 --> 00:18:53,543 Right? 419 00:18:53,543 --> 00:18:54,563 Good, better, best. 420 00:18:54,563 --> 00:18:55,013 Right? 421 00:18:55,073 --> 00:18:57,443 Um, good is having something 422 00:18:58,283 --> 00:19:03,353 right, using your email as your additional factor, not very good at all. 423 00:19:03,383 --> 00:19:03,893 Email. 424 00:19:03,893 --> 00:19:06,118 That means if that means, if your email was hacked. 425 00:19:06,818 --> 00:19:09,998 Then your, you know, then your factor is hacked. 426 00:19:09,998 --> 00:19:10,358 Right? 427 00:19:10,778 --> 00:19:16,598 Um, and I have seen situations where the entire corporate email system was hacked 428 00:19:17,018 --> 00:19:21,488 and people, and then the, the, the backup system used email as the factor. 429 00:19:21,758 --> 00:19:24,878 And the people, they, they were again, uh, they were attacked. 430 00:19:24,908 --> 00:19:28,388 They were successfully, they successfully took over the backup 431 00:19:28,388 --> 00:19:32,888 system because they had already successfully taken over the email system. 432 00:19:33,308 --> 00:19:34,628 So email not so good. 433 00:19:35,468 --> 00:19:37,448 SMS is also not so good. 434 00:19:37,538 --> 00:19:38,198 Why is 435 00:19:38,213 --> 00:19:39,293 days, right? 436 00:19:39,308 --> 00:19:40,718 Especially the why is that? 437 00:19:40,733 --> 00:19:43,193 well, because SMSs could be. 438 00:19:43,988 --> 00:19:45,608 Um, hijacked, right? 439 00:19:45,608 --> 00:19:45,728 You 440 00:19:45,728 --> 00:19:50,498 could do a sim swap and also if you're following the latest news, right? 441 00:19:50,498 --> 00:19:54,218 Uh, many, many providers have had their SMS or actually their 442 00:19:54,218 --> 00:19:56,078 communications networks compromised, 443 00:19:56,918 --> 00:19:57,248 Right. 444 00:19:57,248 --> 00:19:59,768 And you now have the US government telling people you should use 445 00:19:59,768 --> 00:20:01,448 end-to-end encrypted applications. 446 00:20:01,733 --> 00:20:02,903 Yeah, yeah. 447 00:20:03,443 --> 00:20:07,073 Um, yeah, yeah, for anything that matters, you should totally use that. 448 00:20:07,673 --> 00:20:12,803 Um, and so I, again, either of these is better than nothing. 449 00:20:13,523 --> 00:20:17,873 So if you have a system that only supports email or SMS, then use it anyway. 450 00:20:18,413 --> 00:20:22,223 But strongly encourage that vendor, whoever they are to, to 451 00:20:22,223 --> 00:20:25,193 support, uh, uh, OTP or PAs keys. 452 00:20:25,193 --> 00:20:25,553 We're gonna get 453 00:20:25,553 --> 00:20:26,483 to PAs keys in a minute. 454 00:20:27,173 --> 00:20:32,093 So there are cases where they actually had physical hardware that 455 00:20:32,093 --> 00:20:34,643 would sort of rotate keys, right? 456 00:20:34,643 --> 00:20:37,163 And then when you want to access something, you would basically 457 00:20:37,163 --> 00:20:40,583 read the number off the key, right, and type it in to log in. 458 00:20:40,583 --> 00:20:43,223 And of course it would synchronize with the backend and all the rest. 459 00:20:43,223 --> 00:20:46,523 So it would always know like what the number should be, 460 00:20:46,823 --> 00:20:49,403 and that's kind of how you would access the system. 461 00:20:50,033 --> 00:20:50,513 Yeah. 462 00:20:50,903 --> 00:20:51,743 Not as convenient. 463 00:20:52,613 --> 00:20:53,813 not, not as convenient. 464 00:20:53,813 --> 00:20:54,203 Yeah. 465 00:20:54,233 --> 00:20:56,423 Um, but, but very secure. 466 00:20:56,453 --> 00:20:56,903 Right. 467 00:20:56,933 --> 00:21:01,373 Um, so you had to, you, in order to log in, you had to know the username and 468 00:21:01,373 --> 00:21:04,673 password, and then the, the additional factor came from the fact that you 469 00:21:04,673 --> 00:21:06,473 had physical possession of that. 470 00:21:06,863 --> 00:21:09,383 Thing that key fob Right. 471 00:21:09,653 --> 00:21:13,013 Um, and, um, and then, uh, use that, 472 00:21:13,043 --> 00:21:13,373 right? 473 00:21:13,583 --> 00:21:18,653 That did require that, um, device had to be able to be 474 00:21:18,653 --> 00:21:21,683 synchronized to a, to a clock 475 00:21:22,073 --> 00:21:26,363 so that it, so that it would know exactly when, you know the 'cause it would do like 476 00:21:26,363 --> 00:21:28,373 an extra one every 30 seconds I think. 477 00:21:28,443 --> 00:21:28,793 Okay. 478 00:21:29,318 --> 00:21:32,918 Um, and, uh, so yeah, you were, you were, you were talking about 479 00:21:32,918 --> 00:21:34,058 you, you had to be on the back 480 00:21:34,058 --> 00:21:37,358 end to, so you had to be able to know what number was gonna be on 481 00:21:37,358 --> 00:21:37,988 that device. 482 00:21:38,468 --> 00:21:40,328 That's a very, very strong factor. 