[00:01.150 --> 00:01.570]  Hi.
[00:01.790 --> 00:04.410]  So I'm going to talk about security options for high-risk travel.
[00:05.130 --> 00:06.950]  Unfortunately, the URL doesn't work.
[00:07.230 --> 00:15.230]  My server crashed about 14 hours ago, like right after I got on the plane, so I'm going to try to fix that later tonight, possibly Monday.
[00:16.590 --> 00:17.810]  Otherwise, I'll mirror it somewhere.
[00:18.370 --> 00:18.790]  Cool.
[00:18.990 --> 00:33.890]  So just as a quick overview, we're going to talk about a system that'll give you a way to think about the relative risk of types of travel and what you can do, and then some techniques, tools, and procedures for how you can travel the most safely in your particular setting,
[00:34.470 --> 00:45.210]  some case studies of things that worked and didn't work, both that I've tried and that have been tried by other people, and then some future research and development stuff that I'm actually actively working on or that would be awesome for somebody else to work on,
[00:45.330 --> 00:54.490]  and then some opportunities for people to either lobby or be activists or otherwise make some positive change, like social good, as well in this area.
[00:54.490 --> 00:55.850]  So, quick intro.
[00:56.070 --> 00:56.390]  Who am I?
[00:56.530 --> 00:58.510]  So I'm a cypherpunk from the early 1990s.
[00:58.630 --> 01:13.090]  I found the mailing list when I was, like, 12, and it was a complete change seeing that crypto and software could let people, especially, like, random people anywhere in the world, kids, whatever, stand up to the most powerful organizations in the world if they had the right math behind them.
[01:13.470 --> 01:18.710]  Then I started the world's first offshore data haven in the North Sea, HavenCo, in 2000 with some friends of mine.
[01:19.690 --> 01:23.470]  And that lasted for a little while and sort of fell apart.
[01:23.470 --> 01:30.210]  And I then went to Iraq and Afghanistan and worked as a defense contractor for eight years building satellite networks and cell phone networks and things all over there.
[01:30.390 --> 01:31.730]  So I got to travel to cool places.
[01:31.990 --> 01:35.230]  I did a trusted computing startup, so I know a fair bit about that technology.
[01:35.690 --> 01:40.530]  I then worked for a network security vendor, Cloudflare, which I'm sure is very popular with all the friends at Tor.
[01:41.550 --> 01:47.870]  And now I work at a startup that I started relatively recently that we're working on some cool stuff in the secure computing device space.
[01:48.510 --> 01:50.830]  More importantly, why am I actually qualified?
[01:50.990 --> 01:53.170]  I've traveled to a bunch of countries worldwide.
[01:54.490 --> 01:55.470]  Countries and territories.
[01:55.730 --> 01:59.750]  I'm not really too particular about, like, the exact status of British Crown dependencies and things like that.
[02:00.070 --> 02:01.710]  I travel a lot for personal travel.
[02:01.830 --> 02:03.350]  I go through passports every two or three years.
[02:04.010 --> 02:04.970]  Frequent travel a lot.
[02:05.070 --> 02:06.670]  So I basically live to travel.
[02:06.810 --> 02:07.370]  It's fun.
[02:07.570 --> 02:08.670]  It's work and everything else.
[02:09.030 --> 02:16.990]  And I also have this horrible habit of carrying every piece of computer gear I can possibly carry when I travel, which is a bad security practice, as we'll see.
[02:17.590 --> 02:18.850]  And I'm probably on some lists.
[02:21.270 --> 02:25.590]  So why is it special to talk about travel security versus just general computer security?
[02:26.930 --> 02:28.550]  There's a few things that are different about it.
[02:28.630 --> 02:33.630]  There's a lot of things that are in common, some things that are, like, amped up or ramped down, but some things that are fundamentally different.
[02:34.170 --> 02:37.070]  One of the biggest things is that you're exposed to multiple jurisdictions.
[02:37.090 --> 02:38.230]  There's different sets of law.
[02:38.230 --> 02:39.370]  I know U.S. law relatively well as a non-lawyer.
[02:41.690 --> 02:45.450]  I know virtually nothing about non-common law countries.
[02:45.730 --> 02:56.250]  And especially if it's a country where there's a language barrier, like China or the Middle East or anywhere else, if somebody handed me a document that was saying all sorts of crazy stuff, I would not necessarily know what it is.
[02:56.410 --> 03:00.930]  So I know some general principles on what's legal and what's not legal in certain countries.
[03:00.930 --> 03:04.850]  But I think, like most people, you're much more familiar with your own jurisdiction than with other jurisdictions.
[03:04.850 --> 03:14.010]  And there's a lot of special laws that apply to either non-citizens, temporary residents, people in transit, or even citizens that are in transit and things at borders.
[03:14.250 --> 03:19.930]  And borders are sometimes defined as, like, 100-mile radius of the coast that don't really apply normally.
[03:19.930 --> 03:27.770]  So all these protections that you think you have under the Constitution don't necessarily, according to certain people, apply in places like New York City that are within 100 miles of a border.
[03:28.630 --> 03:30.270]  You're away from your home base of support.
[03:30.270 --> 03:33.770]  So if you have a problem, you don't really know what to do, you don't have people to call on.
[03:34.390 --> 03:37.470]  And it's not something you do every day, any given trip.
[03:37.590 --> 03:38.590]  So it's new.
[03:38.930 --> 03:49.390]  And if you're gonna go after a single interesting set of people, people who travel frequently internationally are usually pretty productive targets to go after for economic purposes, intelligence purposes, anything else.
[03:50.030 --> 03:52.010]  And the threats are always changing.
[03:52.410 --> 03:54.730]  So nothing really there is that new.
[03:54.890 --> 03:56.730]  Why do we care about it now versus in the past?
[03:56.950 --> 04:00.310]  And it's always been a problem for, like, governments, intelligence community, all those crazy people.
[04:00.310 --> 04:04.590]  But the new thing that has fundamentally changed is economic espionage.
[04:04.770 --> 04:10.730]  Popping somebody's laptop or gaining access to their systems can actually be monetized now in a fairly direct way.
[04:11.290 --> 04:16.570]  And there are countries that have an organized campaign of going after intellectual property, system access, everything else.
[04:17.150 --> 04:19.410]  Multiple countries, including the United States.
[04:21.970 --> 04:24.130]  Not necessarily for economic purposes, but for purposes.
[04:25.230 --> 04:27.770]  Where this is a common thing to happen.
[04:28.210 --> 04:34.430]  And a lot of countries, because of this whole war on terror thing, are pushing the limits of what they say they're allowed to do, everything else.
[04:34.610 --> 04:37.670]  So it's a problem that's increasing and everything else.
[04:37.810 --> 04:39.270]  And there's a lot of people who travel internationally.
[04:39.430 --> 04:40.470]  It's not a small set of people.
[04:40.470 --> 04:43.490]  It's like $350 right now to fly to China from here.
[04:43.810 --> 04:45.610]  And that's, like, pretty cheap.
[04:46.830 --> 04:48.830]  So... and people travel with a bunch of devices.
[04:50.030 --> 04:55.050]  So the things that, like, really make travel unique from a threat perspective are international travel.
[04:55.370 --> 04:58.290]  Something where somebody else instigates your travel.
[04:58.410 --> 05:02.210]  Where it's not like a random act by you, but where somebody solicits you to travel to a location.
[05:02.610 --> 05:04.810]  We've seen a lot of cases where that will be interesting later.
[05:05.270 --> 05:08.550]  And then a schedule known to people outside in advance so they have time to prep.
[05:08.550 --> 05:11.330]  And there's sort of two conflicting things.
[05:11.550 --> 05:15.210]  If it's something that you do all the time, it's easier to plan ahead as the attacker.
[05:15.510 --> 05:21.090]  But also if it's something that you've only done your first time or a couple times, then it's harder for you to know what's normal or what's not normal about it.
[05:21.230 --> 05:23.530]  So both extremes are actually fairly risky.
[05:24.130 --> 05:26.270]  And then, unfortunately, there are people who are high risk.
[05:26.390 --> 05:28.390]  And it's not really... sometimes it's something they've done.
[05:28.890 --> 05:30.170]  Sometimes it's completely random.
[05:30.390 --> 05:33.970]  And there's this whole scale of, like, zero to Snowden of how much of a target you are.
[05:34.690 --> 05:37.990]  And you definitely want to be very, very close to zero on this scale.
[05:38.370 --> 05:39.490]  I think it's a log scale.
[05:40.850 --> 05:45.270]  And you don't even need to be a legitimate target on your own by virtue of anything you've done.
[05:45.690 --> 05:48.730]  Certainly working at an organization that's of interest makes you a target.
[05:48.950 --> 05:57.850]  But even just knowing people that are targets or having a similar name to somebody as a target or somebody thinks you might have access to somebody who is a target is a reason to be targeted.
[05:57.850 --> 06:02.030]  In other cases, it's actually cheaper just to, like, hack everyone than to target specific people.
[06:02.210 --> 06:05.110]  So if you're coming from a certain location or whatever else, you can be a target.
[06:05.670 --> 06:08.090]  And source countries, destinations, transit locations.
[06:08.310 --> 06:17.790]  Like, right now, if you fly via Istanbul, you still get... you get, like, a six-month U.S. TSA secondary search thing automatically, even if you're just in transit.
[06:17.970 --> 06:18.950]  So it's kind of crazy.
[06:19.410 --> 06:22.770]  And if you have... once you get targeted once, you're likely to remain a target for a long time.
[06:22.770 --> 06:28.650]  So some people... like, this is a thing where, like, the mean level of pain isn't really a useful metric.
[06:28.910 --> 06:32.390]  It's because some people are gonna be responsible for almost all the searches.
[06:33.810 --> 06:34.730]  And it's a hard problem.
[06:34.830 --> 06:36.810]  Like, computer security, we have to admit, is a hard problem.
[06:36.930 --> 06:40.290]  We've done an exceptionally bad job of solving it over the past, like, 50 years.
[06:41.890 --> 06:45.930]  And the same problems that work in computer... general computer security apply to travel.
[06:46.050 --> 06:47.690]  It doesn't, like, get easier because you're traveling.
[06:48.030 --> 06:49.890]  So there's lots of variables.
[06:50.010 --> 06:50.890]  It's hard to generalize.
[06:50.890 --> 06:59.550]  And the other thing is, if you're responsible for an organization, the people who travel, especially to high-risk international locations, are usually both important and fairly independent.
[06:59.770 --> 07:03.910]  So they're really hard to train or direct to do certain things or not do other things.
