1 00:00:00,681 --> 00:00:04,851 You found the backup wrap up your go-to podcast for all things 2 00:00:04,851 --> 00:00:07,641 backup recovery and cyber recovery. 3 00:00:08,121 --> 00:00:12,351 In this episode, we're taking a look at password managers, something that 4 00:00:12,351 --> 00:00:14,326 we've been recommending for years. 5 00:00:15,336 --> 00:00:18,996 We all know that you need one, but which one should you choose? 6 00:00:19,176 --> 00:00:24,726 Well, uh, we're, we're taking some lessons from the LastPass breach and we talk about 7 00:00:24,726 --> 00:00:29,136 what features you should look for when picking the best password manager for 8 00:00:29,136 --> 00:00:32,166 your needs, including at least one topic. 9 00:00:32,286 --> 00:00:34,266 I haven't seen anybody else talking about. 10 00:00:35,641 --> 00:00:40,741 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 11 00:00:40,741 --> 00:00:45,421 Backup, and I've been passionate about backup and recovery for over 30 years. 12 00:00:45,661 --> 00:00:46,231 Ever since. 13 00:00:46,231 --> 00:00:49,321 I had to tell my boss that we had no backups of the 14 00:00:49,321 --> 00:00:51,391 production database we just lost. 15 00:00:51,901 --> 00:00:56,191 I don't want that to happen to you, and that's why I do this podcast. 16 00:00:56,581 --> 00:01:01,891 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 17 00:01:02,161 --> 00:01:04,201 This is the backup wrap up. 18 00:01:18,141 --> 00:01:19,101 Welcome to the show. 19 00:01:19,791 --> 00:01:24,591 Hi, I am w Curtis Preston, AKA, Mr. Backup, and I have with me a 20 00:01:24,591 --> 00:01:31,101 guy who has no idea how happy he's about to be when I tell him the 21 00:01:31,101 --> 00:01:33,171 news that I'm about to tell him. 22 00:01:33,621 --> 00:01:35,331 Persona, Molly, how's it going? 23 00:01:35,331 --> 00:01:35,826 Persona. 24 00:01:36,561 --> 00:01:38,701 Uh, I'm good. 25 00:01:39,526 --> 00:01:39,816 Okay. 26 00:01:40,971 --> 00:01:41,611 I wanna know what 27 00:01:41,796 --> 00:01:47,976 So, so those of you that watch us on YouTube watch PSA's face when 28 00:01:47,976 --> 00:01:55,176 I tell him this, I, I finally found a use for my, my planer. 29 00:02:00,771 --> 00:02:03,366 I, I've had it for how long now? 30 00:02:03,726 --> 00:02:04,056 For like 31 00:02:04,206 --> 00:02:05,736 three years, I wanna say. 32 00:02:05,766 --> 00:02:06,696 three years. 33 00:02:07,476 --> 00:02:14,076 And I bought it primarily due to peer pressure from my power tool. 34 00:02:14,076 --> 00:02:14,676 Pusher. 35 00:02:14,676 --> 00:02:16,876 Prasanna Malaiyandi, 36 00:02:17,196 --> 00:02:18,246 and uh, 37 00:02:18,261 --> 00:02:18,801 salesman. 38 00:02:18,806 --> 00:02:19,296 You know that. 39 00:02:19,686 --> 00:02:20,316 yeah. 40 00:02:20,346 --> 00:02:20,916 Yeah. 41 00:02:21,321 --> 00:02:27,741 Um, so I am there, there's this, you know, um, those of you that 42 00:02:27,741 --> 00:02:30,681 follow the podcast know about the big TV that I bought and everything. 43 00:02:30,681 --> 00:02:35,991 And, and now there's this hole in the wall, and I want that hole to continue 44 00:02:35,991 --> 00:02:40,101 because I want to get access to underneath the stairs, which is where I, you know, 45 00:02:40,101 --> 00:02:41,841 it's a great, like, big storage area. 46 00:02:42,951 --> 00:02:45,711 And, uh, I have decided. 47 00:02:46,251 --> 00:02:49,881 Um, I, I had this whole plan that I, I was gonna make a hidden door. 48 00:02:49,881 --> 00:02:52,701 It turns out to be way more complex than I wanted to do, 49 00:02:53,181 --> 00:02:54,771 to, to have it truly be hidden. 50 00:02:54,891 --> 00:02:55,311 Right. 51 00:02:55,851 --> 00:02:58,971 Uh, and so I, I've decided to go complete opposite, which 52 00:02:58,971 --> 00:03:00,501 is, uh, it's gonna be a door. 53 00:03:00,561 --> 00:03:01,941 I'm gonna, it's gonna look like a door. 54 00:03:01,941 --> 00:03:03,081 It's gonna look like a regular door. 55 00:03:03,081 --> 00:03:06,786 I. I'm gonna frame it like a regular door, but it's not built like a regular door. 56 00:03:06,786 --> 00:03:07,746 It's too small. 57 00:03:07,956 --> 00:03:13,116 And so I need to build a door and, um, like, unless I wanna spend 58 00:03:13,116 --> 00:03:15,906 like a ridiculous amount of money for a solid core door, and then 59 00:03:15,906 --> 00:03:19,926 trim it down to size, it's only 19 inches wide and 48 inches high. 60 00:03:20,986 --> 00:03:22,546 I'm gonna build my own door. 61 00:03:22,546 --> 00:03:26,596 And I said, well, I'm gonna build it out of two by fours and then, you know, and 62 00:03:26,596 --> 00:03:28,936 build a frame with pocket screws and everything. 63 00:03:29,206 --> 00:03:36,286 But then I'm like, I need all these two by fours to be exactly the same size, and 64 00:03:36,286 --> 00:03:39,706 also to have sharp, sharp corners, not the rounded 65 00:03:39,706 --> 00:03:41,866 corners that you typically have in a two by four. 66 00:03:42,376 --> 00:03:44,566 And so I said, I know what to do. 67 00:03:45,726 --> 00:03:52,446 I, I can finally pull out my, my, um, planer that I've had for quite a while 68 00:03:52,896 --> 00:03:56,916 and, uh, I did a, I did a test run of it today and oh, the, the two by four that 69 00:03:56,916 --> 00:04:00,666 goes through it is, is just gorgeous and I knew you'd be very excited. 70 00:04:01,056 --> 00:04:03,156 See, aren't you glad you have a planer? 71 00:04:04,806 --> 00:04:05,256 Yes. 72 00:04:05,256 --> 00:04:08,016 The three, the, how much was that plater? 73 00:04:08,226 --> 00:04:09,696 Like $500 maybe. 74 00:04:09,756 --> 00:04:11,706 I think it was like four 50 on sale or 75 00:04:11,736 --> 00:04:18,486 Yeah, so like, let's say a $500 planer is saving me $200 on a, on a door. 76 00:04:19,056 --> 00:04:21,246 So Yeah. 77 00:04:21,276 --> 00:04:22,326 So there you go. 78 00:04:22,536 --> 00:04:25,386 you also used it last time for your last project too. 79 00:04:25,506 --> 00:04:26,856 did, I didn't use it. 80 00:04:26,916 --> 00:04:28,296 Yeah, I, I remember. 81 00:04:28,386 --> 00:04:29,016 Yeah. 82 00:04:29,136 --> 00:04:29,766 So I've, I've, 83 00:04:30,096 --> 00:04:31,176 inch off of something. 84 00:04:31,416 --> 00:04:31,926 yeah. 85 00:04:31,956 --> 00:04:32,166 Yeah. 86 00:04:32,166 --> 00:04:33,666 Which is essentially what I'm doing here 87 00:04:33,666 --> 00:04:33,936 too. 88 00:04:33,936 --> 00:04:35,556 I'm, I'm doing, I'm trimming it both. 89 00:04:36,336 --> 00:04:37,236 Both ways. 90 00:04:37,296 --> 00:04:37,686 Right? 91 00:04:37,686 --> 00:04:41,076 I'm, I'm making it, I'm making, I'm turning a rough two by four 92 00:04:41,076 --> 00:04:43,086 into a piece of like, finished 93 00:04:43,716 --> 00:04:45,126 wood that I'm gonna use. 94 00:04:45,186 --> 00:04:46,056 Um, you know, 95 00:04:46,956 --> 00:04:49,266 anyway, I just thought you'd be very exci. 96 00:04:49,266 --> 00:04:49,356 I 97 00:04:49,356 --> 00:04:51,366 knew that you would be very excited about that. 98 00:04:51,486 --> 00:04:51,939 excited. 99 00:04:52,121 --> 00:04:53,321 Um, so anyway. 100 00:04:53,891 --> 00:04:54,311 All right. 101 00:04:54,641 --> 00:04:57,851 Well, we should probably talk about what we came here to 102 00:04:57,851 --> 00:04:59,051 talk about, what the people 103 00:04:59,051 --> 00:05:00,281 came here to listen to. 104 00:05:02,271 --> 00:05:02,661 This is no 105 00:05:02,661 --> 00:05:04,281 longer called a backup wrap up. 106 00:05:04,281 --> 00:05:06,231 This is now called the Woodworking Shop. 107 00:05:06,761 --> 00:05:07,331 yeah. 108 00:05:07,661 --> 00:05:11,351 Uh, I'm pretty sure there are pretty established podcasts for that. 109 00:05:11,981 --> 00:05:18,911 So I, I, so the core of this, uh, episode is going to be about how 110 00:05:18,911 --> 00:05:21,581 if I was starting, you know, I already have a password manager. 