483 00:21:40,328 --> 00:21:43,208 Not as convenient because you have to carry it around 484 00:21:43,433 --> 00:21:43,793 Or if 485 00:21:43,793 --> 00:21:45,953 it broke, then you couldn't log in. 486 00:21:46,058 --> 00:21:46,178 Yeah. 487 00:21:46,898 --> 00:21:47,108 Yeah. 488 00:21:47,348 --> 00:21:48,188 If it broke you. 489 00:21:48,278 --> 00:21:49,328 If you stepped on it. 490 00:21:49,748 --> 00:21:50,918 Um, yeah. 491 00:21:50,918 --> 00:21:55,628 And so that's why a lot of people, they have gone to the, uh, the OTP, you 492 00:21:55,628 --> 00:21:57,668 know, the Auie or Google Authenticator. 493 00:21:57,668 --> 00:21:58,778 That's what I Prasannally used. 494 00:21:58,778 --> 00:21:59,558 I used Auie. 495 00:22:00,038 --> 00:22:05,168 I used Google Authenticator for a while until I, um, went to, um, 496 00:22:05,588 --> 00:22:09,308 move my phones and I didn't realize that I had to like, transfer it 497 00:22:09,308 --> 00:22:10,748 while my phone was still alive. 498 00:22:10,748 --> 00:22:14,078 And I ended up having to redo all my, all my MFA. 499 00:22:15,788 --> 00:22:23,348 Um, and, um, and, and that's nice because it, it can be, uh, basically it's wherever 500 00:22:23,348 --> 00:22:25,538 you, your, your factor is kind of. 501 00:22:25,883 --> 00:22:29,873 The fact that you, you have sort of actually multiple factors because you 502 00:22:29,873 --> 00:22:31,733 have to have possession of the phone, 503 00:22:31,823 --> 00:22:35,963 the the device where this app is running and you have to be able to log into 504 00:22:35,963 --> 00:22:38,483 that phone to get to that application. 505 00:22:38,723 --> 00:22:41,153 So it's kind of like multiple factors. 506 00:22:41,483 --> 00:22:43,948 Uh, by the way, some people also refer to this as two A. 507 00:22:44,138 --> 00:22:47,183 Technically it's MFA because there could be more than 508 00:22:47,183 --> 00:22:48,233 two factors. 509 00:22:48,743 --> 00:22:51,233 Uh, but that's what some people call it was two FA 510 00:22:51,233 --> 00:22:51,983 back in the day. 511 00:22:52,583 --> 00:22:54,113 Um, and. 512 00:22:54,113 --> 00:23:02,573 I think a strong MFA with, um, with a strong password is a pretty strong, 513 00:23:02,993 --> 00:23:04,823 um, system. 514 00:23:05,153 --> 00:23:06,263 Having said that, 515 00:23:06,593 --> 00:23:09,983 there is, there is a thing called MFA exhaustion. 516 00:23:09,983 --> 00:23:10,073 Do 517 00:23:10,073 --> 00:23:10,518 you wanna talk about that? 518 00:23:11,258 --> 00:23:11,588 Yeah. 519 00:23:11,708 --> 00:23:15,038 This is basically, and we saw this in, what was that case? 520 00:23:15,038 --> 00:23:17,318 There was, was it the Okta breach? 521 00:23:17,738 --> 00:23:18,068 Right. 522 00:23:18,098 --> 00:23:18,368 Where 523 00:23:18,368 --> 00:23:19,028 basically. 524 00:23:19,838 --> 00:23:21,008 People, right? 525 00:23:21,008 --> 00:23:25,028 In the normal case, MFA is great, but bad actors have started exploiting 526 00:23:25,028 --> 00:23:29,198 this and they will try to log in and it will send an MFA request to the user. 527 00:23:29,618 --> 00:23:32,918 And sometimes it's like, okay, accept that this is me. 528 00:23:33,068 --> 00:23:35,528 And sometimes they get so tired of always seeing it. 529 00:23:35,528 --> 00:23:36,368 They're like, fine, screw it. 530 00:23:36,368 --> 00:23:36,788 I'm just gonna 531 00:23:36,788 --> 00:23:37,028 push 532 00:23:37,103 --> 00:23:37,433 Fine. 533 00:23:38,108 --> 00:23:38,708 Exactly. 534 00:23:38,768 --> 00:23:42,308 And so now they've let the bad actor into the system when they shouldn't have. 535 00:23:42,908 --> 00:23:45,278 Which is exactly what happened with the Okta hack, right? 536 00:23:45,308 --> 00:23:51,368 It was actually an inside person at Okta that essentially fell for a, a, a, uh, 537 00:23:51,368 --> 00:23:56,228 an MFA exhaustion attack, and they ended up letting the, the threat actor into 538 00:23:56,228 --> 00:24:00,128 the system and bad things happen as a 539 00:24:00,128 --> 00:24:00,878 result, right? 540 00:24:01,238 --> 00:24:09,158 Um, and so there are exploits known for MFA still way better than the alternative, 541 00:24:09,218 --> 00:24:09,698 right? 542 00:24:10,313 --> 00:24:14,453 And, and I and I, when I think about the MFA exhaustion, me, my 543 00:24:14,453 --> 00:24:18,683 brain, the way it, if I got 57 MFA requests, I'd be like, whiskey, 544 00:24:18,683 --> 00:24:20,963 tango, foxtrot, man, what is going on? 545 00:24:21,023 --> 00:24:23,243 The last thing I'm gonna do is go, yeah, yeah, yeah. 546 00:24:23,273 --> 00:24:24,773 Stop bothering me here. 547 00:24:24,773 --> 00:24:26,063 Let the person in. 548 00:24:26,063 --> 00:24:29,363 I don't, I don't understand MFA exhaustion, but 549 00:24:29,423 --> 00:24:30,833 people are gonna be people 550 00:24:30,848 --> 00:24:33,758 but it could also be the case that while you're legitimately 551 00:24:33,758 --> 00:24:34,988 trying to do something, 552 00:24:35,228 --> 00:24:38,288 you also get a bad actor trying to do something as well. 553 00:24:38,678 --> 00:24:39,428 And so you 554 00:24:39,428 --> 00:24:39,848 may be 555 00:24:39,878 --> 00:24:43,478 is true if, if there's some simultaneously and you may authenticate 556 00:24:43,478 --> 00:24:46,058 the wrong, the wrong, uh, thing. 