[07:04.170 --> 07:08.250]  And that's a pretty big problem for any system that relies on the cooperation of the user.
[07:08.790 --> 07:11.470]  And it's hard enough to get work done normally.
[07:11.930 --> 07:15.730]  Especially going to a country where you don't have an office, where you don't have great connectivity, everything else.
[07:15.930 --> 07:17.570]  Getting any work done at all is gonna be hard.
[07:17.570 --> 07:21.330]  So people aren't going to be very tolerant of increasing delays that they view as security.
[07:21.510 --> 07:27.970]  So you've got... this is, like, the hardest possible security environment for most users that they're gonna face in a reasonable time period.
[07:28.830 --> 07:32.910]  So we could talk about lots and lots of things, but I'm gonna try to narrow it to a specific scope.
[07:33.510 --> 07:39.370]  Certainly technical security, not stuff like how to not get mugged and things like that in the country, because I really don't know anything about that particularly.
[07:41.410 --> 07:45.930]  Then there's people that are completely out of scope here, like government personnel have regulations that they follow.
[07:45.930 --> 07:52.710]  The crazy thing about government regulations, having been sort of, like, as a contractor part of it, is it defines both a ceiling and a floor for what they're gonna do.
[07:53.390 --> 07:56.210]  They generally don't exceed them, but they will not usually meet them.
[07:56.330 --> 07:58.270]  So they're not really terribly interesting in a lot of ways.
[07:58.790 --> 08:04.610]  And then people who are extremely high risk, and things that are extremely high risk, like, it's not really worth trying to generalize from this.
[08:04.910 --> 08:10.650]  Protecting Snowden is basically an impossible problem, so it's not gonna help anybody else to solve that particular problem.
[08:10.650 --> 08:20.010]  And then there's stuff that's so low risk that the incremental pain from doing this as a travel-optimized thing isn't worth it, so I wouldn't do your domestic routine travel this way.
[08:20.230 --> 08:27.450]  And then there's sort of, like, this Goldilocks problem that we're trying to find, where it's just hard enough to be worth solving, but also not so impossible that we can't solve it.
[08:27.930 --> 08:32.590]  So there's a bunch of factors that influence this risk thing, all these things.
[08:32.790 --> 08:33.750]  I'm just gonna go through them.
[08:34.070 --> 08:35.150]  Like, how specific is it?
[08:35.150 --> 08:43.310]  But there's places where everybody is a target, and it's just sort of by virtue of being there, so that's sort of, like, ambient hacking that happens there.
[08:43.470 --> 08:46.990]  Like, airports, coffee shops, certain countries, things like that.
[08:47.750 --> 08:54.570]  There's being targeted as a person in a category, like, say, everybody who goes to certain conferences is likely to be a target of certain organizations.
[08:54.950 --> 08:59.390]  Um, if you're known to be, like, a computer security professional, you're sort of interesting as a target.
[08:59.690 --> 09:07.110]  There's actually good reasons to preferentially attack people who are not computer security people Because they're less likely to discover it, so you go after other people within organizations.
[09:08.150 --> 09:16.510]  But sometimes, like, a specific individual or a specific organization is a target because, say, somebody wants a particular piece of information or a particular system access that that organization or person has.
[09:17.690 --> 09:20.830]  Then there's different techniques that the attacker's gonna use.
[09:21.250 --> 09:24.350]  Sort of a taxonomy from, like, least bad to most bad.
[09:24.530 --> 09:26.390]  I'd say passive network attacks and sniffing.
[09:26.450 --> 09:28.390]  You have to assume that, like, every network is sniffed.
[09:28.450 --> 09:30.370]  Like, it seems crazy to not assume that anymore.
[09:31.450 --> 09:35.430]  And you should be using systems that are resistant against passive adversaries like that.
[09:35.830 --> 09:47.150]  But then you have more active network attacks, especially on mobile networks or on networks where there's a captive portal or something else where you're potentially exposed to a network that's controlled by the attacker that can modify some traffic in transit.
[09:47.410 --> 09:51.030]  Because, unfortunately, not all traffic is integrity protected or encrypted.
[09:52.290 --> 09:58.550]  Then there's the physical non-destructive access, which can be something where somebody says, like, you leave a laptop and they image it.
[09:58.630 --> 10:02.030]  Or something where they say, give me your laptop or something very simple like that.
[10:03.110 --> 10:06.350]  But that's sort of a non-destructive thing where there's a bar to what they're willing to do.
[10:06.750 --> 10:09.730]  Physical modifications to your hardware, where I will talk about that a little bit later.
[10:10.290 --> 10:18.510]  And then multi-round physical modifications where they modify it and then come back a little bit later and have modified and take benefit of having you using a compromised system.
[10:18.670 --> 10:20.110]  So evil made is a subset of that.
[10:21.470 --> 10:24.730]  And then the other thing is, what do they get when they compromise you?
[10:25.450 --> 10:29.590]  Is it gonna be only your current, like, working set of data from your current trip or something like that?
[10:29.730 --> 10:35.670]  Or are they gonna get, like, all of your emails and all of your documents that you've ever created on your computer from, like, day one?
[10:36.550 --> 10:42.710]  And will they be able to put something on your computer that will get them persistent access to other systems or to that system over time?
[10:43.170 --> 10:49.050]  Which is a surprisingly large target for a lot of the economic espionage on people that are remote.
[10:49.670 --> 10:52.930]  And then there's, of course, like, how hardcore the attacker is.
[10:53.170 --> 10:56.590]  Like, there's cases where they don't really care that much.
[10:56.850 --> 10:57.350]  And I'm...
[10:57.350 --> 11:07.190]  I think it's sort of a... there's certain techniques and certain things where if they're really capable and they're not really that interested, those attacks are... like, they're probably gonna have great, like, passive, pervasive monitoring.
[11:07.470 --> 11:14.970]  But for, like, actual physical attacks, that's gonna be kind of more bounded by effort than it is by their capabilities.
[11:15.310 --> 11:21.290]  Because forcing someone to disclose information is sort of a non-scalable thing, but it's also a pretty low technical bar.
[11:21.570 --> 11:25.890]  So if you piss off somebody enough, then even if they're not very competent, they can do that.
[11:26.350 --> 11:29.610]  And then you have to worry about, like, how bad is it if you're compromised?
[11:29.950 --> 11:31.270]  I mean, is somebody gonna get killed?
[11:31.430 --> 11:38.650]  I mean, there's a case in Syria where there was a journalist who potentially was killed because of ComSec failure and other people as well.
[11:38.930 --> 11:41.470]  All the way down to maybe it's just, like, a mild inconvenience.
[11:41.610 --> 11:42.950]  So I don't know.
[11:43.110 --> 11:44.810]  Like, you have to sort of prioritize these things.
[11:45.070 --> 11:47.390]  And it's really easy to prioritize money values.
[11:47.390 --> 11:53.770]  Like, if you think that compromising this data could be a $500,000 compromise, then you can sort of calculate your probability and risk.
[11:53.910 --> 11:57.790]  But, like, if people's lives or criminal liability are involved, then it's really hard to do.
[11:58.050 --> 12:01.830]  Also, if you're, say, a journalist and you're protecting your sources, you don't have a lot of money.
[12:01.850 --> 12:07.070]  And the value of your story is not necessarily a huge dollar value, but it is the lives of the people that you're working with.
[12:07.090 --> 12:14.070]  So it's both your reputation, your personal, like, happiness and well-being for the rest of your life, as well as the lives of other people.
[12:14.190 --> 12:18.070]  So it's actually pretty hard to gauge, like, what the actual consequences are.
[12:18.210 --> 12:20.610]  And a lot of cases, you don't know what the real consequences are going to be.
[12:20.970 --> 12:22.930]  And then, of course, what are your resources to defend?
[12:23.630 --> 12:27.470]  Like, if you're a government, yeah, you probably are not getting advice from talk at HOPE.
[12:27.670 --> 12:29.390]  If you're a... yeah.
[12:30.450 --> 12:31.490]  However, if you're...
[12:32.190 --> 12:45.650]  I would argue that people like Google and Apple that develop the platforms themselves that everybody uses are probably in a better position to protect those platforms than any customers, including governments, because governments largely are using COTS systems now.
[12:46.050 --> 12:49.930]  And then, well-resourced enterprises that are just using, like, best practice third-party tools are one thing.
[12:50.170 --> 12:56.410]  But unfortunately, this is one of those problems where the people that are most at risk are also least capable of defending... the least resource to defend themselves.
[12:56.650 --> 13:06.630]  They can be really smart, but things that depend on them, like, throwing away hardware after a chip, doesn't really work for most individuals and certainly doesn't work for most, like, activist organizations.
[13:06.630 --> 13:12.870]  So it's kind of unfortunate there that a company that really doesn't care about cost of hardware is in a better position to not have to worry about the hardware.
[13:13.630 --> 13:18.850]  And then there's the question of, like, how much exposure is there to your things?
[13:19.030 --> 13:22.110]  Like, if you're one individual, you have to be the target.
[13:23.010 --> 13:30.570]  There's a lot of cases where the principal, like the person who has the data that they're going after is not their actual... is not their most optimum target.
[13:30.770 --> 13:40.270]  Going after somebody who's, like, an admin to that person or something else is a much better target because they're usually less sophisticated, more susceptible to certain kinds of social engineering attacks.
[13:40.470 --> 13:47.090]  Like, there's a standard CEO, you must send this file to me now to an accounting person who is in fear of the CEO.
[13:48.630 --> 13:53.770]  And there's people who... I would say this is something where the most dangerous thing is when you haven't done it before.
[13:54.290 --> 13:58.990]  If you travel all the time, you're probably fairly familiar with what things work and you have a pretty reasonable routine.
[13:59.130 --> 14:07.090]  But if it's your first trip and you're told to go to China as part of a deal team or something, then you're going to have less of a security posture than other people.
[14:07.430 --> 14:17.510]  And if you're an activist or a journalist or someone else who doesn't have necessarily the most ironclad legal status in the country, or if you're doing stuff that's unpopular, then you're also fairly exposed.
[14:17.710 --> 14:22.130]  So, on those metrics, we can sort of calculate a score, but it's kind of very subjective.
[14:22.650 --> 14:25.210]  I think it's just easy to say, like, what is completely out?
[14:25.330 --> 14:36.130]  Like, helping you get stuff in and out of North Korea is probably not something that I feel at all comfortable advising you on, because the consequences of failure are incredibly high.
[14:36.450 --> 14:41.290]  Like, people... even U.S. citizens are held for, like, ten years there if they do something fairly minor.