111 00:05:21,821 --> 00:05:24,791 You have a password manager, I'm happy with my password manager. 112 00:05:25,391 --> 00:05:27,521 Um, and, um. 113 00:05:27,701 --> 00:05:28,991 we've also talked about pass keys. 114 00:05:29,441 --> 00:05:31,091 And we've also talked about PAs keys. 115 00:05:31,091 --> 00:05:33,641 And by the way, my password manager now supports PAs keys, 116 00:05:33,641 --> 00:05:33,881 right? 117 00:05:33,881 --> 00:05:39,461 So, um, so my question is, um, but, but. 118 00:05:40,526 --> 00:05:45,086 The, the core of what we're gonna talk about is, if I was picking, if I was 119 00:05:45,086 --> 00:05:48,116 starting today, what, what are the, what are some of the things that I 120 00:05:48,116 --> 00:05:53,156 would look at and we can make, we're gonna talk both in terms of feature 121 00:05:53,156 --> 00:05:58,886 functions as well as one really crucial thing that I haven't seen listed 122 00:05:58,886 --> 00:06:01,826 when I see other people talk about, hey, how to pick a password manager. 123 00:06:02,576 --> 00:06:06,956 Um, so we're gonna talk about that, which really comes from. 124 00:06:07,916 --> 00:06:12,686 A big lesson that was learned from a very big hack of a password manager. 125 00:06:13,496 --> 00:06:18,536 So, um, this, this episode started with the fact that there had been a 126 00:06:18,536 --> 00:06:24,296 handful of cyber incidents in the last, uh, week or so since, you know, in, 127 00:06:24,296 --> 00:06:25,766 in the time that we're recording this. 128 00:06:26,396 --> 00:06:32,066 And, um, you know, I see three there, there was, there was the, um, the 129 00:06:32,066 --> 00:06:33,386 one that you talked about where the. 130 00:06:33,596 --> 00:06:35,906 The, the ransomware gang encrypted the 131 00:06:35,906 --> 00:06:39,026 network from a webcam, right? 132 00:06:39,116 --> 00:06:44,756 Uh, we've got the rubric, um, uh, hack, we've got the, uh, and we've 133 00:06:44,756 --> 00:06:51,776 got this, this FBI notification that LastPass has definitely been 134 00:06:51,776 --> 00:06:54,481 involved in some actual breaches of 135 00:06:54,491 --> 00:06:54,971 Well, 136 00:06:55,511 --> 00:06:56,001 wallets. 137 00:06:56,621 --> 00:07:02,261 the, breach against LastPass where they exfiltrated some data was then used. 138 00:07:02,936 --> 00:07:03,536 Right, right, 139 00:07:03,611 --> 00:07:07,601 wanna make sure that LastPass wasn't actually involved in committing 140 00:07:07,646 --> 00:07:08,126 Yeah. 141 00:07:08,486 --> 00:07:09,116 Yes. 142 00:07:09,236 --> 00:07:09,866 Yes. 143 00:07:10,106 --> 00:07:10,826 And, and 144 00:07:11,486 --> 00:07:11,756 yeah. 145 00:07:11,756 --> 00:07:16,466 And, and again, we're, uh, we're doing our best to sort of, uh. 146 00:07:17,141 --> 00:07:17,861 What do you call it? 147 00:07:17,921 --> 00:07:20,471 Uh, distill the things that we can read in the news. 148 00:07:20,471 --> 00:07:22,691 We're not involved in any of these. 149 00:07:23,141 --> 00:07:29,831 Um, uh, and you know, and we're also not cybersecurity experts, uh, but you know, 150 00:07:30,011 --> 00:07:36,281 I think we can, um, we can distill what's important for the audience here, which. 151 00:07:37,736 --> 00:07:41,816 Anyone that listens to this podcast more than a few times is going to hear 152 00:07:41,816 --> 00:07:43,796 us recommend a password manager, right? 153 00:07:43,796 --> 00:07:45,776 They're gonna hear us talk about the 3, 2, 1 rule. 154 00:07:45,986 --> 00:07:48,266 They're gonna hear us talk about the importance of offsite backups. 155 00:07:48,266 --> 00:07:50,456 They're gonna hear, talk about the importance of immutability 156 00:07:51,626 --> 00:07:54,086 and the importance of having a password manager, right? 157 00:07:54,116 --> 00:07:58,376 And so since we're talking about a lot, I don't think we've done an episode where we 158 00:07:58,376 --> 00:08:06,236 sh we just talk about, um, you know, how to pick a password manager and, um, so. 159 00:08:06,251 --> 00:08:09,851 The, and, and, and they do fall into a couple different categories. 160 00:08:09,851 --> 00:08:12,791 We'll get to that in a sec, but let's, first, let's just, 161 00:08:12,821 --> 00:08:14,651 uh, sort of do a roundup here. 162 00:08:14,861 --> 00:08:19,811 So the first one that I see is this, this rubric, um, notification. 163 00:08:19,991 --> 00:08:24,971 So the good news here is that this isn't, you know, I, I initially 164 00:08:24,971 --> 00:08:26,771 called it rubric hack, but basically. 165 00:08:27,476 --> 00:08:32,306 Rubrik noticed some, um, anomalous activity on, on a server that 166 00:08:32,306 --> 00:08:34,646 they have that contains log files. 167 00:08:34,946 --> 00:08:37,106 Um, you know, they took the server offline. 168 00:08:37,406 --> 00:08:40,796 They went and changed a bunch of passwords, you know, rotated keys, uh, 169 00:08:40,796 --> 00:08:43,256 to mitigate any risk they don't have. 170 00:08:43,256 --> 00:08:46,436 You know, as, as is often a case, they don't have any, 171 00:08:46,436 --> 00:08:48,896 any, uh, evidence that that. 172 00:08:49,541 --> 00:08:54,281 Anything, uh, you know, there was any malfeasance other than the fact 173 00:08:54,281 --> 00:08:57,131 that they saw some activity in a log server that shouldn't be there. 174 00:08:57,821 --> 00:09:01,001 Um, and so they, they did what they should do, right? 175 00:09:01,001 --> 00:09:01,151 They 176 00:09:01,151 --> 00:09:04,151 notified the world and, uh, rotated the keys. 177 00:09:04,346 --> 00:09:05,186 yeah, and I was 178 00:09:05,186 --> 00:09:09,521 actually quite pleased because I. That they notified people, right? 179 00:09:09,521 --> 00:09:14,711 Because that's something that you don't normally publicly disclose, 180 00:09:14,711 --> 00:09:15,071 right? 181 00:09:15,071 --> 00:09:18,551 Or you just disclose it to the specific customers or whatever else. 182 00:09:18,551 --> 00:09:22,631 But they were upfront about it and we're like, Hey, we saw this. 183 00:09:22,661 --> 00:09:23,651 We took action. 184 00:09:24,311 --> 00:09:25,241 Nothing happened. 185 00:09:25,661 --> 00:09:27,821 Everything is good because we've also had cases, right? 186 00:09:27,821 --> 00:09:31,421 Ransomware cases where they did, they weren't forthcoming, right? 187 00:09:31,421 --> 00:09:31,901 The Okta 188 00:09:31,901 --> 00:09:34,931 hack as an example, right? 189 00:09:35,081 --> 00:09:35,441 right. 190 00:09:35,501 --> 00:09:36,101 Exactly. 191 00:09:36,356 --> 00:09:37,796 transparent is, I think another thing 192 00:09:37,796 --> 00:09:40,256 that we always stress on the podcast as well. 193 00:09:40,496 --> 00:09:41,006 It is. 194 00:09:41,006 --> 00:09:44,036 And, and they, and they basically, they, they were as transparent as could be. 195 00:09:44,036 --> 00:09:45,806 They put a blog post on their website. 196 00:09:45,836 --> 00:09:46,196 Right. 197 00:09:46,226 --> 00:09:51,356 And, um, so, uh, basically as a result, of course notified the world. 198 00:09:51,986 --> 00:09:53,726 Um, this, what's 199 00:09:53,726 --> 00:09:54,086 that? 200 00:09:54,446 --> 00:09:55,046 to Rubrik. 201 00:09:55,196 --> 00:09:55,976 Kudos to Rubrik. 202 00:09:56,066 --> 00:09:56,336 Right? 203 00:09:56,756 --> 00:10:02,846 So, um, the next one I'd like you to talk about because it's a really interesting 204 00:10:03,266 --> 00:10:05,786 thing, this idea, this the webcam 205 00:10:05,846 --> 00:10:06,476 hack. 206 00:10:07,106 --> 00:10:08,186 Um, Yeah. 207 00:10:08,186 --> 00:10:08,666 go ahead. 208 00:10:08,726 --> 00:10:13,196 a company that, uh, got attacked by ransomware 209 00:10:13,736 --> 00:10:16,466 and they were looking back to figure out, okay, what happened? 210 00:10:16,526 --> 00:10:22,376 And, uh, so this ransomware gang got into the network and they compromised a 211 00:10:22,376 --> 00:10:25,886 server and they tried to deploy malware. 