557 00:24:46,178 --> 00:24:52,898 So there are known attacks against MFA, they are rare, uh, you know, 558 00:24:52,928 --> 00:24:53,858 et cetera, et cetera, et cetera. 559 00:24:54,428 --> 00:24:54,848 Um, 560 00:24:55,073 --> 00:24:56,123 But, but, But, that, 561 00:24:56,468 --> 00:24:56,768 what Go 562 00:24:56,963 --> 00:24:59,783 but there is one downside with MFAs, 563 00:25:00,488 --> 00:25:01,088 Which is. 564 00:25:01,343 --> 00:25:04,548 Well, assuming that you're not using a password manager. 565 00:25:05,513 --> 00:25:05,933 Right. 566 00:25:06,053 --> 00:25:07,493 You still have to remember the password. 567 00:25:08,078 --> 00:25:08,648 Yes. 568 00:25:08,693 --> 00:25:11,093 in an IT environment, you have to rotate your password. 569 00:25:11,483 --> 00:25:15,473 You're now adding password one, password two, password 570 00:25:15,473 --> 00:25:16,253 1, 2, 3, 571 00:25:16,463 --> 00:25:16,823 right? 572 00:25:16,823 --> 00:25:18,263 It's like all the variations, 573 00:25:18,263 --> 00:25:21,353 and so it's still that problem that you run into, 574 00:25:21,908 --> 00:25:25,238 So is password 1, 2, 3, that this is not, that's not a good password. 575 00:25:25,298 --> 00:25:27,383 oh, that is the best password in the world. 576 00:25:27,443 --> 00:25:28,613 It's the most popular. 577 00:25:28,793 --> 00:25:29,003 It's 578 00:25:29,003 --> 00:25:29,273 the most, 579 00:25:29,378 --> 00:25:30,338 dollar signs. 580 00:25:30,458 --> 00:25:36,248 I used dollar signs for the SI know. 581 00:25:37,778 --> 00:25:38,708 Oh, Lord. 582 00:25:38,738 --> 00:25:39,488 Yes, you're right. 583 00:25:39,488 --> 00:25:40,273 That is it. 584 00:25:40,278 --> 00:25:41,828 It is, it is. 585 00:25:42,218 --> 00:25:45,308 It's funny, like one of the, one of the things that people, there, 586 00:25:45,548 --> 00:25:52,778 there's the, um, there's the, um, the horse battery staple, uh, thing. 587 00:25:52,988 --> 00:25:53,318 Right? 588 00:25:53,318 --> 00:25:55,478 Which is a, and, and, and there. 589 00:25:56,123 --> 00:26:04,073 Story, they made a point of saying that by, um, coming up with longer 590 00:26:04,073 --> 00:26:08,903 and longer passwords and more and more complicated passwords, we made sure 591 00:26:08,903 --> 00:26:14,123 that that computers couldn't guess those passwords, but we also made 592 00:26:14,123 --> 00:26:15,713 sure that humans could never remember 593 00:26:15,713 --> 00:26:15,923 them. 594 00:26:16,343 --> 00:26:17,003 Exactly. 595 00:26:17,003 --> 00:26:17,333 So now 596 00:26:17,333 --> 00:26:19,493 you write it down on a sticky note or 597 00:26:19,913 --> 00:26:20,423 Yeah. 598 00:26:20,663 --> 00:26:21,113 Um. 599 00:26:21,173 --> 00:26:21,893 variations. 600 00:26:22,448 --> 00:26:23,198 Exactly. 601 00:26:23,258 --> 00:26:23,738 Yeah. 602 00:26:23,798 --> 00:26:27,758 Um, and I used to have a system before I went to password managers that I've 603 00:26:27,758 --> 00:26:29,918 talked about where I had like one core 604 00:26:29,918 --> 00:26:34,568 password and then I upended and pre-end the, like a shortened 605 00:26:34,568 --> 00:26:35,918 version of the domain name. 606 00:26:35,918 --> 00:26:36,188 And, you know, 607 00:26:36,188 --> 00:26:39,098 that was my, I, I had this way of having a unique password but 608 00:26:39,098 --> 00:26:40,448 without having unique password. 609 00:26:41,108 --> 00:26:45,698 Um, so if, like, if my password was password 1, 2, 3, my Gmail 610 00:26:45,698 --> 00:26:47,618 password was GM password. 611 00:26:47,618 --> 00:26:48,788 1, 2 3, GM. 612 00:26:49,403 --> 00:26:49,763 Right. 613 00:26:49,763 --> 00:26:53,093 That was a, that was a way that I did it back in the day before 614 00:26:53,093 --> 00:26:54,383 I discovered password managers. 615 00:26:54,443 --> 00:26:56,628 Could you imagine remembering all the passwords? 616 00:26:58,043 --> 00:27:02,153 I can't, I can't, I have hundreds, hundreds of accounts. 617 00:27:02,943 --> 00:27:06,633 1 thing that is starting to happen that I do like is being able to 618 00:27:06,633 --> 00:27:08,343 authenticate via, like Google. 619 00:27:08,553 --> 00:27:09,543 Um, I do like 620 00:27:09,543 --> 00:27:10,173 Apple or 621 00:27:10,593 --> 00:27:10,983 Yeah. 622 00:27:11,073 --> 00:27:11,403 Yeah. 623 00:27:12,093 --> 00:27:13,143 Um, all right. 624 00:27:13,263 --> 00:27:13,803 So, 625 00:27:14,433 --> 00:27:14,883 um. 626 00:27:15,903 --> 00:27:17,283 So passwords have some downsides. 627 00:27:17,283 --> 00:27:17,853 Remembering the 628 00:27:18,183 --> 00:27:19,023 have some downsides. 629 00:27:19,023 --> 00:27:20,343 MFA has some downsides. 