[14:41.710 --> 14:44.850]  And the consequences for local people are far worse.
[14:45.010 --> 14:47.330]  Like, if you were handing somebody data, they're probably going to get killed.
[14:48.650 --> 14:50.830]  Active conflict zones are kind of questionable.
[14:51.070 --> 15:03.610]  Like, the attackers are not necessarily that well-resourced, but they certainly have enough money and some resources to buy decent, like, oxygen gear, and they're willing to do... like, if you're killing people every day, like, rubber hosing somebody is not a serious,
[15:03.630 --> 15:05.110]  like, incremental moral bar.
[15:05.370 --> 15:11.190]  So, those are also not great places, but there might... enough people have reason to go to those places that they might be a reasonable thing.
[15:11.690 --> 15:18.590]  I'd say borderline high, Russia, in a lot of ways, is a scary place to visit as a U.S. citizen or as a non-Russian right now.
[15:20.170 --> 15:28.110]  Because the... if you... I think it's fine for the vast majority of people, but if you become of interest, then the... there's a lot of flexibility on what can happen to you.
[15:28.270 --> 15:29.010]  So, there's that.
[15:29.350 --> 15:31.730]  And I'd say borderline low, like, EU people coming to the U.S.
[15:31.830 --> 15:38.490]  The U.S. has lots of bad laws about... or less... less privacy-friendly laws about, like, data protection, all sorts of other stuff.
[15:38.650 --> 15:45.350]  But the U.S. is generally fairly law-abiding with respect to EU citizens, at least as far as, like, crimes against the person.
[15:46.650 --> 15:49.410]  So, you're not going to get rubber hosed for data in most cases.
[15:49.570 --> 15:52.110]  Like, there are probably a very limited number of exceptions and things like that.
[15:52.110 --> 15:56.910]  And then, domestic travel within the U.S. or EU as a citizen is not really in the scope for this thing.
[15:57.130 --> 15:58.470]  So, in the middle, there is a sweet spot.
[15:58.570 --> 15:59.330]  That sweet spot is China.
[16:00.290 --> 16:04.770]  It's really good because lots of people go there, especially Western organizations go there for business, for travel.
[16:04.870 --> 16:05.590]  It's an awesome country.
[16:05.790 --> 16:06.950]  I've been there a few times.
[16:08.110 --> 16:08.730]  Great people.
[16:08.850 --> 16:09.550]  Lots of cool stuff.
[16:10.570 --> 16:12.710]  Commercial center of, like, building all hardware in the world.
[16:13.990 --> 16:16.490]  It's nice because it's generally commercial intelligence purposes.
[16:16.710 --> 16:17.570]  It's not, like, state security.
[16:17.570 --> 16:25.770]  As long as you're not involved in, like, some crazy activist thing there where you're trying to, like, overthrow the Chinese Party, the Communist Party, you're probably just a target of economic espionage.
[16:26.490 --> 16:30.070]  And that puts a ceiling on how far things are going to go, which is great.
[16:31.630 --> 16:33.950]  And usually your number one thing is getting kicked out.
[16:36.010 --> 16:37.150]  Substantially law-abiding country.
[16:38.090 --> 16:42.730]  Maybe you would say not as law-abiding as Western countries, but pretty law-abiding on international stuff.
[16:42.770 --> 16:44.570]  And they care about their reputation, unlike, say, North Korea.
[16:45.130 --> 16:46.610]  And there's a lot of people that travel there.
[16:46.750 --> 16:47.450]  The travel's important.
[16:47.550 --> 16:48.790]  So, there's actually a market for this.
[16:48.790 --> 16:51.250]  There's enough people that it's a repeatable process, not a one-off thing.
[16:51.750 --> 16:53.070]  And they're technically sophisticated.
[16:53.250 --> 16:58.710]  Like, in a former job, I saw some amazing network attacks that they were doing against some sites.
[16:59.290 --> 17:01.570]  Or that a country in Asia was doing against some sites.
[17:02.290 --> 17:04.190]  And, yeah, a large country in Asia.
[17:04.690 --> 17:09.510]  And they were the most sophisticated attacks I've ever seen in terms of DDoS and everything else.
[17:09.710 --> 17:19.330]  So, like, technical quality-wise, I'm sure there's parts of NSA and other organizations that are probably better, but they don't use them against public targets like that.
[17:19.390 --> 17:20.370]  So, you don't get to see them as much.
[17:20.610 --> 17:24.070]  And so, they're actually an interesting target to go after, to try to defend against.
[17:25.790 --> 17:29.490]  So, my general goals here are you always want to avoid special treatment.
[17:29.630 --> 17:30.530]  You don't want to stand out.
[17:30.670 --> 17:36.890]  You don't want to carry, like, a special thing that makes you identified as a special, like, super high-security paranoid person.
[17:39.270 --> 17:49.530]  And you both want to resist things that are most likely, but you also don't want to fail and have to tell people that you failed because of some really obvious thing that is, like, standard best practice.
[17:49.750 --> 17:59.850]  It is way less embarrassing as a CISO if you get hacked by zero day, which is why everyone always gets hacked by zero day, even if they didn't, than if you get hacked because somebody, like, used a default password on something.
[18:00.090 --> 18:06.330]  So, you want to make sure that you've got all your, like, really basic stuff covered and prioritize that.
[18:06.450 --> 18:09.510]  So, prioritize for both likelihood and embarrassment if it fails.
[18:09.510 --> 18:12.450]  And then you want to limit the information that you have that's exposed.
[18:12.690 --> 18:15.510]  Like, that's the basic principle of security, minimizing threat surface.
[18:15.690 --> 18:34.330]  And if you are targeted, you don't antagonize them any more than, like, don't actively antagonize them because that might actually take it from a sort of, like, interesting economic espionage slash network can you get it through game to a barred for life game or a potentially,
[18:34.330 --> 18:36.230]  like, criminal type thing or whatever.
[18:36.470 --> 18:37.830]  So, don't piss people off.
[18:37.830 --> 18:39.970]  It's in countries where you don't have... yeah.
[18:40.730 --> 18:44.290]  And use good technology to help yourself.
[18:44.650 --> 18:46.030]  You don't want to spend lots of money doing this.
[18:46.130 --> 18:47.290]  So, use the best technology you can.
[18:48.530 --> 18:54.730]  So, there's some techniques that overlap a lot with conventional security practices for securing your normal office stuff.
[18:55.030 --> 18:59.290]  And then there's some unique stuff that you can do because of travel or unique stuff that you have to do because of travel.
[18:59.730 --> 19:07.230]  And one of the most unique things is that you're doing this for, like, a specific expedition, not for a long-term, indefinite, open-ended thing.
[19:07.490 --> 19:08.670]  So, that's actually kind of a cool thing.
[19:10.010 --> 19:10.970]  So, you want to minimize...
[19:10.970 --> 19:12.050]  So, these are sort of the basic things.
[19:12.250 --> 19:13.670]  You want to minimize the threat surface.
[19:13.910 --> 19:17.670]  You want to not take, like, every possible platform, every possible device.
[19:17.810 --> 19:19.250]  You want to minimize and standardize.
[19:19.330 --> 19:23.910]  If you have one organization platform, you want to use that as much as possible.
[19:23.910 --> 19:31.910]  And probably the most standard thing that's sort of unique to travel that large organizations are doing now is they have like a travel pool of hardware.
[19:32.150 --> 19:34.010]  So that's an interesting problem.
[19:34.970 --> 19:51.750]  They want to send only certain hardware to China from the U.S. or EU, but they want to let users be as productive as possible, but they also want to defend against both persistent software and persistent hardware attacks.
[19:51.750 --> 19:58.970]  So they want to do all this cool stuff, but like managing that pool of hardware has been historically a pain.
[19:59.130 --> 20:01.550]  I've seen different solutions that people have done there.
[20:02.610 --> 20:13.290]  One is they take the oldest machines in their fleet of regular office use machines, wipe them, install them with special software or whatever the baseline software is going to be, send them and try to manage them like that.
[20:13.290 --> 20:21.910]  The other option is you go to like a random computer store like Best Buy or Apple Store or whatever else and buy some random completely unconnected to you off-the-shelf stuff and use that.
[20:22.630 --> 20:31.110]  And then the other solution is you build your dedicated infrastructure that is highly secure, locked down just as much as your day-to-day stuff, but a separate installation of it or maybe even more advanced.
[20:31.110 --> 20:33.210]  And these all have different problems.
[20:33.470 --> 20:45.190]  The problem of using your oldest hardware is you're sending your pickiest, arguably most important users to a high pain environment using like the crappiest hardware you can find.
[20:45.430 --> 20:54.770]  So when it breaks when they're in China, when like your CEO goes to China and his laptop breaks because it was like the five-year-old laptop that you were going to throw away, you have no way to replace it.
[20:55.670 --> 20:57.450]  And you can't use a lot of the layer software tools.
[20:57.590 --> 20:59.450]  So there's good and bad to that.
[20:59.750 --> 21:00.330]  Mostly bad.
[21:01.110 --> 21:03.630]  There's the buy completely random stuff off-the-shelf.
[21:04.050 --> 21:08.770]  And the problem there is you don't have any of the sort of like baseline protections.
[21:09.310 --> 21:12.130]  You might have like vendor spyware or whatever on the machine still.
[21:12.150 --> 21:12.750]  You have to wipe them.
[21:12.870 --> 21:17.650]  Like there's all sorts of stuff where you don't have the basic protections you have on your regular corporate environment or your regular personal environment.
[21:17.650 --> 21:24.910]  So what happens when that gets hacked and it's to something that would have been protected by your regular fleet of machines.
[21:25.150 --> 21:32.770]  And the problem with building like a dedicated pool of machines that use high security stuff that you manage is it actually does have to be as separate as possible from your existing stuff.
[21:33.130 --> 21:42.510]  Like you could probably use like licenses across the things, but the servers they talk to, the provisioning infrastructure, everything else has to be separate or else theoretically you could pivot from one of those machines to it.
[21:42.510 --> 21:46.810]  And that basically doubles the amount of work that your IT security team has.
[21:47.090 --> 21:50.450]  And for a lot of these organizations, their IT security team is already zero people.
[21:50.750 --> 21:57.750]  So zero time... somehow zero times two is actually worse than zero times one, but it's very bad.
[21:57.890 --> 21:59.350]  So there's some pain.
[21:59.510 --> 22:02.650]  One of these solutions is usually better than the others, but none of them are great solutions.
[22:03.810 --> 22:04.490]  So there's that.
[22:04.810 --> 22:06.130]  Then there's the prepare systems in advance.