212 00:10:26,516 --> 00:10:30,236 And while they tried to deploy the malware, it was basically caught by the 213 00:10:30,236 --> 00:10:32,996 endpoint detection and response software 214 00:10:33,551 --> 00:10:33,941 Right. 215 00:10:34,676 --> 00:10:37,316 that basically was like, Hey, you can't run, you look bad, 216 00:10:37,316 --> 00:10:38,396 so we're not gonna let you run. 217 00:10:39,276 --> 00:10:39,626 Right, 218 00:10:39,926 --> 00:10:42,416 So then they kept looking around, they're like, okay, how 219 00:10:42,416 --> 00:10:43,976 do we continue to attack this? 220 00:10:43,976 --> 00:10:47,456 And they saw that there were a bunch of servers and PCs and other things, 221 00:10:47,906 --> 00:10:50,936 but they all had EDS on it, EDR agents. 222 00:10:51,266 --> 00:10:54,806 And so what they decided to do is they noticed, hey, there's a webcam 223 00:10:56,186 --> 00:10:58,916 the network and it's running Linux. 224 00:10:59,531 --> 00:10:59,821 Yeah. 225 00:10:59,826 --> 00:11:00,026 Yeah. 226 00:11:00,311 --> 00:11:04,541 they were able to, oh, and it had a vulnerability, so they were able 227 00:11:04,541 --> 00:11:07,511 to basically take over the webcam. 228 00:11:07,601 --> 00:11:12,101 They were able to monitor the live feeds as well, and at the same time, 229 00:11:12,131 --> 00:11:18,161 they basically SMB mounted the file shares and the NAS servers from the 230 00:11:18,161 --> 00:11:23,411 webcam and on the webcam, they deployed their malware and had it go encrypt 231 00:11:23,711 --> 00:11:25,391 all of the data in the company. 232 00:11:27,146 --> 00:11:31,016 That's just, I mean, it, it's, it's amusing a little bit. 233 00:11:31,016 --> 00:11:32,276 It's amusing if you're not them. 234 00:11:32,576 --> 00:11:38,516 It's amusing that it, that it was a webcam, but it, it, it, it just reiterates 235 00:11:38,516 --> 00:11:45,266 that, that I. Issue that like any device on your network that has a brain. 236 00:11:45,686 --> 00:11:45,986 Right. 237 00:11:45,986 --> 00:11:50,006 We've been joking recently that I got a new washer and dryer and 238 00:11:50,006 --> 00:11:53,216 they have an app and I'm sure that washer and dryer is running Linux. 239 00:11:53,216 --> 00:11:53,546 Right. 240 00:11:53,576 --> 00:11:58,706 I know, I know, It's not running Windows and it's not running Mac Os so pretty 241 00:11:58,706 --> 00:12:04,496 sure it's running, you know, Debian or something on, on some little card and, um. 242 00:12:04,841 --> 00:12:10,511 I noticed that I got, and I installed the app on my phone, and so I get 243 00:12:10,511 --> 00:12:14,651 notifications that laundry's done, which is kind of cool, right? 244 00:12:15,131 --> 00:12:21,491 Um, but I got the notification from the phone of saying, Hey, you're, 245 00:12:21,551 --> 00:12:25,781 this, this, um, this, uh, app has been 246 00:12:26,051 --> 00:12:28,361 monitoring your your location 247 00:12:28,361 --> 00:12:29,981 for the last, do you want to? 248 00:12:30,221 --> 00:12:33,611 And I'm like, why does my washer dryer need to know where I 249 00:12:33,611 --> 00:12:33,941 am? 250 00:12:34,691 --> 00:12:40,031 But yeah, we, we, we put a lot of these smart devices on our network and that, 251 00:12:40,031 --> 00:12:41,681 you know, they have vulnerabilities 252 00:12:41,681 --> 00:12:47,321 and, and and it's, you know, we talk a lot about, you know, you're only 253 00:12:47,321 --> 00:12:48,911 strong as your weakest link, right? 254 00:12:49,151 --> 00:12:53,141 When you have all these devices on your network, uh. 255 00:12:54,041 --> 00:12:54,261 Yep. 256 00:12:54,401 --> 00:12:56,171 They, they all have to be managed. 257 00:12:56,171 --> 00:13:00,461 So I was gonna say, they all have to be managed from a cybersecurity perspective. 258 00:13:00,971 --> 00:13:05,261 And so in the end, this device had a vulnerability that 259 00:13:05,261 --> 00:13:07,331 was most likely patchable, 260 00:13:08,231 --> 00:13:08,741 right. 261 00:13:09,161 --> 00:13:13,361 All they had to do was update that webcam, but it wasn't because 262 00:13:13,361 --> 00:13:15,191 it was just some random device 263 00:13:15,701 --> 00:13:18,461 sitting on the network that nobody was uh, securing. 264 00:13:18,551 --> 00:13:18,851 Yep. 265 00:13:18,881 --> 00:13:21,371 And they couldn't run their EDR agent on it and all 266 00:13:21,371 --> 00:13:21,941 the rest of that. 267 00:13:21,941 --> 00:13:22,241 Right. 268 00:13:22,241 --> 00:13:22,661 So, 269 00:13:22,991 --> 00:13:26,081 and this is where I think sometimes network security becomes 270 00:13:26,081 --> 00:13:28,481 your best friend, because why? 271 00:13:28,481 --> 00:13:32,411 Is there a reason that a network camera needs access to your corporate network? 272 00:13:32,441 --> 00:13:33,192 I don't know, but. 273 00:13:35,306 --> 00:13:36,176 Yeah. 274 00:13:36,386 --> 00:13:37,436 Well, there might've been. 275 00:13:37,496 --> 00:13:42,311 I mean, you know, I, I mean, are you suggesting basically 276 00:13:42,311 --> 00:13:43,196 it should be on a separate 277 00:13:43,196 --> 00:13:44,636 network or, okay. 278 00:13:44,696 --> 00:13:45,026 Yeah. 279 00:13:45,776 --> 00:13:45,926 Yeah. 280 00:13:45,926 --> 00:13:46,586 that makes sense. 281 00:13:46,796 --> 00:13:48,656 Um, the, um. 282 00:13:50,081 --> 00:13:52,871 I was just thinking about my house, not, not the corporate 'cause. 283 00:13:54,161 --> 00:13:54,581 Yeah. 284 00:13:54,611 --> 00:13:55,031 Anyway. 285 00:13:55,361 --> 00:13:55,841 Uh, I 286 00:13:55,841 --> 00:13:58,391 don't have, I know, I know it's very common to create a, 287 00:13:58,391 --> 00:14:00,341 a smart device network, right? 288 00:14:00,881 --> 00:14:02,831 Uh, they can all hack each other, but not, 289 00:14:02,921 --> 00:14:04,601 um, yeah. 290 00:14:05,411 --> 00:14:09,416 So, um, and then let's talk about the big one. 291 00:14:09,416 --> 00:14:09,581 Big one. 292 00:14:09,611 --> 00:14:14,261 So we'll start, we'll go back to, we'll just remind, you 293 00:14:14,261 --> 00:14:16,301 wanna remind, uh, the listeners. 294 00:14:16,946 --> 00:14:19,481 What happened in 2022 with LastPass? 295 00:14:19,661 --> 00:14:25,091 Yeah, so LastPass is an online password manager, um, where you, 296 00:14:25,121 --> 00:14:26,921 they manage your passwords for you. 297 00:14:26,921 --> 00:14:30,821 Everything is encrypted with your master password, so they don't actually have 298 00:14:30,821 --> 00:14:35,501 access to the data, and then you're able to access it from anywhere, any 299 00:14:35,501 --> 00:14:37,481 device that you want, any website. 300 00:14:38,066 --> 00:14:38,456 Right? 301 00:14:38,501 --> 00:14:46,421 so what happened is in 2022, attackers got into LastPass by deploying. 302 00:14:46,736 --> 00:14:52,076 Malware on a plex server of an employee and then 303 00:14:52,256 --> 00:14:52,946 That's back. 304 00:14:52,976 --> 00:14:56,336 We're back to why is there a plex server on the corporate network? 305 00:14:56,516 --> 00:14:56,726 What? 306 00:14:56,726 --> 00:14:58,406 What is a plex server, by the way, for those 307 00:14:58,406 --> 00:14:59,246 that don't know what that is? 308 00:14:59,306 --> 00:15:00,866 media server, so it 309 00:15:00,866 --> 00:15:03,956 allows you to stream videos and audio and other things like that. 310 00:15:04,381 --> 00:15:04,671 Yeah. 311 00:15:05,006 --> 00:15:08,126 So, uh, now granted, I don't know if that was on the corporate network, 312 00:15:08,126 --> 00:15:10,136 it might have been someone's home network, which they, I'm piggybacked 313 00:15:10,136 --> 00:15:10,316 on. 314 00:15:10,316 --> 00:15:11,336 I don't know those details, 315 00:15:11,726 --> 00:15:12,266 but. 316 00:15:12,866 --> 00:15:17,276 What they did was they were able to then get into LastPass object 317 00:15:17,276 --> 00:15:22,136 store system and basically copy out these encrypted vaults, which 318 00:15:22,136 --> 00:15:24,656 contained all of the end users' passwords. 