630 00:27:21,423 --> 00:27:25,233 A strong statement was made when I was discussing this with a colleague 631 00:27:25,233 --> 00:27:30,693 the other day, and he said, there are no known successful attacks 632 00:27:30,873 --> 00:27:32,943 against a Fido compliance system. 633 00:27:34,143 --> 00:27:35,973 And I was like, huh. 634 00:27:36,903 --> 00:27:37,353 Right. 635 00:27:38,943 --> 00:27:42,483 And so I, I immediately had to Google Fido 636 00:27:43,443 --> 00:27:44,043 because 637 00:27:44,238 --> 00:27:44,388 this? 638 00:27:44,388 --> 00:27:44,508 Is 639 00:27:44,508 --> 00:27:45,288 this a dog? 640 00:27:45,393 --> 00:27:46,473 what Pasky were. 641 00:27:46,503 --> 00:27:48,333 I didn't know that it was called Fido. 642 00:27:48,333 --> 00:27:50,343 I didn't know that it fell under this thing called Fi 643 00:27:50,643 --> 00:27:50,913 by the 644 00:27:50,913 --> 00:27:52,233 Fido is a framework 645 00:27:52,833 --> 00:27:58,653 Fido is the framework under which Pasky fall, so Fido is a, an 646 00:27:58,653 --> 00:28:01,233 acronym for Fast Identity Online. 647 00:28:01,533 --> 00:28:01,953 Right. 648 00:28:02,313 --> 00:28:04,713 And there is a thing called the Fido Alliance. 649 00:28:04,773 --> 00:28:06,428 Um, you wanna talk about that? 650 00:28:06,828 --> 00:28:07,068 Yeah. 651 00:28:07,098 --> 00:28:11,178 So it's basically a bunch of companies where like, passwords suck, 652 00:28:11,943 --> 00:28:12,063 yeah. 653 00:28:12,288 --> 00:28:13,368 should do something better. 654 00:28:13,368 --> 00:28:16,428 So Microsoft, I don't know if you remember this with Windows 655 00:28:16,428 --> 00:28:18,198 10 or 11, they did Microsoft. 656 00:28:18,198 --> 00:28:18,318 Hello? 657 00:28:19,483 --> 00:28:19,983 Yeah. 658 00:28:20,163 --> 00:28:21,483 Trying to ditch passwords. 659 00:28:21,483 --> 00:28:21,993 This was probably 660 00:28:21,993 --> 00:28:24,153 like five years ago, six years ago, right. 661 00:28:24,153 --> 00:28:28,293 And so there's been this push because companies realize passwords are a pain, 662 00:28:28,893 --> 00:28:29,223 Yeah. 663 00:28:29,433 --> 00:28:32,103 And so there's been a push to sort of get rid of them. 664 00:28:32,583 --> 00:28:37,293 And so Fido was created and it's joined by a bunch of companies and 665 00:28:37,293 --> 00:28:43,443 organizations in order to try to eliminate passwords from the world, 666 00:28:44,133 --> 00:28:45,063 if you wanna put it that way. 667 00:28:45,063 --> 00:28:45,363 Right? 668 00:28:45,363 --> 00:28:47,223 And Fido is a framework. 669 00:28:48,243 --> 00:28:48,633 right. 670 00:28:48,858 --> 00:28:53,343 keys is just one implementation of using Fido. 671 00:28:53,913 --> 00:28:55,863 It is probably the biggest implementation, 672 00:28:55,863 --> 00:28:57,633 but it is just one implementation, 673 00:28:57,633 --> 00:28:57,993 right? 674 00:28:58,383 --> 00:29:00,993 And the idea is that you don't have to remember a password. 675 00:29:01,113 --> 00:29:03,243 Um, it, it's been interesting. 676 00:29:03,243 --> 00:29:08,733 There's been a push by some vendors to do Passwordless login that 677 00:29:08,733 --> 00:29:10,713 is very much not Fido compliant. 678 00:29:10,713 --> 00:29:12,543 I dunno if you've seen this, where I've had some. 679 00:29:13,548 --> 00:29:17,418 SaaS vendors that I'm basically, they don't want, they don't want 680 00:29:17,418 --> 00:29:18,618 you to username and password. 681 00:29:18,618 --> 00:29:21,468 They, they say, give us your email and we will send you a one-time 682 00:29:21,468 --> 00:29:22,728 password to log in. 683 00:29:22,938 --> 00:29:25,398 And I'm like, that's a single factor, 684 00:29:26,088 --> 00:29:28,578 and it's a system that could totally be hacked. 685 00:29:28,578 --> 00:29:29,958 So I, I, I hate that. 686 00:29:29,958 --> 00:29:31,368 That is not what we're talking about. 687 00:29:31,458 --> 00:29:31,848 Right. 688 00:29:32,478 --> 00:29:38,868 Um, the, the, do you want to talk a little bit about what, again, I I think 689 00:29:38,868 --> 00:29:42,048 we should state, we're now getting into. 690 00:29:43,233 --> 00:29:46,023 The, the outer reaches of our, of our technical knowledge. 691 00:29:46,023 --> 00:29:47,943 We are not cybersecurity professionals. 692 00:29:48,303 --> 00:29:49,833 We know enough to be dangerous. 693 00:29:50,133 --> 00:29:54,303 Um, and, um, and when, and if, if we were implementing something for 694 00:29:54,303 --> 00:29:55,623 somebody, we would be bringing in 695 00:29:55,623 --> 00:29:57,513 somebody like, uh, Dr. 696 00:29:57,513 --> 00:29:59,913 Mike Saylor, uh, to, to, to do 697 00:29:59,913 --> 00:30:00,333 this. 698 00:30:00,483 --> 00:30:01,593 So, so do you 699 00:30:01,593 --> 00:30:03,573 want me to walk through kind of how it works 700 00:30:03,963 --> 00:30:04,323 at a high, 701 00:30:04,383 --> 00:30:07,923 concept, first off, what, what, you know, it uses this 702 00:30:07,923 --> 00:30:10,503 concept of, of, uh, public key encryption. 