[22:06.290 --> 22:09.670]  So because this is a time-limited thing, you want to prepare stuff before you travel.
[22:10.750 --> 22:13.090]  There's some obvious stuff there.
[22:13.270 --> 22:14.610]  Like you want to make it work while you're here.
[22:15.050 --> 22:23.230]  But there's also some things like auto-updates are one of the best things for security for regular use in normal environments.
[22:23.730 --> 22:26.770]  Because one of the biggest problems is out-of-date stuff, not getting patched, everything else.
[22:26.970 --> 22:33.930]  But when you're in an incredibly hostile network environment, that's sort of asking for trouble more so than anything else.
[22:34.030 --> 22:34.830]  Or installing new software.
[22:34.830 --> 22:39.270]  So either auto-updates or installing a new package that a user is somehow prompted to do.
[22:39.470 --> 22:47.810]  On a network that's hostile, where you don't necessarily have great end-to-end security, or where hypothetically a CA is controlled by the same government that potentially is your adversary.
[22:49.330 --> 22:50.110]  Not a good idea.
[22:50.310 --> 22:51.530]  So you want to try to minimize that.
[22:53.090 --> 22:55.770]  And you want to harden your systems as well as possible.
[22:55.770 --> 22:59.970]  Like, I know how to harden iOS and Mac OS, Linux, and a few other platforms.
[23:00.130 --> 23:03.770]  I don't actually know very much about hardening Android and Windows 7.
[23:04.410 --> 23:06.050]  I'm okay on Windows 10, not so much.
[23:06.150 --> 23:10.090]  But, like, if you know your platforms, you want to harden them as well as you can.
[23:10.290 --> 23:15.750]  You might want to use the same platforms that you're using for your day-to-day use, just because your users are going to be most comfortable with those.
[23:15.830 --> 23:17.270]  And you should know hardening those.
[23:17.470 --> 23:20.590]  Plus, some people have written some really good security guides.
[23:20.590 --> 23:22.770]  The Gruck wrote a pretty good iOS guide.
[23:23.670 --> 23:25.730]  Filippo from Cloudflare wrote a pretty good guide.
[23:26.430 --> 23:28.090]  There's some other people that have written guides.
[23:29.150 --> 23:30.470]  The problem is they get out of date.
[23:30.610 --> 23:32.630]  They're sort of particular to your problems.
[23:32.790 --> 23:36.510]  And it's a checklist, so you have to implement it yourself, and you have to make sure that everything's done.
[23:36.950 --> 23:37.590]  So there's that.
[23:38.130 --> 23:44.130]  And then the other fundamental principle that saves you from huge amounts of pain is to minimize the amount of data on the machines.
[23:44.770 --> 23:54.390]  The number of times where people take their daily use machine and just, like, fly to China with it, and they have all their email, all their data, all their corporate access on that system...
[23:55.530 --> 23:57.390]  Actually, that's sort of, like, the default people do.
[23:58.030 --> 24:07.970]  And it's horrible, because there's nothing you can do if somebody says, like, turn over this machine or else where the or else is be thrown in jail.
[24:08.130 --> 24:13.550]  Like, there's no corporate user that's going to, like, stand up and say, oh, throw me into jail for forever for my company's data.
[24:13.550 --> 24:20.430]  So, well, there have been historical exceptions to that, at least one, and I would not advise that in a foreign country.
[24:22.750 --> 24:26.270]  But, yeah, so if you're not going to use the data while you're there, there's no reason to have it.
[24:26.330 --> 24:27.130]  It's only a liability.
[24:28.430 --> 24:31.030]  There's some interesting stuff in that area later.
[24:32.290 --> 24:34.650]  So, yeah, and the other thing is to travel naked.
[24:34.810 --> 24:41.650]  So travel with no data on the laptop, only tools, such that when you get to the country, you download the data there.
[24:41.650 --> 24:44.030]  You don't, obviously, want to download unencrypted data.
[24:44.190 --> 24:44.930]  You want it to be encrypted.
[24:45.070 --> 24:46.990]  You want to have reasonable tools for the integrity and everything else.
[24:47.090 --> 24:52.610]  But it's much more acceptable if somebody is saying, turn over all the stuff on your laptop.
[24:52.610 --> 24:59.190]  If what you're turning over is a system with a bunch of tools on it, then if it's a system that has a bunch of tools on it and all your data.
[24:59.590 --> 25:00.970]  So that's a basic principle.
[25:01.570 --> 25:06.630]  And then you want to protect keys and credentials at a higher level of security than you protect the actual data.
[25:06.630 --> 25:14.890]  So one of the things that is not intuitive is that the target for a lot of this stuff in intellectual property tax is not necessarily the stuff that you have with you.
[25:15.090 --> 25:21.750]  It's persistent access, especially, like, elevated access credentials or other pivots into systems back in other countries.
[25:21.870 --> 25:26.030]  So it's actually easier to target a U.S., a very, very well-secured U.S.
[25:26.130 --> 25:31.510]  system by attacking a client device that is temporarily in your country than it is to go after it over the network.
[25:31.510 --> 25:32.830]  And it's a diverse thing.
[25:32.990 --> 25:38.470]  So you don't want to take your SSH keys that you use for logging into production systems or everything else with you.
[25:39.530 --> 25:41.990]  And if you're not going to use them while you're there, you shouldn't take them.
[25:42.650 --> 25:50.630]  And you want to potentially use time-limited credentials, things like that, and have a very good system for removing those credentials from systems and everything else.
[25:51.590 --> 26:04.110]  And another sort of non-intuitive thing, especially from the organizational side or from the government side or large enterprise side, is that people's personal accounts, normally there's, like, policies of don't let them use it on their work machines because it's a liability for us.
[26:04.290 --> 26:11.850]  If somebody posts something about, like, a political candidate from a White House computer, that gets everybody in a lot of trouble, so you don't want to allow personal devices there.
[26:12.030 --> 26:14.430]  It's sort of the opposite of that if somebody goes to China.
[26:14.550 --> 26:28.970]  If, like, the CEO of your company goes to China and his personal Twitter account gets hacked while he's there and starts tweeting stuff about, like, how they're about to buy, like, a large company or something like that, that can cause problems both for the individual and for the company.
[26:29.230 --> 26:32.430]  So protecting their personal stuff while they're there is important.
[26:33.110 --> 26:36.410]  Even stuff like nuisance things would be a compromise there.
[26:38.110 --> 26:39.330]  And virtualization's a good solution there.
[26:39.390 --> 26:43.850]  You do definitely want to keep it separate from your primary work stuff, but you do need to figure out a way.
[26:43.950 --> 26:49.130]  These people are going to be there for a week or two at a time, in a lot of cases, on long flights, everything else.
[26:49.230 --> 26:54.870]  If they're not able to do something in a safe way to use their personal stuff, they're going to use it in an unsafe way.
[26:55.090 --> 27:01.290]  There's almost nothing that you can do that's going to keep people from checking in their personal email and everything else for that long period.
[27:02.550 --> 27:04.230]  And then there's user training.
[27:04.350 --> 27:17.450]  Like, the fundamental principle is that anyone who's going on a trip like that for work purpose is important enough that they prioritize getting stuff done versus necessarily complying with every detail of every policy, and they're away from the people that can enforce those policies.
[27:17.690 --> 27:23.310]  So, if there's a conflict between, like, security and getting the job done, they're almost always going to compromise on security.
[27:23.670 --> 27:29.330]  And you want to make... the trick there is you make the easiest way to do something also the safest way to do it.
[27:29.670 --> 27:39.750]  And the best thing I've ever found has been to make the VPN incredibly useful or the network access tool you use incredibly better than, like, using a native local network.
[27:39.750 --> 27:44.450]  So, the users want to use the VPN because it makes stuff work better for them.
[27:44.590 --> 27:46.410]  And use that as a trick to get them to do everything else.
[27:48.490 --> 27:52.510]  So, those are, like, sort of general principles that you can use to evaluate whether stuff is good or bad.
[27:52.710 --> 27:55.070]  But let's talk about, like, stuff that actually works and doesn't work.
[27:59.170 --> 28:08.170]  So, the number one question that anyone ever asks when they're going to China, and I get this, like, probably five times a week from people, is what VPN should I use?
[28:08.170 --> 28:11.070]  And the problem is there's no great answer to that.
[28:12.490 --> 28:17.350]  The problem is it's sort of like a dis-economy to scale type thing.
[28:17.470 --> 28:23.190]  Like, if a VPN... if a public VPN is really, really good, it's then a bigger target to try to block.
[28:23.450 --> 28:28.430]  And there's sort of a... there's different technologies that people are using.
[28:28.830 --> 28:31.890]  Most VPN technologies are very, very basic VPN technologies.
[28:32.070 --> 28:37.150]  They're either IPsec or they're SSL tunneling, open VPN style.
[28:37.150 --> 28:42.950]  There's nothing particularly optimized about circumventing most conventional VPNs.
[28:43.430 --> 28:47.530]  There are circumvention networks and access networks that are great, but they have other trade-offs.
[28:47.850 --> 28:52.750]  So, any regular VPN that works well, once it gets enough users, it's going to be harder and harder to make work.
[28:53.690 --> 29:02.070]  The thing that I have found that works the best is if you have, one, backups and diversity on those things, and also if you use something that's dedicated to a small pool of people as possible.
[29:02.070 --> 29:08.810]  So, either set up your own infrastructure or somehow have a dedicated deployment for your particular users.
[29:08.930 --> 29:09.670]  That works fairly well.
[29:09.850 --> 29:13.070]  But you do want to have something where it can fail back to different protocols, different ports.
[29:13.230 --> 29:17.610]  Because the secret about the great firewall of China is there is no great firewall of China.
[29:17.730 --> 29:21.310]  There's, like, one on every network in every province that's actually slightly different.
[29:21.710 --> 29:24.730]  And they often block stuff and it changes over time and everything else.
[29:24.910 --> 29:29.630]  So, stuff that works great in Shanghai does not necessarily work great on, like, a mobile network in Beijing.
[29:30.970 --> 29:33.010]  And it's really hard to stay up to date on that.
[29:33.230 --> 29:36.550]  There are some people that are doing some automated monitoring, which is kind of cool for that.
[29:37.590 --> 29:41.010]  Things that work exceptionally well are international roaming data service.
[29:41.210 --> 29:44.730]  It's expensive, but it does bypass a lot of protections on a lot of the networks.
[29:45.370 --> 29:47.330]  So, you get relatively unfiltered access.
[29:47.830 --> 29:49.810]  And it's not super expensive.
