1 00:00:00,170 --> 00:00:03,950 You found the backup wrap up your go-to podcast for all things 2 00:00:03,950 --> 00:00:06,319 backup recovery and cyber recovery. 3 00:00:06,830 --> 00:00:09,680 In this episode, we're talking about some research that some 4 00:00:09,680 --> 00:00:11,930 folks did into password managers. 5 00:00:12,530 --> 00:00:17,605 A new paper out of Zurich took a look at LastPass, bit Warden and Dashlane. 6 00:00:18,185 --> 00:00:20,974 And they found some pretty significant vulnerabilities 7 00:00:21,005 --> 00:00:22,565 in their core architecture. 8 00:00:22,955 --> 00:00:28,355 Not bad code or sloppy programming, but actually a fundamental design flaw. 9 00:00:29,285 --> 00:00:33,335 I'm still a fan by the way, but you need to understand what these vulnerabilities 10 00:00:33,335 --> 00:00:38,435 are, why they exist, and what you should be doing right now to protect yourself. 11 00:00:38,915 --> 00:00:42,545 We also talk about, uh, pass keys and whether or not they're 12 00:00:42,605 --> 00:00:43,880 actually the answer to this problem. 13 00:00:45,005 --> 00:00:49,415 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 14 00:00:49,415 --> 00:00:53,435 Backup, and I've been passionate about backup and recovery ever since. 15 00:00:53,975 --> 00:00:57,965 Uh, I had to tell my boss that there were no backups of the, uh, production 16 00:00:57,965 --> 00:00:59,555 database that we had just lost. 17 00:00:59,945 --> 00:01:02,584 I don't want that to happen to you, and that's why I do this. 18 00:01:02,915 --> 00:01:07,415 On this podcast, we turn unappreciated admins into Cyber Recovery Heroes. 19 00:01:07,745 --> 00:01:09,755 This is the backup wrap up. 20 00:01:24,732 --> 00:01:26,052 Welcome to the backup wrap up. 21 00:01:26,052 --> 00:01:29,652 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with 22 00:01:29,652 --> 00:01:32,682 me a guy that seems to remember my podcast better than Me. 23 00:01:32,952 --> 00:01:34,452 Prasanna Malaiyandi. 24 00:01:34,482 --> 00:01:34,842 How's it going? 25 00:01:34,842 --> 00:01:35,262 Persona. 26 00:01:36,117 --> 00:01:36,687 I'm good. 27 00:01:36,687 --> 00:01:38,757 This is why you keep me around, Curtis, 28 00:01:38,877 --> 00:01:40,287 Well, it's literally the only reason. 29 00:01:40,557 --> 00:01:44,032 There are no other reasons to, to keep you around. 30 00:01:45,092 --> 00:01:45,312 Uh, 31 00:01:45,927 --> 00:01:47,037 I'm like your second brain. 32 00:01:47,037 --> 00:01:49,797 You know how they talk about ai, and AI is gonna be your second 33 00:01:49,797 --> 00:01:54,747 brain or doppelganger and be able to replace you, your digital twin. 34 00:01:54,867 --> 00:01:55,167 That's a 35 00:01:55,227 --> 00:01:55,467 yeah. 36 00:01:55,587 --> 00:02:01,257 Um, I would really like to see you pass as me, sir. I just want to just wanna see. 37 00:02:03,717 --> 00:02:05,547 By the way, there's a bumper sticker for you. 38 00:02:06,837 --> 00:02:08,367 I, I've seen that one before. 39 00:02:08,577 --> 00:02:09,237 Have you seen it? 40 00:02:09,267 --> 00:02:09,627 Okay. 41 00:02:10,077 --> 00:02:10,437 Yes, I 42 00:02:10,677 --> 00:02:15,447 Uh, it says, first of all, I'm a delight and it has a a, a possum. 43 00:02:16,317 --> 00:02:20,487 so for people who may not realize, we also do video. 44 00:02:20,487 --> 00:02:21,027 So if you go to 45 00:02:21,182 --> 00:02:21,472 Yeah. 46 00:02:21,567 --> 00:02:23,877 search for the backup wrapup, you can actually see us and 47 00:02:23,877 --> 00:02:24,777 what Curtis is drinking. 48 00:02:24,777 --> 00:02:26,727 Show people your mug that you got for your birthday. 49 00:02:27,342 --> 00:02:30,972 Uh, it's my mug that I got from my birthday, which is I came, I 50 00:02:30,972 --> 00:02:33,072 saw, I forgot what I was doing. 51 00:02:33,342 --> 00:02:36,732 I went back, I got distracted. 52 00:02:36,912 --> 00:02:39,372 When did I turn 60? 53 00:02:39,492 --> 00:02:39,912 Yeah. 54 00:02:39,972 --> 00:02:41,172 Is this my cup? 55 00:02:41,892 --> 00:02:42,192 What? 56 00:02:42,852 --> 00:02:43,722 What's going on? 57 00:02:43,812 --> 00:02:47,172 I have to pee, by the way, uh, I'm having to read this backwards for 58 00:02:47,172 --> 00:02:48,792 the, for the record on my side. 59 00:02:48,792 --> 00:02:49,932 I have to read this backwards. 60 00:02:50,892 --> 00:02:52,572 I'm not, I'm, I'm able to read. 61 00:02:52,632 --> 00:02:54,672 I just thought that was important to, to distinguish. 62 00:02:56,712 --> 00:02:58,272 Uh, so 63 00:02:58,467 --> 00:02:59,157 So what are we gonna 64 00:02:59,292 --> 00:03:03,642 Ana, once again, we talk a lot on this show about password 65 00:03:03,642 --> 00:03:06,822 managers and I do think, you know, good, better, best, right? 66 00:03:06,822 --> 00:03:09,912 We talk a lot about good, better, best, and we, we, and we, and we say that 67 00:03:09,912 --> 00:03:11,952 you should have a password manager. 68 00:03:11,982 --> 00:03:13,692 And then there's always the, you know, there's always 69 00:03:13,692 --> 00:03:14,952 that one person in the crowd. 70 00:03:14,952 --> 00:03:17,082 It's like, well, what if the bedroom manager get hacked? 71 00:03:17,082 --> 00:03:17,412 You know? 72 00:03:18,162 --> 00:03:18,612 And 73 00:03:20,832 --> 00:03:22,002 that's what they sound like to me. 74 00:03:23,322 --> 00:03:28,182 Uh, and, and, and, and I, you know, and, and with, with, with one 75 00:03:28,182 --> 00:03:32,142 exception, you know what I used to say was I, I, I don't know anyone. 76 00:03:32,142 --> 00:03:34,482 I know plenty of people that got hacked because they didn't have 77 00:03:34,482 --> 00:03:37,332 a password manager, but I didn't know anyone who ever got hacked 78 00:03:37,332 --> 00:03:38,802 because they had a password manager. 79 00:03:39,042 --> 00:03:41,982 Now I know a handful of people because of what happened to 80 00:03:41,982 --> 00:03:43,452 LastPass a couple of years ago. 81 00:03:43,452 --> 00:03:44,562 Was that a couple of years ago? 82 00:03:44,772 --> 00:03:45,342 Was that a year ago? 83 00:03:45,557 --> 00:03:46,997 A couple years ago at this point. 84 00:03:46,997 --> 00:03:47,177 Yeah. 85 00:03:47,867 --> 00:03:53,147 Where, uh, I I, it, it had to do with backups, right? 86 00:03:53,177 --> 00:03:56,357 Where they, where they, they had hard coded the password. 87 00:03:56,357 --> 00:04:00,797 The, uh, you know, they had hard coded a password and that 88 00:04:00,857 --> 00:04:02,057 allowed some people to get in. 89 00:04:02,057 --> 00:04:06,767 And then that, that allowed them access to the encrypted vaults, which they then, um. 90 00:04:07,767 --> 00:04:09,807 Did brute force attacks against, right. 91 00:04:09,897 --> 00:04:14,247 Uh, and they were able to get into some, especially older vaults that 92 00:04:14,247 --> 00:04:16,017 use some older encryption and stuff. 93 00:04:16,107 --> 00:04:22,017 Um, and the, and so I'm still a very, even, even after the, the, the thing 94 00:04:22,017 --> 00:04:25,227 that we're gonna talk about today, I'm still a strong proponent and 95 00:04:25,227 --> 00:04:31,107 I know that, uh, our, our regular guest, uh, my co-author, uh, Dr. 96 00:04:31,107 --> 00:04:34,962 Mike Sailor, co-author of this little book right here, learning ransomware. 97 00:04:35,157 --> 00:04:35,457 Yeah. 98 00:04:35,562 --> 00:04:36,732 Response and recovery. 99 00:04:37,152 --> 00:04:40,332 Um, I know he also is a big fan of password managers. 100 00:04:40,782 --> 00:04:45,972 Um, and as we're going to cover in this episode, the password managers 101 00:04:45,972 --> 00:04:53,202 I think are the best option for the current, like to, to deal with all of 102 00:04:53,202 --> 00:04:55,332 the legacy technology that we have. 103 00:04:56,157 --> 00:04:57,747 Still moving forward. 104 00:04:58,287 --> 00:05:04,857 I think we all agree that fido compliant pass keys are definitely the, the 105 00:05:04,857 --> 00:05:07,257 current best option for the future. 106 00:05:07,617 --> 00:05:13,017 Uh, for, well for now, but it does require change on your part. 107 00:05:13,017 --> 00:05:16,917 And I, I think if you take nothing away from this episode. 