[00:01.300 --> 00:04.420]  Welcome to Building Resilient Cyber Defenses, but make it garden.
[00:04.620 --> 00:06.320]  I'm so excited that my slides are working.
[00:06.820 --> 00:10.420]  I had a slide mishap at DEF CON last week, so.
[00:11.260 --> 00:12.700]  My name is Yael Grauer.
[00:13.060 --> 00:16.700]  I work as a program manager of cybersecurity research at Consumer Reports.
[00:17.480 --> 00:32.480]  And you might know me from my work at Consumer Reports on Security Planner or from some of my reports, which we'll talk about a little bit later, or maybe some of my... I've done some investigative tech reporting outside of CR, and I maintain a data broker opt-out list to help people remove their address from people search.
[00:38.540 --> 00:41.800]  So one of the things I'll be doing in this talk, it's kind of an ambitious talk.
[00:41.960 --> 00:43.860]  We're going to be doing a lot in an hour, so buckle up.
[00:45.160 --> 00:54.200]  But I'm going to be describing... I'm going to be using gardening analogies to try to make digital security advice more accessible to people who might not resonate with military analogies.
[00:55.640 --> 00:59.840]  And I wanted to thank Crypto and Privacy Village at DEF CON for their theme this year, which was in the garden.
[01:00.440 --> 01:02.600]  And that is kind of what gave me the idea to do this.
[01:03.220 --> 01:09.320]  So it's been a really fun experiment to see which gardening analogies work when discussing cybersecurity and which don't.
[01:11.140 --> 01:13.700]  So a quick overview of what we're going to discuss.
[01:13.860 --> 01:14.680]  It's a lot.
[01:15.180 --> 01:21.620]  So we're going to start with what I just said about terminology, and I'm going to try to give you a framework for making security decisions.
[01:22.500 --> 01:27.860]  And I'm going to spend quite a bit of time on this, because I think understanding the concepts is the most important thing.
[01:29.760 --> 01:40.840]  Because advice is constantly changing, so you need to have some way to evaluate it and, like, think through the advice and understand if it applies to your specific situation or that of the person that you're trying to help.
[01:41.500 --> 01:46.160]  And I'm hoping this will be more approachable and easier to understand than some of the current language.
[01:46.980 --> 01:52.840]  So then after we do that, we're going to look at some digital security advice people have been repeating for as long as I can remember.
[01:53.560 --> 01:55.680]  And analyze when and whether it makes sense.
[01:57.120 --> 01:59.100]  And then we're going to use this new framework to do that.
[01:59.260 --> 02:02.620]  And then we'll do the same for some of the more viral advice, which is crowdsourced.
[02:02.780 --> 02:05.200]  I ask people, what viral security advice have you heard lately?
[02:06.820 --> 02:18.200]  And then we'll... I'll quickly show you the way we try to follow this framework in Security Planner, which is a free tool that gives you a customized digital security plan tailored to the individual and their devices.
[02:18.840 --> 02:29.200]  And then we'll talk about some of the limitations of digital security guidance and some other ways that CR works to try to work towards true transparency and fairness in the marketplace.
[02:31.140 --> 02:33.840]  So yes, cybersecurity basics, but make it garden.
[02:34.800 --> 02:36.760]  So again, we're going to start with a conceptual framework.
[02:37.020 --> 02:39.660]  But before we get into it, I do have a confession to make.
[02:40.140 --> 02:43.300]  I'm really good at growing vegetables, but I'm a serial houseplant killer.
[02:44.260 --> 02:46.840]  I have a really confusing monstera right now.
[02:47.080 --> 02:49.800]  Like, I guess it looks the same when you under and overwater it.
[02:51.420 --> 02:53.880]  So don't take houseplant advice from me.
[02:54.000 --> 02:57.820]  I would gladly take houseplant advice from you if you're good at monsteras.
[02:59.440 --> 03:05.940]  Okay, so one of the first things that you start to learn when you're starting to look into digital security is to think about your attack surface.
[03:06.740 --> 03:16.020]  So your unauthorized person is the attacker and all the different areas where they could try to enter or exfiltrate data or gain control of your device or whatever are attack vectors.
[03:16.500 --> 03:19.220]  And the sum of all these points is your attack surface.
[03:20.360 --> 03:28.920]  So, like, I think this is a military terminology where it's talking about vulnerabilities for military systems, infrastructure, personnel, etc.
[03:30.020 --> 03:33.640]  But I started trying to think about it as a garden analogy.
[03:34.960 --> 03:39.540]  Because if you have a garden plot, you're usually not that worried about things outside of your garden plot.
[03:40.260 --> 03:42.740]  If you're in a community garden, you're planning in your own plot.
[03:42.920 --> 03:45.380]  You're probably not planning in other people's plot.
[03:45.620 --> 03:48.900]  If you have a garden at home, you probably are ignoring your neighbor's garden.
[03:50.340 --> 03:55.820]  If you're worried about freezing temperatures and you need to cover up plants, you're going to do this in your plot and not just randomly.
[03:56.980 --> 03:57.880]  That would be weird.
[03:59.460 --> 04:02.460]  But the area you have to pay attention to can grow.
[04:03.400 --> 04:07.200]  Like, what if somebody asks you, like, can you keep an eye on my garden when I'm out of town for a week?
[04:07.380 --> 04:10.300]  Then you have twice as much garden surface area to look at.
[04:11.020 --> 04:13.780]  And then there's things that you might think are contained until they're not.
[04:13.780 --> 04:17.820]  Like, if there's an infestation of something that could, like, get into your garden.
[04:18.140 --> 04:20.820]  Or say you're in a community garden and a gate is damaged.
[04:21.220 --> 04:25.860]  Suddenly you're thinking of areas beyond what you originally thought you had to pay attention to.
[04:27.660 --> 04:36.800]  And then another term you hear early on when you start showing an interest in cybersecurity, which I think can be kind of annoying to people, is, like, people will be like, what is your threat model?
[04:38.440 --> 04:40.400]  And it's actually not even a military term.
[04:40.420 --> 04:42.640]  I think it came to us from Microsoft in 2004.
[04:45.200 --> 04:46.600]  And I'm not knocking it.
[04:46.780 --> 04:51.440]  But, like, for me it makes more sense to think about it in terms of gardening as a, you know, recovering hippie.
[04:52.720 --> 04:54.240]  Like, where are you vulnerable?
[04:54.240 --> 04:55.820]  What the relevant threats are?
[04:55.940 --> 04:56.960]  How likely they are to happen?
[04:57.280 --> 04:59.020]  Like, I don't usually think in that language.
[04:59.300 --> 05:01.540]  But I think about, like, what makes sense in my environment?
[05:01.560 --> 05:02.940]  What makes sense in my ecosystem?
[05:03.800 --> 05:06.120]  And that's when I think about, like, plant hardiness zones.
[05:08.160 --> 05:11.200]  Because if you are a gardener, like, I live in the desert.
[05:11.240 --> 05:14.080]  So people will tell me you should grow XYZ.
[05:14.260 --> 05:16.080]  But they live in a completely different state.
[05:16.200 --> 05:17.760]  And none of those plants would grow in the desert.
[05:19.100 --> 05:20.720]  And I can plant all winter.
[05:20.900 --> 05:25.880]  But if I tell somebody, like, you can garden all winter and they don't live in the desert, they probably can't garden all winter.
[05:27.060 --> 05:30.460]  And even just different parts of the state, like, can change.
[05:30.640 --> 05:34.420]  So you have to, like, put in your ZIP code and look in the USDA plant hardiness zone map.
[05:34.560 --> 05:37.960]  And it looks at, you know, annual temperature, rainfall, et cetera.
[05:37.960 --> 05:42.960]  So then you can look up your hardiness zone and get information on what plants grow in your region.
[05:43.180 --> 05:46.340]  And I think this is something that, like, tech people can learn from gardeners.
[05:46.700 --> 05:49.940]  Because people often give people advice that does not make sense for them.
[05:50.160 --> 05:53.000]  And it just doesn't...
[05:53.000 --> 05:53.920]  It just doesn't...
[05:53.920 --> 05:59.260]  Like, if you tell somebody, use Linux, and they can barely turn on their computer, like, they're not going to listen to you.
[06:00.280 --> 06:00.700]  So...
[06:01.300 --> 06:02.260]  People get very mad.
[06:02.320 --> 06:05.940]  I know somebody's going to ask a question about that afterwards and be very upset with me.
[06:06.720 --> 06:07.600]  But I don't know.
[06:07.700 --> 06:12.880]  If you are a person with memory issues, then maybe you do share your password manager password with your partner.
[06:13.140 --> 06:15.760]  But if you're in an abusive relationship, that's a really bad idea.
[06:16.220 --> 06:21.300]  So there's basically no one-size-fits-all solution for gardening, security, et cetera.
[06:22.860 --> 06:24.220]  And this thinks...
[06:24.220 --> 06:29.740]  Like, it looks a little bit at physical location, which can actually be applicable because there's different rules in different countries.