[29:50.530 --> 29:53.190]  It's, like, 20 bucks a month for unlimited data from certain providers.
[29:53.410 --> 29:55.730]  So, that's actually a pretty good backup solution.
[29:56.610 --> 29:59.290]  The dedicated pools of travel laptops do work pretty well.
[29:59.290 --> 30:01.130]  They are best practice now for everybody.
[30:01.770 --> 30:03.070]  But it's a pain to manage.
[30:03.230 --> 30:05.430]  Like, the biggest problem is managing them and things like that.
[30:05.910 --> 30:06.710]  And then there's...
[30:06.710 --> 30:14.130]  The weirdest thing is, like, Snapchat, although it's blocked in China, but tools like Snapchat that are sort of ephemeral are ideal for this kind of trip.
[30:14.170 --> 30:18.870]  Because they enforce the ephemerality and non-permanence of the data more than anything else.
[30:18.970 --> 30:29.270]  Like, one of the stories I've heard from the Turkish coup and counter coup and all the other stuff that's going on is people, like, security agents on the buses are telling people, hey, unlock your WhatsApp for me on the phone.
[30:29.450 --> 30:34.070]  And if you don't have, like, auto-delete in your client, that's a lot of data there.
[30:34.170 --> 30:39.910]  If you have auto-delete and you've only got, like, 15 minutes of data, eh, it's a pain, but it's not anywhere near as huge a compromise.
[30:40.070 --> 30:46.690]  So, things that sort of automatically do data retention policy and let you scale it down to very, very short periods are great.
[30:47.430 --> 30:51.210]  So, those are some, unfortunately, relatively limited number of things that work fairly well.
[30:51.510 --> 30:52.750]  There's a lot of stuff that doesn't work.
[30:53.090 --> 30:54.370]  So, special hardware.
[30:54.470 --> 30:55.990]  There's a lot of companies selling special hardware.
[30:56.150 --> 30:58.450]  For a while, I was working on, like, a travel router thing.
[30:59.730 --> 31:01.890]  And it sort of is still a viable thing.
[31:02.030 --> 31:13.090]  But, like, if it's special hardware that identifies you as somebody who particularly cares about security when you're traveling, there's a lot of downsides to having that in your possession and having it seen.
[31:13.090 --> 31:19.130]  If it's seen as, like, a network access device that helps you work more productively, like a battery or something like that, then great.
[31:19.310 --> 31:26.030]  But, if it's something that is specially designed to be, like, a security network hardware device, eh, big red flag there.
[31:26.370 --> 31:29.590]  And Google Chromebooks would check all the boxes for, like, awesome stuff.
[31:29.710 --> 31:30.910]  They have very little local state.
[31:31.090 --> 31:31.990]  There are all sorts of other stuff.
[31:32.110 --> 31:33.630]  They're relatively secure of the network by default.
[31:33.910 --> 31:40.430]  But, unfortunately, Google has made some decisions some while ago to really anger China.
[31:40.430 --> 31:45.570]  So, a lot of Google services are blocked in China for both commercial and retaliatory reasons.
[31:46.170 --> 31:48.090]  So, Chromebooks don't work very well in China.
[31:48.450 --> 31:50.030]  They depend a lot on Google services.
[31:50.230 --> 31:53.890]  So, they're great in concept, but in actual practice they don't work very well.
[31:54.210 --> 31:58.770]  Desktop as a service is another solution that would be awesome because then you don't actually have any data in the country.
[31:58.910 --> 32:00.270]  You're just using it as sort of like a terminal.
[32:00.570 --> 32:02.330]  But the networks are not so great.
[32:03.130 --> 32:12.030]  And then, there are a lot of, like, things that you would never expect to be dependencies of websites and things like that, that are, like, Facebook, Google, things that are blocked.
[32:12.450 --> 32:12.950]  There's that.
[32:13.110 --> 32:15.150]  And there's the free and commercial VPNs that are often blocked.
[32:15.250 --> 32:18.050]  Like, the big, either free ones or very cheap ones that are very popular.
[32:19.610 --> 32:21.950]  And then some corporate VPNs are more blockable than others.
[32:22.810 --> 32:24.450]  Stuff that works but fails often.
[32:24.590 --> 32:25.690]  Like, the full disk encryption thing.
[32:25.690 --> 32:32.890]  I mean, nobody is, like, breaking full disk encryption in a way other than telling you to decrypt it.
[32:33.050 --> 32:36.590]  But that works remarkably well when you're in a country where you don't have any legal standing.
[32:38.110 --> 32:39.370]  And then secure messengers.
[32:39.550 --> 32:41.970]  If you are a target enough, they can force you to unlock it.
[32:42.070 --> 32:42.590]  It's a huge problem.
[32:43.690 --> 32:46.650]  Anything that depends on users to, like, manually cycle stuff through.
[32:47.010 --> 32:52.350]  I've never seen users that are, like, remembering to do that or whatever else unless it's necessary to actually get the work done.
[32:53.070 --> 32:54.330]  And stuff changes over time.
[32:54.330 --> 33:00.370]  The other... the weirdest thing that I've seen in, like, a year of caring... a couple years of caring about this problem for other people as well as my own problem.
[33:00.610 --> 33:02.210]  Sometimes you know your machine is compromised.
[33:02.610 --> 33:04.310]  And it's the only machine you have.
[33:04.530 --> 33:06.190]  And you're in a place where you can't easily replace it.
[33:06.270 --> 33:07.710]  So you're actually stuck still using it.
[33:08.010 --> 33:12.810]  So you're talking to people and trying to avoid disclosing, you know, it's... it's a crazy problem.
[33:14.490 --> 33:16.430]  So these are problems that we should not have.
[33:17.290 --> 33:22.630]  It's unfair to, like, end users... like, technical users, you could fix this yourself.
[33:22.630 --> 33:27.150]  So it's sort of not as much of, like, a moral failing that we've failed the technical users.
[33:27.390 --> 33:31.310]  Like, regular users that are actually trying to get real work done, this should work for them.
[33:31.410 --> 33:32.110]  And it doesn't.
[33:32.450 --> 33:36.490]  So lots of cool stuff that I'm working on, other people can work on.
[33:36.610 --> 33:39.350]  It would be awesome to have people work on solving these particular problems.
[33:39.350 --> 33:41.710]  So, better VPNs.
[33:41.810 --> 33:44.610]  Like, VPNs that are optimized for this particular use case.
[33:44.790 --> 33:48.650]  Like, I love Tor, despite having worked at a place that doesn't love Tor so much.
[33:50.430 --> 33:56.970]  They are great for getting around, like, circumvention purposes, access, everything else.
[33:57.090 --> 34:03.110]  But, unfortunately, it's, performance-wise, not as efficient as a direct VPN.
[34:03.110 --> 34:06.210]  And not as integrated into any platform as a direct VPN.
[34:06.430 --> 34:12.310]  So, for a lot of people, it's not a good solution for 24-7 use, especially in a corporate environment.
[34:12.650 --> 34:16.270]  So there needs to be something that works better for users.
[34:16.270 --> 34:23.190]  It doesn't get blocked, or when it does get blocked, can fail in a more sort of, like, graceful way and degrade back to other protocols that are maybe less efficient.
[34:23.190 --> 34:28.930]  So, improving how VPNs work is a very, very important problem... solving this problem.
[34:30.950 --> 34:32.750]  Hardware appliances are really nice.
[34:32.910 --> 34:40.230]  Like, there's a standard problem when you're traveling of having a bunch of wireless devices that you want to associate to an AP in a hotel or cafe or whatever else.
[34:40.410 --> 34:42.970]  And having to re-associate them to somebody else's network is a huge pain.
[34:43.530 --> 34:46.010]  So, that's where hardware devices would make a lot of sense.
[34:47.730 --> 34:55.190]  Selling them as, like, a super high-security device that's gonna bypass all security intervention is not a useful thing for users.
[34:56.690 --> 35:04.010]  Desktop as a service, I would say, is probably the most awesome thing if it can be made to work in this particular environment.
[35:04.470 --> 35:09.570]  I've tried to get it to work in a reasonable way on simulations of high... of these networks...
[35:09.570 --> 35:13.610]  The problem is the networks are high latency to anywhere that you care about.
[35:14.990 --> 35:16.990]  They have limited... they have variable bandwidth.
[35:17.190 --> 35:21.350]  There's a lot of jitter, so, like, variation in the latency.
[35:21.350 --> 35:23.850]  And there's a lot of packet loss on some networks.
[35:24.110 --> 35:25.550]  And it's intermittent, all sorts of things.
[35:25.670 --> 35:26.930]  And that's just from, like, regular use.
[35:27.030 --> 35:28.310]  That's not even when they're trying to block it.
[35:28.550 --> 35:33.350]  So, it needs to be something that works very, very well with low-quality networks.
[35:33.610 --> 35:40.750]  And most people try to do desktop as a service from, say, China all the way back to North America or Europe.
[35:41.090 --> 35:43.670]  And that's probably not the optimal place to do it.
[35:43.830 --> 35:50.390]  It might be worth putting a hardened desktop as a service server in a place that has better network connectivity to the target location.
[35:50.390 --> 35:52.870]  That could be Hong Kong as sort of the obvious one.
[35:53.490 --> 35:56.910]  Russia has good connectivity to certain areas, but has its own problems.
[35:58.210 --> 35:59.690]  Taiwan and Japan probably...
[35:59.690 --> 36:07.250]  Like, there's things you could do to move the servers closer to the users where you trust them more than you would trust them in China, but maybe not as much as home.
[36:07.710 --> 36:08.450]  And then there's building...
[36:08.910 --> 36:14.070]  It's crazy that, like, desktop as a service on some applications is screen scraping.
[36:14.070 --> 36:16.870]  Like, there should be something that's more reasonable for that.
[36:17.050 --> 36:19.870]  So, lowering the network communications requirements there.
[36:21.770 --> 36:23.490]  Laptops are an area that I've been working on the most.
[36:24.390 --> 36:26.110]  Ultimately, it's crazy...
[36:26.110 --> 36:30.470]  Like, the travel pool of laptop is a great idea, but you wouldn't...
[36:30.470 --> 36:30.910]  You don't...
[36:30.910 --> 36:32.090]  Like, most medical devices...
[36:32.090 --> 36:33.030]  Like, this is probably the best analogy.
[36:33.510 --> 36:48.330]  Medical devices, in a lot of cases, they push toward making them disposable, because it's actually cheaper to throw something away and know that the new one you're getting is completely intact, works perfectly, sterile, everything else, and doesn't have any history from previous stuff.