108 00:05:17,607 --> 00:05:21,147 Go do passkeys anywhere you can, anywhere it matters. 109 00:05:21,832 --> 00:05:22,052 Um, 110 00:05:22,287 --> 00:05:23,007 But, but, but, 111 00:05:23,222 --> 00:05:23,512 okay. 112 00:05:25,017 --> 00:05:32,037 I don't think pass keys will replace the issue that we are about to talk about 113 00:05:32,037 --> 00:05:40,522 with password managers because you could still use managers that support pass keys. 114 00:05:43,617 --> 00:05:44,157 Uh. 115 00:05:49,227 --> 00:05:49,677 Uh, 116 00:05:50,337 --> 00:05:50,727 as an 117 00:05:50,817 --> 00:05:51,237 yeah, 118 00:05:51,237 --> 00:05:52,167 supports passkey, 119 00:05:52,917 --> 00:05:53,307 but, 120 00:05:53,517 --> 00:05:53,877 so I 121 00:05:53,907 --> 00:05:54,147 but. 122 00:05:54,207 --> 00:05:58,797 but I think though Passkey itself is tied to a device, so that makes it more secure 123 00:05:59,157 --> 00:05:59,517 Yeah. 124 00:05:59,547 --> 00:06:00,327 Yeah. 125 00:06:00,387 --> 00:06:03,117 I, I think that I, that, that, that's the, that's the thing with 126 00:06:03,147 --> 00:06:04,407 passkey that make it different. 127 00:06:05,277 --> 00:06:09,687 So, so I, I'm just, I'm, I'm, I'm even though with your, with your, once 128 00:06:09,687 --> 00:06:12,957 again, giving me the read why I'm wrong. 129 00:06:13,347 --> 00:06:17,367 Um, I'm, I, I stand by, I stand by my original statement. 130 00:06:17,472 --> 00:06:19,212 to make sure it's a clarification pass. 131 00:06:19,212 --> 00:06:23,262 Keys are great, but pass keys does not mean password managers are not required. 132 00:06:23,262 --> 00:06:26,712 Pass keys help alleviate the issue about stolen credentials. 133 00:06:28,347 --> 00:06:29,097 Yes. 134 00:06:29,217 --> 00:06:29,667 Right. 135 00:06:29,697 --> 00:06:30,087 Okay. 136 00:06:31,467 --> 00:06:33,897 Uh, so what are we talking about pana? 137 00:06:33,927 --> 00:06:35,752 What are we, what, what, what started this whole thing? 138 00:06:35,952 --> 00:06:37,812 about your book or coffee cup. 139 00:06:37,812 --> 00:06:39,402 That coffee cup was pretty awesome. 140 00:06:41,172 --> 00:06:43,002 No, but, okay, so today, right? 141 00:06:43,002 --> 00:06:45,132 Like Curtis said, we always talk about password managers. 142 00:06:45,522 --> 00:06:50,112 We've even had, I think he was a researcher from the University of York 143 00:06:50,632 --> 00:06:50,832 Yeah. 144 00:06:51,342 --> 00:06:55,542 I wanna say like three years ago, who actually did an analysis 145 00:06:55,542 --> 00:06:58,422 of various password managers and found six vulnerabilities. 146 00:06:58,422 --> 00:07:00,912 So like password managers are not. 147 00:07:01,617 --> 00:07:04,467 Some magical thing that's like bulletproof and secure all the time, right? 148 00:07:04,467 --> 00:07:08,757 It's constantly being tested and validated to make sure there are no vulnerabilities 149 00:07:08,757 --> 00:07:11,397 that allow exposure of your credentials. 150 00:07:11,727 --> 00:07:14,157 Especially 'cause people put important things in their 151 00:07:14,157 --> 00:07:18,867 password manager, including the password their crypto wallets, 152 00:07:19,527 --> 00:07:19,857 Right. 153 00:07:20,067 --> 00:07:20,577 so, 154 00:07:21,087 --> 00:07:24,837 And as we know from the guy that accidentally threw away his crypto wallet, 155 00:07:25,557 --> 00:07:27,867 uh, that would be really important. 156 00:07:28,512 --> 00:07:29,082 Yes, 157 00:07:29,277 --> 00:07:30,027 to the crypto wallet. 158 00:07:30,147 --> 00:07:30,357 Yeah. 159 00:07:31,062 --> 00:07:36,072 And so recently an article came out from, I think it's been circling 160 00:07:36,072 --> 00:07:41,112 the web, but it was a, I think it's a research institute in Zurich, 161 00:07:41,282 --> 00:07:41,702 Mm-hmm. 162 00:07:42,107 --> 00:07:42,267 Zurich. 163 00:07:42,387 --> 00:07:44,472 I wanna say that, uh. 164 00:07:44,892 --> 00:07:49,092 Looked and came back and was like, Hey, we took three of the most popular 165 00:07:49,092 --> 00:07:55,122 password managers, LastPass, bit Warden and Dashlane, and we analyzed it to figure 166 00:07:55,122 --> 00:07:57,102 out like what vulnerabilities exist. 167 00:07:57,222 --> 00:07:59,742 And they came back with the list of vulnerabilities, which. 168 00:08:00,177 --> 00:08:02,787 They're saying we're not sort of like what people normally 169 00:08:02,787 --> 00:08:04,407 think about when they think like, 170 00:08:04,512 --> 00:08:04,862 Right. 171 00:08:05,007 --> 00:08:06,117 software is exposed. 172 00:08:06,117 --> 00:08:12,447 But it was like fundamental issues in architecture of these password managers, 173 00:08:12,447 --> 00:08:16,947 which could lead to your passwords being compromised and things like that. 174 00:08:17,757 --> 00:08:18,087 Right. 175 00:08:18,777 --> 00:08:19,047 Yeah. 176 00:08:19,047 --> 00:08:19,317 Yeah. 177 00:08:19,317 --> 00:08:25,737 I think that's, and, and, and the issue that they, uh, said as, as I 178 00:08:25,737 --> 00:08:29,127 understand it, basically th this, and they, they said, this isn't, 179 00:08:29,187 --> 00:08:31,077 this isn't a matter of bad coding. 180 00:08:31,647 --> 00:08:38,007 Uh, this was more a fundamental, uh, issue with the concept of. 181 00:08:38,802 --> 00:08:40,962 The, the vault model, right? 182 00:08:40,962 --> 00:08:46,212 Where you've got this, this vault, uh, and, and the, the, the server up there 183 00:08:46,212 --> 00:08:48,942 doesn't ever know your password, right? 184 00:08:49,272 --> 00:08:53,112 The, it only knows the vault, the encrypted vault, right? 185 00:08:53,472 --> 00:08:55,782 Which, let's just talk about how this works, right? 186 00:08:55,782 --> 00:08:55,842 So, 187 00:08:55,977 --> 00:08:56,847 actually talk about that. 188 00:08:57,012 --> 00:09:02,502 yeah, so, so you have, you have a password manager, and then when you authenticate 189 00:09:02,502 --> 00:09:05,322 a new device, because, because. 190 00:09:06,177 --> 00:09:08,217 The whole concept of a password manager. 191 00:09:08,217 --> 00:09:09,507 I have a password manager. 192 00:09:09,567 --> 00:09:10,827 You have a password manager, 193 00:09:11,037 --> 00:09:11,277 yep. 194 00:09:11,847 --> 00:09:17,727 Um, I, I want to be able to use that password manager both on this laptop. 195 00:09:18,477 --> 00:09:24,057 Uh, my other, I have another laptop, which, which is a laptop I like to close. 196 00:09:24,117 --> 00:09:28,647 It's it because it's, it's got an open window on it, so I like to close windows 197 00:09:28,647 --> 00:09:31,827 whenever I can, but I'm, and then, um. 198 00:09:32,382 --> 00:09:33,702 It's, it's my windows. 199 00:09:33,702 --> 00:09:33,792 It's 200 00:09:33,807 --> 00:09:34,407 Your phone. 201 00:09:34,452 --> 00:09:36,672 my windows laptop, my phone, right? 202 00:09:36,672 --> 00:09:41,052 And any other random device that I might need to use, I, I want, 203 00:09:41,412 --> 00:09:45,582 I want to not, I don't want to have to email passwords around. 204 00:09:45,582 --> 00:09:48,432 I don't wanna have to copy and paste between platforms, right? 205 00:09:48,912 --> 00:09:52,242 And so I want to have the same password manager in multiple 206 00:09:52,242 --> 00:09:56,892 places, which means that there does need to be some centralized 207 00:09:56,892 --> 00:09:59,892 communication and we need to be, um. 208 00:10:00,297 --> 00:10:02,757 Sending the passwords baked back and forth. 209 00:10:02,757 --> 00:10:05,307 'cause I'm gonna change the password on my Mac. 210 00:10:05,577 --> 00:10:10,737 And then an hour later, maybe even five minutes later, I might want to, uh, use 211 00:10:10,737 --> 00:10:14,217 that same password on my, um, on my phone, 212 00:10:14,817 --> 00:10:15,117 Yeah. 213 00:10:15,357 --> 00:10:19,467 which means that that password needs to be sent up and then back down to the device, 214 00:10:19,467 --> 00:10:25,077 which means that we're sending passwords around now and, and it means that. 215 00:10:25,707 --> 00:10:29,427 Well, you're sending encrypted versions of the password, right? 