Security Now 1071: Bucketsquatting

Leo Laporte takes to the expo floor at RSAC 2026 in San Francisco's Moscone Center for a rapid-fire series of conversations with leading security vendors and thinkers. From Thinkst Canary's honeypot deception tactics to Bitwarden's new Agent Access SDK, Tailscale's AI gateway, and Aikido Security's fully autonomous AI pen testers, the dominant theme is clear: the AI agent era has arrived and security hasn't caught up. Plus, a surprise meeting with WannaCry kill-switch hero Marcus Hutchins. Thinkst Canary, ThreatLocker, and Bitwarden are sponsors of the TWiT.tv Network. 0:29 Haroon Meer | Thinkst Canary – Honeypots & Deception Tech 6:35 Bob Boyle | Torq – AI-Powered Security Automation 9:50 Juan Quesada | Yubico – FIDO2, Passkeys & Pre-Registered YubiKeys 12:33 Rob Allen | ThreatLocker – Zero Trust & Deny by Default 25:53 Arun Singh | Drata – Trust Management & Compliance 27:34 Jelmer Snoeck | Keycard Labs – Ephemeral Tokens for AI Agents 35:26 Kasey Babcock | Bitwarden – Agent Access SDK 41:52 Roeland Delrue | Aikido Security – Autonomous AI Pen Testing 48:56 Bill Keeler | Semperis – Identity Security & "Midnight in the War Room" 52:08 MalwareTech Marcus Hutchins & Cybersecurity Girl Caitlin Sarian 54:30 Chris Hughes | Zenity – Securing AI Agents at Runtime 1:01:35 Jillian Murphy | Tailscale – Networking, Aperture & Free Forever Host: Leo Laporte Guests: Haroon Meer, Rob Allen, Bob Boyle, Juan Quesada, Arun Signh, Kasey Babcock, Roeland Delrue, Bill Keeler, Marcus Hutchins, Caitlin Sarian, Chris Hughes, and Jillian Murphy Download or subscribe to TWiT Events at https://twit.tv/shows/twit-events. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Dan Moren joins Mikah Sargent on Tech News Weekly! Rumors of iOS 27 are slowly making the rounds, with Apple's planned AI reboot. A look inside the lawsuit between Halide co-founders. The US just banned consumer routers made outside of the US. And NASA unveiled its initiatives to return back to the Moon. Dan talks about the rumors of iOS 27 and Apple's planned AI refresh, alongside a new "Ask Siri" feature, that will be part of the unveiling of iOS 27 & macOS 27 at Apple's Worldwide Developer Conference later in June. Mikah goes a bit deeper into the lawsuit that Lux co-founder Ben Sandofsky brought against Sebastiaan de With over financial misconduct and bringing source code with them over to Apple. Sean Hollister of The Verge joins the show to talk about the US's ban on imports of new foreign-made consumer routers and explains what the ban is seeking to do. And Mikah explains NASA's initiatives and plans to return to the Moon, and what NASA plans to do once they return. Hosts: Mikah Sargent and Dan Moren Guest: Sean Hollister Download or subscribe to Tech News Weekly at https://twit.tv/shows/tech-news-weekly. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: hoxhunt.com/securitynow threatlocker.com/twit Melissa.com/twit

Each year, Sony announces its new audio and video products in the Spring, not at CES like most manufacturers. The 2026 crop of products is mostly audio, including two new soundbars, three new subwoofers, and a pair of surround satellites, along with one new TV. Scott Wilkinson reveals all in this episode. Host: Scott Wilkinson Download or subscribe to Home Theater Geeks at https://twit.tv/shows/home-theater-geeks Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Club TWiT members can discuss this episode and leave feedback in the Club TWiT Discord.