[36:49.010 --> 36:51.710]  Applying that same principle to computing is an interesting idea.
[36:51.890 --> 36:54.230]  There's two factors against that.
[36:54.330 --> 36:55.210]  There's the waste issue.
[36:55.770 --> 36:56.190]  Like, cost...
[36:56.190 --> 36:56.910]  There's a cost issue.
[36:57.630 --> 37:00.190]  Like, this is like a $3,000 laptop.
[37:00.370 --> 37:01.490]  I'm unlikely to throw that away.
[37:02.710 --> 37:06.510]  Cheapest laptop you're realistically going to get in the low hundreds of dollars range right now.
[37:07.530 --> 37:09.190]  Maybe that's going to continue to trend down.
[37:09.930 --> 37:17.010]  Plus, it's kind of, like, morally or aesthetically offensive to have a huge pile of, like, discarded, otherwise awesome laptops.
[37:17.410 --> 37:22.150]  So, some solution where maybe the machines could be refurbished or something would be an interesting solution there.
[37:23.150 --> 37:24.310]  One of the ideas...
[37:24.310 --> 37:31.730]  One of the things that Chromebooks get incredibly right is being able to wipe and restore them to a known good state by separating out the programs and operating system from all the user data.
[37:32.090 --> 37:34.470]  Usually lives in an EEPROM compared to the user data.
[37:35.650 --> 37:37.590]  Doing that for other platforms is a great idea.
[37:37.870 --> 37:40.390]  And then making the devices tamper evident, tamper responding.
[37:40.570 --> 37:50.090]  Like, you could conceivably build a secure computer that was able to resist network attacks, software attacks, everything else, as long as you didn't gain physical access to the internals.
[37:51.230 --> 37:58.350]  And if you had a way to verify that the internals hadn't ever been accessed, then you can verify that and then largely trust the platform.
[37:59.230 --> 38:01.570]  The problem is, the best ways to do that...
[38:01.570 --> 38:04.050]  There's, like, expensive ways to do that, like, hardware security module style.
[38:04.270 --> 38:06.890]  And there's cheap ways to do that with, like, paper seals and tape seals.
[38:07.310 --> 38:11.910]  It's like, tape seals are, one, a pain to verify, and two, actually fairly easy to bypass.
[38:12.250 --> 38:16.350]  So, it's not a great solution right now, but maybe some better solution there.
[38:16.350 --> 38:31.270]  And then the other problem is, from a pure software attack, like, the CubesOS people, and a bunch of other people from Europe are working on trying to minimize all the places in your laptop that state is stored.
[38:31.650 --> 38:36.050]  Ideally, you would have a single place on your entire laptop where all the laptop-specific state is stored.
[38:36.210 --> 38:42.490]  You would not have chips everywhere in your system that can have some amount of storage of either program or user data.
[38:42.490 --> 38:45.930]  Right now, that is definitely the case, that you have that.
[38:46.210 --> 38:51.790]  And that makes it really hard to say this machine is intact and returned to a given state, a previous state.
[38:52.170 --> 38:55.670]  And getting users to voluntarily accept, like, lower functionality.
[38:55.970 --> 38:58.450]  I think travel is actually a fairly good market for that.
[38:58.550 --> 39:04.950]  I think it would be really hard to convince somebody to go from, like, a $3,000 laptop to a $200 laptop for daily use in the U.S.
[39:05.330 --> 39:06.630]  on the basis of it's more secure.
[39:07.290 --> 39:13.450]  I mean, Chromebooks have not been a commercial success there, even though they're objectively more secure than most laptops that people use.
[39:14.430 --> 39:19.290]  However, for a trip, for a short, defined period of time, they might be more willing to do that.
[39:19.410 --> 39:21.490]  So that's an area where things are good.
[39:21.970 --> 39:23.710]  The other huge area that people use is phones.
[39:23.850 --> 39:27.730]  Like, I know a lot of people that travel to places like China with just a phone.
[39:27.830 --> 39:28.850]  They don't take a laptop at all.
[39:30.790 --> 39:33.950]  Obviously, advantages are phones are cheaper than laptops in a lot of cases.
[39:34.190 --> 39:35.590]  So they're kind of viewed as disposable.
[39:36.390 --> 39:38.190]  They're really easy to keep with you all the time.
[39:38.190 --> 39:44.230]  Like, you can protect yourself from a lot of the physical attacks by keeping your laptop with you the entire time you're in China.
[39:45.510 --> 39:50.850]  But that is maybe realistic for an individual to do if they're the one setting the policy and they're the one doing it.
[39:51.170 --> 39:57.010]  Telling your users to do that is an example of one of those things where, like, user training will not work to get them to do something that's inconvenient.
[39:57.930 --> 40:01.510]  But phones are really easy to convince people to keep with you, like, Pokemon Go.
[40:01.730 --> 40:02.890]  Like, you might find Pokemon somewhere.
[40:03.070 --> 40:04.050]  So there's that.
[40:04.310 --> 40:07.150]  I mean, phones have another problem of, like, baseband risk and hostile carrier risk.
[40:07.150 --> 40:12.110]  Like, you can largely assume that the mobile network operator is the government in most countries.
[40:13.430 --> 40:15.990]  And they... there's all sorts of bad stuff there.
[40:16.250 --> 40:20.170]  So the baseband and the SIM and everything else are a problem there.
[40:23.410 --> 40:25.970]  The... one other big problem is the lack of virtualization.
[40:25.970 --> 40:32.670]  So, like, you can, as a, like, Turkish security guy, go to somebody and say, show me the WhatsApp on your phone.
[40:32.790 --> 40:40.630]  And unless you've done something very, very strange with your phone, especially on, like, iOS, you have one copy of WhatsApp running on your phone.
[40:40.750 --> 40:45.230]  And it's very easy for them to verify that, yes, this is the copy that they're running and everything else once they have your phone unlocked.
[40:45.370 --> 40:48.210]  So there's no way to, like, hide certain stuff very easily.
[40:48.430 --> 40:53.330]  There's also not an easy way to separate out, like, the personal accounts and the work accounts on phones.
[40:53.330 --> 41:00.710]  There are some platforms like Good and some other things that are sort of on there, but they're inconvenient and not generally used by smaller organizations or individuals.
[41:01.870 --> 41:11.570]  MDM is a, I would say, best practice and probably a minimum standard for, like, any competent person for a large fleet of devices for, like, mobile devices in the U.S.
[41:12.190 --> 41:16.810]  However, making that work when you're taking things on and off of the networks all the time is a huge, huge pain.
[41:17.030 --> 41:21.970]  And a lot of the systems are not designed for remote... working through a great firewall.
[41:21.970 --> 41:25.070]  So you might be able to, like, wipe somebody's phone but not restore it and things like that.
[41:25.550 --> 41:33.710]  And the biggest problem I found with iPhone... with all these things is the concept of traveling with no data on your phone is a great idea.
[41:34.650 --> 41:41.410]  However, to do that well, you want to be able to image and restore to exactly the same state every single time on your machine with, like, one button.
[41:41.850 --> 41:46.630]  And you can largely do that on laptops with some third-party software.
[41:46.950 --> 41:48.690]  Doing that on phones is actually a huge pain.
[41:49.090 --> 41:52.670]  There's a lot of stuff related to the... especially on iOS.
[41:52.810 --> 41:54.410]  There's a lot of stuff that's not backed up.
[41:54.630 --> 41:59.930]  There's a lot of things that are either in... for security reasons, in, like, a secure element that you can't restore.
[42:00.470 --> 42:07.250]  So telling people to completely wipe and restore their phone is going to cause enough user friction each time that doing that on every trip may be viable.
[42:07.390 --> 42:11.630]  Doing that every time they've been away from their phone for any period of time may be less viable.
[42:11.770 --> 42:12.090]  So there's that.
[42:12.290 --> 42:15.210]  And there's the dependence on services that are highly blocked.
[42:15.210 --> 42:23.090]  Google stuff in particular, also iTunes iCloud, they have security issues as well as connectivity issues there.
[42:24.370 --> 42:26.490]  And then the other huge area is...
[42:26.490 --> 42:33.810]  So this whole set of, like, 45 minutes of stuff, you can do it, but you don't really know that you've been successful doing it.
[42:34.010 --> 42:41.830]  It has all the negative things about security where you can fail silently and miss, like, one tiny step and be completely compromised forever.
[42:41.830 --> 42:45.330]  So there's no good tools to, like, manage and optimize doing this stuff right now.
[42:47.030 --> 42:48.830]  So conceivably, you could build this yourself.
[42:49.610 --> 42:51.950]  Conceivably, you could install software and do this.
[42:52.290 --> 42:54.490]  But it's, like, a pain to make it work.
[42:54.550 --> 42:55.290]  So there's that.
[42:55.930 --> 42:57.190]  And a lot of the tools are not...
[42:57.190 --> 43:03.170]  There are tools to sort of manage fleets of machines, like SMS for Windows and everything else, but they're not really designed for small pools of machines.
[43:03.410 --> 43:08.810]  So this is a problem that both small organizations have and travel, so it would be great if people built tools that work great for this.
[43:09.530 --> 43:12.150]  So there's all that, but I have also a sales pitch to have to activists.
[43:12.290 --> 43:14.650]  So I don't think this should be a problem that people have to solve.
[43:15.630 --> 43:23.230]  I would like countries to not actively go after individuals and commercial organizations in the same way they go after each other's intelligence agencies.
[43:23.310 --> 43:37.450]  I don't think it's reasonable for individuals to have to spend money on this or any thought cycles on this, and certainly not activist organizations or companies or anything else, especially when they're not even, like, activists in that country or there's other people.
[43:37.450 --> 43:52.310]  So I would like the laws and best practices and commercial standards and everything else to change such that people have the rights that they're largely promised in their whatever constitutions or other legal documents in their country, wherever they are in that country,
[43:52.430 --> 43:56.850]  and that non-citizens in that country and visitors that are otherwise lawful have access to those things, too.
[43:57.570 --> 44:02.430]  That's probably a harder problem to solve than the technical problem of making this stuff work really well, but it would be great to do.
[44:02.430 --> 44:14.390]  And probably a more practical thing is whenever somebody is a journalist or an individual or an activist or a company that gets hacked in this way, there's a huge incentive, especially for commercial organizations, to hide the fact that they were attacked.
[44:14.950 --> 44:19.010]  One, because it will draw the ire of the attacker if it's known that they were the attacker.
[44:19.790 --> 44:21.710]  Two, it makes them look bad.
[44:22.270 --> 44:25.570]  Three, eh, lots of reasons why they don't want to do it.
