Firewalls Don't Stop Dragons Podcast

With the holiday season come holiday scams – and honestly, just more scammer activity across the board, in general. People are busy and buying lots of stuff, and it’s a time when we’re more vulnerable to schemes to take our money and infect our devices. Today we’ll talk about a few current scams going around and give some solid advice to avoid becoming a victim. In the news: FCC scraps cybersecurity rules for telcos; WhatsApp flaw exposed 3.5B phone numbers; ClickFix scam update; Border Patrol is monitoring US drivers for ‘suspicious’ travel patterns; a tricky Apple Support scam; USPS and EZ-Pass scams; a cool new tool for monitoring your home network for rogue devices; state and local cyber grant program to be renewed; airlines shut down program that sold your flight records; CA court ends electricity surveillance program; also, a few more holiday gift ideas! Article Links Despite Chinese hacks, Trump’s FCC votes to scrap cybersecurity rules for phone and internet companies https://techcrunch.com/2025/11/21/despite-chinese-hacks-trumps-fcc-votes-to-scrap-cybersecurity-rules-for-phone-and-internet-companies/ A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers https://www.wired.com/story/a-simple-whatsapp-security-flaw-exposed-billions-phone-numbers/ ClickFix may be the biggest security threat your family has never heard of https://arstechnica.com/security/2025/11/clickfix-may-be-the-biggest-security-threat-your-family-has-never-heard-of/ Border Patrol is monitoring US drivers and detaining those with ‘suspicious’ travel patterns https://apnews.com/article/immigration-border-patrol-surveillance-drivers-ice-trump-9f5d05469ce8c629d6fecf32d32098cd ‘It made my blood run cold’: scammers are targeting Apple users with this devilishly clever trick – here’s how to stay safe https://www.techradar.com/computing/cyber-security/watch-out-apple-fans-this-scary-scam-is-stealing-personal-accounts-with-real-apple-support-tickets Scam USPS and E-Z Pass Texts and Websites – Schneier on Security https://www.schneier.com/blog/archives/2025/11/scam-usps-and-e-z-pass-texts-and-websites.html Your IP Address Might Be Someone Else’s Problem (And Here’s How to Find Out) https://www.greynoise.io/blog/your-ip-address-might-be-someone-elses-problem Full renewal of state and local cyber grants program passes in House https://therecord.media/state-local-cyber-grants-program-house-passage Airlines Will Shut Down Program That Sold Your Flights Records to Government https://www.404media.co/airlines-will-shut-down-program-that-sold-your-flights-records-to-government/ Victory! Court Ends Dragnet Electricity Surveillance Program in Sacramento https://www.eff.org/deeplinks/2025/11/victory-court-end-dragnet-electricity-surveillance-program-sacramento Best & Worst Gift Guide: https://firewallsdontstopdragons.com/best-worst-gifts-2025/  All my gift guides: https://firewallsdontstopdragons.com/category/best-worst-gifts/  Further Info EasyOptOuts 25% discount: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/  Consumer Reports $10 off: https://www.consumerreports.org/fdsd/  eBay AI settings:  https://accountsettings.ebay.com/ai-preferences My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:08: Intro 0:01:34: Quick tidbits 0:05:10: News preview 0:07:02: FCC scraps cybersecurity rules for telcos 0:11:02: WhatsApp Flaw Exposed 3.5B Phone Numbers 0:17:47: ClickFix scam 0:24:53: CBP is monitoring US drivers for ‘suspicious’ travel patterns 0:32:12: Clever Apple Support scam 0:38:05: More scams to watch for 0:40:19: Your IP Address Might Be Someone Else’s Problem 0:47:15: State and local cyber grant program to be renewed 0:49:13: Airlines Shut Down Program That Sold Your Flights Records 0:51:40: CA Court Ends Electricity Surveillance Program 0:55:27: Tip of the Week 1:03:53: Looking ahead 1:06:22: Patron podcast previews 1:07:42: Looking more ahead