319 00:15:24,786 --> 00:15:25,556 I. Right. 320 00:15:25,736 --> 00:15:29,456 So, so that gave them access to an, to encrypted versions 321 00:15:29,486 --> 00:15:31,196 of the user's passwords. 322 00:15:31,586 --> 00:15:34,136 The vaults were encrypted, 323 00:15:34,526 --> 00:15:35,126 right? 324 00:15:35,606 --> 00:15:40,796 So if, and, and of course the end of the story is that, and, and by the way, just 325 00:15:40,796 --> 00:15:45,146 a couple weeks ago we talked about, we, we had this phrase of like, I know a lot 326 00:15:45,146 --> 00:15:48,536 of, I don't know anyone that's been hacked because they had a password manager, 327 00:15:49,106 --> 00:15:50,276 but I know lots of people that have been 328 00:15:50,276 --> 00:15:51,806 hacked because they didn't have one. 329 00:15:52,136 --> 00:15:53,216 And now we're gonna talk about a 330 00:15:53,216 --> 00:15:53,666 story where. 331 00:15:54,086 --> 00:15:56,666 Where apparently people did get hacked because they used 332 00:15:56,666 --> 00:15:57,626 the wrong password manager. 333 00:15:57,626 --> 00:15:59,816 So, um, which is what led me to 334 00:15:59,876 --> 00:16:01,076 wanting to do this episode. 335 00:16:01,736 --> 00:16:02,581 So, yeah. 336 00:16:02,606 --> 00:16:03,626 2022, right? 337 00:16:03,626 --> 00:16:03,866 So 338 00:16:03,871 --> 00:16:04,291 it's been. 339 00:16:05,486 --> 00:16:07,166 Two and a half plus years. 340 00:16:07,556 --> 00:16:07,946 Right. 341 00:16:08,186 --> 00:16:10,556 And so there were some challenges. 342 00:16:10,556 --> 00:16:14,516 Initially LastPass was like, Hey, don't worry, everything is fine. 343 00:16:14,516 --> 00:16:15,776 You had a master password. 344 00:16:15,776 --> 00:16:17,216 Those weren't compromised. 345 00:16:17,756 --> 00:16:18,026 Right? 346 00:16:18,026 --> 00:16:18,986 All the rest of that. 347 00:16:19,376 --> 00:16:22,466 Um, but it turns out it was in completely true. 348 00:16:23,211 --> 00:16:23,561 Right. 349 00:16:23,756 --> 00:16:28,976 depending on when you actually created your vault, they might 350 00:16:28,976 --> 00:16:30,986 have used a weaker algorithm. 351 00:16:32,141 --> 00:16:32,561 Right, 352 00:16:32,591 --> 00:16:38,501 and also not enforce sort of more or longer passwords. 353 00:16:39,311 --> 00:16:44,891 And so the less iterations they use, as well as the shorter the passwords, 354 00:16:44,891 --> 00:16:46,991 that makes it slightly easier to crack. 355 00:16:48,116 --> 00:16:48,656 Yeah. 356 00:16:48,656 --> 00:16:56,006 And so I guess, and again, I'm not, I. I'm not an expert in this, but could they 357 00:16:56,006 --> 00:16:59,336 have upgraded this vault like over time? 358 00:16:59,876 --> 00:17:03,086 Like if once they, once they went to a strong word, a stronger 359 00:17:03,356 --> 00:17:06,926 encryption algorithm, couldn't they have upgraded that vault? 360 00:17:06,931 --> 00:17:07,101 Uh 361 00:17:07,166 --> 00:17:09,566 I don't, I don't think they could have, 362 00:17:10,461 --> 00:17:10,581 hmm. 363 00:17:11,186 --> 00:17:15,776 I think it would've required recreating a vault, which I'm sure isn't too difficult. 364 00:17:16,676 --> 00:17:16,766 Right. 365 00:17:17,066 --> 00:17:19,076 Right, and moving your passwords over. 366 00:17:19,856 --> 00:17:20,366 Yeah. 367 00:17:20,546 --> 00:17:24,596 Yeah, that'd be, um, it's just so, but they definitely did not do 368 00:17:24,596 --> 00:17:25,376 that, apparently. 369 00:17:25,376 --> 00:17:29,576 So if you've been a, if you've been a, uh, so basically the more money you've given 370 00:17:29,576 --> 00:17:32,636 to LastPass, the better your chance you 371 00:17:32,636 --> 00:17:35,306 have of being hacked, which is somewhat ironic. 372 00:17:35,546 --> 00:17:37,256 I was looking at an article, 373 00:17:37,361 --> 00:17:37,781 Mm-hmm. 374 00:17:37,886 --> 00:17:40,646 to that here from Krebs on security, Brian Krebs, 375 00:17:41,096 --> 00:17:46,226 and he basically had a picture which said, okay, if you use the 376 00:17:46,226 --> 00:17:50,726 algorithm, if you had an old password vault, using the less strict stuff. 377 00:17:51,116 --> 00:17:51,386 Right. 378 00:17:51,386 --> 00:17:58,496 And a common complexity password, you could crack it using a single GPU in 379 00:17:58,496 --> 00:18:01,346 one year and it would cost you $7,500. 380 00:18:02,456 --> 00:18:02,846 Yeah, 381 00:18:05,096 --> 00:18:05,516 Right. 382 00:18:05,816 --> 00:18:10,406 Versus if you had the newer stuff right, it would take 383 00:18:10,406 --> 00:18:12,836 you 10 years and cost $75,000. 384 00:18:15,566 --> 00:18:17,306 that's interesting that it's still. 385 00:18:17,642 --> 00:18:18,002 oh, a 386 00:18:18,002 --> 00:18:19,622 password of average complexity. 387 00:18:19,742 --> 00:18:20,102 Gotcha. 388 00:18:20,582 --> 00:18:20,942 Right. 389 00:18:21,062 --> 00:18:22,922 So it could, right. 390 00:18:22,922 --> 00:18:25,532 So if we think about it, right, it's been two and a half years, 391 00:18:26,912 --> 00:18:29,252 $7,500 isn't a lot of money. 392 00:18:29,882 --> 00:18:34,652 And I think also what they're looking at, especially if you're able to figure 393 00:18:34,652 --> 00:18:37,532 out like who do you want to target, 394 00:18:38,067 --> 00:18:38,487 Mm-hmm. 395 00:18:38,942 --> 00:18:39,212 right? 396 00:18:39,212 --> 00:18:41,072 You don't need to crack everyone's vaults. 397 00:18:42,122 --> 00:18:44,912 If you've identified people whose vaults you wanna crack, 398 00:18:46,592 --> 00:18:49,322 then it could be very lucrative. 399 00:18:49,637 --> 00:18:50,057 Mm-hmm. 400 00:18:50,822 --> 00:18:51,242 Right. 401 00:18:51,272 --> 00:18:56,312 In terms of the payout, and I think this is what we saw in 2023, in 402 00:18:56,312 --> 00:19:00,152 September of 2023, Brian Krebs had also written an article where he 403 00:19:00,152 --> 00:19:05,222 was like, I think that people are actually going after crypto wallets. 404 00:19:06,107 --> 00:19:06,657 Right, right. 405 00:19:07,037 --> 00:19:11,207 Right, and, but they couldn't prove it at the time, but there 406 00:19:11,207 --> 00:19:13,367 just seemed to be some linkages 407 00:19:14,207 --> 00:19:14,657 So, 408 00:19:14,957 --> 00:19:17,662 seemed to link to the fact that people were using. 409 00:19:18,767 --> 00:19:20,237 so let's talk about that. 410 00:19:20,537 --> 00:19:23,567 Um, hang on one second. 411 00:19:23,777 --> 00:19:26,057 Um, so let's talk about that. 412 00:19:26,107 --> 00:19:29,678 And again, I just for the record, not a crypto guy, not 413 00:19:30,097 --> 00:19:32,377 not a cryptocurrency person. 414 00:19:32,977 --> 00:19:37,587 Um, but historically all you need is a passphrase and you're in and 415 00:19:37,587 --> 00:19:39,327 you have the crypto wallet, right? 416 00:19:39,777 --> 00:19:42,327 Um, and you can see everything that's in the crypto wallet. 417 00:19:42,327 --> 00:19:47,037 You can take everything out of the crypto wallet and, um, and so 418 00:19:47,037 --> 00:19:50,847 apparently a bunch of people had that. 419 00:19:51,172 --> 00:19:53,032 There is a way to address this now. 420 00:19:53,872 --> 00:19:56,512 Uh, with something called BIP 39. 421 00:19:56,872 --> 00:20:02,662 And so this is the idea of adding a past phrase on top of your seed phrase, 422 00:20:03,142 --> 00:20:07,522 so you, you have to have two pieces of information to get into a crypto wallet. 423 00:20:07,642 --> 00:20:11,902 Assuming you've enacted this concept called bi BIP 30, 424 00:20:11,932 --> 00:20:13,012 that's hard for me to say. 425 00:20:13,372 --> 00:20:14,482 BIP 39. 