[06:30.480 --> 06:32.700]  But it also can be, like, circumstantial.
[06:32.700 --> 06:43.380]  So, like, somebody who is worried about identity theft has a different threat model than somebody who's being stalked versus somebody who, you know, is...
[06:43.380 --> 06:44.900]  There's just different circumstances.
[06:44.920 --> 06:48.920]  So there's a tendency to just kind of throw out tool recommendations of people.
[06:49.060 --> 06:49.540]  Use signal.
[06:49.700 --> 06:50.020]  Use tour.
[06:50.940 --> 06:52.560]  But not all tools work for all people.
[06:52.600 --> 06:53.880]  It's, like, very, very situational.
[06:54.440 --> 06:58.220]  So, like, if you are in Alaska and I tell you, you can grow veggies, I'll win her.
[06:58.320 --> 07:00.680]  You're going to look at me like I'm crazy because you can't.
[07:01.020 --> 07:01.340]  So...
[07:02.920 --> 07:03.240]  Okay.
[07:03.360 --> 07:05.500]  And then the next term I wanted to talk about is layered defense.
[07:06.500 --> 07:07.140]  Which is...
[07:07.520 --> 07:16.880]  And forgive me if you're in the military and this analogy is completely bonkers, but my understanding of it is that if there is an army invading you, you don't put all of your resources on the front line.
[07:16.880 --> 07:23.420]  You, like, put some resources on the front line and create multiple lines so that your enemy loses momentum over time.
[07:23.620 --> 07:27.740]  And there's a lot of war stories you can look up about that that probably explain it better than I do.
[07:28.760 --> 07:34.600]  And there's a lot of debate about, like, whether layered defense and defense in depth are the same terms or not.
[07:34.740 --> 07:37.800]  But we're going to just go with layered because I wanted to talk about soil layers.
[07:39.440 --> 07:39.880]  So...
[07:41.040 --> 07:41.480]  So...
[07:41.480 --> 07:41.880]  Yeah.
[07:42.020 --> 07:42.520]  But I do...
[07:42.520 --> 07:52.880]  My joke about defense in depth is always, like, if you are not dressed for work and you're on a video call, like, you want your camera off, you want tape on your camera, you want to face your laptop away from you.
[07:53.160 --> 07:56.320]  You want to do multiple things so that nobody knows you're wearing Mickey Mouse pajamas.
[07:56.620 --> 07:58.800]  Like, even if one of them fails, another thing will work.
[07:59.600 --> 08:02.860]  And that's, like, you know, obviously something in security, too.
[08:03.020 --> 08:03.540]  Like, you...
[08:03.540 --> 08:07.660]  Somebody somehow guesses your unique password, you're also using a YubiKey.
[08:09.460 --> 08:09.860]  And...
[08:09.860 --> 08:10.240]  Et cetera.
[08:10.600 --> 08:11.380]  Like, just...
[08:11.380 --> 08:13.640]  And then you also know how to recover.
[08:13.640 --> 08:14.880]  Like, I think...
[08:14.880 --> 08:16.960]  I've lost my wallet at a bar before.
[08:17.360 --> 08:19.080]  Raise your hand if you've lost your wallet.
[08:20.340 --> 08:23.380]  So now I have photocopies of everything in my wallet.
[08:23.560 --> 08:25.920]  So that if that happens again, I know what cards to cancel.
[08:26.620 --> 08:29.320]  So that's kind of another example of having a backup strategy.
[08:30.060 --> 08:37.080]  But I wanted to talk about garden layers because there's things that happen beneath the surface that people might not even think about that help your plant grow.
[08:38.560 --> 08:40.560]  And I don't know a ton about this.
[08:40.700 --> 08:45.460]  I know kind of vaguely there's, like, mineral, air, water, organic matter, things that are decaying.
[08:45.540 --> 08:51.480]  So, like, people usually focus on the top layer, which is your leaves and plants and bugs and et cetera.
[08:51.480 --> 08:53.560]  That's, like, the nutrient-rich top layer.
[08:53.780 --> 08:56.000]  But below that there's topsoil.
[08:56.820 --> 08:58.480]  There is subsoil.
[08:59.200 --> 09:05.160]  There's weathered rock fragments that can influence the drainage of your garden, the nutrients.
[09:05.160 --> 09:10.640]  And then below that there's, like, bedrock, basically unweathered rock.
[09:10.940 --> 09:16.580]  And I think about this for cybersecurity because having a better understanding of these layers can help you prep your garden.
[09:17.540 --> 09:20.940]  And it also depends, again, on where you are and what you're trying to do.
[09:21.840 --> 09:24.220]  And so, like, that can really support the growth of your plant.
[09:24.400 --> 09:37.400]  So when people talk about only a single layer and have, like, a short, snappy video as a solution to something, that might be really effective for some people, but other people, there's other things happening in these lower layers that you need to think about at the same time.
[09:37.840 --> 09:47.800]  And one example I think about is, like, a lot of times people come to me because they're worried about stalkerware and their devices because they're in a stalking or harassment situation.
[09:48.860 --> 09:55.260]  And it's, like, before you talk about stalkerware, you usually ask people, like, do you share accounts with this person?
[09:55.260 --> 09:59.660]  Are you talking to somebody that is friends with them and revealing information that they are getting?
[10:00.300 --> 10:00.820]  Like, et cetera.
[10:01.060 --> 10:09.880]  So there's, like, a lot of other things to think about before you start focusing on just technology, which it's easy to do if you understand it really well.
[10:10.280 --> 10:14.720]  And I think there's, like, a garden-themed joke about layered defense here somewhere.
[10:16.800 --> 10:17.440]  But, yeah.
[10:18.020 --> 10:27.420]  And then I had sun and water nutrients because we need, you know, healthy online communities to flourish, just like plants need sun and water and nutrients to thrive.
[10:29.100 --> 10:31.520]  So privacy and security by design.
[10:31.900 --> 10:32.660]  Content moderation.
[10:33.040 --> 10:33.920]  That's fair and transparent.
[10:34.480 --> 10:35.880]  Trust and safety teams.
[10:36.340 --> 10:38.220]  People planning for emerging threats.
[10:38.760 --> 10:41.640]  And you can have too much water and too much sun.
[10:41.640 --> 10:44.140]  It depends on the temperament of each plant or each community.
[10:44.380 --> 10:49.300]  But there's some basics that you have to put in place, which I think are pretty standard across the board.
[10:49.580 --> 10:52.560]  Like, they might operate a little differently, but the concepts are the same.
[10:53.640 --> 10:55.940]  And then your threat landscape is going to change.
[10:56.220 --> 11:01.300]  So if you look at the list of dangers in a given area, it's different depending on your environment or ecosystem.
[11:02.140 --> 11:04.080]  And this can be, like, a physical environment.
[11:04.080 --> 11:10.800]  Like, I live in the desert, so I worry about, you know, jumping cholla, cactus, scorpions, heatstroke, rattlesnakes, etc.
[11:11.680 --> 11:13.840]  Even the plants worry about storing water.
[11:14.480 --> 11:21.120]  But in Florida, you might still worry about heatstroke, but you're also worried about alligators or cottonmouth snakes or black widow spiders.
[11:21.900 --> 11:23.320]  And these can actually change.
[11:23.500 --> 11:27.020]  Like, even plant hardiness zones are changing slightly because of global climate change.
[11:27.980 --> 11:30.140]  And your environment and threats can change.
[11:30.320 --> 11:36.040]  And it's funny that I use the garden analogy, because I think this is also true from somebody moving from, like, a rural area to a city.
[11:37.160 --> 11:38.780]  There's just... and vice versa.
[11:38.780 --> 11:42.640]  There's just new things you have to kind of learn to understand.
[11:43.440 --> 11:51.020]  And then I think it's so much better to plan for and prevent things from happening than to try to clean them up afterwards.
[11:51.360 --> 11:56.800]  And the analogy I usually hear is people who get an alarm system for their home after it's already been broken into.
[11:57.600 --> 12:06.620]  But I also think about weed infestations, because it's so much easier to try to prevent them from happening, even if it's not entirely effective, than to not even think about it at all.
[12:06.620 --> 12:08.580]  And then you're trying to clean it up after the fact.
[12:11.560 --> 12:14.200]  And then preparing for specific situations and events.
[12:14.360 --> 12:18.420]  It's like... depending on your environment, it's like a whole thing.
[12:18.640 --> 12:20.960]  Like when you are like, oh my god, there's gonna be a freeze.
[12:20.960 --> 12:22.200]  I have to prepare for a freeze.
[12:22.700 --> 12:25.200]  I'm gonna harvest as much as I can before the freeze.
[12:25.220 --> 12:25.880]  I need to water.
[12:26.180 --> 12:30.340]  I need to cover my plants with frost cloth or fabric, but only at night.
[12:30.340 --> 12:33.820]  I have to wrap the young trees or shrubs with burlap.