703 00:30:10,593 --> 00:30:10,803 yeah. 704 00:30:10,863 --> 00:30:13,893 So let's talk about first like how normal login works, right? 705 00:30:13,893 --> 00:30:14,103 So 706 00:30:14,103 --> 00:30:17,763 normal website you're logging in, you know, your username and password. 707 00:30:18,183 --> 00:30:24,783 The, uh, hosting provider, whatever you're logging into, has a probably 708 00:30:24,783 --> 00:30:26,223 an encrypted version of that. 709 00:30:26,223 --> 00:30:26,583 And so it 710 00:30:26,583 --> 00:30:28,953 does some computation, sends it over compared and says, 711 00:30:28,953 --> 00:30:29,823 okay, you're all good to go. 712 00:30:30,543 --> 00:30:30,903 Right. 713 00:30:30,918 --> 00:30:32,208 Right now what they've 714 00:30:32,208 --> 00:30:35,868 done is, um, they've gotten rid of the password part. 715 00:30:35,918 --> 00:30:37,778 And, and there's a couple different ways, right? 716 00:30:38,018 --> 00:30:43,028 One is many of these systems, for instance, if you're using a phone, right? 717 00:30:43,028 --> 00:30:48,278 In order to access the, the private key that's stored on the phone, the phone will 718 00:30:48,608 --> 00:30:51,788 require sort of a biometric verification. 719 00:30:51,788 --> 00:30:52,208 So like 720 00:30:52,208 --> 00:30:55,958 your face, your fingerprint, maybe a passcode, potentially. 721 00:30:56,483 --> 00:30:56,873 right. 722 00:30:56,973 --> 00:31:01,503 in order to be able to unlock access to that private key in order 723 00:31:01,503 --> 00:31:02,733 to do the rest of the handshake. 724 00:31:02,733 --> 00:31:06,183 So that's sort of that second factor or the multifactor 725 00:31:06,603 --> 00:31:07,833 to prove that it is you. 726 00:31:07,833 --> 00:31:11,763 So there's a device which contains the key, and then there's the you part to 727 00:31:11,763 --> 00:31:12,333 say you are 728 00:31:12,458 --> 00:31:16,868 that, that's gonna be, you know, like you said, you either like face ID thumbprint, 729 00:31:17,438 --> 00:31:21,638 uh, passcode, depending on that, that that could be picked by the user, 730 00:31:21,938 --> 00:31:22,328 right? 731 00:31:22,598 --> 00:31:26,108 That authenticates you to that device and then the device, then the device 732 00:31:26,108 --> 00:31:28,448 authenticates you to the other system. 733 00:31:29,018 --> 00:31:29,588 Um, 734 00:31:29,588 --> 00:31:30,398 And there's 735 00:31:30,398 --> 00:31:31,268 one other thing to 736 00:31:31,268 --> 00:31:33,098 also add is the private key itself. 737 00:31:33,098 --> 00:31:37,718 So a lot of the new phones, they have a secure area that's completely 738 00:31:37,718 --> 00:31:41,123 cordoned off from everything else where this processing happens. 739 00:31:42,803 --> 00:31:48,383 So in, uh, windows desktop, it's called the TPM or Trusted Processor module. 740 00:31:48,383 --> 00:31:52,733 I think, um, on your iPhones, it's usually called like the secure 741 00:31:52,733 --> 00:31:54,203 enclave and things like that. 742 00:31:54,203 --> 00:31:58,703 So this is a very special, secure area where cryptographic functions are done 743 00:31:58,703 --> 00:32:00,293 and biometrics are being processed. 744 00:32:00,593 --> 00:32:04,043 So your biometrics are never actually sent to the server, 745 00:32:04,373 --> 00:32:04,643 Right. 746 00:32:04,643 --> 00:32:07,493 It's all run locally just to say, you are who you are. 747 00:32:07,523 --> 00:32:09,143 Okay, now I can access that private key. 748 00:32:10,163 --> 00:32:15,173 Another very popular, at least in terms of its, I've seen it a lot. 749 00:32:15,623 --> 00:32:19,433 Another implementation of this has been this company called Ubi O. 750 00:32:20,043 --> 00:32:20,463 Mm-hmm. 751 00:32:20,543 --> 00:32:22,403 And they have these things called UBI Keys. 752 00:32:22,403 --> 00:32:26,303 And they are, uh, you know, little thumb systems. 753 00:32:26,303 --> 00:32:28,133 You know, we call 'em thumb drives 'cause they, you 754 00:32:28,133 --> 00:32:29,633 pull 'em in and out with your thumb, right? 755 00:32:29,903 --> 00:32:30,983 Or, or they look like 756 00:32:31,253 --> 00:32:32,033 they look like a thumb. 757 00:32:32,393 --> 00:32:34,883 And basically it's something that plugs into the USB. 758 00:32:35,453 --> 00:32:38,813 The later ones, they actually have biometric on the device. 759 00:32:38,813 --> 00:32:42,263 Like meaning that you can put a, a, a thumbprint on the device. 760 00:32:42,593 --> 00:32:45,953 They have other ones that don't have that, which means there must be some 761 00:32:46,013 --> 00:32:48,833 authentication in software to the device. 762 00:32:49,403 --> 00:32:55,073 Um, and I. Um, what this does is this, this allows for this 763 00:32:55,073 --> 00:32:59,213 kind of authentication to happen on pretty much any computer, 764 00:32:59,573 --> 00:33:02,663 uh, either a Windows or a Mac or a Linux-based computer. 