[44:25.650 --> 44:37.030]  But if you find out about this thing, these things happening to people, and you think it's a good idea to disclose that, I think it's good to know which countries are doing what to what people and why, and making that as public as possible is good.
[44:37.330 --> 44:46.830]  It might be a case where the organizations don't want it to be public, but it's in everyone's good collectively for it to be as public as possible, so there's probably some sort of collective action problem there.
[44:48.050 --> 44:52.130]  So, yeah, in general, I'm happy to talk with people about their specific travel needs to specific places.
[44:52.310 --> 44:55.810]  I know China pretty well because I know a lot of people that are going out there specifically.
[44:55.810 --> 45:00.470]  I don't know as much about, like, Russia or I know moderate about the Middle East and some conflict zones.
[45:01.410 --> 45:02.850]  I think it's an interesting problem.
[45:03.010 --> 45:05.410]  It really depends on who you are as an organization or as an individual.
[45:06.010 --> 45:16.830]  And then once my web server is back up, I'm going to put together some links to the other people's documents on how to harden specific platforms, especially stuff like Android and Windows that I don't really care as much about.
[45:17.610 --> 45:20.690]  And anyone interested in some of these R&D areas, I'd love to talk to you.
[45:21.210 --> 45:31.430]  I think building this stuff as a tool for travelers is a great way to build some tools that a lot of people use, but it's also something that's useful for small groups of users everywhere.
[45:32.070 --> 45:32.630]  So, yeah.
[45:32.750 --> 45:33.070]  Great.
[45:33.330 --> 45:34.050]  Well, thank you very much.
[45:42.160 --> 45:43.600]  What about satellite Internet?
[45:43.800 --> 45:44.540]  Is it good or not?
[45:45.080 --> 45:47.740]  So, satellite Internet is an interesting case.
[45:47.920 --> 45:49.600]  I actually ran a satellite network operator.
[45:50.820 --> 45:52.720]  There's a couple different kinds of satellite Internet.
[45:52.720 --> 45:54.840]  There's, like, fixed facility satellite Internet.
[45:55.060 --> 46:04.080]  We're using, like, a C-band or a K-U-band or a K-A-band, which is a dish that generally... either a really expensive dish or one that somebody has manually installed.
[46:04.240 --> 46:05.000]  It's a fixed location.
[46:05.220 --> 46:07.940]  It takes, like, 20 minutes to install, but, like, it's a fixed location.
[46:08.320 --> 46:09.660]  That's good for some offices.
[46:10.380 --> 46:21.080]  There's definitely cases in... Satellite has some interesting characteristics where it's fairly easy to... like, it works in a lot of places, but it's sort of obvious that you're using it.
[46:21.080 --> 46:27.960]  One, you can look for dishes if you can't hide them, and two, if they know specific... like, you're not necessarily going to be covert using it.
[46:28.880 --> 46:31.760]  That's for the fixed facility locations, but it does bypass the local network.
[46:31.880 --> 46:40.880]  So, if you're encrypted and you're not exposed there, the only thing you're likely to be leaking is your exact GPS coordinates and what you're... like, that you're using it at all.
[46:41.280 --> 46:47.360]  However, there's more... the other interesting thing are your satellite phones or the mobile data terminals, like the MRSAT-BGAN stuff.
[46:48.520 --> 46:50.100]  Downside is that stuff's really expensive.
[46:50.100 --> 46:55.260]  It's like $10,000 for a BGAN receiver, and it's, I think, $4 a megabyte per...
[46:55.260 --> 46:58.200]  $4 a megabyte for data.
[46:58.520 --> 47:01.560]  Or, like, an Iridium phone or Thriya phone or other things like that.
[47:02.180 --> 47:04.360]  Maybe $1,000 bucks and similar kinds of charges.
[47:04.540 --> 47:08.260]  So they're relatively expensive, and most of those are...
[47:08.260 --> 47:20.760]  either allow the host country to block it in their geographic region, because they don't want to go to war with the country, or they turn over lots of data about who's using what terminals where to those people.
[47:21.220 --> 47:23.160]  It sort of depends on who your adversary is.
[47:24.120 --> 47:38.320]  If you're commercially... if you're going to some... like, say, like, Africa for oil or something, or an aid organization or whatever else, it's a pretty good solution, because you're probably, at worst, leaking the fact that you're using this stuff to local people.
[47:38.320 --> 47:45.960]  If you were trying to use it to... like, North Korea or, like, Iran or someplace like that, yeah, not as good a solution.
[47:46.320 --> 47:49.800]  But yeah, they're interesting, but they're expensive is the main concern.
[47:51.820 --> 47:53.200]  Are we... do you have more questions?
[47:55.000 --> 48:03.960]  I have a question specifically about device encryption, because, I mean, I use readily available device encryption on my hard drive, you know, I lock my phone, all that stuff.
[48:04.260 --> 48:06.440]  I typically only am in the U.S. and Europe.
[48:07.760 --> 48:12.000]  So in those instances, I'm prepared to hand over that device rather than unlock it.
[48:12.240 --> 48:17.560]  But what I hear you commenting is that in many of these countries, that's not the issue.
[48:17.840 --> 48:20.760]  It's you will unlock it or we will something.
[48:21.080 --> 48:21.400]  Yes.
[48:22.260 --> 48:25.800]  I'm always happy to, like, burn a device rather than...
[48:25.800 --> 48:29.320]  Like, a lawyer for three hours is more than a computer.
[48:29.620 --> 48:32.940]  So, yeah, if we're only losing your device, that's awesome.
[48:33.400 --> 48:35.540]  The real issue is you can be detained.
[48:35.540 --> 48:38.460]  You can either be expelled, which is maybe bad...
[48:38.460 --> 48:42.880]  If you're an individual and you're traveling and it means your vacation's cut short, that might actually be a worthwhile thing to do.
[48:43.040 --> 48:46.000]  But if you're there for work, like, it's probably better to turn over...
[48:46.000 --> 48:50.940]  If you can turn over a machine that doesn't have anything sensitive on it, that might actually be a better thing.
[48:51.080 --> 48:53.920]  But you should be able to make that choice from knowing what's on your machine.
[48:53.920 --> 49:02.420]  It shouldn't be your turnover machine that you think doesn't have anything on it, but actually has credentials to your accounts that you then get accessed remotely.
[49:02.820 --> 49:06.040]  But, yeah, I would say the U.S. and EU are...
[49:06.040 --> 49:13.460]  Unless you're in, like, the 30 or 40 people they really, really care about, like, close to Snowden, they're just going to take your devices.
[49:13.500 --> 49:16.780]  Or they're going to... if you're not a citizen of the country, they're going to say you're not allowed to enter.
[49:16.780 --> 49:18.780]  That's a fairly low bar for them as well.
[49:19.100 --> 49:20.080]  And that could be expensive.
[49:20.340 --> 49:21.200]  It could definitely.
[49:21.540 --> 49:25.500]  Do you think that disk encryption from the major vendors is of value?
[49:25.780 --> 49:26.320]  Oh, absolutely.
[49:26.500 --> 49:28.620]  I think it is a standard best practice that everybody should use.
[49:28.800 --> 49:30.720]  There are a lot of reasons why disk crypto is awesome.
[49:31.180 --> 49:34.560]  One, it lets you do instant delete, because you can actually delete it.
[49:34.780 --> 49:38.500]  I don't really trust any spinning Rust hard drive deletion protocol.
[49:39.140 --> 49:43.460]  And SSD deletion... there's a SATA race command, but, like, unclear if it works.
[49:47.600 --> 49:53.760]  You certainly would not have a reasonable passphrase and everything else for it, but, yeah, I think disk encryption is a best practice that everybody should use.
[49:55.900 --> 49:56.300]  Hi.
[49:56.440 --> 50:08.220]  I've been working with students on the university level, and when they go on their semester abroad to China, what I've always recommended to them is that they should install the university VPN client and make sure that it works locally before they go,
[50:08.280 --> 50:16.160]  because of things like you can access all the journals that the university pays for, which is worth probably, like, thousands upon thousands of dollars of access.
[50:16.320 --> 50:25.620]  And I said, also, your university Gmail account will work, and your access to Facebook and all the other stuff you're used to using as an American will still work, and you won't be going, what the hell?
[50:27.580 --> 50:28.020]  Yeah.
[50:28.020 --> 50:43.060]  Using the VPN... I mean, you can... if it doesn't work in the U.S., it won't work in China, but if it works in the U.S., it might not work in China, but it's up to your particular configuration, but if it's a organizationally run thing, it's more likely to be blocked from a protocol perspective than it is to be blocked from an IP perspective,
[50:43.060 --> 50:44.480]  so if it works, it works.
[50:44.880 --> 51:03.560]  Usually what we found is it works because they have... they frequently access resources that are hosted on the university's servers, so it means they have to connect to, you know, star.edu, or star.edu, so frequently they can connect in via the VPN, and everything tends to work just fine.
[51:03.780 --> 51:03.880]  Cool.
[51:04.120 --> 51:04.200]  Yeah.
[51:06.500 --> 51:08.840]  What about exporting strong encryption?
[51:09.360 --> 51:13.840]  Yes, that is a legally challenging area.
[51:15.220 --> 51:17.900]  Generally, if it stays under your control, you're okay.
[51:18.120 --> 51:33.380]  If you're a U.S. citizen, care... I'm not a lawyer, so not legal advice, but in practice, over the last, like, 20 years of doing this, if it stays on your personal machines, and you're a U.S. person... in the U.S. case I know particularly well, if you're a U.S. person with all the stuff under your control the whole time,
[51:33.620 --> 51:34.520]  you're in pretty good shape.
[51:34.760 --> 51:39.640]  There's probably some exceptions to that, but, like, I would be reluctant to go to, like, one of the...
[51:39.640 --> 51:43.920]  I think it's five bad countries now with data, but, like, in general, you're okay.
[51:44.480 --> 51:50.880]  If it's a non-citizen, you want to... it's more complicated there.
[51:51.360 --> 51:54.960]  And then there's the more challenging problem is importing our strong crypto.
[51:55.620 --> 52:02.120]  Certain countries, which always changes, and I can't give any particular advice about it, have bars on certain things.
[52:02.580 --> 52:05.400]  It's much more of an issue with hardware crypto than it is with software crypto.
[52:05.560 --> 52:07.220]  Like, say, TPMs in China are banned.
[52:07.400 --> 52:11.080]  There's a special thing called a TCM that is sort of like a TPM.