216 00:10:29,817 --> 00:10:33,807 Um, and, and it never sees the unencrypted version of your password, which is 217 00:10:33,807 --> 00:10:35,157 really important that it's only, 218 00:10:35,397 --> 00:10:36,237 and how was that done? 219 00:10:36,987 --> 00:10:38,397 it's whi, which. 220 00:10:39,027 --> 00:10:44,517 The how are they able to share this information without them ever seeing 221 00:10:45,387 --> 00:10:47,022 unencrypted version of your passwords? 222 00:10:47,322 --> 00:10:51,642 Yeah, so there's going to be a password that, that only you use on your local 223 00:10:51,642 --> 00:10:57,942 device that is used to unencrypt or decrypt the password on your local device. 224 00:10:58,272 --> 00:10:59,502 And it's going, 225 00:10:59,577 --> 00:11:00,387 and I am awesome. 226 00:11:01,452 --> 00:11:01,752 what? 227 00:11:02,547 --> 00:11:03,012 Is that your 228 00:11:03,102 --> 00:11:07,242 Oh, exit my password is, I'm kind of a big deal. 229 00:11:07,512 --> 00:11:08,292 That's my password. 230 00:11:08,922 --> 00:11:10,722 Um, the, um. 231 00:11:11,427 --> 00:11:14,607 The, you made me lose my train of thought. 232 00:11:15,177 --> 00:11:19,347 So there is, there's a local password that is, uh, sort of your, your password. 233 00:11:19,407 --> 00:11:21,177 You know, it's your, your one password. 234 00:11:21,177 --> 00:11:24,177 In fact, one of the password managers, the name of the password manager is 235 00:11:24,177 --> 00:11:27,687 one password because you just have to remember one password and then 236 00:11:27,687 --> 00:11:29,817 that password is used to locally. 237 00:11:30,582 --> 00:11:37,332 Unencrypt your, um, data, um, and the, and it's gonna unencrypt 238 00:11:37,332 --> 00:11:38,772 that password for that moment. 239 00:11:38,772 --> 00:11:43,062 And it's when, when it's encrypting it, it's going to use a, a 240 00:11:43,062 --> 00:11:45,402 long key as well as some salt. 241 00:11:45,732 --> 00:11:49,537 And again, this is, I. Definitely, I'm gonna say this is de definitely where I 242 00:11:49,537 --> 00:11:54,697 start to get on the, on the edge of my knowledge, but it's going modern password 243 00:11:54,697 --> 00:11:58,837 encryption is going to encrypt it both with your key as well as some salt. 244 00:11:59,377 --> 00:12:04,897 Um, that is gonna make it, uh, super hard for someone without that to decrypt. 245 00:12:04,962 --> 00:12:05,982 because, because, yeah. 246 00:12:05,982 --> 00:12:08,322 Like you said, you don't want anyone to be able to access 247 00:12:08,322 --> 00:12:09,612 even the vendor you're using 248 00:12:09,682 --> 00:12:10,032 Right. 249 00:12:10,182 --> 00:12:13,872 manager to be able to decrypt that password, right? 250 00:12:13,872 --> 00:12:15,912 Because you're the only one who knows it, and it should only stay local. 251 00:12:16,902 --> 00:12:20,442 And this is true, even in the case of like when you're using the pa, 252 00:12:20,472 --> 00:12:27,372 the chrome version of the password manager, the vault is stored locally 253 00:12:27,672 --> 00:12:30,297 and you're decrypting locally, right? 254 00:12:30,297 --> 00:12:30,312 Um, 255 00:12:30,847 --> 00:12:31,137 Yeah. 256 00:12:31,602 --> 00:12:35,382 the um, and, and so that the password is never. 257 00:12:36,147 --> 00:12:41,247 The, the unencrypted password is never stored or sent anywhere other 258 00:12:41,247 --> 00:12:45,777 than when you're copying and pasting, uh, or automated pasting into the, 259 00:12:46,227 --> 00:12:47,907 the device that you're logging into. 260 00:12:48,627 --> 00:12:53,697 Um, uh, but, but there is this concept of a vault, right? 261 00:12:53,727 --> 00:13:01,092 And that is a. Think of it as a little mini database that has a, has the 262 00:13:01,092 --> 00:13:04,992 copy of all of your passwords and other interesting information, right? 263 00:13:04,992 --> 00:13:08,952 Like I've got in there, I've got numbers that I seem to need a lot, right? 264 00:13:08,952 --> 00:13:17,472 Like my, my bank account number and, um, uh, my, the federal ID of my LLC, right? 265 00:13:17,562 --> 00:13:19,032 Um, it's not a number. 266 00:13:19,197 --> 00:13:20,432 a notes feel that you 267 00:13:20,532 --> 00:13:20,952 Yeah. 268 00:13:21,042 --> 00:13:21,312 Yeah. 269 00:13:21,312 --> 00:13:25,002 I have a secure notes and um, you know, like I know my social security number, 270 00:13:25,002 --> 00:13:28,872 but I don't know that number because it's a number that I don't use very often. 271 00:13:28,872 --> 00:13:29,172 Right. 272 00:13:29,622 --> 00:13:31,932 Uh, and so important things like that. 273 00:13:32,112 --> 00:13:37,512 Um, and, uh, like personas, pants size for example. 274 00:13:37,512 --> 00:13:41,292 You know, I just, you know, I store that in there just because 275 00:13:41,292 --> 00:13:45,012 I want to know, um, what. 276 00:13:45,757 --> 00:13:46,177 creepy. 277 00:13:47,602 --> 00:13:47,892 Yeah. 278 00:13:48,567 --> 00:13:55,227 So, um, the, um, uh, and so you, you, you, you keep a, a 279 00:13:55,227 --> 00:13:56,577 lot of stuff in there, right? 280 00:13:56,607 --> 00:13:59,547 Um, also I have all my credit cards in there, right? 281 00:13:59,547 --> 00:14:05,037 There's a, there's a, and so that, that allows me, when I am using, um, Amazon 282 00:14:05,037 --> 00:14:09,747 and other apps, it allows me to not to say, no, don't save my credit card. 283 00:14:09,747 --> 00:14:12,357 I'm gonna give you my credit card each time, and it'll just copy and 284 00:14:12,357 --> 00:14:13,527 paste the credit card in there. 285 00:14:14,427 --> 00:14:15,052 And so again, it's, it's. 286 00:14:16,002 --> 00:14:21,342 It's trying to find a balance between security and convenience. 287 00:14:21,372 --> 00:14:24,672 As we know, they are always at Ward. 288 00:14:24,672 --> 00:14:24,882 Why? 289 00:14:24,882 --> 00:14:25,782 Why do we say that? 290 00:14:27,522 --> 00:14:31,542 Because if you make something so difficult to use, even if it's 291 00:14:31,542 --> 00:14:32,777 super secure, no one's gonna use it. 292 00:14:33,552 --> 00:14:33,972 Yeah. 293 00:14:34,287 --> 00:14:37,617 They will have like the old school way where, hey, I need a really long password 294 00:14:37,617 --> 00:14:38,967 and I have to change it every 30 days. 295 00:14:39,207 --> 00:14:41,487 Let me just write it on a sticky note and stick it on my monitor. 296 00:14:42,342 --> 00:14:42,882 Yeah. 297 00:14:42,957 --> 00:14:45,162 I was actually in a business. 298 00:14:45,882 --> 00:14:46,782 The other day. 299 00:14:47,412 --> 00:14:52,302 And there it is, like all the passwords, just on sticky notes on the monitor. 300 00:14:52,302 --> 00:14:54,552 And it just, it hurt my little heart. 301 00:14:55,272 --> 00:15:01,002 Um, it was a business that I was advising and, uh, I advised him to stop that. 302 00:15:01,662 --> 00:15:04,482 I was like, first thing we're gonna talk about is those sticky notes. 303 00:15:05,022 --> 00:15:05,592 Um. 304 00:15:07,382 --> 00:15:11,067 And, and it wasn't even like, like the, the way the person had 305 00:15:11,067 --> 00:15:12,627 their monitor was like sideways. 306 00:15:13,077 --> 00:15:15,687 So like, anybody that comes into their office is gonna see 307 00:15:15,687 --> 00:15:16,767 the sticky notes, you know? 308 00:15:17,067 --> 00:15:22,767 Anyway, um, I digress, but we, oh, we, oh yeah. 309 00:15:22,767 --> 00:15:28,047 So I think about, and, and, and sometimes we air. 310 00:15:28,722 --> 00:15:30,552 Too far, one side or the other. 311 00:15:30,552 --> 00:15:34,212 I can think of a, of a time where I worked with a very large 312 00:15:34,212 --> 00:15:37,452 company, very large company. 313 00:15:37,452 --> 00:15:42,522 Now again, this is going back, it's going back 27 years, and I worked with 314 00:15:42,522 --> 00:15:46,152 a very large company that absolutely everyone listening to this podcast 315 00:15:46,572 --> 00:15:46,722 Would 316 00:15:46,872 --> 00:15:48,342 probably does business with. 317 00:15:48,972 --> 00:15:49,302 Yeah. 318 00:15:49,872 --> 00:15:57,102 And, uh, they, we used to RSH as root from server to server, anywhere. 