426 00:20:15,447 --> 00:20:20,247 And, but apparently there, I'm, I'm sure I am absolutely sure that there are 427 00:20:20,247 --> 00:20:21,717 tons of wallets that haven't done this. 428 00:20:21,747 --> 00:20:23,337 'cause it's probably, again, like what we were 429 00:20:23,337 --> 00:20:26,367 talking about before, it might be difficult to redo 430 00:20:26,367 --> 00:20:27,747 this once this has been done. 431 00:20:28,197 --> 00:20:28,827 Don't know. 432 00:20:29,607 --> 00:20:35,487 But a bunch of wallets had just this, uh, seed phrase and they 433 00:20:35,487 --> 00:20:38,097 stored their seed phrase in LastPass, 434 00:20:38,757 --> 00:20:39,297 and 435 00:20:39,387 --> 00:20:40,107 to do, right? 436 00:20:40,317 --> 00:20:42,597 Which you would think would be a good thing to do, It's a, 437 00:20:42,957 --> 00:20:43,587 yeah. 438 00:20:44,097 --> 00:20:44,367 Yeah. 439 00:20:44,517 --> 00:20:44,727 It's 440 00:20:44,727 --> 00:20:46,167 stored, it's accessible. 441 00:20:46,632 --> 00:20:49,782 Yeah, I, I mean there, there, you know, I looked at some other discussions 442 00:20:49,782 --> 00:20:55,452 of ways to do this better, ways to do this, and, um, basically the, the 443 00:20:55,452 --> 00:20:59,592 only good way to do it, I think is to do the, the BIP 39 so that you can, 444 00:20:59,652 --> 00:21:01,842 um, so that you need two things, but 445 00:21:01,842 --> 00:21:02,292 then you 446 00:21:02,352 --> 00:21:03,942 need to remember another thing, right? 447 00:21:03,987 --> 00:21:05,697 do you know what the worst way to do it is? 448 00:21:07,152 --> 00:21:08,922 Um, put it on a sticky note. 449 00:21:10,047 --> 00:21:13,287 Put it on a flash drive and throw it in the dump. 450 00:21:17,427 --> 00:21:18,087 Yeah. 451 00:21:18,237 --> 00:21:19,617 I wonder how that guy's going. 452 00:21:19,707 --> 00:21:21,597 That guy that bought the dump, did he buy the dump? 453 00:21:21,687 --> 00:21:23,848 I don't know if they actually bought the dump yet or not. 454 00:21:25,407 --> 00:21:29,247 For those who don't know, there's a guy who bought a bunch of Bitcoins, 455 00:21:29,247 --> 00:21:34,347 had it on a hard drive, the keys, and then basically tossed the drive. 456 00:21:34,377 --> 00:21:38,127 So it's sitting in a landfill with something like a couple billion 457 00:21:38,127 --> 00:21:40,017 dollars worth of Bitcoin at this point. 458 00:21:40,372 --> 00:21:40,662 Yeah. 459 00:21:42,327 --> 00:21:45,297 And he's been looking for that hard drive or a flash drive forever. 460 00:21:45,432 --> 00:21:46,272 Yeah, I bet. 461 00:21:47,082 --> 00:21:54,462 Um, so they stored without an additional, uh, BIP 39, um, pass phrase. 462 00:21:54,462 --> 00:22:00,522 They stored their, you know, they stored their, their seed phrase in 463 00:22:01,662 --> 00:22:07,182 last pass, their LastPass vault was accessed because of the LastPass hack. 464 00:22:07,872 --> 00:22:12,402 I'm assuming they probably then had one of the older encrypted. 465 00:22:13,122 --> 00:22:15,912 Uh, vaults, I'm assuming, uh, this is 466 00:22:15,912 --> 00:22:17,652 definitely an go ahead, 467 00:22:17,667 --> 00:22:19,137 Even if they didn't. 468 00:22:20,037 --> 00:22:20,457 Right. 469 00:22:20,547 --> 00:22:24,987 I wonder if with, because that article was from a while ago with 470 00:22:25,437 --> 00:22:28,557 newer technologies, right? 471 00:22:28,557 --> 00:22:30,027 Newer GPUs. 472 00:22:30,297 --> 00:22:35,697 I wonder if the timings that we had talked about the 10 years is still applicable 473 00:22:36,972 --> 00:22:37,752 Yeah, I don't know. 474 00:22:37,932 --> 00:22:38,562 Um, 475 00:22:38,577 --> 00:22:40,047 was also a single GPU, right? 476 00:22:40,047 --> 00:22:40,527 So if you have a 477 00:22:40,527 --> 00:22:41,127 cluster of GPUs. 478 00:22:43,017 --> 00:22:43,407 Right. 479 00:22:44,547 --> 00:22:45,057 Yeah. 480 00:22:45,117 --> 00:22:50,247 Um, but what we do know is based on this article from, um, Krebs on 481 00:22:50,247 --> 00:22:56,277 Security from Brian Krebs, that it, it, that the first article was, it 482 00:22:56,277 --> 00:22:58,167 appears that people are having their, 483 00:22:58,407 --> 00:23:02,007 um, the wallets stolen and, um, 484 00:23:02,037 --> 00:23:04,197 the, the latest thing, what's that? 485 00:23:04,302 --> 00:23:06,762 I think it was like 30 million, $40 million. 486 00:23:06,942 --> 00:23:12,102 Yeah, so the latest thing was what, what happened, uh, the last couple days, 487 00:23:12,297 --> 00:23:18,957 So in the last couple days, the feds actually have said that, oh yeah, there 488 00:23:18,957 --> 00:23:24,027 was a bunch of cyber heists, I think it was $150 million cryptocurrency heist. 489 00:23:24,027 --> 00:23:27,207 And they basically said, yeah, that was actually from the 490 00:23:27,207 --> 00:23:29,427 last pass breach that happened. 491 00:23:30,957 --> 00:23:31,177 so. 492 00:23:33,117 --> 00:23:34,947 I mean this, this is frustrating. 493 00:23:35,127 --> 00:23:42,327 Um, it's frustrating because you would think that if you're a crypto person 494 00:23:42,927 --> 00:23:47,397 and you know that, that key is the only thing that you can change your crypto, 495 00:23:47,397 --> 00:23:49,167 surely you can change your crypto key. 496 00:23:50,932 --> 00:23:53,272 because You can't change it because it's almost like a private public key. 497 00:23:54,082 --> 00:23:56,482 You basically have to toss it and get another one. 498 00:23:56,482 --> 00:23:58,657 I cannot change once it's broadcast. 499 00:23:58,657 --> 00:24:00,817 Well, okay, you, 500 00:24:00,907 --> 00:24:01,897 could transfer it to 501 00:24:01,987 --> 00:24:05,317 you could transfer your money, so why are they not doing that? 502 00:24:05,317 --> 00:24:05,882 That's all I'm saying. 503 00:24:06,247 --> 00:24:11,437 I'm just saying people that do crypto wallets, I would think would be rather 504 00:24:11,437 --> 00:24:15,307 obsessed with, you know, with security. 505 00:24:15,367 --> 00:24:19,057 so this $150 million cyber heist that happened last year that the 506 00:24:19,057 --> 00:24:21,187 feds were able to recover some money for, 507 00:24:22,147 --> 00:24:28,237 it was actually against a co-founder of the cryptocurrency platform called Ripple. 508 00:24:30,192 --> 00:24:31,507 I don't, I don't understand this. 509 00:24:31,507 --> 00:24:35,077 I mean, I'm, I'm, I'm an amateur at this stuff, and that's the first 510 00:24:35,077 --> 00:24:39,397 thing I would do if I stored my, I don't care what last Pass had told me. 511 00:24:39,547 --> 00:24:43,867 If I was a LastPass customer and I had stored my seed phrase in 512 00:24:44,617 --> 00:24:48,457 LastPass, and they told me that the vault, everything should be fine. 513 00:24:48,457 --> 00:24:49,837 I'd be like, screw that. 514 00:24:49,987 --> 00:24:52,207 I'm transferring my money to a different 515 00:24:52,567 --> 00:24:53,257 vault. 516 00:24:53,707 --> 00:24:54,067 Right? 517 00:24:54,067 --> 00:24:58,207 A different wallet and, uh, with a much stronger passphrase, you 518 00:24:58,207 --> 00:24:59,557 know, all, all, all those things. 519 00:24:59,557 --> 00:25:05,317 I, I don't, which is why when, when I read, I, I think it was Brian 520 00:25:05,317 --> 00:25:08,137 Krebs article, and he was like, these people know what they're doing. 521 00:25:08,857 --> 00:25:10,357 You know, he's like, these are not amateurs. 522 00:25:10,357 --> 00:25:11,407 These people know what they're doing. 523 00:25:11,407 --> 00:25:12,427 And I'm, I don't know. 524 00:25:12,427 --> 00:25:15,967 I, I know, and I know it's just like blaming the victim or whatever, but 525 00:25:17,977 --> 00:25:21,307 first off, I mean, this isn't what this episode is about. 526 00:25:21,307 --> 00:25:24,757 But, but I mean, we're, we're 28 minutes in. 527 00:25:24,937 --> 00:25:26,437 It's still what the episode is about. 528 00:25:26,797 --> 00:25:30,397 But I mean, if you're a crypto person, I don't know. 529 00:25:30,397 --> 00:25:32,437 I would, I would be looking at BIP 39. 