[12:34.940 --> 12:38.720]  It's because you know there's gonna be a freeze, probably.
[12:39.460 --> 12:41.580]  And there's other similarities to this.
[12:41.680 --> 12:45.280]  Like say you're going to be at the border, or you're going to protest.
[12:45.620 --> 12:49.620]  Like how do you kind of prepare in advance for these scenarios?
[12:51.100 --> 12:54.200]  And I had to throw in the walled garden, open garden analogy.
[12:55.160 --> 13:00.260]  But I studied abroad in England for a year, and the gardens there are like so extremely manicured.
[13:00.840 --> 13:05.720]  And I've always been fascinated by the walled garden criticism of tech ecosystems.
[13:05.780 --> 13:09.660]  Because it's actually a garden analogy that's worked its way into cyber security.
[13:10.920 --> 13:19.760]  And it's usually about like a lack of transparency, or monopolistic practices, or data silos, or like flawed measurements, or limitations to data access.
[13:19.760 --> 13:26.880]  But I think there's actually situations where at least something similar to this type of approach can actually be helpful.
[13:26.880 --> 13:34.080]  Like if you're managing a fleet of computers for an organization that's at high risk, you might want more control over what's allowed on them.
[13:35.500 --> 13:39.240]  And then, of course, our beautiful open gardens that are not as regimented.
[13:41.360 --> 13:42.320]  They can be cool.
[13:42.440 --> 13:46.120]  You can also have gardens that are completely overgrown, and out of control, and abandoned.
[13:46.820 --> 13:49.500]  So I feel like it's kind of an ongoing discussion.
[13:49.500 --> 13:57.620]  Like how do you get transparency, cost effectiveness, diversity, while also dealing with fragmentation, and complexity, and all these other factors.
[13:59.720 --> 14:02.680]  And then this is a quote from Anne Lamont.
[14:02.840 --> 14:11.200]  So one of the hidden secrets in cyber security is that while there's a ton of certification, like it's not like medicine where you can face consequences for practicing without a license.
[14:11.620 --> 14:12.880]  Which I think is great.
[14:13.220 --> 14:16.920]  Like, but sometimes people pass along information they don't really understand.
[14:17.760 --> 14:22.840]  They're trying to be helpful, but you run the risk of just repeating things that don't make sense for an individual.
[14:24.120 --> 14:31.020]  And so I thought of this quote because it's like Anne Lamont who picked up a book on gardens and started writing gardens into her fiction.
[14:31.240 --> 14:34.200]  And suddenly everybody she met thought she was this amazing gardener.
[14:34.340 --> 14:37.460]  And she had to be like, wait, no, I don't actually know anything about gardening.
[14:40.880 --> 14:42.240]  Okay, so that was part one.
[14:42.300 --> 14:42.620]  Part two.
[14:42.700 --> 14:45.940]  I wanted to talk about like the sort of old school security advice.
[14:46.420 --> 14:49.820]  Because there is some advice that really hasn't changed over time.
[14:49.820 --> 14:49.840]  Okay.
[14:50.660 --> 14:53.940]  And these are actual screenshots from security planner.org.
[14:54.140 --> 14:55.420]  Which I'll talk about a little bit more later.
[14:56.380 --> 14:59.920]  This is one of the things you get tired of repeating to people if you work in cyber security.
[15:00.080 --> 15:01.280]  Like use a password manager.
[15:01.460 --> 15:03.480]  Generate unique passwords for each account.
[15:05.100 --> 15:09.040]  And I get tired of repeating it because I tell people to do it all the time and they usually don't.
[15:11.840 --> 15:14.400]  And I can see why they don't because it's actually like a lot of work.
[15:14.600 --> 15:16.000]  And that's just the first step.
[15:16.000 --> 15:18.040]  So I don't know.
[15:18.180 --> 15:22.600]  I don't want to say that people shouldn't do this because I hear back from those same people after their accounts are compromised.
[15:23.040 --> 15:24.540]  And I'm like, did you set up a password manager?
[15:24.700 --> 15:24.860]  Nope.
[15:27.320 --> 15:33.660]  But there's some scenarios where, like, people might have an easier time using a browser-based password manager.
[15:34.940 --> 15:40.660]  Like, there's like an ongoing debate about, like, should I tell my grandparents to use a notebook to write things down?
[15:40.920 --> 15:44.120]  Because otherwise they're just going to memorize it and it's going to be a bad password.
[15:45.000 --> 15:49.140]  And then there's companies trying to innovate with things like pass keys, though the rollout was a mess.
[15:51.000 --> 15:57.240]  But as far as advice goes, I feel like this is sort of time-tested advice that does apply to most people for now.
[15:59.300 --> 16:04.940]  And then, like, multi-factor authentication is another thing that everybody tells you to do that I do think most people should be doing.
[16:05.820 --> 16:08.100]  There's debate about security key advice.
[16:08.100 --> 16:08.880]  Like, because not...
[16:08.880 --> 16:10.020]  People don't want to buy...
[16:10.900 --> 16:13.660]  Most people don't want to buy things and carry them around.
[16:14.900 --> 16:22.240]  And there's, like, different gradations of risk for MFA, where SMS is the riskiest, and then emails and push notifications are slightly better.
[16:22.760 --> 16:27.180]  Having an MFA app like Authy on your phone is better than that, and a security key is the best.
[16:27.440 --> 16:32.000]  And I think this is advice that's pretty generic across the board, and I think it makes sense for everybody.
[16:32.520 --> 16:36.840]  And I have had people come to me, and, like, they were phished even though they had an MFA app.
[16:37.540 --> 16:40.340]  And I'm, like, should have gotten the YubiKey, but nobody wants to hear that.
[16:41.380 --> 16:45.020]  So hopefully, like, we'll improve past use so that this isn't an issue.
[16:45.240 --> 16:51.400]  But, yeah, this is, like, I feel like there's never going to be viral videos about this because it's just boring old advice that works.
[16:52.460 --> 16:52.840]  So...
[16:54.280 --> 17:08.660]  So right now it probably sounds like I'm going to say all generic and time-tested security advice is good and viral advice is bad, but, like, I want to point out that some viral advice used to be generic security advice until the industry changed and people just didn't update it.
[17:09.700 --> 17:14.460]  So this can kind of be a problem for when you memorize advice without having a framework to evaluate it.
[17:15.480 --> 17:21.400]  And I put, like, VPNs and AV software into the now viral category that used to be kind of time-tested advice.
[17:23.740 --> 17:25.020]  And, like, I don't know, I...
[17:27.300 --> 17:29.200]  Like, I feel like people tell...
[17:29.200 --> 17:35.020]  Well, we'll talk about this a little bit later, but, like, people tell you to use AV software or VPN because those are easy things to sell.
[17:35.120 --> 17:37.520]  But it doesn't mean it's actually going to help you with what you're trying to do.
[17:38.100 --> 17:39.060]  And people tell you...
[17:39.060 --> 17:42.360]  I really honestly, like, I don't mean to knock Linux users.
[17:42.460 --> 17:45.260]  I feel like this is a good form to give Linux users a hard time.
[17:45.260 --> 17:49.260]  Because, like, I wouldn't tell somebody to use...
[17:49.260 --> 17:51.860]  To get a Monstera if they're bad with houseplants.
[17:52.940 --> 17:57.780]  If somebody's, like, not good with computers, I wouldn't tell them to become a Linux user because they would give up anyway.
[17:59.040 --> 17:59.880]  So, yeah.
[18:00.160 --> 18:00.380]  I don't know.
[18:00.460 --> 18:01.000]  Just some examples.
[18:01.180 --> 18:03.320]  Or when you tell people, like, why don't you just go offline?
[18:03.560 --> 18:04.280]  That's not helpful.
[18:06.440 --> 18:06.840]  So...
[18:07.580 --> 18:08.820]  And then I...
[18:08.820 --> 18:12.840]  Tool-based security advice, I think, can be really useful, except that the tools change.
[18:13.960 --> 18:14.400]  So...
[18:14.400 --> 18:16.400]  And there's circumstances where it doesn't work.
[18:16.600 --> 18:20.420]  Like, I've had people send me signal messages from work phones that could be confiscated.
[18:21.020 --> 18:24.540]  And so, if they're sending me messages about their work, that's not a great idea.
[18:24.720 --> 18:29.440]  I mean, there's ways to kind of minimize your risk by having disappearing messages, et cetera.
[18:29.760 --> 18:33.280]  But, like, just using a tool can lower your risk.
[18:33.420 --> 18:34.440]  I use Signal every day.
[18:34.660 --> 18:37.180]  But, like, being aware of the limitations can be helpful.
[18:37.820 --> 18:44.740]  And also, like, obviously, if you use Signal, but nobody else you know does, then you're not really using it because you have nobody to communicate with on it.
[18:45.760 --> 18:47.500]  And then the context of it can change.
[18:47.700 --> 18:49.020]  So tools can become less effective.