319 00:15:58,242 --> 00:15:58,842 Yeah. 320 00:15:59,052 --> 00:15:59,562 a password. 321 00:16:00,552 --> 00:16:01,242 Yeah, don't 322 00:16:01,302 --> 00:16:01,572 yeah. 323 00:16:02,172 --> 00:16:05,892 Um, just to, to quote somebody that I know, you and I, 324 00:16:06,282 --> 00:16:07,872 you and I watch on YouTube, 325 00:16:08,592 --> 00:16:08,952 Mm-hmm. 326 00:16:09,072 --> 00:16:09,462 right. 327 00:16:12,042 --> 00:16:13,002 That ain't right. 328 00:16:13,182 --> 00:16:17,052 But the other thing though is you talked about usability versus security. 329 00:16:17,107 --> 00:16:17,527 Mm-hmm. 330 00:16:17,712 --> 00:16:21,522 in your case, I'm sure there are times when you have a password that 331 00:16:21,522 --> 00:16:22,662 you wanna share with your wife, 332 00:16:23,412 --> 00:16:23,892 Yeah. 333 00:16:24,132 --> 00:16:26,652 Well, for the record, we use the same password manager, but. 334 00:16:26,832 --> 00:16:27,042 just 335 00:16:27,282 --> 00:16:27,312 Okay. 336 00:16:27,402 --> 00:16:28,602 but yes. 337 00:16:28,782 --> 00:16:29,232 Right. 338 00:16:29,562 --> 00:16:32,742 You wanna share and so you, how would you do it today? 339 00:16:32,742 --> 00:16:34,902 You either give 'em the password and 340 00:16:35,052 --> 00:16:35,352 Yeah, 341 00:16:35,412 --> 00:16:36,342 down somewhere, 342 00:16:36,522 --> 00:16:36,912 yeah, 343 00:16:37,092 --> 00:16:40,152 you have to email it or text it, or some mechanism which is 344 00:16:40,212 --> 00:16:40,482 yeah, 345 00:16:40,512 --> 00:16:41,202 insecure. 346 00:16:41,377 --> 00:16:41,667 yeah. 347 00:16:41,892 --> 00:16:45,042 Or do you just rely on your password manager, which probably 348 00:16:45,072 --> 00:16:46,962 has a share this password 349 00:16:47,172 --> 00:16:47,442 Yeah. 350 00:16:47,502 --> 00:16:47,927 someone else? 351 00:16:47,957 --> 00:16:48,247 Link. 352 00:16:48,747 --> 00:16:53,187 Yeah, we deci, we decided we were tired of both paying for the same password manager. 353 00:16:53,187 --> 00:16:54,477 We just put all the passwords in there. 354 00:16:54,657 --> 00:16:57,147 That doesn't work if you don't trust your spouse, by the way. 355 00:16:57,717 --> 00:17:02,037 Um, but there, there was something, darn it, there was something that you said that 356 00:17:02,037 --> 00:17:04,092 triggered, um, you were talking about. 357 00:17:05,397 --> 00:17:06,007 usability 358 00:17:07,322 --> 00:17:07,402 Hmm. 359 00:17:09,027 --> 00:17:09,317 Okay. 360 00:17:09,352 --> 00:17:09,992 don't know, but yeah. 361 00:17:09,992 --> 00:17:15,027 Uh, just in general, you know, if you make it so insecure, no. 362 00:17:15,207 --> 00:17:16,587 If you make it so secure. 363 00:17:17,487 --> 00:17:20,187 That is difficult to use, then, then no one's gonna use it. 364 00:17:20,247 --> 00:17:20,637 Right. 365 00:17:20,997 --> 00:17:24,897 Um, and as a result, you, you end up being less secure. 366 00:17:24,987 --> 00:17:25,407 Right. 367 00:17:25,522 --> 00:17:25,742 Yep. 368 00:17:25,797 --> 00:17:34,707 Uh, which is why I'm, I'm more of a fan, uh, of really secure passwords 369 00:17:35,157 --> 00:17:39,027 that are in a password manager versus the, we're gonna force you to 370 00:17:39,027 --> 00:17:40,647 change your password every 30 days. 371 00:17:41,097 --> 00:17:41,427 Right. 372 00:17:42,417 --> 00:17:43,017 Um. 373 00:17:43,437 --> 00:17:45,657 There's nothing wrong with changing your passwords. 374 00:17:45,657 --> 00:17:50,127 The problem is that it, it's just a lot of work for, I don't 375 00:17:50,127 --> 00:17:51,777 know, a little bit of whatever. 376 00:17:52,527 --> 00:18:00,447 Um, so, um, so that, that's why, that's the model that they've come up with, which 377 00:18:00,447 --> 00:18:04,347 is, which is referred to as what, what did they call, what did they call this model? 378 00:18:05,277 --> 00:18:05,877 The, 379 00:18:07,082 --> 00:18:08,007 The encrypted vault. 380 00:18:08,727 --> 00:18:10,017 no, there's another one. 381 00:18:12,507 --> 00:18:14,787 It's the, the zero knowledge encryption, right? 382 00:18:15,177 --> 00:18:20,157 The, the zero knowledge encryption model is basically the best way that 383 00:18:20,157 --> 00:18:26,187 they came up of storing and sharing a password between multiple devices. 384 00:18:26,817 --> 00:18:30,477 Uh, but it does have just that concept. 385 00:18:30,477 --> 00:18:31,137 This is what. 386 00:18:31,852 --> 00:18:36,292 I gleaned from the article is that that core concept has 387 00:18:36,292 --> 00:18:37,732 some vulnerabilities in it. 388 00:18:38,512 --> 00:18:43,462 Uh, starting with the idea that there has to be some kind of trust, 389 00:18:44,272 --> 00:18:47,542 uh, because stop, let me back up. 390 00:18:48,532 --> 00:18:55,462 One of the reasons that it has one of the core vulnerabilities is that it needs 391 00:18:55,462 --> 00:18:57,442 to be, and this is a usability issue. 392 00:18:58,047 --> 00:19:01,737 There needs to be a way for you to recover your vault. 393 00:19:03,027 --> 00:19:04,347 We talked about this. 394 00:19:04,557 --> 00:19:09,147 You may remember another previous episode when we had the lady 395 00:19:09,147 --> 00:19:11,187 who, like she said, what do I do? 396 00:19:11,937 --> 00:19:14,037 When I lose everything, hopefully I'll, I'll get a, 397 00:19:14,037 --> 00:19:15,327 I'll get a link to that episode. 398 00:19:15,327 --> 00:19:16,587 That was an interesting discussion. 399 00:19:16,587 --> 00:19:18,447 She's like, what do I do when I lose everything? 400 00:19:18,837 --> 00:19:22,017 And so you do need to go through that exercise. 401 00:19:22,017 --> 00:19:25,407 What is the, what is the exercise that's needed to get 402 00:19:25,407 --> 00:19:26,907 back into your password vault? 403 00:19:27,237 --> 00:19:30,627 If you get locked out of all of your devices, or there's 404 00:19:30,627 --> 00:19:32,397 a fire or something, right? 405 00:19:32,817 --> 00:19:38,307 You need this process because otherwise your life would become a living hell if 406 00:19:38,307 --> 00:19:40,347 you, I, I have like, I'm not kidding. 407 00:19:40,347 --> 00:19:40,737 I have. 408 00:19:41,187 --> 00:19:44,757 500 passwords in my password manager. 409 00:19:44,757 --> 00:19:49,947 I can't imagine what it would be like to recover all of those and authenticate 410 00:19:49,947 --> 00:19:52,197 myself one by one by one by one. 411 00:19:52,197 --> 00:19:57,147 So you need some ability to, um, to recover that. 412 00:19:57,387 --> 00:20:02,847 But that means that when you are in this vulnerable position, you 413 00:20:02,847 --> 00:20:08,187 need to trust the um, this server. 414 00:20:08,612 --> 00:20:08,902 Yeah. 415 00:20:08,952 --> 00:20:12,342 the vendor, well, you need to trust an i an an, an entity. 416 00:20:13,092 --> 00:20:16,242 It may or may not be the you, you need to trust a vendor, but the point is you're 417 00:20:16,242 --> 00:20:18,312 trusting an entity that you can't see. 418 00:20:19,017 --> 00:20:19,527 Yes. 419 00:20:19,872 --> 00:20:20,352 Right? 420 00:20:20,742 --> 00:20:28,872 And so they, what, what I saw was them exploiting that core vulnerability. 421 00:20:28,872 --> 00:20:32,142 It's like, it, it's a core design flaw, right. 422 00:20:32,172 --> 00:20:36,642 That I don't, and I, and I think the point was there's really no way around it. 423 00:20:37,572 --> 00:20:37,992 Right. 424 00:20:38,022 --> 00:20:41,442 unless you basically say, I'm never going to allow a password 425 00:20:41,442 --> 00:20:43,302 reset from the server side, 426 00:20:43,452 --> 00:20:48,642 Which would be a no starter, uh, which would be a non-starter for most people. 427 00:20:49,182 --> 00:20:49,602 Right. 428 00:20:49,662 --> 00:20:50,082 why 429 00:20:51,552 --> 00:20:52,632 Because they wouldn't, 430 00:20:52,632 --> 00:20:52,992 so, so. 431 00:20:53,772 --> 00:20:55,752 I'm just saying from a commercial viability. 