530 00:25:32,467 --> 00:25:35,767 I would be looking how to enact out on a new wallet, and I would be transferring 531 00:25:35,767 --> 00:25:37,327 everything I have into that new wallet. 532 00:25:37,957 --> 00:25:39,427 I would be doing that right now. 533 00:25:39,817 --> 00:25:44,407 Um, and if you, and I'd be doing it sooner than that if I was in the LastPass 534 00:25:44,407 --> 00:25:46,207 hack, but that's just me. 535 00:25:46,612 --> 00:25:50,692 So there was a security reach researcher, let me see if, what was his name? 536 00:25:50,692 --> 00:25:54,322 Zach, uh, XBT is what he goes by. 537 00:25:54,532 --> 00:25:58,762 He's a blockchain security researcher and he basically said over the last 538 00:25:58,762 --> 00:26:03,262 many months there have been several six figure heists from cryptocurrencies. 539 00:26:04,447 --> 00:26:04,777 Mm. 540 00:26:05,512 --> 00:26:05,872 So 541 00:26:05,872 --> 00:26:10,462 it's not, it's just that this $150 billion one is like the 542 00:26:10,462 --> 00:26:10,792 big 543 00:26:10,957 --> 00:26:13,837 just, yeah, it, it, yeah, it got it, got it. 544 00:26:13,837 --> 00:26:14,677 Got news, right, 545 00:26:15,007 --> 00:26:15,247 and it 546 00:26:15,907 --> 00:26:18,697 yeah, and they were saying that all the other six figure people, 547 00:26:18,697 --> 00:26:22,807 they hadn't seen like the similar high, uh, similar patterns that had 548 00:26:22,807 --> 00:26:24,007 happened in other crypto heists. 549 00:26:24,007 --> 00:26:27,037 Like I know we've talked in the past about like sim swapping, 550 00:26:27,517 --> 00:26:27,997 right? 551 00:26:28,057 --> 00:26:31,477 In order to get your phone number and then they're able to unlock 552 00:26:31,477 --> 00:26:33,427 your account, all the rest of that. 553 00:26:33,427 --> 00:26:35,347 But none of those happened to these people. 554 00:26:35,677 --> 00:26:37,387 They're like, yeah, we didn't expect anything. 555 00:26:37,387 --> 00:26:38,827 And then all of a sudden our wallets were drained. 556 00:26:41,767 --> 00:26:45,847 This is not helping my lack of interest in cryptocurrency 557 00:26:48,702 --> 00:26:49,122 anyway. 558 00:26:49,417 --> 00:26:52,477 All right, so I. So here's the thing. 559 00:26:52,477 --> 00:26:56,467 All of this was caused because someone, a, BA, a bunch of people 560 00:26:56,467 --> 00:26:58,687 used the wrong password manager. 561 00:26:58,987 --> 00:27:01,807 So let's, let's just talk about some of the things that we would 562 00:27:01,807 --> 00:27:03,277 look for in a password manager. 563 00:27:03,847 --> 00:27:09,697 And the first thing I want to talk about is, is how do you figure out 564 00:27:09,727 --> 00:27:13,987 that there u the, the strength of, of encryption that they're using 565 00:27:13,987 --> 00:27:15,697 to store your encrypted passwords? 566 00:27:18,577 --> 00:27:21,517 So a lot of this should be public information, 567 00:27:22,237 --> 00:27:22,537 right? 568 00:27:22,537 --> 00:27:26,437 Most of the password managers talk about different options, what you 569 00:27:26,437 --> 00:27:30,067 can do, um, what algorithms they use. 570 00:27:30,397 --> 00:27:35,617 Um, one thing to look for is things like how many iterations. 571 00:27:36,637 --> 00:27:36,997 Right, 572 00:27:37,477 --> 00:27:40,837 which is basically taking the thing that you give them and running it 573 00:27:40,837 --> 00:27:42,307 through their encryption algorithm. 574 00:27:42,307 --> 00:27:43,327 Many times, 575 00:27:43,687 --> 00:27:46,387 the more times, the more iterations the better, because 576 00:27:46,387 --> 00:27:47,767 then it makes it harder to crack. 577 00:27:48,127 --> 00:27:48,277 It 578 00:27:48,277 --> 00:27:49,207 takes a lot longer. 579 00:27:49,942 --> 00:27:53,242 Right, So, um. 580 00:27:54,517 --> 00:27:57,907 That, that, that, that would be one of the first things I would do. 581 00:27:57,937 --> 00:28:02,557 If, if I was, if, if I was concerned about security and I was looking into a password 582 00:28:02,557 --> 00:28:05,317 manager, I would ask that question, 583 00:28:05,527 --> 00:28:08,227 how do you protect the vault itself? 584 00:28:08,437 --> 00:28:10,837 What do you do to, you know, protect that fault? 585 00:28:11,507 --> 00:28:14,327 So that would be one of the first things I would do is I would ask 586 00:28:14,327 --> 00:28:16,097 them how they protect the vault. 587 00:28:16,787 --> 00:28:20,177 Um, there are some, there are some, um. 588 00:28:21,122 --> 00:28:21,932 What do you call it? 589 00:28:21,932 --> 00:28:25,982 Um, table stakes features, things like, obviously the idea 590 00:28:25,982 --> 00:28:31,082 of automatically detecting and saving new passwords automatically 591 00:28:31,082 --> 00:28:34,742 auto-filling those passwords where you have, you know, where you have it. 592 00:28:35,282 --> 00:28:39,122 Um, and, and by the way, there's a bunch of, there's a bunch of, I'm looking 593 00:28:39,122 --> 00:28:42,692 at a particular post and there's a bunch of features that are listed. 594 00:28:42,692 --> 00:28:45,512 I'm only gonna do the ones that are just focusing on security. 595 00:28:46,142 --> 00:28:47,462 Um, I would. 596 00:28:48,077 --> 00:28:52,157 I would be very wary of a password manager at this point 597 00:28:52,157 --> 00:28:53,567 that doesn't support pass keys. 598 00:28:53,807 --> 00:28:54,227 Right. 599 00:28:55,217 --> 00:29:01,757 Um, the, um, what do you think about, uh, MFA with password managers? 600 00:29:02,297 --> 00:29:05,102 I, I definitely, yeah, I was, I was actually surprised you 601 00:29:05,102 --> 00:29:06,977 talked about passkey before MFA. 602 00:29:08,342 --> 00:29:11,702 Um, well, you know, it's like that's the, that's the new thing, right? 603 00:29:12,002 --> 00:29:17,912 Um, but the, the, the idea that, again, this is your password manager. 604 00:29:18,062 --> 00:29:21,062 This is everything, right? 605 00:29:21,212 --> 00:29:24,782 And so if somebody gets a hold of your key and figures out your key. 606 00:29:25,487 --> 00:29:30,227 Uh, being able to, um, make sure that they're not able to directly 607 00:29:30,227 --> 00:29:34,937 log into your, to your account is, um, I, I would think table stakes. 608 00:29:34,937 --> 00:29:35,237 What do you, 609 00:29:35,597 --> 00:29:36,317 wouldn't you agree? 610 00:29:36,422 --> 00:29:37,592 Oh yeah, for sure. 611 00:29:38,102 --> 00:29:42,212 And yeah, whatever the mechanism is that you use to do that. 612 00:29:42,212 --> 00:29:46,652 But please do not use SMS or, uh, email 613 00:29:47,072 --> 00:29:48,122 OTA or 614 00:29:48,182 --> 00:29:50,642 to codes, because yeah, those are not 615 00:29:50,912 --> 00:29:51,422 Yeah. 616 00:29:51,512 --> 00:29:51,812 Yeah. 617 00:29:52,472 --> 00:29:54,032 Well, what would we use instead? 618 00:29:54,032 --> 00:29:54,692 Persona, 619 00:29:55,592 --> 00:29:56,162 you don't want me? 620 00:29:56,252 --> 00:29:57,482 ISMS. 621 00:29:57,482 --> 00:29:58,622 That's what everybody uses. 622 00:29:58,652 --> 00:30:00,002 What do you want me to use instead? 623 00:30:00,037 --> 00:30:01,592 you can use an authenticator app. 624 00:30:02,432 --> 00:30:04,172 Take your pick of whichever one you want. 625 00:30:04,742 --> 00:30:08,492 You could also use like UB keys and other things like that, 626 00:30:08,912 --> 00:30:09,272 Yeah, 627 00:30:09,417 --> 00:30:12,662 I li I like the Authenticator app because essentially it's free, right? 628 00:30:12,692 --> 00:30:16,082 They all also known as OTP or one-time password generators. 629 00:30:16,442 --> 00:30:19,112 Uh, so Google Authenticator is probably the most common. 630 00:30:19,382 --> 00:30:24,122 Uh, I happen to like hy uh, A-U-T-H-Y, uh, also free. 631 00:30:24,122 --> 00:30:30,227 I. Um, and basically that, that's so much better than, um, there 632 00:30:30,227 --> 00:30:32,747 are commercial versions of these that, that are more expensive. 