[18:49.800 --> 18:56.160]  So, again, thinking about risks holistically makes it easier to figure out what to do and then find the best tool for the job.
[18:57.000 --> 18:59.040]  And this is other boring advice.
[19:00.360 --> 19:01.280]  I was going to...
[19:01.280 --> 19:05.560]  I was like, oh, I should put screenshots for updating from Security Planner, but we have so many.
[19:05.720 --> 19:10.960]  We have one for a MacBook and one for your PC and your Android phone and iPhone and on and on and on and on and on.
[19:11.320 --> 19:12.640]  But, yeah, this is good advice.
[19:12.780 --> 19:17.380]  I feel like this is something people should be doing before they do a lot of the things in viral videos.
[19:19.500 --> 19:21.280]  This is a little outdated.
[19:21.360 --> 19:25.320]  It's from 2015, but it's pretty interesting advice from...
[19:25.320 --> 19:37.400]  Or it's pretty interesting information from a Google study on expert and non-expert advice because of what people think about as experts and non-experts.
[19:37.620 --> 19:39.360]  Like, I thought this was really interesting.
[19:39.660 --> 19:43.760]  It's like, what do you think is a threat and what do you think of it?
[19:43.760 --> 19:46.380]  So I hope they do an updated version of this.
[19:47.980 --> 19:53.800]  But I did want to take a look at some of the tried and tested advice and compare it to some of the more recent advice.
[19:54.000 --> 19:55.160]  So, again, like, I crowd sourced this.
[19:55.300 --> 19:56.840]  I asked people, what advice are you hearing?
[19:56.980 --> 20:01.560]  And I got a lot of messages from people saying, like, oh, disable ad ID.
[20:01.680 --> 20:05.600]  And I get a lot of text about this where people ask me, like, should I disable ad ID on my phone?
[20:05.920 --> 20:07.720]  And I'm like, what do you need to be worried about?
[20:07.820 --> 20:09.640]  Like, what is your threat model?
[20:10.480 --> 20:14.260]  Are you worried about data brokers and advertisers tracking and following you?
[20:15.740 --> 20:18.840]  Do you not want a company to create a dossier of all of your locations?
[20:19.200 --> 20:21.440]  I mean, some people are posting those already on Instagram.
[20:22.960 --> 20:24.360]  But those are curated.
[20:24.520 --> 20:25.980]  And, of course, some people don't post that.
[20:26.140 --> 20:27.540]  So I don't think this is bad advice.
[20:28.760 --> 20:31.380]  It definitely makes sense for people who are privacy-minded.
[20:31.600 --> 20:33.640]  But I think some people think it stops all tracking.
[20:34.720 --> 20:37.720]  And I've also heard people give this advice to people that are worried about stalkers.
[20:38.340 --> 20:40.380]  And I'm like, that's not going to help you.
[20:40.460 --> 20:42.680]  You're not thinking about companies having your data right now.
[20:42.800 --> 20:45.200]  You should be thinking about your views are having your data right now.
[20:45.640 --> 20:47.680]  Are you sharing your Google Maps with them?
[20:48.080 --> 20:50.180]  Like, are you talking to somebody who knows them?
[20:51.080 --> 20:55.660]  Like, and then also people will sometimes tell them, like, you should disable this immediately.
[20:55.660 --> 21:00.020]  But sometimes that can be, like, actually harmful and put them at physical risk.
[21:00.240 --> 21:01.580]  So that's another thing to think through.
[21:02.240 --> 21:05.860]  Because sometimes people will just leave it on for that reason.
[21:08.160 --> 21:08.600]  Okay.
[21:08.620 --> 21:09.940]  This is another one I get a lot.
[21:10.060 --> 21:12.220]  Like, every week or two, I get...
[21:12.700 --> 21:14.500]  People are like, stop using signal.
[21:14.600 --> 21:15.340]  I heard it was an op.
[21:15.360 --> 21:16.060]  I read an article.
[21:18.160 --> 21:19.940]  And it's usually, like...
[21:19.940 --> 21:26.460]  I think this is because negative information spreads faster than positive information, even when the negative information is false.
[21:27.360 --> 21:34.280]  And most recently people were sending me an article that was critiquing salaries and funding sources for Signal.
[21:34.840 --> 21:38.380]  And then it made some, like, false claims about metadata being stored on their servers.
[21:38.640 --> 21:40.240]  And I'm like, yeah, that's not happening.
[21:41.340 --> 21:42.820]  And then a lot of people just say this.
[21:42.880 --> 21:43.700]  This is what gets me.
[21:43.880 --> 21:46.220]  Is that a lot of people were like, oh, I heard Signal was compromised.
[21:46.240 --> 21:47.900]  I switched to Telegram.
[21:49.880 --> 21:51.920]  I'm like, cool, you read a BS article.
[21:52.180 --> 21:53.680]  And now you're moving to something less secure.
[21:53.680 --> 21:57.920]  So I think this is an instance where tried and tested advice wins.
[21:58.140 --> 22:00.720]  Like, you might not like somebody getting paid industry wages.
[22:01.100 --> 22:04.840]  But that doesn't make end-to-end encrypted messages not end-to-end encrypted.
[22:05.240 --> 22:08.000]  So I think this is a viral advice people can ignore.
[22:09.620 --> 22:11.480]  And the third one I got is use of VPN.
[22:12.280 --> 22:14.560]  And I've actually written about this for almost a decade.
[22:14.800 --> 22:16.060]  So it's not exactly new advice.
[22:17.200 --> 22:21.760]  But it used to make a lot more sense before HTTPS was, like, almost everywhere.
[22:21.760 --> 22:24.920]  Like, so much of web traffic is encrypted using HTTPS.
[22:26.160 --> 22:27.500]  And I think people don't understand.
[22:27.640 --> 22:31.180]  This is another piece of advice that it's easy to just pay for something.
[22:31.860 --> 22:35.340]  And people don't understand how it works or what they're trying to do.
[22:35.500 --> 22:38.040]  They're just like, oh, I heard about another hack on NPR.
[22:38.300 --> 22:40.460]  And, you know, a YouTuber, like, mentioned a VPN.
[22:40.600 --> 22:41.140]  So I'm going to buy it.
[22:41.220 --> 22:41.780]  And then I'll be good.
[22:41.780 --> 22:45.440]  And there's so much that a VPN cannot defend against.
[22:45.680 --> 22:46.980]  Like, digital fingerprinting.
[22:47.660 --> 22:51.720]  In which apps and websites triangulate characteristics of a computer or phone.
[22:52.460 --> 22:54.800]  Such as, you know, your operating system model names.
[22:54.900 --> 22:56.720]  EFF has done some amazing work on this.
[22:57.700 --> 23:00.780]  But, yeah, they can, like, uniquely identify individual users.
[23:00.960 --> 23:02.040]  Also your screen resolution.
[23:04.260 --> 23:04.780]  GPS.
[23:04.780 --> 23:06.500]  The Wi-Fi you connect to.
[23:06.780 --> 23:07.860]  Cookies, pixels, et cetera.
[23:08.100 --> 23:10.260]  And also, like, some VPNs are really bad.
[23:11.080 --> 23:13.860]  Some of them make things way worse for privacy and security.
[23:15.460 --> 23:18.160]  And, yeah, I think this is one of the things that people talk about.
[23:18.300 --> 23:19.220]  Because it's easy to sell.
[23:19.400 --> 23:20.280]  But there's so many things.
[23:20.420 --> 23:22.540]  Like, this isn't even in my top ten of advice.
[23:22.700 --> 23:25.220]  I'm, like, use MFA.
[23:25.400 --> 23:26.740]  Use HTTPS only mode.
[23:26.900 --> 23:28.080]  Use privacy badger.
[23:28.260 --> 23:29.420]  Shout out to EFF again.
[23:29.900 --> 23:30.760]  Encrypt your laptop.
[23:30.960 --> 23:32.100]  Keep your software up to date.
[23:32.360 --> 23:34.440]  Like, and also it's so situational.
[23:34.440 --> 23:36.120]  Because it depends on what country you're in.
[23:36.760 --> 23:39.760]  And whether you're trying to engage in censorship circumvention.
[23:40.100 --> 23:41.720]  And, again, like, what VPN you use.
[23:41.940 --> 23:44.860]  So this is, like, again, like, very non-viral.
[23:44.940 --> 23:45.580]  It depends.
[23:45.800 --> 23:46.200]  Advice.
[23:48.640 --> 23:49.040]  Okay.
[23:49.080 --> 23:50.360]  I've been reading this a lot lately.
[23:50.540 --> 23:53.160]  People telling people to leave their phone at home at protests.
[23:53.640 --> 23:55.480]  And this is so situational.
[23:55.580 --> 23:59.220]  Like, that I think people would be better off looking at pros and cons.
[23:59.540 --> 24:02.760]  And, like, other options for people this doesn't work for.
[24:02.760 --> 24:05.840]  So, like, if you don't have your phone, you can't call your friends.