Win11 Debloat just got a major upgrade with a slick new GUI, making it easier than ever to clean up your Windows 11 without wrestling with command line scripts. Host: Paul Thurrott Download or subscribe to Hands-On Windows at https://twit.tv/shows/hands-on-windows Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Club TWiT members can discuss this episode and leave feedback in the Club TWiT Discord. Sponsor: canary.tools/twit - use code: TWIT

Is Apple's Passwords app a true contender for your digital life, or does it fall short for tech-savvy households? Find out how it stacks up against premium managers and where it still leaves power users wanting more. How shared password groups work in the Passwords app Step-by-step walkthrough: creating and managing shared groups Apple Passwords sharing vs. third-party apps like 1Password, Bitwarden (TWiT sponsor) Wi-Fi password management and sharing via QR codes Passwords app limitations: organization, secure notes, file storage, platform support Migration challenges from other password managers Travel needs and sensitive data: third-party travel mode vs. Passwords app Who should use Apple's Passwords app and who needs more advanced tools Hybrid approaches: combining Apple Passwords with third-party managers Host: Mikah Sargent Download or subscribe to Hands-On Apple at https://twit.tv/shows/hands-on-apple Want access to the ad-free audio and video and exclusive features? Become a member of Club TWiT today! https://twit.tv/clubtwit Club TWiT members can discuss this episode and leave feedback in the Club TWiT Discord. Sponsor: threatlocker.com/twit

This week, the hosts get hands-on with their favorite "chill" apps and say why subtle design choices, like haptic feedback and story-driven gameplay, make all the difference in truly relaxing tech. Hear which picks have earned their spot as go-to digital escapes. Pigment and Lake: Adult coloring book apps for iPad Coloring ASMR app for quick relaxation on the go Loner: Minimalist zen flying game with soothing visuals Satisgame: Quick, tactile puzzle app with haptic feedback Apple's sound therapy music and ambient background sounds Dark Noise and background sound customization for relaxation Flow Free+ game for puzzle-based relaxation App Cap: Marble Sort app for satisfying gameplay Hosts: Mikah Sargent and Rosemary Orchard Contact iOS Today at [email protected]. Download or subscribe to iOS Today at https://twit.tv/shows/ios-today Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Club TWiT members can discuss this episode and leave feedback in the Club TWiT Discord.

Tech journalist Marshall Kirkpatrick joins the panel to showcase a new AI-powered tool that doesn't just summarize articles—it thinks like a journalist, flagging what's truly new and revealing the patterns that matter. If you want to stay several steps ahead in the AI race, this episode is a must-listen. Malware autodownloaded by AI agents Meta loses trial after arguing child exploitation was "inevitable" on its apps We're saying goodbye to the Sora app. To everyone who created with Sora, shared it, and built community around it: thank you. What you made with Sora mattered, and we know this news is disappointing. TurboQuant: Redefining AI efficiency with extreme compression Apple Can 'Distill' Google's Big Gemini Model Apple Plans AI Reboot With Siri App, New Look and 'Ask Siri' Button in iOS 27 Google Search referrals to the web have plummeted, AI links are 'less than 1%' of traffic A US appeals court puts on hold an earlier ruling that had blocked Perplexity from using its agentic shopping tool to shop on Amazon's marketplace A look at "tokenmaxxing", a status game where employees at a number of companies compete on leaderboards to show how much AI they're using Elon Musk Announces $20B 'Terafab' Chip Plant in Texas To Supply His Companies Jury finds Elon Musk guilty of defrauding Twitter investors [U] Tracy Kidder, Author of 'The Soul of a New Machine,' Dies at 80 AI Doc trailer reflect — Time-Travel Reflection for Obsidian Esoteric Ebb Butthole Regex Blaster Hosts: Leo Laporte, Jeff Jarvis, and Paris Martineau Guest: Marshall Kirkpatrick Download or subscribe to Intelligent Machines at https://twit.tv/shows/intelligent-machines. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: outsystems.com/twit spaceship.com/twit