633 00:30:32,987 --> 00:30:38,417 That, that, the big thing with those, uh, that I found because I, I I, like, for 634 00:30:38,417 --> 00:30:43,427 example, my, my bank requires me to use the semantic one-time password generator. 635 00:30:44,537 --> 00:30:50,087 The big difference between that and um, uh, authe and Google Authenticator. 636 00:30:51,092 --> 00:30:55,352 Is that they generate a new key every 30 seconds, 637 00:30:55,532 --> 00:30:58,832 but it's doing it every 30 seconds. 638 00:30:58,832 --> 00:31:04,712 Like, uh, like every 30 seconds on the 32nd thing, right? 639 00:31:04,712 --> 00:31:05,792 According to like the 640 00:31:05,792 --> 00:31:06,812 atomic clock somewhere. 641 00:31:07,202 --> 00:31:11,372 Uh, whereas like with semantic, when I pull it up, it generates a new. 642 00:31:11,957 --> 00:31:13,937 Pass code at that 643 00:31:13,937 --> 00:31:16,457 moment, and you have 30 seconds from that moment. 644 00:31:16,637 --> 00:31:19,337 So that's what you get from a commercial one versus the the free one. 645 00:31:20,147 --> 00:31:22,817 Um, yeah, you, you've gotta use that. 646 00:31:22,847 --> 00:31:23,207 Right? 647 00:31:23,237 --> 00:31:26,897 Um, and so please, please, please don't use SMS or email as 648 00:31:26,897 --> 00:31:29,297 your, as your second method of authentication. 649 00:31:29,837 --> 00:31:35,447 Um, the, um, what about the inclusion of biometrics? 650 00:31:35,447 --> 00:31:37,097 It's a great way. 651 00:31:37,157 --> 00:31:40,907 Well, I consider that almost an MFA, right? 652 00:31:41,192 --> 00:31:41,432 It. 653 00:31:41,462 --> 00:31:42,002 Well, it is. 654 00:31:42,002 --> 00:31:42,392 Yeah. 655 00:31:42,662 --> 00:31:43,022 Right. 656 00:31:43,682 --> 00:31:49,292 Um, I like this concept where there, what, what, and I remember going through 657 00:31:49,292 --> 00:31:54,182 this back in the day and that was they would pull in all the passwords 658 00:31:54,182 --> 00:31:56,222 that are stored in like my browser. 659 00:31:56,582 --> 00:31:58,317 Uh, and then, and then, you know, just. 660 00:31:58,842 --> 00:31:59,592 Figure them out. 661 00:31:59,592 --> 00:32:01,362 And then they would look at them and they would say, Hey, 662 00:32:01,422 --> 00:32:02,742 let's do a password health check 663 00:32:02,742 --> 00:32:03,822 on these passwords, right? 664 00:32:03,822 --> 00:32:04,902 So that you can go fix them. 665 00:32:05,652 --> 00:32:09,882 Um, and I, and also that did not give me the greatest sense of security, 666 00:32:09,882 --> 00:32:12,432 the fact that they were able to just suck the passwords out of my browser. 667 00:32:12,432 --> 00:32:15,372 But I, I'm assuming that means that it's authentic 668 00:32:15,372 --> 00:32:17,682 because I'm in the browser and they're authenticating to the browser. 669 00:32:17,712 --> 00:32:18,672 I don't know for sure. 670 00:32:19,512 --> 00:32:27,072 But, um, the next thing is, um, automatic generation of new passwords. 671 00:32:27,162 --> 00:32:28,182 Um, right. 672 00:32:28,277 --> 00:32:29,957 so here's my question. 673 00:32:30,857 --> 00:32:32,567 I know we talk a lot about password managers. 674 00:32:32,567 --> 00:32:32,867 I know we're 675 00:32:32,867 --> 00:32:36,137 talking here about like passwords of like websites and things like that, 676 00:32:36,257 --> 00:32:36,707 yeah, 677 00:32:37,517 --> 00:32:40,307 and I know we did an episode a couple, maybe three weeks ago, 678 00:32:40,307 --> 00:32:41,657 four weeks ago, about pass keys. 679 00:32:42,287 --> 00:32:43,967 Does pass keys just solve all of this? 680 00:32:44,627 --> 00:32:45,227 PAs keys. 681 00:32:45,587 --> 00:32:48,137 PAs keys do solve all of this. 682 00:32:48,797 --> 00:32:49,457 Um. 683 00:32:49,487 --> 00:32:51,887 the how do you get to your actual password manager? 684 00:32:52,532 --> 00:32:53,162 Yeah. 685 00:32:53,252 --> 00:32:55,292 Um, but again, but not everything 686 00:32:55,472 --> 00:32:56,702 supports PAs keys yet. 687 00:32:56,882 --> 00:32:57,272 Right. 688 00:32:57,452 --> 00:32:59,552 PAs keys does make this much, much easier. 689 00:32:59,702 --> 00:33:00,062 Right. 690 00:33:00,062 --> 00:33:02,432 Having said that, I. If you're going to use a 691 00:33:02,432 --> 00:33:09,212 password use as long as, because again, a 15 character password and a 40 character 692 00:33:09,212 --> 00:33:12,482 password takes the same level of effort for the password manager to put it in. 693 00:33:12,962 --> 00:33:18,692 And so use as long as a password as your password manager will allow you to create 694 00:33:19,082 --> 00:33:21,122 and the website will allow you to put in. 695 00:33:21,602 --> 00:33:22,622 Um, 696 00:33:22,697 --> 00:33:22,877 me. 697 00:33:22,877 --> 00:33:24,497 When the website is like the max 698 00:33:24,497 --> 00:33:26,807 password length is 16 characters, and you're like, oh, 699 00:33:27,712 --> 00:33:28,202 Yeah. 700 00:33:28,622 --> 00:33:31,592 Or, or the, the worst, in my opinion, actually worse than that 701 00:33:31,592 --> 00:33:32,912 is when they tell you that the, 702 00:33:33,152 --> 00:33:35,792 some of the characters that you used are not allowed 703 00:33:36,422 --> 00:33:37,352 and you're like, ah. 704 00:33:38,672 --> 00:33:39,002 Yeah. 705 00:33:40,352 --> 00:33:45,122 Um, but yeah, that, that should be, that should be, uh, a feature. 706 00:33:45,122 --> 00:33:48,452 And when you're creating those passwords that you should be able 707 00:33:48,452 --> 00:33:52,502 to like, uh, 'cause some, some websites again, won't take special 708 00:33:52,502 --> 00:33:58,232 characters, which is crazy, but, um, you know, you can turn that on there. 709 00:33:58,232 --> 00:34:01,322 There's also where there's a feature in Dashlane, I don't know 710 00:34:01,322 --> 00:34:03,992 if you've seen this, but there's a feature in Dashlane where they 711 00:34:03,992 --> 00:34:06,152 will purposefully use lookalike. 712 00:34:06,722 --> 00:34:09,452 Letters next to each other, or, or, you know, 713 00:34:09,782 --> 00:34:12,512 to, to, to further confuse, uh, things. 714 00:34:13,112 --> 00:34:19,082 Um, but yeah, that, that's, um, um, and then of course, obviously the big thing 715 00:34:19,082 --> 00:34:23,582 you're looking, you know, everybody should have syncing across multiple devices. 716 00:34:24,152 --> 00:34:26,012 Um, I'm just looking at 717 00:34:26,732 --> 00:34:27,752 different things. 718 00:34:28,292 --> 00:34:28,712 What, 719 00:34:28,922 --> 00:34:29,282 eh, 720 00:34:30,002 --> 00:34:30,542 what. 721 00:34:32,042 --> 00:34:32,462 sinking 722 00:34:32,552 --> 00:34:35,852 I am saying for a commercial password manager, why would you, I 723 00:34:35,852 --> 00:34:37,352 mean, that's, that's table stakes. 724 00:34:38,642 --> 00:34:39,092 yeah. 725 00:34:39,722 --> 00:34:40,142 Yes. 726 00:34:40,172 --> 00:34:43,172 Sorry, I do not use a commercial password manager. 727 00:34:43,442 --> 00:34:43,892 Yes. 728 00:34:43,892 --> 00:34:45,992 I know you're a little, you're a little weird 729 00:34:46,382 --> 00:34:50,492 in so many ways, but, um, I. Yeah, I do. 730 00:34:50,582 --> 00:34:54,812 And I sync it across my, you know, my multiple devices. 731 00:34:55,502 --> 00:34:59,282 Um, and my wife and I actually share, you know, we, because it's 732 00:34:59,282 --> 00:35:02,582 like, I don't know, whatever it is, like 80 bucks a year or whatever. 733 00:35:03,272 --> 00:35:08,822 Um, so we, I realized why are we, you know, why are we paying for this twice? 734 00:35:08,822 --> 00:35:09,002 So 735 00:35:09,002 --> 00:35:10,142 we now we just have 736 00:35:10,202 --> 00:35:10,682 everything. 737 00:35:10,682 --> 00:35:12,782 But what the, what's that? 738 00:35:13,037 --> 00:35:13,937 you just need one vault. 