[24:05.840 --> 24:08.360]  You can't videotape police violence.
[24:08.640 --> 24:08.880]  You can't...
[24:09.780 --> 24:10.880]  There's some kind of emergency.
[24:11.500 --> 24:14.540]  You probably don't have another way to access information.
[24:14.860 --> 24:18.860]  I also laugh about navigation because I know a lot of people that wouldn't even get to the protest.
[24:21.940 --> 24:23.200]  If they couldn't...
[24:23.200 --> 24:24.660]  If they didn't have directions on their phone.
[24:25.520 --> 24:28.120]  But it does make it harder to track you digitally.
[24:28.360 --> 24:30.240]  So I'm not telling people not to use it.
[24:30.420 --> 24:36.620]  But I think, like, this hardline approach stops people from taking other steps to protect themselves when they do take their phone.
[24:36.760 --> 24:38.020]  Like, turn off biometrics.
[24:38.700 --> 24:39.980]  Because police can't require...
[24:39.980 --> 24:41.520]  They can require your password...
[24:41.520 --> 24:44.660]  They cannot require your password, but they can require biometric access.
[24:45.760 --> 24:46.400]  Airplane mode.
[24:46.620 --> 24:49.420]  Not posting your location in real time on social media.
[24:50.320 --> 24:51.980]  There's, like, a lot of different...
[24:51.980 --> 24:52.940]  There's just a lot of...
[24:52.940 --> 24:53.100]  I don't know.
[24:53.160 --> 24:56.680]  This is like when you go to a plant store and they ask you, like, do you have any pads?
[24:57.020 --> 24:58.040]  Do you have any allergies?
[24:59.020 --> 24:59.580]  Are you...
[24:59.580 --> 25:00.560]  How often are you around?
[25:00.660 --> 25:01.820]  Like, how good are you with plants?
[25:01.820 --> 25:04.580]  Like, so some people can get to a protest without a phone.
[25:05.260 --> 25:05.980]  No problem.
[25:06.300 --> 25:08.140]  Other people are going to get lost on their way to the car.
[25:08.380 --> 25:12.340]  Like, what are you planning on doing at the protest?
[25:12.460 --> 25:14.480]  Is another question that people might not ask you.
[25:15.800 --> 25:17.000]  What kind of protest is it?
[25:17.040 --> 25:18.040]  Who do you think might show up?
[25:18.160 --> 25:20.360]  Like, these are all just important questions to think through.
[25:21.160 --> 25:25.000]  And I've seen similar things where people are like, you should carry a border phone to obscure your identity.
[25:25.380 --> 25:27.620]  And I'm like, is it really going to obscure your identity?
[25:27.920 --> 25:30.420]  Or are people just going to know you have multiple accounts?
[25:30.420 --> 25:33.760]  Are you carrying both phones at the same time everywhere you go?
[25:34.060 --> 25:37.440]  Like, can you even afford another phone and maintain it at the same time?
[25:37.500 --> 25:39.180]  There's just so many, like, it depends.
[25:40.760 --> 25:41.480]  So, yeah.
[25:42.420 --> 25:45.280]  And then this is a tough one, the period tracking apps.
[25:45.880 --> 25:50.200]  This is something people started talking about a lot when Roe was overturned.
[25:50.320 --> 25:58.460]  People were suddenly very confused about these apps and whether they would be used to criminalize, missed or irregular periods or miscarriages, something like that.
[25:58.460 --> 26:03.140]  Or if you have an abortion in a state where it's legal and returned to a state where it's not.
[26:04.100 --> 26:06.540]  If you use medication for a self-managed abortion.
[26:06.820 --> 26:12.940]  And I feel like this is a really easy thing to write about because there are better choices for secure period tracking apps.
[26:13.100 --> 26:16.840]  And it's something people have control over at a time when so many people feel so helpless.
[26:18.140 --> 26:22.180]  But there's also no evidence of any investigations of people based on these apps.
[26:22.500 --> 26:28.200]  Like, the biggest threat that I've seen of criminalization is somebody reporting an individual to the police.
[26:28.960 --> 26:32.720]  Whether it's a hospital staffer or, like, a so-called friend.
[26:32.900 --> 26:35.020]  So, yeah, you can use apps to better protect your data.
[26:35.400 --> 26:36.180]  That's great.
[26:36.580 --> 26:43.260]  But as of right now, I don't think police are arresting people based on, like, an analysis of period data in a database.
[26:44.800 --> 26:49.280]  And the part where I think it could be harmful is if people stop using them all together.
[26:50.980 --> 26:52.600]  And, like, stop tracking their periods.
[26:52.720 --> 26:57.300]  Because sometimes it's really important to know, like, how pregnant you are if you do plan to travel to have an abortion.
[26:59.060 --> 27:04.460]  And there's a really good article about this called Fear, Uncertainty, and Period Trackers by Kendra Albert that I would recommend.
[27:05.200 --> 27:07.020]  I don't think this data is wrong.
[27:07.020 --> 27:08.840]  It doesn't hurt you to switch apps.
[27:08.840 --> 27:14.200]  But it could hurt you to stop tracking your period depending on state laws and your situation.
[27:15.720 --> 27:18.160]  And then AI training is another one I hear a lot about.
[27:18.520 --> 27:20.120]  And this one's still up in the air for me.
[27:20.300 --> 27:23.280]  Because I don't think a lot of companies offer meaningful opt-outs yet.
[27:24.040 --> 27:25.160]  It's kind of the wild west.
[27:25.340 --> 27:27.320]  So I'm still kind of forming my opinion about this.
[27:28.580 --> 27:32.280]  But I just am not convinced that a lot of these companies will do what they say they will.
[27:32.500 --> 27:34.580]  Especially if you're using a free version.
[27:34.580 --> 27:39.340]  And I don't know if there's any way to actually verify that your data is excluded from training.
[27:39.700 --> 27:46.140]  So, personally, I don't type anything I don't want to exist forever at an association with my name anywhere other than, like, Signal.
[27:46.720 --> 27:47.200]  So...
[27:47.820 --> 27:51.580]  And then covering your laptop camera, which is my joke about, you know, defense and depth.
[27:52.420 --> 27:58.320]  I don't know how many people, like, have remote attackers or malware that's going to access your device.
[27:58.320 --> 27:58.960]  And if...
[27:58.960 --> 28:02.500]  For me, if it did, I have bigger concerns.
[28:04.140 --> 28:08.140]  But I heard from a lot of people that were mad about this advice because they damaged their screens.
[28:08.440 --> 28:10.340]  Their automatic brightness got messaged.
[28:11.200 --> 28:13.100]  Like, turning this on and off was annoying.
[28:14.560 --> 28:15.000]  So...
[28:15.000 --> 28:15.900]  I don't think this is bad advice.
[28:16.020 --> 28:16.720]  It's just not my...
[28:16.720 --> 28:18.080]  It's not my top advice.
[28:18.880 --> 28:21.400]  I'm more worried about the cameras I can't see, personally.
[28:22.900 --> 28:24.320]  And then disable the microphones.
[28:24.320 --> 28:30.920]  The advice I've seen is to switch your default microphone to headset or external mic and turn it off when you're not using it.
[28:31.500 --> 28:34.260]  So if somebody's on my laptop and the microphone...
[28:34.260 --> 28:36.740]  Like, again, the microphone is not what I'm most concerned about.
[28:37.640 --> 28:42.700]  And I don't want to use an external headset because I'm on too many calls.
[28:42.920 --> 28:45.920]  But I'm not convinced that it can't be re-enabled.
[28:46.440 --> 28:47.200]  Like, I don't know.
[28:47.380 --> 28:47.820]  I just...
[28:47.820 --> 28:49.300]  I'm still kind of thinking this through.
[28:49.300 --> 28:56.940]  But I'm like, okay, somebody can get into my computer and, you know, switch my mic to re-recording.
[28:57.620 --> 28:59.840]  And if I disable it, this will stop them.
[28:59.940 --> 29:01.360]  And somehow they can't re-enable it.
[29:01.440 --> 29:01.900]  Like, I don't know.
[29:01.960 --> 29:02.800]  I just don't see it.
[29:04.380 --> 29:08.640]  So the premise of this talk was comparing viral new advice with tried and tested advice.
[29:08.660 --> 29:13.380]  But there's, like, not always a clear way to differentiate between them because things change over time.
[29:14.680 --> 29:15.520]  Like VPNs.
[29:16.280 --> 29:18.260]  Sometimes new vulnerabilities are introduced.
[29:18.580 --> 29:20.300]  So, like, your advice should change with it.
[29:20.440 --> 29:26.380]  But, like, a lot of new advice is delivered in a way that does not actually make sense for what people say it's for.
[29:26.880 --> 29:28.920]  So this is my shameless self-promotion.
[29:29.760 --> 29:39.400]  This is a free tool called Security Planner, which is how we try to tailor our digital security advice to individuals and their use cases without mentioning the military or gardening.