[52:11.320 --> 52:18.100]  And they use a weird argument of they want to make sure there aren't backdoors put in by NSA, which is probably a totally legitimate concern for them.
[52:18.100 --> 52:25.540]  But in practice, it means it's really hard to send TPMs to China and you end up just not using anything, which maybe is also a positive intended consequence for them.
[52:26.100 --> 52:31.080]  But, yeah, I'd say crypto import and possession in-country might actually be a bigger thing than export.
[52:31.500 --> 52:32.660]  What were the five countries?
[52:33.440 --> 52:35.220]  Well, I mean, they're always going away.
[52:35.340 --> 52:37.800]  But, like, I think North Korea is still on that list.
[52:38.380 --> 52:39.960]  Iraq is no longer on that list.
[52:40.360 --> 52:40.720]  Iran.
[52:42.060 --> 52:42.420]  Sudan.
[52:43.120 --> 52:44.780]  Libya is probably not on that list anymore.
[52:44.960 --> 52:45.240]  They might be.
[52:45.380 --> 52:45.680]  I don't know.
[52:46.820 --> 52:47.740]  Sudan was on the list.
[52:47.980 --> 52:50.720]  Like, Cuba was on the list and is probably not on the list anymore.
[52:50.860 --> 52:53.320]  But it's the Treasury Department banned export countries.
[52:54.360 --> 52:54.720]  So...
[52:54.720 --> 53:04.840]  So you mentioned not necessarily being concerned with, like, Android or other platforms, but I think there's something to be said for, one, like, storage devices that can be reasonably hidden.
[53:04.960 --> 53:08.600]  So, like, micro SD cards and there are also, like, secure elements coming out in those form factors.
[53:08.600 --> 53:10.780]  I'm not arguing that Android is not a good platform.
[53:10.940 --> 53:13.460]  It's just I personally don't use an Android phone, so I'm not as familiar with it.
[53:13.500 --> 53:13.720]  Well...
[53:13.720 --> 53:15.260]  There's a lot of cool stuff about the Android platform.
[53:16.180 --> 53:16.560]  Um...
[53:16.560 --> 53:16.920]  The...
[53:16.920 --> 53:17.020]  Yeah.
[53:17.340 --> 53:17.720]  Removable...
[53:17.720 --> 53:19.760]  Removable media is good.
[53:21.140 --> 53:21.520]  Um...
[53:21.520 --> 53:27.080]  The biggest problem with Android, from a security perspective, is if you have users that have a diverse population of Android devices.
[53:27.300 --> 53:30.360]  But if you can specify which Android devices they use, you're pretty good.
[53:30.580 --> 53:32.420]  And, of course, the patching and everything else.
[53:32.620 --> 53:32.740]  Yeah.
[53:32.900 --> 53:33.940]  Well, I mean, the projects...
[53:33.940 --> 53:38.480]  Mostly the point being Android because you have more freedom with the hardware than you would with iOS.
[53:38.600 --> 53:41.240]  In terms of adding in microSDs or adding in secure elements.
[53:41.420 --> 53:41.520]  Yeah.
[53:41.520 --> 53:44.380]  I would say, theoretically, also alternative ROMs on Android.
[53:44.780 --> 53:45.040]  Yeah.
[53:45.040 --> 53:46.600]  Probably the best thing you could do today.
[53:46.840 --> 53:50.220]  I mean, actually, sadly, BlackBerry might still be the best thing you could do today.
[53:50.760 --> 53:51.880]  But, uh...
[53:51.880 --> 53:52.300]  Copyright, right?
[53:52.300 --> 53:57.880]  You might be better off with, like, one of the security focus, like, yeah, Copyright or somebody, on Android devices.
[53:58.400 --> 53:58.520]  Yeah.
[53:58.520 --> 54:04.920]  From a works out of the box, no hassle, I would say iOS is by far the most secure thing you can just go out and buy that most users are willing to use.
[54:04.920 --> 54:07.540]  And that, like, CEOs of companies are actually tolerant of.
[54:08.300 --> 54:08.660]  Um...
[54:08.660 --> 54:13.560]  There might also be an argument of, if you work at a company where everybody uses iOS devices, give them iOS devices for travel.
[54:13.940 --> 54:14.260]  Uh...
[54:14.260 --> 54:15.120]  Even if it's not optimum.
[54:15.400 --> 54:15.880]  But, yeah.
[54:16.280 --> 54:16.780]  But, yeah.
[54:16.860 --> 54:18.760]  I would like to know more about Android security.
[54:19.180 --> 54:19.540]  Um...
[54:19.540 --> 54:21.060]  I've always deferred that to other people.
[54:21.060 --> 54:21.440]  Yeah.
[54:21.520 --> 54:23.060]  The BlackBerry Priv is interesting.
[54:23.260 --> 54:24.840]  It has a lot of hardware security.
[54:26.200 --> 54:26.360]  Yeah.
[54:26.700 --> 54:27.060]  Uh...
[54:27.060 --> 54:28.080]  So what if, uh...
[54:28.080 --> 54:30.580]  They want your phone and you have crypto on it.
[54:31.060 --> 54:31.840]  And, uh...
[54:31.840 --> 54:33.080]  They're like, unlock your...
[54:33.080 --> 54:33.720]  Unlock your phone.
[54:33.900 --> 54:34.880]  And they just break it.
[54:35.440 --> 54:36.880]  What would happen if she's, like, cracked it?
[54:36.880 --> 54:41.460]  That depends on who they are, who you are, where you are.
[54:42.080 --> 54:42.280]  Yeah.
[54:42.840 --> 54:43.180]  Uh...
[54:43.180 --> 54:44.960]  In general, it depended...
[54:44.960 --> 54:48.080]  It might depend on who the actual person was on the other side of that.
[54:48.080 --> 54:49.060]  And how you did it.
[54:49.180 --> 54:49.620]  Like, if it...
[54:49.620 --> 54:53.460]  If your phone didn't work somehow when you handed it to them, it would probably be no big problem.
[54:53.840 --> 54:54.960]  But if you're like, f*ck you.
[54:55.220 --> 54:55.680]  Break the phone.
[54:56.360 --> 54:57.620]  Bad things will happen to you.
[54:57.900 --> 54:58.020]  The...
[54:58.020 --> 55:00.840]  The exact definition of what those bad things are, I don't know what they are.
[55:03.280 --> 55:03.640]  Um...
[55:03.640 --> 55:03.720]  Yeah.
[55:03.840 --> 55:04.040]  Uh...
[55:04.040 --> 55:04.300]  Two minutes.
[55:04.540 --> 55:05.080]  So one more question.
[55:06.080 --> 55:06.440]  Um...
[55:06.440 --> 55:07.400]  Multi-factor authentication.
[55:07.520 --> 55:08.260]  Does it work?
[55:08.660 --> 55:09.020]  Yes.
[55:09.220 --> 55:10.840]  Multi-factor authentication is...
[55:11.660 --> 55:13.580]  Maybe second to, uh...
[55:13.580 --> 55:14.320]  Automatic updates.
[55:14.480 --> 55:15.840]  It's an awesome thing in the U.S.
[55:16.960 --> 55:17.320]  Um...
[55:17.320 --> 55:22.820]  Multi-factor auth when you're using SMS and you're changing your SIMS fails for the obvious reason.
[55:23.800 --> 55:24.320]  Yeah.
[55:25.360 --> 55:25.880]  Um...
[55:25.880 --> 55:29.840]  Google Authenticator on your device or something like that, that's an actual client on your device works awesome.
[55:30.320 --> 55:30.700]  Um...
[55:30.700 --> 55:33.900]  The downside of that is those clients, unfortunately...
[55:33.900 --> 55:37.100]  Fortunately and unfortunately, don't persist through wipes of devices.
[55:37.360 --> 55:39.200]  So you have to usually reseed them with stuff.
[55:39.800 --> 55:40.200]  So...
[55:40.200 --> 55:45.440]  Unless you have a network way to do that, you're transporting the raw seed for, like, your HOTP stuff.
[55:46.240 --> 55:46.640]  Um...
[55:47.300 --> 55:47.700]  Hardware...
[55:47.700 --> 55:48.020]  Um...
[55:48.020 --> 55:50.340]  Tokens are the solution that I've always used for people for that.
[55:50.620 --> 55:54.380]  But those have a cost and they're bulky and you can only have, like, a fairly limited...
[55:54.380 --> 55:57.740]  It's okay to have one, but give somebody ten of them and they're gonna get really angry.
[56:08.780 --> 56:09.180]  Um...
[56:09.180 --> 56:09.860]  It's okay to have a network all the time.
[56:10.000 --> 56:15.760]  But when you're traveling and bouncing around between VPNs, that is the thing that kills the, like, are you secure logic on a lot of these websites.
[56:15.980 --> 56:18.600]  So using a consistent VPN actually helps you there.
[56:19.040 --> 56:19.240]  Yeah.
[56:19.800 --> 56:20.160]  Cool.
[56:20.340 --> 56:21.320]  Well, thank you very much.
[56:21.420 --> 56:22.880]  And now it's gonna be Q&A, I think.
[56:23.340 --> 56:23.880]  Or, uh...
[56:23.880 --> 56:24.280]  The open mic.
[56:40.900 --> 56:41.460]  Thanks, man.
[56:41.760 --> 56:42.280]  No problem.
[56:42.460 --> 56:42.620]  Thanks.
[56:43.360 --> 56:44.140]  Got a badge.
[56:44.280 --> 56:44.560]  Okay.
[56:44.800 --> 56:45.420]  Now we're good.
[56:47.320 --> 56:47.680]  Wait.
[56:47.840 --> 56:48.660]  Just everyone go up and sit.
[56:48.660 --> 56:48.680]  Um...
[56:48.680 --> 56:48.700]  accommodation is kind.
[56:48.700 --> 56:48.700]  Right?
[56:48.700 --> 56:48.720]  All right, now these.
[56:48.720 --> 56:48.760]  Can't you guess?
[56:48.760 --> 56:48.920]  Took their postz or have not remembered?
[56:48.960 --> 56:48.960]  Das aí it has them!
[56:48.960 --> 56:49.000]  No problem.
[56:49.040 --> 56:49.080]  Also...
[56:49.080 --> 56:49.140]  That's what Got his seat.
[56:49.180 --> 56:49.300]  On the Is that too chat?
[56:49.340 --> 56:49.380]  Phil Gospel at the vast.
[56:49.420 --> 56:49.500]  Okay.
[56:49.500 --> 56:49.500]  Not even...
[56:49.500 --> 56:49.500]  Please say!
[56:49.500 --> 56:49.500]  Yeah.