In 2015, Satya Nadella said that he wanted users to love Windows. But Microsoft has only enshittified Windows more aggressively since then. Paul wrote a book. And now Microsoft says it's changed, baby, and it's serious this time. Here's what was said ... and what was not said.A Timeline Early signs of positive change: Rust in the Windows kernel, numerous new security features in Windows 11 - "two sides" of Windows, the engineering side and the "let's push AI at all costs/UX" side - more recently, Baseline Security Mode and User Transparency and Consent announcement Last September, Pavan Davuluri took over Windows and reorganized the business immediately, bringing Server/Core back in-house In December, Paul saw the first signs of positive changes in OneDrive, while not perfect, a major step back from the enshittification there. It took a few months to understand exactly what changed. In January, there are over one billion Windows 11 users. Davuluri first mentions a push for quality in 2026 - "pain points" In February, Nadella announced leadership changes that included people directly in charge of security and engineering quality Now, Microsoft has announced that it will address (some of) the complaints about Windows 11, and this includes performance and reliability improvements across the board Microsoft said it will Let you move the Taskbar to other screen edges, finally Improve File Explorer performance Make changes to how users to skip Windows Updates (vaguely) Make improvements to Widgets (but what about the quality problem?) Remove unnecessary Copilot entry points Make the Windows Insider Program more transparent More relevant recommendations in Start - ?? Reduce resource usage across the board, give more resources to what you're doing (good for gaming, especially) Reduce interaction latency - WInUI3 Reduce search latency throughout - also context menus and navigation (which is WinUI3, I guess) Make improvements to Windows Subsystem for Linux OS, drive, and in-box app reliability improvements Windows Hello improvements - Wonders if this is tied to the complaint about speed here What Microsoft didn't discuss Of the several items in the Windows 11 Enshittification Checklist, only one was addressed by Davuluri's post, Windows Update chaos, and then only partially. Not mentioned: Forced telemetry, bundled crapware, forced Microsoft account sign-ins, forced Microsoft Edge usage and configuration harassment, hardware requirements (less relevant today), OneDrive behaviors (partially addressed already). Recall is rare in that it's opt-in, but most of the AI and unwanted features are opt-out or worse Controlled Feature Releases are not controlled, but they do suck Microsoft has monthly Security Updates that include new features. Security and Feature updates should be separate and have different pausing rules Microsoft is not removing Copilot from Windows, nor is it doing less AI; it is just removing Copilot icons from most places and trying to be more thoughtful about how it deploys AI in Windows 11 The Windows Insider Program makes 0 sense right now, and this was only partially addressed; it's not clear what's changing yet Davuluri says that WinUI3 UIs are the solution to many performance problems, but just using an old Mor These show notes have been truncated due to length. For the full show notes, visit https://twit.tv/shows/windows-weekly/episodes/976 Hosts: Leo Laporte, Paul Thurrott, and Richard Campbell

When convenience trumps caution, disaster waits in the wings. Join Steve Gibson and Mikah Sargent as they break down the jaw-dropping oversights lurking in mission-critical tax and cloud tools, and examine how a single unchecked decision can upend internet security for years. H&R Block's tax software does something SO WRONG. The Intoxalock breathalyzer calibration cyber attack. Firefox now offers a 100% free built-in VPN. TikTok and Meta's tracking pixels are so much more. Russians beg for the return of Telegram, WhatsApps and others. Never connect your crypto-wallet to an unknown service. What would a week be without a Cisco CVSS of 10.0. Ubiquiti patches a 10.0 critical flaw. Listener feedback and... What's "Bucketsquatting" and what can be done to prevent it Show Notes - https://www.grc.com/sn/SN-1071-Notes.pdf Hosts: Steve Gibson and Mikah Sargent Download or subscribe to Security Now at https://twit.tv/shows/security-now. You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsors: hoxhunt.com/securitynow guardsquare.com outsystems.com/twit zscaler.com/security

Apple announces June 8th - June 12th for WWDC 2026. Tim Cook announces that the Mac had its best launch week for first-time Mac customers. And a dispute is brewing between the two Halide co-founders as one of them files suit against the other! WWDC Announced. "Mac just had its best launch week ever for first-time Mac customers. We love seeing the enthusiasm!" Stephen Hackett MacBook Neo report. Apple's 'Nice Guy' Heir Apparent. Apple acquisition talks, fraud accusations: Behind one app startup's nasty split. Apple Stores 'running low' on Apple TV, HomePod, and HomePod mini inventory. iPhone Air is demonstrably not a failure for Apple. Picks of the Week Stephen's Pick: Terminal command to hide Tahoe menu icons. Christina's Pick: Dropzone 5 Jason's Pick: Prompt 3.5 Andy's Pick: The lost episode of MST3K - KTMA K03 Star Force Hosts: Jason Snell, Andy Ihnatko, and Christina Warren Guest: Stephen Hackett Download or subscribe to MacBreak Weekly at https://twit.tv/shows/macbreak-weekly. Join Club TWiT for Ad-Free Podcasts! Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit Sponsor: cachefly.com/twit