[29:40.380 --> 29:43.640]  And we inherited... Consumer Reports inherited it from Citizen Lab.
[29:43.640 --> 29:46.180]  And we start by asking people, what devices do you use?
[29:46.540 --> 29:51.240]  It's, like, extremely annoying to get instructions for how to lock down a device that you don't use.
[29:51.600 --> 29:52.640]  When you Google it.
[29:52.740 --> 29:53.560]  I've had this happen to me.
[29:53.700 --> 29:55.660]  And I'm like, why are these tips working?
[29:55.720 --> 29:56.900]  Because I'm not on this device.
[29:57.280 --> 29:58.080]  I hate that.
[29:59.220 --> 30:01.020]  And then we ask people what they're trying to do.
[30:01.220 --> 30:05.820]  So, again, like, if you're worried about online banking, that's different than being worried about harassment.
[30:05.820 --> 30:10.700]  Even though, like, you might be told to, you know, passwords and MFA for everything.
[30:10.980 --> 30:12.640]  But a lot of the advice is different.
[30:13.480 --> 30:21.020]  And then we ask people if any of the series of things apply to them to further kind of calculate what advice would make the most sense in which order.
[30:21.800 --> 30:25.020]  And then they get a digital security plan that's specific and personalized.
[30:25.680 --> 30:28.020]  And sometimes this plan is really long.
[30:29.240 --> 30:31.620]  And that's because of the ecosystem.
[30:32.420 --> 30:37.580]  Like, I wish we had a better ecosystem so that you wouldn't have to do so many things to secure your devices.
[30:38.200 --> 30:39.820]  And that's why we prioritize it.
[30:39.840 --> 30:45.180]  So, at least, if people can only do one thing, they get started on something that's tailored and personalized to them.
[30:46.400 --> 30:48.900]  But there's also a lot of things that security planner can't do.
[30:49.000 --> 30:50.160]  Like, we don't have a support desk.
[30:50.200 --> 30:51.940]  We don't answer individual questions.
[30:52.360 --> 31:09.520]  So, we try to tell people if you need to talk to a person or if you need, like, very specific advice, like, go to access now's digital security help line, go to the cyber civil rights initiative, crisis helpline, reproduction legal helpline, 988 or the Trevor project,
[31:09.860 --> 31:12.520]  which used to be part of 988 and now isn't, which is ridiculous.
[31:13.920 --> 31:15.460]  And Vida activa, et cetera.
[31:16.560 --> 31:19.320]  And then it's also, like, not super targeted advice.
[31:19.320 --> 31:24.340]  So, we link to 15 other guides that are more specific.
[31:24.780 --> 31:27.440]  Like, there's one just for documentary filmmakers.
[31:27.660 --> 31:29.280]  There's one just for abortion activists.
[31:30.080 --> 31:36.180]  And so, we link to, like, all the guides we can find that are up to date, which is actually very few of them.
[31:36.340 --> 31:37.300]  It's like, yeah.
[31:38.300 --> 31:40.760]  But this is just a small part of what Consumer Reports does.
[31:40.920 --> 31:43.900]  Because I feel like a lot of change needs to happen on the systemic level.
[31:43.900 --> 31:46.700]  So, again, going back to that layer analogy.
[31:47.380 --> 31:52.960]  And these are just some examples of projects I've worked on, which, again, are just a small sliver of what Consumer Reports works on.
[31:53.100 --> 31:55.500]  But I feel like I'm most equipped to answer questions about them.
[31:56.520 --> 31:59.840]  So, like, we've called out companies for memory unsafe devices.
[31:59.860 --> 32:00.660]  We've called out...
[32:00.660 --> 32:10.680]  We've called on companies to offer essential security features even for the free tiers or least expensive tier of their products to amplify work by Zadig security.
[32:11.720 --> 32:13.260]  And we're best known for our ratings.
[32:13.500 --> 32:15.460]  These are actually not full ratings projects.
[32:15.680 --> 32:21.880]  But we've evaluated products to see how their privacy and security claims stack up for VPNs.
[32:22.160 --> 32:26.480]  And alongside Tal Poppy with Victoria's in the audience.
[32:26.800 --> 32:29.840]  And Lee Honeywell, we looked at people search removal services.
[32:30.240 --> 32:31.360]  We got a bunch of volunteers.
[32:31.920 --> 32:34.960]  Signed them up for services and saw where their information was removed.
[32:35.180 --> 32:37.000]  And it didn't do as well as I thought it would.
[32:38.300 --> 32:40.560]  So, yeah, we actually work in a lot of different ways.
[32:40.800 --> 32:43.280]  Like, what makes sense for a situation?
[32:43.280 --> 32:46.440]  Is it helping consumers decide between products and services?
[32:47.460 --> 32:51.860]  Is it teaching them how to use it in a way that preserves their privacy and security?
[32:52.200 --> 32:55.480]  Is it working with lawmakers to create consumer-friendly policies?
[32:55.800 --> 32:58.080]  Do we need to call out companies that have room for improvement?
[32:58.640 --> 33:02.160]  We also have investigative journalists that expose harmful practices.
[33:02.160 --> 33:09.060]  So, all this is to say that the entire landscape is so much larger than just an individual changing a setting or buying a product.
[33:09.560 --> 33:12.280]  We need to, like, create a better ecosystem for everybody.
[33:12.500 --> 33:15.100]  And hold companies accountable when they drop the ball.
[33:15.240 --> 33:17.940]  Whether that's through legislation or public pressure campaigns.
[33:19.360 --> 33:21.980]  And these are my... I have room for questions.
[33:22.000 --> 33:24.360]  And you can follow me on the socials.
[33:35.460 --> 33:36.140]  All right.
[33:36.900 --> 33:40.260]  Taking questions and also if anybody has advice about houseplants.
[33:46.070 --> 33:46.810]  Sorry, I'm late.
[33:47.570 --> 33:48.630]  Thank you so much, yeah.
[33:49.710 --> 33:55.130]  As a reminder, for the folks who are asking questions on Matrix, please make sure you at tag me.
[33:55.550 --> 34:03.890]  We have two mics, so we can have two lines for questions, and I'll interrupt and intersperse folks with questions from Matrix as we get them.
[34:12.830 --> 34:13.310]  Hello.
[34:13.570 --> 34:15.350]  Thank you for your perspective on all this.
[34:17.190 --> 34:19.310]  I'm wondering about Consumer Reports themselves.
[34:19.590 --> 34:26.470]  Like, those of us who are older remember, like, the paper magazine that would tell you, you know, which brand of car was less safe or whatever.
[34:26.710 --> 34:37.290]  But how is the general support for work like yours at Consumer Reports regarding things like InfoSec data security and everything?
[34:38.470 --> 34:38.890]  Okay.
[34:39.170 --> 34:39.290]  Yeah.
[34:39.450 --> 34:40.170]  That's a great question.
[34:40.730 --> 34:41.790]  Thank you for your support.
[34:42.150 --> 34:47.430]  Now, we do have, like, the testing team does look at privacy and security of specific products.
[34:48.210 --> 34:57.070]  There was a digital standard that helped come up with, like, things we look for for privacy, security, ownership, et cetera.
[34:57.070 --> 35:05.510]  And I worked, actually, with a testing team on our VPN ratings, which was not full ratings because we only looked at privacy and security, but they were pretty great to work with.
[35:06.390 --> 35:07.010]  So, yeah.
[35:08.070 --> 35:10.090]  I get a lot of support, which is super cool.
[35:12.070 --> 35:14.950]  I have a question from the interwebs.
[35:15.990 --> 35:17.830]  Do you know any...
[35:17.830 --> 35:18.390]  Sorry.
[35:18.830 --> 35:19.250]  Starting over.
[35:19.530 --> 35:20.970]  Do you know any...
[35:21.610 --> 35:25.430]  Do you know of any data about the prevalence of stalkerware?
[35:25.430 --> 35:38.430]  I'm eager to use cyber skills to help in areas of domestic violence and would happily deploy lightweight IDS slash NSM detectors like spy guard for nearby shelters.
[35:39.030 --> 35:44.810]  But web searches yield little data to show it's a problem they should consider assessing or addressing.
[35:45.170 --> 35:45.370]  Thanks.
[35:45.370 --> 35:46.250]  Interesting.
[35:46.770 --> 35:53.750]  So, for stalkerware, we have an article on consumer reports and we have a page in security planner, but it's not...
[35:54.250 --> 36:00.950]  It mostly talks about AV software that has been shown to find the most popular forms of stalkerware.
[36:01.350 --> 36:05.950]  And, actually, we worked really closely with Eva Galpern at EFF who, like, helped with those evaluations.
[36:07.370 --> 36:09.070]  But, yeah, I don't know much about...
[36:09.070 --> 36:14.770]  Like, mostly it's less just teaching people, like, here is what you need to worry about if you're worried about stalkerware.
[36:14.770 --> 36:16.390]  And a lot of it is not technical at all.
[36:17.210 --> 36:21.750]  And then if they do think they have it on their device, we tell them, like, here's how to find it.