432 00:20:57,222 --> 00:20:57,612 I know. 433 00:20:57,762 --> 00:20:58,722 So lemme go back. 434 00:20:58,722 --> 00:21:01,182 One of the things that we say, one of the things that we say 435 00:21:01,212 --> 00:21:05,982 is that if you have like, um. 436 00:21:06,852 --> 00:21:12,162 If you, uh, let me, let me, what's the phrase I'm looking for here? 437 00:21:12,222 --> 00:21:12,672 Um, 438 00:21:15,642 --> 00:21:22,812 um, oh, so if, for example, you have a backup encryption and if 439 00:21:22,812 --> 00:21:27,942 you lose the key, your vendor says, oh, we'll just, uh, fix it for you. 440 00:21:28,842 --> 00:21:30,192 That's not a good answer. 441 00:21:30,837 --> 00:21:31,497 Yes. 442 00:21:32,577 --> 00:21:39,567 That's kind of, that's kind of what you're talking about is, is that there, um, that 443 00:21:40,047 --> 00:21:42,297 Now, I don't wanna say backdoor, it's too harsh, 444 00:21:42,327 --> 00:21:42,747 Yeah. 445 00:21:42,747 --> 00:21:43,077 Well, 446 00:21:43,107 --> 00:21:43,287 but. 447 00:21:44,397 --> 00:21:46,377 I think backdoor is, is fine. 448 00:21:46,437 --> 00:21:46,977 Right. 449 00:21:47,187 --> 00:21:48,867 Um, all right. 450 00:21:48,867 --> 00:21:49,527 I got a story. 451 00:21:49,767 --> 00:21:55,707 Um, I was consulting, this is like, I don't know, five 452 00:21:55,707 --> 00:21:59,367 companies go and we had a, um. 453 00:22:00,162 --> 00:22:03,312 We got an, we got an email from a former employee. 454 00:22:03,312 --> 00:22:04,302 It was a consulting company. 455 00:22:04,752 --> 00:22:07,242 It was a former consultant that used to work for our company. 456 00:22:07,632 --> 00:22:14,982 And the client was like financial trading firm, you know, wall Street type company. 457 00:22:15,582 --> 00:22:22,062 And, uh, he emailed us and said, Hey, um, the firewall on, um, empty squat, 458 00:22:22,212 --> 00:22:25,962 uh, company was throwing up some errors and so I logged in and fixed them. 459 00:22:27,012 --> 00:22:27,702 I'm sorry, what? 460 00:22:29,262 --> 00:22:33,552 He had a back door that he had left open so he could help us out. 461 00:22:33,822 --> 00:22:38,952 We're like, uh, okay, uh, let us work on the offboarding process. 462 00:22:39,342 --> 00:22:46,662 But the, so you, you want, I'd say this is definitely a difference between 463 00:22:46,662 --> 00:22:52,062 the commercial password management type concept and encryption management 464 00:22:52,062 --> 00:22:54,702 concept and a consumer grade. 465 00:22:55,002 --> 00:22:55,212 yeah. 466 00:22:55,797 --> 00:22:56,727 Password manager. 467 00:22:57,372 --> 00:23:00,072 but I agree with all that. 468 00:23:00,072 --> 00:23:02,052 In fact, I think in that prior. 469 00:23:02,397 --> 00:23:03,597 Podcast episode, 470 00:23:03,777 --> 00:23:03,987 Mm-hmm. 471 00:23:04,287 --> 00:23:10,317 we actually recommended the person to go look to see if recovery keys are 472 00:23:10,317 --> 00:23:13,797 supported, that they can generate and mail it to someone across the country. 473 00:23:14,127 --> 00:23:14,577 Yes. 474 00:23:14,637 --> 00:23:17,132 That's exactly what we, what we, uh, talked about. 475 00:23:17,262 --> 00:23:17,612 Right. 476 00:23:18,282 --> 00:23:20,052 and so that's one mechanism. 477 00:23:20,412 --> 00:23:22,752 I think though, even though you just mentioned Curtis 478 00:23:22,902 --> 00:23:24,852 consumer versus like enterprise 479 00:23:24,912 --> 00:23:25,332 Mm-hmm. 480 00:23:25,422 --> 00:23:29,982 from security, all of like, even if you look at the vulnerabilities they talk 481 00:23:29,982 --> 00:23:36,192 about, that's even available for org or it's even possible in organizations too 482 00:23:36,512 --> 00:23:36,932 Mm-hmm. 483 00:23:37,152 --> 00:23:40,182 of sort of the auto enrollment and the fact that you have. 484 00:23:40,932 --> 00:23:45,192 A administrator in an organization who might need to reset the passwords 485 00:23:45,202 --> 00:23:45,552 Right. 486 00:23:46,182 --> 00:23:47,412 their employee forgets. 487 00:23:47,602 --> 00:23:48,057 Right, right. 488 00:23:48,552 --> 00:23:48,822 Right. 489 00:23:48,822 --> 00:23:53,082 And that I think is still exploitable, and it's not necessarily 490 00:23:53,307 --> 00:23:53,937 Yeah. 491 00:23:54,267 --> 00:23:55,167 Well, well, 492 00:23:55,422 --> 00:23:58,422 like the issues of dealing with an organization, right? 493 00:23:58,437 --> 00:23:58,827 well, the, 494 00:23:59,022 --> 00:24:00,522 users are gonna forget things. 495 00:24:00,522 --> 00:24:00,822 They go on 496 00:24:00,927 --> 00:24:01,167 yeah. 497 00:24:01,242 --> 00:24:02,322 they come back, they forget. 498 00:24:02,727 --> 00:24:03,027 Yeah. 499 00:24:03,072 --> 00:24:03,732 I can't get in. 500 00:24:04,032 --> 00:24:09,072 And so there's this level of security that they need to be able to build in because. 501 00:24:09,837 --> 00:24:11,642 They need that password reset functionality. 502 00:24:11,892 --> 00:24:16,722 I guess what I'm trying to understand is what they, so, so as 503 00:24:16,722 --> 00:24:21,132 I understand what they did was they impersonated the server, right? 504 00:24:21,642 --> 00:24:21,942 So. 505 00:24:22,797 --> 00:24:27,477 Um, what that would allow them to, if they impersonated the server. 506 00:24:27,477 --> 00:24:31,317 Again, this is what we were saying, you need to trust this entity and 507 00:24:31,317 --> 00:24:35,187 so you're reaching out to reset your vault, to reset the password of your 508 00:24:35,187 --> 00:24:38,787 vault or to, or not to reset the password, but to recover your vault. 509 00:24:39,477 --> 00:24:41,127 And so you have to reach out to this entity. 510 00:24:41,127 --> 00:24:45,297 You have to trust it to a certain amount, and you give it your password. 511 00:24:45,912 --> 00:24:49,272 In order to au or you give it your recovery key in order to 512 00:24:49,272 --> 00:24:52,512 authenticate yourself, and then what? 513 00:24:52,587 --> 00:24:54,642 And, and then it can do what it does. 514 00:24:54,642 --> 00:24:59,322 But my point, the point is that it could then take that recovery key and recover 515 00:24:59,322 --> 00:25:03,402 your vault without you, I guess is the idea of what, what, what they talked 516 00:25:03,402 --> 00:25:05,502 about here, the core, that core concept. 517 00:25:06,657 --> 00:25:10,797 And like in the organization case, you could auto-enroll. 518 00:25:11,127 --> 00:25:15,297 It's not just your own password that gets used right as the encryption, but also 519 00:25:15,297 --> 00:25:19,317 the organization because they need to be able to access that recovery key as well. 520 00:25:19,527 --> 00:25:22,677 And so now you have two sources that can access your key and it's no 521 00:25:22,677 --> 00:25:25,977 longer, I would say it's still zero. 522 00:25:26,637 --> 00:25:27,207 What did you call it? 523 00:25:27,237 --> 00:25:28,317 Zero encryption? 524 00:25:28,677 --> 00:25:28,977 No. 525 00:25:29,022 --> 00:25:30,222 Zero knowledge encryption. 526 00:25:30,282 --> 00:25:31,003 ZKE. 527 00:25:31,242 --> 00:25:35,922 encryption, but it's someone in your organization who has that knowledge, 528 00:25:35,922 --> 00:25:37,377 not the server or the vendor. 529 00:25:38,082 --> 00:25:41,742 What would be interesting, I know that what they did, the, the, the research 530 00:25:41,742 --> 00:25:45,072 is they reached out to the password managers as good researchers should do, 531 00:25:45,072 --> 00:25:49,092 reach out to the password managers to allow them to try to address these core, 532 00:25:49,692 --> 00:25:53,682 um, the, again, this core vulnerability. 533 00:25:53,772 --> 00:25:54,162 Right? 534 00:25:54,342 --> 00:25:56,682 And again, it's a very, it's kind of an edge case. 535 00:25:57,627 --> 00:26:02,997 Because it, it only, you know, the, the thing that we talked about, it only would 536 00:26:02,997 --> 00:26:09,177 work if you're, if you're trying to, uh, reset, you know, you're trying to recover 537 00:26:09,177 --> 00:26:13,887 your password manager and they were able to impersonate the server at that moment. 538 00:26:14,487 --> 00:26:18,052 So it's, I I still, I think it's a very edge case, right? 539 00:26:18,752 --> 00:26:18,972 Um, 540 00:26:19,137 --> 00:26:19,197 Yeah. 541 00:26:19,672 --> 00:26:19,892 but. 542 00:26:20,817 --> 00:26:24,837 I, I know that the password managers in question said that they were working on, 543 00:26:24,837 --> 00:26:27,357 on, uh, addressing these vulnerabilities. 