Holiday shopping season is here! And that must mean that it’s time again for my annual Best & Worst Gift Guide! But this time I’ve recruited some top minds from Consumer Reports to lend their expertise and enlighten us with their tech gift-giving strategies! Yael Grauer, Stacey Higginbotham and Jeff Landale join me for a round table discussion of how to give tech gifts that won’t ruin the security and privacy of your recipients! Interview Notes $10 off Consumer Reports!! https://www.consumerreports.org/fdsd/  Consumer Reports: https://www.consumerreports.org/  Cyber Readiness Report: https://innovation.consumerreports.org/new-report-2025-consumer-cyber-readiness/  Security Planner: https://securityplanner.consumerreports.org/  Vulnerability Disclosure Programs: https://innovation.consumerreports.org/who-ya-gonna-call/  Give Dragon Coupons! https://firewallsdontstopdragons.com/give-the-gift-of-security-and-privacy/  Library Freedom Project: https://libraryfreedom.org/  Yael on spyware and iPhone 17: https://innovation.consumerreports.org/apples-new-iphone-memory-protections-safeguards-devices-against-sophisticated-attacks/  Yael interview (Security Planner): https://podcast.firewallsdontstopdragons.com/2025/02/17/security-planner/  Stacey interview (software tethering): https://podcast.firewallsdontstopdragons.com/2024/11/11/cutting-the-software-tether/  iVerify interview: https://podcast.firewallsdontstopdragons.com/2023/11/13/securing-your-smartphone/  Further Info All my Best & Worst guides: https://firewallsdontstopdragons.com/category/best-worst-gifts/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:15: Intro 0:02:18: What is your tech gift giving philosophy? 0:08:37: What are some worrying tech trends? 0:17:41: What are your tech gift horror stories? 0:22:09: What are your thoughts on giving tech gifts to kids? 0:29:52: What gifts are on your naughty list? 0:42:31: What’s on your nice tech gift list? 0:54:51: How should you handle receiving a bad gift? 1:07:06: Any other hot tips or advice? 1:11:08: What are some great non-tech gifts? 1:17:40: How can Consumer Reports help here? 1:20:39: Wrap-up 1:22:35: Dealing with phone spyware 1:24:35: Newsletter info 1:24:51: IoT vulnerability programs 1:25:04: Give Thanks 1:25:37: Patron podcast preview 1:26:28: Other gift ideas 1:27:27: EasyOptOuts and PayPal 1:28:12: Looking ahead

Data brokers are amassing tons of our personal information, often from public sources. You can try to find all of these brokers and request your data be deleted, but it’s a lot easier to deputize a trustworthy and affordable service to do all that work for you – and to do so on a regular basis. I’ll give you my easy button solution for this. Also in the news: Meta will use your AI sessions to target ads; Google is rolling out agentic AI shopping tools; OpenTable is gathering and sharing your dining habits; Amazon sues Perplexity over their agentic shopping tool; first ever reported AI-orchestrated hacking campaign; EU Commission looks to gut privacy laws; lawmakers want to ban all VPN use; US Senator uses opponents’ can VIN info against them; and new health privacy bill seeks to protect data in apps, smart watches. Article Links Meta won’t allow users to opt out of targeted ads based on AI chats https://arstechnica.com/tech-policy/2025/10/meta-wont-allow-users-to-opt-out-of-targeted-ads-based-on-ai-chats/ Google Is Rolling Out ‘Agentic Checkout’ to Make Your Purchases for You https://lifehacker.com/tech/google-is-rolling-out-agentic-checkout Texas Server Says Your Waitstaff Can Now See What Type Of Customer You Are If You Use OpenTable https://brobible.com/culture/article/opentable-ai-customer-profiling/ Amazon sues Perplexity over ‘agentic’ shopping tool https://www.reuters.com/business/retail-consumer/perplexity-receives-legal-threat-amazon-over-agentic-ai-shopping-tool-2025-11-04/ Disrupting the first reported AI-orchestrated cyber espionage campaign https://www.anthropic.com/news/disrupting-AI-espionage Civil society decries digital rights ‘rollback’ as European Commission pushes data protection changes https://therecord.media/civil-society-privacy-rollback Lawmakers Want to Ban VPNs https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing Senate Democrats seek to ‘get to bottom’ of Moreno’s car-data collection https://rollcall.com/2025/11/06/senate-democrats-seek-to-get-to-bottom-of-morenos-car-data-collection/ Health privacy bill seeks protections for data collected by apps, smartwatches https://therecord.media/health-privacy-bill-seeks-protections-apps-smartwatches Tip of the Week: Erasing Your Data: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/  Further Info Ask ARC to delete data and stop sharing: https://www.404media.co/how-to-opt-out-of-airlines-selling-your-travel-data-to-the-government/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:07: Intro 0:00:45: News briefs 0:02:57: News preview 0:05:38: Meta won’t let you opt out of AI data gathering 0:15:05: Google Is Rolling Out ‘Agentic Checkout’ 0:20:13: OpenTable gathering and sharing your dining info 0:31:22: Amazon sues Perplexity over ‘agentic’ shopping tool 0:38:57: First reported AI-orchestrated cyber attack 0:51:33: European Commission pushes data protection changes 0:55:15: Lawmakers Want to Ban VPNs 1:04:03: Senator uses VIN info against opponents 1:10:38: Health privacy bill seeks protections for data collected by apps, smartwatches 1:12:43: Tip of the Week 1:16:26: Looking ahead