765 00:33:03,233 --> 00:33:07,463 All you need is that device and some method of authenticating 766 00:33:07,463 --> 00:33:08,543 yourself to that device. 767 00:33:09,298 --> 00:33:14,698 Um, and, and, and what I like about those is that they are incredibly affordable. 768 00:33:15,118 --> 00:33:17,068 Um, you know, I'm not, they're not a sponsor. 769 00:33:17,068 --> 00:33:20,388 I, you know, and, and there are other vendors, but what I really 770 00:33:20,388 --> 00:33:22,908 like about YubiKey is that. 771 00:33:23,578 --> 00:33:29,818 Uh, you, you can get a UV key for like, like their best UV key is like $55. 772 00:33:30,178 --> 00:33:35,248 It's a, you can buy one of them and, uh, and you can start using this with 773 00:33:35,248 --> 00:33:35,758 your, 774 00:33:35,968 --> 00:33:36,478 please don't 775 00:33:36,568 --> 00:33:37,438 in your world. 776 00:33:37,588 --> 00:33:38,968 I, I knew you were gonna say that. 777 00:33:38,968 --> 00:33:40,408 I was waiting for you to say that. 778 00:33:40,708 --> 00:33:41,728 What did you just say? 779 00:33:41,818 --> 00:33:43,198 Please don't just buy one. 780 00:33:43,798 --> 00:33:44,488 Why not? 781 00:33:44,818 --> 00:33:48,268 Because if you lose that UB key, you lose access to everything. 782 00:33:49,048 --> 00:33:50,668 They should only sell them in pairs. 783 00:33:50,728 --> 00:33:51,058 They do. 784 00:33:51,058 --> 00:33:52,258 Actually sell 'em in pairs too. 785 00:33:53,093 --> 00:33:53,383 Okay. 786 00:33:53,398 --> 00:33:53,638 Yeah. 787 00:33:54,928 --> 00:33:55,348 Yeah. 788 00:33:55,408 --> 00:33:55,798 Yeah. 789 00:33:56,128 --> 00:33:58,798 Um, so yeah, so re there are other 790 00:33:58,798 --> 00:34:00,988 companies and, um, and those 791 00:34:00,988 --> 00:34:02,308 companies are more than welcome 792 00:34:02,308 --> 00:34:04,198 to, to, to reach out to me. 793 00:34:04,798 --> 00:34:05,068 You go 794 00:34:05,278 --> 00:34:09,778 but this is also where I think like Apple, Microsoft, Google, right? 795 00:34:09,778 --> 00:34:12,178 They also all support PAs keys as well. 796 00:34:12,448 --> 00:34:16,708 And one of the benefits of going with that sort of a software based approach is they 797 00:34:16,708 --> 00:34:18,928 normally handle all the synchronization. 798 00:34:18,928 --> 00:34:22,948 So Apple as an example, they will make sure on your iCloud key chain, 799 00:34:22,948 --> 00:34:25,558 right, which stores all your pass keys and things like that, they'll 800 00:34:25,558 --> 00:34:26,938 synchronize it across your devices. 801 00:34:27,643 --> 00:34:28,453 Right, right. 802 00:34:28,453 --> 00:34:29,503 Which is very helpful. 803 00:34:29,893 --> 00:34:31,333 Um, another, um. 804 00:34:32,308 --> 00:34:36,928 Um, and again, I, I'm on the outer reaches of my, of my knowledge here, 805 00:34:37,168 --> 00:34:42,568 but I believe this also qualifies as Fido and a passkey, and that is how 806 00:34:42,568 --> 00:34:45,298 I currently log into my credit union. 807 00:34:45,868 --> 00:34:49,198 I. So my, currently, when I log into my credit union, I no longer, 808 00:34:49,228 --> 00:34:51,148 I had to switch over to this system. 809 00:34:51,868 --> 00:34:54,478 Um, and like at some point they told 810 00:34:54,478 --> 00:34:56,668 me that this is your choice, right? 811 00:34:57,238 --> 00:35:00,028 And, um, I need my username. 812 00:35:00,028 --> 00:35:03,553 I. And then I need a pin code. 813 00:35:04,003 --> 00:35:08,413 So, uh, in this case, four digits that I do need to remember the pin code. 814 00:35:09,013 --> 00:35:11,623 And then they have an app. 815 00:35:11,683 --> 00:35:16,273 In this case it's um, uh, the semantic VIP. 816 00:35:16,853 --> 00:35:20,153 App that is a one-time password generator. 817 00:35:20,543 --> 00:35:26,483 The, the, the reason why they like that, uh, versus the like Auie. 818 00:35:26,663 --> 00:35:31,943 The problem with Auie is that like, is the synchronization aspect, I think the time 819 00:35:31,943 --> 00:35:37,553 synchronization aspect, but, um, so they use, what they want me to do is they want 820 00:35:37,553 --> 00:35:43,343 me to start up the VIP app, which again, I can only access the VIP app if I'm on. 821 00:35:43,738 --> 00:35:44,338 The device 822 00:35:44,338 --> 00:35:45,478 that's been authenticated. 823 00:35:46,708 --> 00:35:50,578 Um, so I start at the, the, the VIP app, and then I put in my pin 824 00:35:50,578 --> 00:35:57,118 code followed by the six digit, um, number that is generated by the app. 825 00:35:57,268 --> 00:35:59,128 And that is my password. 826 00:35:59,638 --> 00:36:04,828 Uh, you know, it goes in the password field and that way I'm, the only thing 827 00:36:04,828 --> 00:36:07,048 I have to remember is the, the pen code. 828 00:36:07,048 --> 00:36:11,878 And I'm pretty sure this qualifies as, as, I don't know if it does or not, 829 00:36:12,133 --> 00:36:18,133 I, I, it's, so my thing with PAs keys is it's supposed to be seamless, right? 