[36:21.850 --> 36:25.230]  And then also, like, to talk through...
[36:25.230 --> 36:30.550]  Like, to think through, like, what happens if I remove this from my phone?
[36:30.550 --> 36:33.570]  Is that going to make my situation better or worse?
[36:33.650 --> 36:40.610]  And that's, like, the target of it is kind of best positioned to know what they should do.
[36:40.610 --> 36:46.830]  Because I feel like sometimes there's a lot of pressure from tech people to, like, take this off right away, which can actually put somebody at more risk.
[36:46.990 --> 36:49.230]  So, yeah, I learned a lot about this from Eva, actually.
[36:49.670 --> 36:53.690]  And hopefully we'll be able to update that soon as they evaluate more AV software.
[36:53.870 --> 36:55.710]  But, yeah, I wish I knew more technically about it.
[36:55.790 --> 36:58.130]  But I don't think I can answer that question fully.
[36:58.470 --> 36:59.410]  So, sorry.
[37:01.650 --> 37:02.770]  There's some...
[37:05.270 --> 37:20.150]  There's some really egregious advertising for VPNs, particularly with sponsorships and stuff like that, where they say things that everyone in this room, and a lot of people outside this room, could very clearly see as being very, very, very wrong.
[37:22.150 --> 37:22.690]  Yeah.
[37:22.810 --> 37:25.150]  Is there anything that...
[37:25.830 --> 37:29.970]  Are there any agencies or any groups that are trying to combat that?
[37:30.210 --> 37:32.550]  Or, like, that's kind of what you're doing?
[37:33.170 --> 37:35.250]  Yeah, we did a...
[37:35.250 --> 37:42.030]  Yeah, no, you're absolutely right that there's a lot of VPN advertising that is hyperbolic or misleading, potentially misleading.
[37:42.770 --> 37:43.750]  Yeah, and that's...
[37:43.750 --> 37:52.870]  We actually did a white paper on this, and we, like, wrote up the language that we thought could be potentially misleading, and then got responses from all the VPN providers about it.
[37:53.070 --> 37:58.230]  But, yeah, I think a lot of this is education, because it's, like, a lot of people are using VPNs because they don't know what they do.
[37:59.030 --> 38:05.790]  And so either they're paying for a level of privacy and security that they're not actually getting, or that they already have through HTTPS.
[38:06.050 --> 38:07.910]  And it's, like, yeah, it's horrifying.
[38:08.550 --> 38:18.250]  And there's one thing, there's a...I came up with a concept at one point for a 2FA method that could mitigate most phishing risks.
[38:18.290 --> 38:19.990]  So I'd love to run that by you afterwards.
[38:20.290 --> 38:21.310]  Oh, yeah, sure, that'd be great.
[38:23.130 --> 38:27.290]  I apologize, I have another question from the Internet, but this one's a little long, and my eyes are made of garbage.
[38:27.490 --> 38:29.250]  So it's going to take me a couple of goes, I apologize.
[38:30.150 --> 38:35.270]  So the question is, tied into the whole...excuse me, my microphone.
[38:35.710 --> 38:39.350]  Tied into the whole leave your phone at home topic.
[38:39.550 --> 38:45.670]  The argument I usually hear for that is it still talks to cell towers even when turned off.
[38:45.810 --> 38:46.070]  Yeah.
[38:46.530 --> 38:48.590]  And that reason seems flawed.
[38:48.830 --> 38:55.290]  I'm not a hardware expert, but I'd imagine communication with cell towers would still require power.
[38:55.290 --> 39:03.290]  Is the idea that your phone is still tracking you, even if it's off, unless you put it in a Faraday bag, actually true?
[39:07.910 --> 39:13.890]  I mean, I...like a Faraday bag or leaving at home, if you were absolutely worried about being tracked, is the best bet.
[39:14.930 --> 39:22.130]  I just think people need to think through, like...I don't know, I get frustrated with this, because then I see people post pictures publicly of these protests.
[39:22.310 --> 39:24.490]  And I'm like, why did you...I don't know.
[39:25.290 --> 39:37.650]  It's not an easy answer to that question, but like...and yeah, if you're trying to not be traceable at all, then yeah, you want to...like...I can see why people do it, I guess, is my answer.
[39:41.470 --> 39:52.390]  So from the consumer point of view, is there a role for Consumer Reports in pushing back a little bit against the online companies in the same way that, yes, wear seat belts, but you also test car safety.
[39:52.530 --> 40:00.670]  And that many companies still to this day insist on using password rules that NIST have said, do not do it.
[40:00.810 --> 40:06.410]  I interviewed some of the people involved in the original NIST device, and they used the word encoded folklore when they were coming up with it.
[40:06.410 --> 40:11.550]  And you should not, you know, insist on using special characters, you should not expire passwords.
[40:11.770 --> 40:15.710]  And even at some companies I've talked to, they said, well, you have to be PCI compliant.
[40:16.070 --> 40:21.490]  So the PCI guidelines, look, have these rules which are now really kind of in opposition to NIST.
[40:21.710 --> 40:29.830]  Like in the same way that the Consumer Reports says, well, you...we buy this, we disable Facebook, your rules are not very good, so you get a ding on that.
[40:29.830 --> 40:33.930]  You know, national...you know, government even websites don't always follow the best advice.
[40:34.230 --> 40:34.270]  Yeah.
[40:34.410 --> 40:42.510]  And so we're trying to follow the good password advice, but we can't because the sites physically will not let us, in some cases by very explicit policy.
[40:42.830 --> 40:49.970]  And then maybe there's a way to publicly highlight who's doing a good job, who's obeying the curtain NIST advice, and who's back in the early 2000s.
[40:49.970 --> 41:03.810]  Yeah, I think, like, for CR, we're more likely to call out companies if they won't allow you to set good passwords, or won't allow, like, won't require you, won't allow or require things like MFA, than to say, like, it's annoying that you make us reset passwords,
[41:04.370 --> 41:06.870]  which you don't actually have to do according to NIST guidelines.
[41:07.210 --> 41:09.950]  But luckily, if you use a password manager, it's a lot quicker and easier.
[41:10.830 --> 41:14.270]  But yeah, I don't think we've actually called them out for that yet.
[41:17.090 --> 41:17.490]  Hi.
[41:18.410 --> 41:19.850]  I really like the garden analogy.
[41:20.190 --> 41:23.550]  That is, it, like, helps lock in a couple things for me, certainly.
[41:24.530 --> 41:31.850]  One of the things that I was curious about is, is there, like, are, like, security planner is, like, a really great tool.
[41:32.030 --> 41:34.570]  And it's something that, like, I'm excited to push friends to.
[41:35.570 --> 41:40.370]  But are there places to, like, test, like, how well your methods are working?
[41:40.370 --> 41:45.730]  Like, almost a way to, like, go outside and try to peek in.
[41:46.030 --> 41:51.770]  Or is there, like, good places to look for, like, where our data might have been compromised already?
[41:52.810 --> 41:56.290]  If you want to see where data has been compromised, I recommend Have I Been Home?
[41:57.270 --> 42:01.330]  Which is awesome for just seeing where your data has been compromised.
[42:01.330 --> 42:05.650]  And, like, if you have access to those accounts, like, if you're not using them, close them.
[42:05.650 --> 42:07.950]  If you are using them, change your password if you haven't already.
[42:09.330 --> 42:12.630]  But, yeah, I don't know, like, that's kind of, I feel like that's more like pen testing.
[42:12.790 --> 42:14.710]  I don't know anybody who does that for individuals.
[42:16.750 --> 42:19.350]  Except for, like, doxing, like, looking up your address.
[42:19.590 --> 42:22.710]  This is, like, not a CR project, but the data broker opt-out list that I run.
[42:23.870 --> 42:29.630]  Like, it'll give you a list of places you can check to see if your address is there and get it removed.
[42:31.590 --> 42:34.510]  Yeah, but not, I don't think exactly like what you're saying.
[42:35.150 --> 42:35.250]  Yeah.
[42:35.710 --> 42:36.390]  Also makes sense.
[42:36.390 --> 42:36.830]  Yeah.
[42:37.290 --> 42:40.710]  And it's actually really annoying because, like, you have, this is, like, a full-time job.
[42:40.710 --> 42:43.810]  And, like, like, I still find my address crop up places.
[42:43.810 --> 42:45.450]  And I've been removing it for years.
[42:45.450 --> 42:46.510]  And it's very annoying.
[42:46.770 --> 42:49.330]  So it's, like, we need, like, policy changes, I think.
[42:52.540 --> 42:55.040]  Thank you for the very educational talk.
[42:55.520 --> 42:58.240]  For full transparency, I work in threat intelligence.
[42:58.540 --> 43:06.420]  I've been a little disappointed in just in general that I haven't really heard anyone talk about threat intelligence in any of the talks I've been in so far.
[43:06.420 --> 43:10.800]  But I think it would be kind of a cool analogy with the garden.