544 00:26:27,357 --> 00:26:29,727 It'd be interesting to see what they have done 545 00:26:30,297 --> 00:26:30,597 Yeah, 546 00:26:30,777 --> 00:26:30,987 that end. 547 00:26:31,137 --> 00:26:33,867 that was kind of like one category of vulnerabilities. 548 00:26:33,867 --> 00:26:38,067 I think another was sort of just the nature of encrypted vaults, 549 00:26:38,397 --> 00:26:38,817 Mm-hmm. 550 00:26:38,817 --> 00:26:44,337 because unlike file which then gets encrypted with a single key. 551 00:26:44,742 --> 00:26:48,972 What they're doing is they're sort of having entries and fields within 552 00:26:48,972 --> 00:26:53,052 those entries that may get encrypted in different ways, and they're not just 553 00:26:53,052 --> 00:26:54,792 sort of going through and encrypting 554 00:26:54,867 --> 00:26:59,307 Yeah, it's like, it's like, it's like row level encryption in a database, if 555 00:26:59,307 --> 00:27:04,467 you will, which then you've got metadata that's above that, which is not encrypted. 556 00:27:05,127 --> 00:27:05,517 Right. 557 00:27:05,562 --> 00:27:06,792 may or may not be encrypted. 558 00:27:06,792 --> 00:27:06,972 And 559 00:27:07,047 --> 00:27:07,377 Yeah. 560 00:27:07,622 --> 00:27:07,742 I. 561 00:27:08,142 --> 00:27:13,752 there, it looks like, from what I could tell, there's no strong verification 562 00:27:14,232 --> 00:27:18,492 that you're not able to switch around fields within your encrypted 563 00:27:18,492 --> 00:27:19,962 vault to be able to expose things. 564 00:27:19,962 --> 00:27:22,962 So I think in one example, they talked about taking. 565 00:27:23,382 --> 00:27:29,112 Uh, your username and password and moving the cipher text those particular 566 00:27:29,112 --> 00:27:31,152 fields into a different field 567 00:27:31,297 --> 00:27:31,717 Mm-hmm. 568 00:27:31,722 --> 00:27:32,562 URL, 569 00:27:32,577 --> 00:27:32,997 Mm-hmm. 570 00:27:33,072 --> 00:27:36,672 could then expose part of your password potentially, uh, 571 00:27:36,702 --> 00:27:39,312 depending on the password manager. 572 00:27:40,122 --> 00:27:43,152 so it, and there's no check to say, is the vault still the 573 00:27:43,152 --> 00:27:44,472 same as what it was initially? 574 00:27:45,027 --> 00:27:45,447 Right. 575 00:27:45,597 --> 00:27:48,507 And again, these, these are features that they could add, right? 576 00:27:48,507 --> 00:27:50,877 The, that's the kind of thing where they could add that feature. 577 00:27:50,877 --> 00:27:53,157 And maybe that's what, and again, it would be interesting 578 00:27:53,157 --> 00:27:54,927 to see how they've responded. 579 00:27:55,107 --> 00:27:55,167 Um. 580 00:27:56,397 --> 00:27:58,557 And, uh, you know, at least one. 581 00:27:58,587 --> 00:28:03,237 I I, you know, as I've said before, I am not a fan of ASPA based on multiple 582 00:28:03,237 --> 00:28:04,857 issues that have happened in the past. 583 00:28:05,457 --> 00:28:10,647 Um, that, that it, to me, it just doesn't seem like they put the, the 584 00:28:10,647 --> 00:28:15,837 right emphasis on, again, usability versus, um, versus security. 585 00:28:16,347 --> 00:28:19,227 Uh, I don't think that they, they, they appear to not put the right 586 00:28:19,227 --> 00:28:21,627 emphasis on, uh, the security part. 587 00:28:22,257 --> 00:28:25,107 one big takeaway I had from the paper though, 588 00:28:25,377 --> 00:28:25,707 Sure. 589 00:28:25,797 --> 00:28:31,887 you caught it, but, they, so they looked at three password managers, 590 00:28:32,237 --> 00:28:32,587 Uhhuh. 591 00:28:32,637 --> 00:28:34,807 Bit warden, LastPass, and Dashlane, 592 00:28:35,022 --> 00:28:35,352 Yeah. 593 00:28:36,177 --> 00:28:36,477 right? 594 00:28:36,807 --> 00:28:42,147 Do you know what the number of users are across these three products? 595 00:28:42,882 --> 00:28:43,722 What, what, 596 00:28:44,442 --> 00:28:47,712 There are 60 million users and 23% of the market, 597 00:28:50,052 --> 00:28:51,252 and what's your point with that? 598 00:28:51,762 --> 00:28:52,092 which 599 00:28:52,212 --> 00:28:52,422 that 600 00:28:52,572 --> 00:28:52,842 that 601 00:28:52,932 --> 00:28:53,682 more or less? 602 00:28:53,832 --> 00:28:55,062 million people 603 00:28:55,242 --> 00:28:55,362 Yeah. 604 00:28:55,452 --> 00:28:58,962 using password managers, sorry, 200 a quarter 605 00:28:59,052 --> 00:28:59,472 Oh, 606 00:28:59,682 --> 00:29:01,212 are using password managers. 607 00:29:01,452 --> 00:29:02,082 oh, that's in. 608 00:29:02,292 --> 00:29:03,312 Interesting. 609 00:29:03,342 --> 00:29:09,792 I never even, so, okay, so you took the the, they said that these three were this 610 00:29:09,792 --> 00:29:11,862 many and then that's 25% of the market. 611 00:29:11,862 --> 00:29:16,302 And then you extrapolated that to mean that there's a quarter of a billion people 612 00:29:16,512 --> 00:29:20,382 that are using password managers, which means that the vast majority of people in 613 00:29:20,382 --> 00:29:22,482 the world are not using password managers. 614 00:29:23,277 --> 00:29:23,997 know we always ask that question, right? 615 00:29:23,997 --> 00:29:24,177 How many 616 00:29:24,222 --> 00:29:24,282 Yeah. 617 00:29:24,327 --> 00:29:25,227 are using password managers? 618 00:29:25,437 --> 00:29:28,857 So it could maybe, it might be a little off, but it shouldn't be 619 00:29:28,857 --> 00:29:30,927 like a magnitude off, you know? 620 00:29:31,062 --> 00:29:31,962 Right, right. 621 00:29:32,472 --> 00:29:37,902 That is, that is actually a really interesting, um, yeah, I like that. 622 00:29:38,562 --> 00:29:44,772 Um, I wonder how many people are, I think, I think the vast majority of 623 00:29:44,772 --> 00:29:48,492 people, like we're gonna say non nerds. 624 00:29:49,197 --> 00:29:54,267 Non-security focused people, they probably just use Chrome. 625 00:29:55,167 --> 00:29:55,557 Right. 626 00:29:55,557 --> 00:30:01,737 They probably just use the saved passwords in Chrome or Edge or Firefox or whatever. 627 00:30:02,307 --> 00:30:02,727 Right. 628 00:30:04,617 --> 00:30:07,497 So also a number on that too. 629 00:30:08,187 --> 00:30:08,487 Okay. 630 00:30:09,387 --> 00:30:14,007 Google and Apple's built-in password managers account for 55% of the market? 631 00:30:16,647 --> 00:30:18,297 Of the 250 million. 632 00:30:19,232 --> 00:30:19,452 Yes. 633 00:30:21,792 --> 00:30:22,082 Okay. 634 00:30:22,227 --> 00:30:22,797 depressing. 635 00:30:23,757 --> 00:30:25,887 So they're counting those as password managers, 636 00:30:26,832 --> 00:30:27,342 Yes. 637 00:30:28,257 --> 00:30:28,707 huh? 638 00:30:28,827 --> 00:30:29,607 Because I don't really count. 639 00:30:29,607 --> 00:30:31,887 I mean, it's, again, that's the good, better, best. 640 00:30:31,887 --> 00:30:34,767 It's better than nothing, but not much better. 641 00:30:35,802 --> 00:30:41,472 Well, I should also caveat this by saying that, um, these are 642 00:30:41,472 --> 00:30:43,092 coming from two different surveys 643 00:30:43,352 --> 00:30:43,772 Mm-hmm. 644 00:30:45,072 --> 00:30:50,622 So the Google and Apple one is coming from a survey of a thousand U US consumers. 645 00:30:52,152 --> 00:30:56,442 Right versus the other one is coming from the actual 60 million number we talked 646 00:30:56,442 --> 00:31:01,752 about earlier is coming from a different set of studies surveys, so it may not 647 00:31:01,752 --> 00:31:03,372 be apples to apples to compare them, 648 00:31:04,662 --> 00:31:06,492 Or apple apples to Androids. 649 00:31:07,692 --> 00:31:09,912 yes, apples to androids if you wish. 650 00:31:11,892 --> 00:31:12,672 Um. 651 00:31:13,002 --> 00:31:14,922 But it still at least gives you some relative numbers, 652 00:31:14,967 --> 00:31:20,367 Yeah, so I, I think, again, I think that the takeaway from this episode, I would, 653 00:31:20,607 --> 00:31:24,867 you know what, I would reach out to your, if you, if your password manager, well, 654 00:31:24,867 --> 00:31:28,437 you know, if your password manager is on this or not, I would reach out to them and 655 00:31:28,437 --> 00:31:30,087 say, Hey, what do you think about this? 656 00:31:30,267 --> 00:31:32,367 You know, what's your response to this article? 