830 00:36:18,133 --> 00:36:23,443 The fact that you have to jump through these hoops, I think is one reason why 831 00:36:23,443 --> 00:36:26,113 I wouldn't say it's quite the same. 832 00:36:26,713 --> 00:36:29,563 My question is, does it qualify under Fido? 833 00:36:29,923 --> 00:36:32,023 Oh, that I don't know. 834 00:36:32,113 --> 00:36:33,553 Is it Fido compliant? 835 00:36:34,273 --> 00:36:34,843 Um, 836 00:36:35,653 --> 00:36:36,013 Because the 837 00:36:36,013 --> 00:36:36,763 process you just 838 00:36:36,883 --> 00:36:39,433 saying is, what you're saying is that you don't have to remember anything. 839 00:36:40,078 --> 00:36:41,458 Under a pasky situation. 840 00:36:41,488 --> 00:36:41,848 Right. 841 00:36:42,208 --> 00:36:44,278 The only thing I have to remember is how to authenticate to the 842 00:36:44,278 --> 00:36:45,508 device that has the thing. 843 00:36:45,928 --> 00:36:46,318 Right. 844 00:36:47,488 --> 00:36:48,148 Um, 845 00:36:48,808 --> 00:36:51,208 Right, because you don't even wanna remember, like you wanna 846 00:36:51,208 --> 00:36:52,738 remember like very minimal, right? 847 00:36:52,738 --> 00:36:55,528 And it shouldn't be something you remember per website, 848 00:36:56,548 --> 00:36:56,908 right, 849 00:36:57,088 --> 00:36:57,268 right, 850 00:36:57,268 --> 00:36:59,578 It's like your password manager, you just remember the master password. 851 00:36:59,578 --> 00:37:00,628 It remembers everything else, 852 00:37:01,438 --> 00:37:01,708 right, 853 00:37:01,858 --> 00:37:02,068 right. 854 00:37:02,068 --> 00:37:05,938 In this case, you just don't even have to remember a master password, right? 855 00:37:05,968 --> 00:37:07,798 You just bring you or whatever 856 00:37:07,798 --> 00:37:08,638 you do to log into 857 00:37:08,638 --> 00:37:09,388 your device, right? 858 00:37:10,198 --> 00:37:11,728 So here's my, so here's my question. 859 00:37:11,758 --> 00:37:15,238 If, if a Fido compliance system 860 00:37:15,538 --> 00:37:18,748 is so much better, why don't we just use it for everything? 861 00:37:19,468 --> 00:37:23,758 Like right now, I, I, I'm a backup guy and I wanna make sure that my backup system 862 00:37:23,938 --> 00:37:26,308 is, is as secure as it could possibly be. 863 00:37:26,428 --> 00:37:27,898 It sounds like Fido is better. 864 00:37:28,228 --> 00:37:31,468 Why don't I just, tomorrow I start using this for everything. 865 00:37:31,678 --> 00:37:32,818 Well, two things. 866 00:37:32,818 --> 00:37:36,178 One is the vendor needs to support Fido, right? 867 00:37:36,178 --> 00:37:36,388 So 868 00:37:36,388 --> 00:37:37,528 it's not simple, right? 869 00:37:37,528 --> 00:37:40,468 They need to actually build the mechanisms to support it. 870 00:37:40,738 --> 00:37:48,958 The other thing too is I don't know if Fido works in a non uh, connected case. 871 00:37:49,258 --> 00:37:51,778 Like if you're not connected to the internet, will it work? 872 00:37:52,588 --> 00:37:52,948 Hmm. 873 00:37:56,398 --> 00:37:59,578 Well, what scenario are you thinking of? 874 00:37:59,578 --> 00:38:02,608 Where I would be running a backup system that's not connected to the internet. 875 00:38:03,028 --> 00:38:05,068 Maybe you're in a skiff or you're 876 00:38:05,068 --> 00:38:11,458 in a, in a secure location where you don't necessarily have outside access. 877 00:38:11,458 --> 00:38:13,343 I'm sure it would work, but I just don't know. 878 00:38:14,463 --> 00:38:14,753 Yeah. 879 00:38:14,758 --> 00:38:15,148 Yeah. 880 00:38:15,958 --> 00:38:17,248 Well, I'm not sure it work. 881 00:38:17,278 --> 00:38:21,478 I think there's a pretty high chance it would work, but again, I also don't know. 882 00:38:21,748 --> 00:38:22,138 Right. 883 00:38:23,338 --> 00:38:23,938 Um, 884 00:38:24,103 --> 00:38:28,303 but us, but, but here's the other thing is I think backup vendors, or sorry, backup 885 00:38:28,303 --> 00:38:32,438 admins should be talking to their vendors and saying, please provide me pass keys. 886 00:38:33,298 --> 00:38:38,158 yeah, and, and, and you, you can tomorrow, right? 887 00:38:38,518 --> 00:38:43,978 You can start using something like UB Key to authenticate yourself if 888 00:38:43,978 --> 00:38:46,648 you've got, if you have servers, right? 889 00:38:46,828 --> 00:38:49,408 There are, there are UB key. 890 00:38:50,188 --> 00:38:55,738 Uh, implementations for Unix windows, you know, or, or Linux, windows and Mac. 891 00:38:56,038 --> 00:38:57,988 And so you could tomorrow. 892 00:38:59,083 --> 00:39:03,973 Reconfigure your logins for all of your devices that have anything to 893 00:39:03,973 --> 00:39:09,043 do with, uh, if, again, if you're using a, a traditional system 894 00:39:09,043 --> 00:39:12,883 that that is based on some sort of server you could change so that the 895 00:39:12,883 --> 00:39:18,793 o you, you can only log into the OS via UB key and, and and pass keys. 896 00:39:18,883 --> 00:39:19,273 Right? 