[43:12.190 --> 43:26.900]  The whole garden analogy and ecosystem is thinking about threat actors as pests and how frequently you don't see the, you know, the results of it until you have, like, an infestation and stuff like that.
[43:26.900 --> 43:40.160]  But really, again, more seriously thinking about what are the threats, not just, like, your footprint, but also who's more likely to be targeting you?
[43:40.160 --> 43:42.080]  Is it a nation state actor?
[43:42.300 --> 43:45.400]  Is it your own country or government?
[43:45.660 --> 43:47.420]  Is it a criminal threat actor?
[43:47.880 --> 43:48.240]  Is it?
[43:48.380 --> 43:58.960]  And so I think that's something that could be very useful for deciding what to prioritize and how to prioritize it.
[43:58.960 --> 44:01.400]  I think we try to do that a lot, a little bit with this.
[44:01.560 --> 44:06.400]  But if there's ways we could do it, like, I'm definitely open to suggestions if there's ways we could describe it better.
[44:06.520 --> 44:10.280]  But we try to kind of get at this by asking people, do any of these apply to you?
[44:10.380 --> 44:12.140]  And, but yeah, I don't know.
[44:12.200 --> 44:12.640]  It's evolving.
[44:12.800 --> 44:20.300]  And if people want to get involved, like, we have a friends of security planner list where we, like, get suggestions for people on what to change and improve.
[44:21.080 --> 44:23.820]  So definitely open to suggestions there.
[44:28.280 --> 44:37.360]  While we wait for anybody else who might have any questions, did you have a slide that has your contact info that people could use if they wanted to reach out?
[44:37.820 --> 44:38.080]  Yeah.
[44:38.640 --> 44:39.140]  It's right here.
[44:39.720 --> 44:43.420]  It's actually my personal email because, yeah.
[44:43.700 --> 44:47.980]  But I have a, I have a CR one too, which is just, yeah, l.grower at consumer.org.
[44:48.540 --> 44:51.680]  Do you want to try and edit your slide real quick so that it's your personal email?
[44:51.780 --> 44:51.800]  I could.
[44:51.800 --> 44:53.840]  Actually, I don't know if I can because it's...
[44:53.840 --> 44:54.500]  I'm sorry.
[44:54.600 --> 44:56.380]  I'm just joking with you about the person.
[44:57.380 --> 44:57.980]  All right.
[44:59.660 --> 45:02.260]  But I, I can post it on one of these accounts.
[45:02.700 --> 45:03.040]  Cool.
[45:03.900 --> 45:04.280]  Thank you so much.
[45:04.280 --> 45:05.400]  People usually ask for the opposite.
[45:05.600 --> 45:07.040]  They'll be like, I want your personal email.
[45:08.060 --> 45:08.940]  I bet they do.
[45:09.800 --> 45:10.440]  Yes, please.
[45:12.020 --> 45:13.140]  Thank you for the talk.
[45:13.280 --> 45:14.180]  Much appreciated.
[45:15.080 --> 45:15.880]  Love the work.
[45:16.180 --> 45:16.540]  Big fan.
[45:16.540 --> 45:28.700]  My question is whether you, you've coordinated with the Mozilla campaign to raise awareness of the privacy issues in car.
[45:28.700 --> 45:37.220]  And as car are becoming more and more automated, we have more remote access to some really outrageous privacy practices.
[45:37.520 --> 45:41.880]  And I kind of imagine I would love customer report to have a section about this car.
[45:42.200 --> 45:43.200]  Yes, it's safe.
[45:43.220 --> 45:44.200]  It has airbags.
[45:44.360 --> 45:47.020]  And then how are the privacy practices of itself for?
[45:47.720 --> 45:49.140]  Yeah, no, that's a really good question.
[45:49.380 --> 45:53.540]  I don't, I know we've looked at it, but I don't think we've done any projects around it.
[45:53.620 --> 45:56.180]  I'd have to like go back and look that up because I'm not on that team.
[45:57.060 --> 46:03.120]  I know like it's old, but I am the cavalry did some work on this about like these, this is what we expect from car devices.
[46:03.340 --> 46:06.280]  Like these are ways you can secure this.
[46:07.720 --> 46:09.500]  But yeah, and it's definitely important work.
[46:10.800 --> 46:11.180]  Thank you.
[46:11.940 --> 46:12.680]  Yeah, thank you.
[46:14.240 --> 46:16.280]  Oh my God, I love your bikini kill shirt.
[46:16.960 --> 46:17.720]  Thank you.
[46:17.800 --> 46:20.420]  And thank you for the talk and especially for the gardening analogies.
[46:20.620 --> 46:29.160]  It's, I think it's really good to move beyond a lot of the military industrial complex language that pervades cyber security.
[46:29.600 --> 46:35.760]  Um, especially stuff like cyber kill chain, roll my eyes.
[46:36.280 --> 46:40.820]  Um, but a quick question about, um, one security tool.
[46:40.820 --> 46:43.260]  Uh, email randomizers.
[46:44.040 --> 46:48.780]  And whether or not that's something that, uh, what's your verdict on that?
[46:48.940 --> 46:52.480]  And whether or not they're useful, uh, to give people as advice.
[46:52.680 --> 46:54.500]  Wait, can you tell me what they are so I know?
[46:55.280 --> 46:59.580]  So, uh, I think the biggest one is iCloud plus has a hide my email feature.
[46:59.840 --> 47:05.020]  That allows you to randomly generate an email address that allows, that forwards to your actual email address.
[47:05.260 --> 47:05.700]  Right, yeah.
[47:05.700 --> 47:13.720]  So it's a way to, like, hide your email address and prevent it from being, you know, around in different databases that might get breached.
[47:13.900 --> 47:16.960]  Yeah, I've used those, uh, I think I used, like, Apine Blur.
[47:17.180 --> 47:19.260]  Like, God, ages ago I used something like that.
[47:19.660 --> 47:21.100]  Yeah, I mean, I think those are cool.
[47:21.200 --> 47:25.480]  Like, it, I, I like the ones where you can tell who sold your email.
[47:26.540 --> 47:32.440]  Uh, but I have noticed that when people try to opt out of things, they end up inadvertently linking all of their accounts.
[47:32.440 --> 47:36.220]  When they're like, oh, I wanna, here's all the things that I've used that are linked to me.
[47:36.940 --> 47:39.800]  Um, so, yeah, this is complicated.
[47:40.860 --> 47:45.840]  Um, yeah, I have used those and then I'm like, I can't get into my account because I didn't save this properly.
[47:46.360 --> 47:46.580]  Yeah.
[47:47.580 --> 47:53.280]  The one thing I think they're useful for outside of security is signing up for, like, oh, your new signups get a discount.
[47:53.680 --> 47:54.020]  Right, yeah.
[47:54.020 --> 47:55.460]  You just keep doing that over and over again.
[47:55.960 --> 48:04.700]  I think somebody signed up for, um, uh, a list that I run and they were using their, like, like, they had a little hyphen and said that it was associated with the list.
[48:04.860 --> 48:07.500]  And I was like, do they think I'm gonna sell their email address?
[48:07.680 --> 48:08.720]  I would never do that.
[48:10.440 --> 48:11.240]  But, yeah.
[48:11.720 --> 48:18.560]  But, yeah, it is a good way to track where you're, like, who's selling your address to who, um, because they have that modifier.
[48:19.360 --> 48:20.020]  All right.
[48:20.180 --> 48:21.900]  I have one last question for you before we wrap.
[48:22.260 --> 48:29.720]  Um, do you have a resource, uh, do you have resource recommendations for those who are considering more, uh, adept technique?
[48:30.680 --> 48:31.500]  Oh, goodness.
[48:31.740 --> 48:37.000]  Uh, for those who are considered more technically adept and who end up doing technical support for family and friends?
[48:37.580 --> 48:42.420]  Uh, um, like, more technical resources than security planner?
[48:43.140 --> 48:44.240]  Uh, EFF, probably.
[48:45.660 --> 48:48.900]  Um, yeah, that's a good question.
[48:49.720 --> 48:55.120]  Um, when, if it's, like, um, friends and family, I don't know for sure.
[48:55.260 --> 49:00.200]  But, like, I send people to the Access Now digital helpline a lot when they're, like, worried about things in other countries.
[49:00.200 --> 49:06.840]  Because I'm like, oh, yeah, I'm not, they have lawyers who are familiar with laws in all these, like, countries that I have no idea what is going on.
[49:07.040 --> 49:08.780]  And they can get very technical.
[49:09.260 --> 49:12.840]  Um, so, yeah, I can, it depends on the, on the situation.
[49:13.860 --> 49:14.440]  But, yeah.
[49:15.640 --> 49:18.600]  I, I, I guess that's a good thing to end on, is it depends.
[49:20.340 --> 49:21.320]  Well, thank you very much.
[49:21.320 --> 49:21.800]  Thank you very much.
[49:24.020 --> 49:24.900]  Thank you.