657 00:31:32,967 --> 00:31:38,367 What are you doing to address this core sort of fundamental question, right? 658 00:31:38,787 --> 00:31:39,237 Um. 659 00:31:39,357 --> 00:31:43,317 be surprised if the other password managers who are not part of this initial 660 00:31:43,317 --> 00:31:49,132 investigation are already publishing some FAQ or something in response. 661 00:31:49,317 --> 00:31:50,307 Yeah, I wouldn't be surprised. 662 00:31:50,307 --> 00:31:51,147 Yeah, agreed. 663 00:31:51,627 --> 00:31:54,657 Um, the, uh. 664 00:31:55,362 --> 00:31:58,572 That would be one thing to do is to contact your password manager, especially 665 00:31:58,572 --> 00:32:02,082 if it's one of these three to say, Hey, it says that you're working on stuff. 666 00:32:02,082 --> 00:32:02,922 What are you working on? 667 00:32:03,102 --> 00:32:03,462 Right. 668 00:32:04,062 --> 00:32:09,132 Uh, I know I use one of the three, so, uh, I, I'm gonna reach out to them. 669 00:32:09,132 --> 00:32:11,592 I haven't, the article just came out a couple days ago. 670 00:32:12,132 --> 00:32:15,132 Um, and uh, and I happen to see it on, on LinkedIn. 671 00:32:15,947 --> 00:32:20,057 And, uh, I will, again, I will reiterate kind of what I said in the beginning. 672 00:32:20,057 --> 00:32:21,797 One, I'm still a fan of password managers. 673 00:32:21,797 --> 00:32:24,287 I still think it's better than the alternative. 674 00:32:24,917 --> 00:32:31,187 Um, and I do think that it is really just a stop gap, right? 675 00:32:31,727 --> 00:32:39,677 Like if we go back to, if we go back, it's kind of like target side deduplication. 676 00:32:39,707 --> 00:32:43,517 If I will, if I can, if I must, if I, whatever. 677 00:32:43,937 --> 00:32:44,117 So. 678 00:32:44,307 --> 00:32:44,877 believe you. 679 00:32:46,407 --> 00:32:49,617 So target side deduplication is stupid. 680 00:32:50,457 --> 00:32:50,967 Right? 681 00:32:50,967 --> 00:32:54,807 And I, and I know that, you know that there's some giant companies 682 00:32:54,957 --> 00:32:59,097 that, that, that make a lot of money on target side Deduplication what? 683 00:32:59,097 --> 00:33:00,237 Do, what, what, what's target side? 684 00:33:00,957 --> 00:33:01,317 Deduplication persona. 685 00:33:02,022 --> 00:33:06,582 Target side ddu is where you send the data over and in the storage system 686 00:33:06,912 --> 00:33:10,662 you figure out what all the ddu, uh, what all the duplicates are, and then 687 00:33:10,662 --> 00:33:12,222 you ddu it down before writing it to, 688 00:33:13,152 --> 00:33:13,542 Right. 689 00:33:13,692 --> 00:33:17,592 So you're de-duping at the target as opposed to de-duping at the source. 690 00:33:17,622 --> 00:33:18,012 Right. 691 00:33:18,582 --> 00:33:23,082 And it's dumb, but, but I'm saying it's dumb. 692 00:33:23,082 --> 00:33:24,072 And I'll say why it's dumb. 693 00:33:24,117 --> 00:33:25,542 I and I stand by the statement. 694 00:33:26,682 --> 00:33:34,602 Um, because again, it's, it's, I think this is very, I think this is very, um. 695 00:33:35,052 --> 00:33:39,342 This really is a great parallel here because it's dumb, but it's still 696 00:33:39,342 --> 00:33:41,832 better than what we had before, right? 697 00:33:42,102 --> 00:33:43,992 So it's, why do I say it's dumb? 698 00:33:43,992 --> 00:33:49,212 It's dumb because your backup software is still pretending like it's writing to tape 699 00:33:49,212 --> 00:33:53,862 for God's sakes, and it's sending full backups and, and full file incrementals. 700 00:33:53,922 --> 00:33:56,412 And we're sending all of that across the, the land. 701 00:33:56,712 --> 00:33:58,902 And then we're gonna do the magic on the other end. 702 00:33:58,902 --> 00:34:00,972 We're getting, all we're getting is. 703 00:34:01,862 --> 00:34:05,192 We're getting storage efficiency, we're getting no network efficiency. 704 00:34:05,672 --> 00:34:06,092 Right. 705 00:34:06,152 --> 00:34:11,702 Um, if you, if you could switch to source side deduplication, you get 706 00:34:11,702 --> 00:34:17,162 both storage and network efficiency, uh, and also less work on the client. 707 00:34:17,462 --> 00:34:17,732 Hang on. 708 00:34:17,732 --> 00:34:18,782 Lemme I'll, I'll finish. 709 00:34:18,782 --> 00:34:19,467 I'm, I'll bring it home. 710 00:34:19,777 --> 00:34:23,327 I'll bring it home, but it does require. 711 00:34:24,252 --> 00:34:26,112 An architectural change, right? 712 00:34:26,112 --> 00:34:29,142 It does require you to change out your backup software, or it 713 00:34:29,142 --> 00:34:32,022 requires your backup software to make a major architectural change. 714 00:34:32,352 --> 00:34:34,482 That's why I'm saying it's a great parallel to here, 715 00:34:34,812 --> 00:34:35,102 Yeah. 716 00:34:35,412 --> 00:34:40,002 I think that PAs keys are definitely better, but we're still in the 717 00:34:40,032 --> 00:34:42,612 early phases of adoption of PASIs. 718 00:34:42,612 --> 00:34:46,872 I know I'm still in the early phases of PA passkey adoption, and I still find 719 00:34:46,872 --> 00:34:49,512 it kind of weird and annoying because. 720 00:34:50,067 --> 00:34:52,587 The, it is d it is tied to the device. 721 00:34:52,647 --> 00:34:55,377 So it's like, you know, do I want to do this passkey? 722 00:34:55,767 --> 00:35:00,477 Uh, I can only do the passkey on my phone or the passkey on my, on my Mac. 723 00:35:00,717 --> 00:35:02,397 I can't, I can't share them 724 00:35:02,637 --> 00:35:03,477 log in 725 00:35:03,747 --> 00:35:05,337 'cause they're tied to the device. 726 00:35:05,607 --> 00:35:08,217 The passkey is tied to the device by design. 727 00:35:08,607 --> 00:35:09,057 Right. 728 00:35:09,567 --> 00:35:10,137 Um, 729 00:35:10,167 --> 00:35:13,257 you, does it, does your da, your password manager support 730 00:35:14,307 --> 00:35:15,712 pass keys for the same account? 731 00:35:17,817 --> 00:35:18,597 um, 732 00:35:18,672 --> 00:35:18,882 same 733 00:35:19,167 --> 00:35:19,377 yeah. 734 00:35:19,722 --> 00:35:24,462 Well, but it's, but they're stored locally, you know what I mean? 735 00:35:24,972 --> 00:35:25,632 Um, 736 00:35:25,752 --> 00:35:27,402 stored in, is encrypted. 737 00:35:27,822 --> 00:35:28,062 yeah. 738 00:35:28,062 --> 00:35:29,172 I don't even, I don't even know. 739 00:35:29,172 --> 00:35:29,922 This is what I'm saying. 740 00:35:29,922 --> 00:35:33,552 We're still in the early phases of, we're still in the early phase. 741 00:35:33,792 --> 00:35:37,062 I'm trying to go to Pasky when I can, but also. 742 00:35:38,067 --> 00:35:38,367 Here. 743 00:35:38,367 --> 00:35:40,227 So here I, I'll tell you, I'll tell you, I'll tell you where 744 00:35:40,227 --> 00:35:41,487 passkey are driving me crazy. 745 00:35:41,877 --> 00:35:43,557 And that's logging into QuickBooks. 746 00:35:43,652 --> 00:35:43,942 Okay? 747 00:35:43,947 --> 00:35:48,327 QuickBooks says, Hey, do you wanna log in with a passkey or do you wanna 748 00:35:48,327 --> 00:35:50,607 log in with that stupid old password? 749 00:35:50,607 --> 00:35:55,942 And, um, MFA and I go, I wanna log in with a passkey. 750 00:35:56,247 --> 00:35:57,087 And it goes, great. 751 00:35:57,087 --> 00:35:57,777 What's your PAs key? 752 00:35:57,777 --> 00:35:58,887 And I go, here's my PAs key. 753 00:35:58,887 --> 00:36:00,867 And it says, Hey, what's your MFA? 754 00:36:00,867 --> 00:36:01,647 And I'm like, damn it. 755 00:36:01,887 --> 00:36:02,097 Like, 756 00:36:04,407 --> 00:36:06,327 that's the whole reason I went with the PAs key. 757 00:36:07,122 --> 00:36:07,512 You know? 758 00:36:07,512 --> 00:36:07,872 Right. 759 00:36:07,872 --> 00:36:11,502 And so, and so, like it's, and, and maybe that's just an implementation thing on 760 00:36:11,502 --> 00:36:13,692 the, in the, on the fact of, of Intuit. 761 00:36:14,232 --> 00:36:19,092 Um, and, uh, just take my money, take my, they get, they get too much of my money. 762 00:36:19,152 --> 00:36:21,312 That's what I think is Intuit gets too much of my money. 