739 00:35:14,492 --> 00:35:20,252 Yeah, I just need one fault and, um, what it does mean is my, my dash 740 00:35:20,252 --> 00:35:24,212 lane account is ginormous in terms of the number of passwords are there. 741 00:35:25,712 --> 00:35:26,222 Um. 742 00:35:27,362 --> 00:35:31,202 I, I do think, you know, read the website, read the stuff that 743 00:35:31,202 --> 00:35:32,972 they do to secure your password. 744 00:35:33,062 --> 00:35:36,962 Uh, most of these things that we talked about are going to be table 745 00:35:36,962 --> 00:35:40,232 stakes for any, uh, password manager. 746 00:35:40,892 --> 00:35:43,317 Do you remember the OnePass? 747 00:35:43,382 --> 00:35:45,782 Was it last, uh, one password? 748 00:35:47,252 --> 00:35:47,462 Yeah. 749 00:35:47,462 --> 00:35:47,977 What about it? 750 00:35:48,297 --> 00:35:51,722 That was the one where they didn't encrypt all the data in the vaults. 751 00:35:52,397 --> 00:35:53,297 Yeah. 752 00:35:53,417 --> 00:35:53,837 Yeah. 753 00:35:53,837 --> 00:35:55,787 They, they, um, I mean the 754 00:35:55,787 --> 00:36:00,587 stuff, yeah, the stuff that they used, luckily the stuff that they used 755 00:36:00,587 --> 00:36:04,727 wasn't stuff that would directly impact your security, but more indirectly. 756 00:36:04,727 --> 00:36:04,937 Right. 757 00:36:04,937 --> 00:36:08,627 It was stuff that, it was like personal information that could 758 00:36:08,627 --> 00:36:10,697 be used to then further, uh, yeah. 759 00:36:10,697 --> 00:36:11,507 that was great too. 760 00:36:11,567 --> 00:36:11,837 Yeah. 761 00:36:11,837 --> 00:36:14,147 So that's a good, that's a good, another good question to ask. 762 00:36:14,147 --> 00:36:15,797 Thanks for bringing that up, is. 763 00:36:16,277 --> 00:36:21,347 Is all of my personal data, uh, encrypted or just the, the passwords. 764 00:36:21,377 --> 00:36:21,767 Right. 765 00:36:22,097 --> 00:36:25,277 Um, now of course you're not gonna be able to check that, but 766 00:36:25,937 --> 00:36:27,737 You know what I do wonder? 767 00:36:27,737 --> 00:36:33,227 So in the LastPass, the cyber wallet heist that were going on, 768 00:36:33,377 --> 00:36:33,527 mm-hmm. 769 00:36:33,797 --> 00:36:37,847 they said most people had stored their key, the seed key 770 00:36:38,282 --> 00:36:38,572 Yeah. 771 00:36:38,897 --> 00:36:40,607 the secret notes field 772 00:36:40,907 --> 00:36:41,567 of the entry. 773 00:36:42,372 --> 00:36:49,092 I wonder if how they had created these vaults, if the attackers were able to 774 00:36:49,092 --> 00:36:52,302 find, what are all the vaults where people had written something in the 775 00:36:52,302 --> 00:36:54,642 secure notes, secure notes field, 776 00:36:54,977 --> 00:36:56,027 Oh, I see what you're saying. 777 00:36:56,027 --> 00:36:57,527 To narrow down those that they, 778 00:36:57,762 --> 00:36:57,942 Yeah. 779 00:36:58,432 --> 00:36:58,722 yeah. 780 00:36:59,867 --> 00:37:01,697 Yeah, I, I have stuff in there too. 781 00:37:01,697 --> 00:37:06,107 I have like, um, I have like a, I have a note that says like, important numbers 782 00:37:06,497 --> 00:37:09,887 and it's like my driver's license number and, you know, the stuff that I keep 783 00:37:09,887 --> 00:37:13,727 getting asked for and I don't necessarily wanna pull up my wallet for Yeah. 784 00:37:14,477 --> 00:37:21,077 Um, the, the phone number to be able to swat, um, uh, persona's, 785 00:37:21,077 --> 00:37:23,267 house, you know, stuff like that. 786 00:37:24,647 --> 00:37:25,217 Um. 787 00:37:26,087 --> 00:37:28,067 I hope, I hope that's helpful to people. 788 00:37:28,157 --> 00:37:33,017 Um, you know, it's when, whenever you see a big thing like this, it, 789 00:37:33,017 --> 00:37:36,917 it's a chance for you to reconsider whatever it is that you're doing, 790 00:37:37,217 --> 00:37:37,637 right? 791 00:37:38,297 --> 00:37:44,567 And, um, uh, if you've, if you've had a password manager for a while, maybe it's 792 00:37:44,567 --> 00:37:47,837 time to, you know, find out, you know, did have they upgraded their password? 793 00:37:47,837 --> 00:37:50,687 Do you need to do something to, to make your password more secure? 794 00:37:51,827 --> 00:37:58,247 Um, it's hard, it's easy to pick apart something in hindsight, right? 795 00:37:58,247 --> 00:38:00,977 It's harder to figure it out, uh, moving forward. 796 00:38:00,977 --> 00:38:06,467 But I still think even, even with LastPass, generally you are better 797 00:38:06,467 --> 00:38:08,057 off having a password manager. 798 00:38:08,087 --> 00:38:12,557 You are much better off having a password manager and or pasky, right? 799 00:38:13,157 --> 00:38:16,727 Um, I, you know, it's funny that you mentioned now, now that I 800 00:38:16,727 --> 00:38:21,077 understand what Pasky are and how they work, I'm not actually sure what. 801 00:38:21,992 --> 00:38:27,932 What role Dashlane pays plays in when I store a passkey in Dashlane, 802 00:38:28,502 --> 00:38:31,712 Just to store your PA key because if someone 803 00:38:31,712 --> 00:38:33,872 gets your PA key, they get access to your account. 804 00:38:34,262 --> 00:38:35,972 Right, so basically, 805 00:38:36,452 --> 00:38:40,742 so, so it's taking the role that like. 806 00:38:41,522 --> 00:38:44,432 The, the key chain takes in. 807 00:38:44,642 --> 00:38:45,002 Okay. 808 00:38:45,092 --> 00:38:45,482 Alright. 809 00:38:45,722 --> 00:38:48,932 So it becomes again the, the encrypted place where I store the encrypted. 810 00:38:48,932 --> 00:38:49,172 Yeah. 811 00:38:49,172 --> 00:38:49,382 Okay. 812 00:38:49,682 --> 00:38:52,532 Alright, makes sense. 813 00:38:52,712 --> 00:38:57,332 Um, so, you know, I've done past keys on a handful of my accounts whenever I 814 00:38:57,332 --> 00:39:00,602 see it now that I, now that I understand what it is and now that it actually 815 00:39:00,602 --> 00:39:02,372 makes my life easier, not harder. 816 00:39:03,152 --> 00:39:06,872 Um, so I've just got like, I don't know, 500 more accounts to go. 817 00:39:09,272 --> 00:39:10,232 Uh, simple. 818 00:39:10,847 --> 00:39:11,297 Yeah. 819 00:39:11,837 --> 00:39:12,257 All right. 820 00:39:12,257 --> 00:39:15,137 Well thanks for the chat again, persona. 821 00:39:15,662 --> 00:39:19,982 Now I'm super excited to hear how the planning goes, so send me pics. 822 00:39:20,297 --> 00:39:21,707 I knew that you would say that. 823 00:39:22,997 --> 00:39:25,697 I know I love watching your face, but I was like, he doesn't know 824 00:39:25,697 --> 00:39:27,167 what it is that I'm about to say. 825 00:39:28,007 --> 00:39:28,367 All right. 826 00:39:28,397 --> 00:39:30,047 Well, thank you to our listeners. 827 00:39:30,137 --> 00:39:32,057 Uh, you are why we do this. 828 00:39:32,447 --> 00:39:34,907 Uh, you know, be sure to check us out on YouTube. 829 00:39:34,967 --> 00:39:36,737 Um, you know, we're available on YouTube. 830 00:39:36,737 --> 00:39:39,137 We're available on, you know, wherever you get your podcasts. 831 00:39:39,227 --> 00:39:40,967 And subscribe if you like us. 832 00:39:40,967 --> 00:39:41,627 Subscribe. 833 00:39:41,777 --> 00:39:43,757 If you don't, well, I don't know. 834 00:39:43,762 --> 00:39:45,407 Go, go find something else to do. 835 00:39:46,127 --> 00:39:48,682 Uh, that is a wrap. 836 00:39:51,592 --> 00:39:56,302 The backup wrap up is written, recorded and produced by me w Curtis Preston. 837 00:39:56,842 --> 00:40:01,642 If you need backup or Dr. Consulting content generation or expert witness 838 00:40:01,642 --> 00:40:04,222 work, check out backup central.com. 839 00:40:04,942 --> 00:40:08,062 You can also find links from my O'Reilly Books on the same website. 840 00:40:08,722 --> 00:40:12,832 Remember, this is an independent podcast and any opinions that you 841 00:40:12,832 --> 00:40:14,722 hear are those of the speaker. 842 00:40:14,787 --> 00:40:16,617 And not necessarily an employer. 843 00:40:17,547 --> 00:40:18,267 Thanks for listening.