897 00:39:19,663 --> 00:39:20,173 Um, 898 00:39:20,263 --> 00:39:22,064 and two UB keys, by the way, please. 899 00:39:22,303 --> 00:39:23,323 two UBI key two. 900 00:39:25,033 --> 00:39:27,763 Um, and then, um, and then. 901 00:39:28,528 --> 00:39:32,338 The, the harder one will be if you're using a SaaS provider, uh, you, 902 00:39:32,338 --> 00:39:34,408 you, you should be pressuring them 903 00:39:34,408 --> 00:39:36,208 to support, uh, Pasky. 904 00:39:36,258 --> 00:39:36,478 Yep. 905 00:39:37,748 --> 00:39:41,498 That's our, you know, again, we're not experts in this. 906 00:39:41,798 --> 00:39:43,658 Uh, you should talk to an expert in this. 907 00:39:44,078 --> 00:39:46,628 Um, if you like the UB key thing, check that out. 908 00:39:46,688 --> 00:39:51,038 Uh, YUBI key, uh, that's the name of the product. 909 00:39:51,158 --> 00:39:52,808 UB Co. Is the, is the company. 910 00:39:53,318 --> 00:39:55,088 Uh, UB probably stands for something. 911 00:39:55,718 --> 00:39:57,068 I don't know what it stands for. 912 00:39:57,133 --> 00:39:58,958 U You be, you'd be more secure. 913 00:39:59,108 --> 00:40:00,488 That's pretty good. 914 00:40:00,488 --> 00:40:01,883 Maybe they could use you in marketing, Curtis. 915 00:40:02,473 --> 00:40:02,763 Yeah. 916 00:40:04,208 --> 00:40:07,393 Um, the, um, it's probably, I don't know. 917 00:40:07,448 --> 00:40:11,498 I don't know where the name comes from, but, um, so all we're saying is. 918 00:40:12,338 --> 00:40:14,948 All of this is more secure than just a username and password. 919 00:40:15,458 --> 00:40:18,308 MFA's better, uh, than, than nothing. 920 00:40:18,878 --> 00:40:20,708 Uh, there's three levels, right? 921 00:40:20,708 --> 00:40:24,158 You got email, SMS and one-time password generators. 922 00:40:24,713 --> 00:40:26,978 the the latter is definitely the best. 923 00:40:27,308 --> 00:40:30,428 Um, probably the most secure is an actual key fob. 924 00:40:30,848 --> 00:40:31,898 Most people aren't gonna use that. 925 00:40:31,898 --> 00:40:34,148 Most people are gonna use it and as an app. 926 00:40:34,658 --> 00:40:36,068 Um, and then. 927 00:40:36,613 --> 00:40:41,833 The PAs keys is probably the most secure of them all, but it requires more changes 928 00:40:41,833 --> 00:40:45,223 to your, um, to your infrastructure. 929 00:40:45,673 --> 00:40:51,613 Uh, I will say that if you have servers or backup applications or 930 00:40:51,613 --> 00:40:57,493 backup storage, that doesn't require either MFA or PAs keys to log in, 931 00:40:57,673 --> 00:41:01,243 man, you need to fix that stuff now. 932 00:41:02,888 --> 00:41:03,128 Oh, 933 00:41:03,253 --> 00:41:04,093 you concur. 934 00:41:04,148 --> 00:41:05,138 yeah, Oh, definitely. 935 00:41:05,138 --> 00:41:05,408 Yeah. 936 00:41:05,468 --> 00:41:06,728 You're just a matter of time. 937 00:41:07,583 --> 00:41:09,143 Yeah, just a matter of time. 938 00:41:10,223 --> 00:41:10,733 All right. 939 00:41:10,823 --> 00:41:13,763 Once again, we managed to fill 45 minutes 940 00:41:13,763 --> 00:41:15,203 talking about something. 941 00:41:15,863 --> 00:41:19,343 In the beginning I was like, I dunno if we're gonna, if we're gonna fill 942 00:41:19,793 --> 00:41:20,003 the 943 00:41:20,048 --> 00:41:23,408 telling you, I'm telling you, we always figure out a way to fill the time. 944 00:41:24,128 --> 00:41:25,328 It's like sand or 945 00:41:25,328 --> 00:41:25,688 water. 946 00:41:25,883 --> 00:41:28,823 could be that one of us can talk forever. 947 00:41:29,933 --> 00:41:31,463 I don't know which one of us it 948 00:41:31,463 --> 00:41:31,973 would be. 949 00:41:32,243 --> 00:41:34,883 One of us definitely talks more than the 950 00:41:34,883 --> 00:41:35,333 other one. 951 00:41:37,583 --> 00:41:39,323 Anyway, I digress. 952 00:41:40,223 --> 00:41:41,403 You have a nice day Prasanna 953 00:41:41,633 --> 00:41:43,763 Thank you Curtis, and you as well. 954 00:41:43,763 --> 00:41:43,793 I. 955 00:41:44,573 --> 00:41:46,673 and, uh, I hope our 956 00:41:46,883 --> 00:41:51,383 um, our, uh, listeners have a nice day as well. 957 00:41:52,133 --> 00:41:53,213 That is a wrap. 958 00:41:57,008 --> 00:42:01,548 The backup wrap up is written, recorded, and produced by me w Curtis Preston. 959 00:42:02,288 --> 00:42:06,908 If you need backup or Dr. Consulting content generation or expert witness 960 00:42:07,018 --> 00:42:09,548 work, check out backup central.com. 961 00:42:10,168 --> 00:42:13,548 You can also find links from my O'Reilly Books on the same website. 962 00:42:14,548 --> 00:42:18,188 Remember, this is an independent podcast and any opinions that 963 00:42:18,188 --> 00:42:21,948 you hear are those of the speaker and not necessarily an employer. 964 00:42:22,728 --> 00:42:23,668 Thanks for listening.