763 00:36:21,942 --> 00:36:23,412 But, um. 764 00:36:24,462 --> 00:36:28,302 And so I, I, I keep getting little, little implementation issues like that. 765 00:36:28,302 --> 00:36:31,662 And it, and it's, it's different per app. 766 00:36:31,662 --> 00:36:32,952 It's different per device. 767 00:36:32,952 --> 00:36:36,552 And I think if I am having challenges and concerns and confusion, 768 00:36:36,552 --> 00:36:40,392 then you know, Joe Jane user, 769 00:36:40,392 --> 00:36:41,662 imagine my parents using it. 770 00:36:42,282 --> 00:36:42,792 I can't. 771 00:36:42,852 --> 00:36:43,092 Yeah. 772 00:36:43,092 --> 00:36:44,112 I can't imagine. 773 00:36:44,142 --> 00:36:44,562 Yeah. 774 00:36:45,222 --> 00:36:48,792 Um, I can't imagine Lily using it, for example. 775 00:36:49,347 --> 00:36:51,567 As smart as she is, she's brilliant. 776 00:36:52,407 --> 00:36:53,907 Uh, that's my granddaughter. 777 00:36:53,907 --> 00:36:56,427 For those who don't, she's, she's 12 and she's amazing. 778 00:36:56,757 --> 00:37:00,897 And she's, as I like to say, she's officially entered the, that's 779 00:37:00,897 --> 00:37:02,277 what you're wearing, phase of life. 780 00:37:05,517 --> 00:37:10,677 Um, but yeah, so we're still in that early sort of growing pain stage of that. 781 00:37:10,677 --> 00:37:14,157 But I guess what I'm saying is perhaps this is, this gives you yet 782 00:37:14,157 --> 00:37:17,337 another reason why you should look into, uh, implementing PAs keys. 783 00:37:18,612 --> 00:37:22,572 Start with like the most vulnerable things first, right? 784 00:37:22,572 --> 00:37:27,222 Things like QuickBooks, things like, um, you know, your bank, what was that? 785 00:37:27,792 --> 00:37:28,392 Amazon. 786 00:37:28,692 --> 00:37:29,412 Yeah, Amazon. 787 00:37:29,412 --> 00:37:30,162 Yeah, Amazon. 788 00:37:30,522 --> 00:37:30,882 Yeah. 789 00:37:30,972 --> 00:37:35,052 I mean, yeah, if you could log into Amazon and Costco. 790 00:37:35,577 --> 00:37:37,377 In my life, you could wreak havoc. 791 00:37:37,407 --> 00:37:40,197 I'm just saying you could, you know, next thing I know, there's 792 00:37:40,197 --> 00:37:43,437 4,700 packages going to Wichita. 793 00:37:44,637 --> 00:37:49,317 Um, and um, at some point, hopefully Amazon would be like, Hey, Curtis, 794 00:37:49,317 --> 00:37:50,547 you got a new friend in Wichita. 795 00:37:50,997 --> 00:37:52,947 I, I'd like to think that they would do that, but I 796 00:37:53,257 --> 00:37:53,547 Yeah. 797 00:37:53,547 --> 00:37:53,847 don't know. 798 00:37:54,477 --> 00:37:57,897 But yeah, so I, I definitely think you should, you should look into doing it at 799 00:37:57,897 --> 00:38:01,977 the really important things like banking. 800 00:38:02,922 --> 00:38:06,462 Online shopping, um, you know, bookkeeping, 801 00:38:06,927 --> 00:38:07,217 Yeah. 802 00:38:07,272 --> 00:38:10,392 uh, and again, personas, pants, size, 803 00:38:14,532 --> 00:38:17,292 any, what are any other takeaways for you from this? 804 00:38:17,292 --> 00:38:17,682 Um, 805 00:38:20,097 --> 00:38:21,117 No, I agree. 806 00:38:21,117 --> 00:38:25,497 I think password managers are still valuable just because like 807 00:38:25,737 --> 00:38:28,107 everything, you're always gonna find vulnerabilities over time. 808 00:38:28,107 --> 00:38:30,417 No matter what the system is, right, 809 00:38:30,582 --> 00:38:30,822 yeah. 810 00:38:30,867 --> 00:38:31,677 be exposed. 811 00:38:31,677 --> 00:38:33,507 It's just how quickly people react. 812 00:38:33,867 --> 00:38:37,197 It doesn't mean stop using pass, uh, password managers. 813 00:38:37,502 --> 00:38:37,947 Right, right, 814 00:38:37,977 --> 00:38:41,067 You should still continue to use it because like you said, it's better 815 00:38:41,067 --> 00:38:42,867 than whatever else was there before. 816 00:38:43,137 --> 00:38:47,127 It may not be as good as what's coming in the future, but that's not mature yet. 817 00:38:47,792 --> 00:38:48,142 right. 818 00:38:50,002 --> 00:38:55,017 And uh, yeah, it'll just be, I wonder how many years we're gonna continue to have 819 00:38:55,017 --> 00:38:57,702 to do the, like, at what point do some. 820 00:38:59,547 --> 00:39:04,437 Sites say, sorry, but you have to use a passkey. 821 00:39:05,397 --> 00:39:05,727 Right. 822 00:39:05,727 --> 00:39:10,887 So I think, for example, I think like, uh, USAA, that's a credit union 823 00:39:10,947 --> 00:39:12,507 that I, that I belong to, right? 824 00:39:12,897 --> 00:39:19,497 They, um, a couple years ago they were like, we no longer do passwords. 825 00:39:20,007 --> 00:39:24,567 We now do username and pin plus. 826 00:39:25,527 --> 00:39:29,157 An MFA token that is generated by the semantic. 827 00:39:29,157 --> 00:39:36,807 We use the semantic, um, you know, uh, VIP, the the semantic VIP software, right? 828 00:39:37,287 --> 00:39:40,197 Uh, which is really just an MFA, uh, token. 829 00:39:40,467 --> 00:39:44,517 And so you need the PIN plus the, which I think is pretty secure, right? 830 00:39:44,547 --> 00:39:48,087 So you don't really, all you have to remember is that p the pin, but. 831 00:39:48,522 --> 00:39:54,467 imagine now every single app or website you visit requires a separate MFA 832 00:39:54,897 --> 00:39:55,287 Oh yeah. 833 00:39:55,317 --> 00:39:59,097 No, I'm not, I'm definitely not a fan of the fact that I have to use the, the 834 00:39:59,097 --> 00:40:02,607 other one, the IIUI use authe, right? 835 00:40:02,637 --> 00:40:03,657 Uh, we talked about this. 836 00:40:03,657 --> 00:40:07,767 I use Authe as my MFA for most things, and I do that over Google 837 00:40:07,767 --> 00:40:12,627 Authenticator because, uh, being able to, again, security versus usability. 838 00:40:12,987 --> 00:40:17,577 I like that I can, that the, that vault I can recover, uh, with a password. 839 00:40:17,942 --> 00:40:21,572 But, um, and of course I have that password in my password manager. 840 00:40:22,742 --> 00:40:24,722 Uh, catch 22 situation there. 841 00:40:25,712 --> 00:40:26,852 Yeah, it, it is. 842 00:40:26,852 --> 00:40:28,892 By the way, do you remember the lesson of inception? 843 00:40:30,252 --> 00:40:31,272 It's all a dream. 844 00:40:31,562 --> 00:40:31,712 No. 845 00:40:31,712 --> 00:40:35,702 The technical, there's a technical lesson from inception, an IT 846 00:40:36,512 --> 00:40:39,212 level to lesson from inception. 847 00:40:39,512 --> 00:40:43,472 If you run a VM inside a vm, inside a vm, it's really slow. 848 00:40:47,191 --> 00:40:53,581 The, the downside to the free MFA, uh, software is that it's not time 849 00:40:53,581 --> 00:40:59,791 synchronized with, with the, the well it is, but it, it, it's a every 30 seconds. 850 00:41:00,091 --> 00:41:03,391 It's, whereas like with the, with the semantic VIP, the 30 seconds 851 00:41:03,391 --> 00:41:07,321 starts the moment you start the app, whereas, uh, these, the, the 852 00:41:07,321 --> 00:41:09,181 free ones, it's just, it's just a. 853 00:41:10,021 --> 00:41:12,601 Literally at, at every 30 seconds, install on the atomic clock. 854 00:41:12,631 --> 00:41:15,421 They're on the atomic clock, you're on the atomic clock, and they just know 855 00:41:15,421 --> 00:41:19,231 when the 30, so you're, if you start it up, you'll get the timer Anyway. 856 00:41:19,231 --> 00:41:20,641 If you don't know what I'm talking about, you just gotta 857 00:41:20,641 --> 00:41:22,651 go use one of the MFA things. 858 00:41:22,651 --> 00:41:29,581 But, uh, but I will say this, if you're not using MFA or pass keys 859 00:41:29,821 --> 00:41:33,361 on anything that matters, then you are just asking for a world to hurt. 860 00:41:34,231 --> 00:41:36,661 Um, you know, uh. 861 00:41:37,186 --> 00:41:37,406 Bad. 862 00:41:37,406 --> 00:41:39,246 Bad, bad, bad. 863 00:41:39,451 --> 00:41:39,751 Okay. 864 00:41:39,751 --> 00:41:40,651 Well, it's been fun. 865 00:41:40,651 --> 00:41:41,071 Persona, 866 00:41:42,151 --> 00:41:43,036 Always is 867 00:41:43,501 --> 00:41:44,551 what's your size? 868 00:41:46,966 --> 00:41:48,001 72. 869 00:41:49,141 --> 00:41:49,596 It's not 870 00:41:52,141 --> 00:41:52,621 All right. 871 00:41:52,621 --> 00:41:53,556 That is a wrap.