In the US alone, there are tens of thousands of small organizations that are responsible for critical infrastructure and vital community services. Most of them don’t have an IT department let alone a cyber security expert on staff. And yet these organizations are being attacked by cyber criminal gangs with ransomware and are also being targeted by foreign adversaries who would like the ability to disrupt our very civilization. While the US federal cyber agencies have not properly responded to these threats, a handful of volunteer organizations have emerged, organized under the Cyber Resilience Corps, to address these needs. Today I’ll speak with Michael Razeeq, Grace Menna, Adrien Ogee and Eric Franco about their much-needed efforts. Interview Notes Cyber Resilience Corps: https://cltc.berkeley.edu/program/cyber-resilience-corps/  Volunteer! https://cybervolunteers.us  Cyber Security Clinics: https://cybersecurityclinics.org/  The Ransomware Hunting Team: https://en.wikipedia.org/wiki/The_Ransomware_Hunting_Team  Roadmap to Cyber Defense: https://cltc.berkeley.edu/publication/roadmap-to-community-cybersecurity/  Path to Long-Term Cyber Resilience report: https://cltc.berkeley.edu/publication/a-path-to-long-term-cyber-resilience-for-under-resourced-organizations/  Grace Menna’s BSides LV talk: https://www.youtube.com/live/v20rxx_afw0?&t=1410   CISA Cybersecurity Resources for High-Risk Communities: https://www.cisa.gov/audiences/high-risk-communities/cybersecurity-resources-high-risk-communities  FBI InfraGuard: https://www.infragardnational.org/  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:13: Intro 0:00:26: Couple announcements 0:01:09: Interview setup 0:03:38: Defining some terms 0:06:40: Introductions 0:07:51: What is the Cyber Resilience Corps? 0:13:59: What are some of the other affiliated cyber groups? 0:19:24: How do you reach organizations in need? 0:26:43: Do orgs ever resist or eschew your help? 0:34:22: How are these efforts funded? 0:42:14: is there agreement on where to focus efforts? 0:44:02: Which sectors are most important to secure? 0:51:11: Are there accepted standards for infrastructure security? 0:53:38: What are the requirements for volunteers? 1:04:19: How do match volunteers with needs? 1:08:28: How long do the support relationships last? 1:16:31: What key things have you learned from your initial work? 1:22:58: How do you scale this effort to address the massive need? 1:25:18: Shouldn’t Big Tech be doing more here? 1:33:49: How can we help? 1:37:28: If I’m an organization, how do I get help? 1:38:38: What’s next? 1:44:28: Wrap-up 1:47:59: Patron podcast preview 1:48:59: Looking ahead

Today we’ll wrap up my series of tips for enumerating all your old online accounts and deciding whether to delete them or just dumb down the personal data they have on you. There are several things to consider – we’ll go through them all! In other news: a study ranks the most private AI chatbots; LinkedIn is set to use your personal data to train their AI; ChatGPT has released an AI browser; new phishing scam for password manager creds; Gmail did not leak 183M passwords; man discovers his robot vacuum sharing lots of personal data; more info on Cellebrite’s mobile hacking abilities; Flock expanded its surveillance with Ring and drones; and group finds that half of our satellite communications are not encrypted. Article Links Which Generative AI Is Most Privacy-Respecting? https://www.obscureiq.com/which-generative-ai-is-most-privacy-respecting/ LinkedIn will use your data to train AI – how to opt out https://proton.me/blog/linkedin-ai-training Chatgpt Atlas Browser https://www.washingtonpost.com/technology/2025/10/22/chatgpt-atlas-browser/ Phishing scam uses fake death notices to trick LastPass users https://www.malwarebytes.com/blog/news/2025/10/phishing-scam-uses-fake-death-notices-to-trick-lastpass-users No, Gmail has not suffered a massive 183 million passwords breach https://www.techradar.com/pro/security/no-gmail-has-not-suffered-a-massive-183-million-passwords-breach-but-you-should-still-look-after-your-data Man Alarmed to Discover His Smart Vacuum Was Broadcasting a Secret Map of His House https://futurism.com/robots-and-machines/robot-vacuum-broadcasting Someone Snuck Into a Cellebrite Microsoft Teams Call and Leaked Phone Unlocking Details https://www.404media.co/someone-snuck-into-a-cellebrite-microsoft-teams-call-and-leaked-phone-unlocking-details/ Ring cameras are about to get increasingly chummy with law enforcement https://arstechnica.com/gadgets/2025/10/ring-cameras-are-about-to-get-increasingly-chummy-with-law-enforcement/ Exclusive: Flock Safety paid over $300 million for 17-month-old drone startup Aerodome https://techcrunch.com/2024/10/23/flock-safety-paid-over-300-million-for-17-month-old-drone-startup-aerodome/ Leak From the Sky: It Turns Out a Lot of Satellite Data Is Unencrypted” https://www.pcmag.com/news/leak-from-the-sky-it-turns-out-a-lot-of-satellite-data-is-unencrypted Tip of the Week: https://firewallsdontstopdragons.com/removing-old-accounts/  Further Info Data Diet series: https://firewallsdontstopdragons.com/data-diet-introduction/  Backing up 2FA seed codes: https://firewallsdontstopdragons.com/how-to-backup-2fa-seed-codes/  Using email aliases: https://firewallsdontstopdragons.com/how-to-use-email-aliases-part-1/  Claudito: https://github.com/micahflee/claudito  LM Studio: https://lmstudio.ai/  Dark Wire book: https://www.hachettebookgroup.com/titles/joseph-cox/dark-wire/9781541702691/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:07: Intro 0:00:27: News briefs 0:01:49: News preview 0:03:53: Which AI Is Most Privacy-Respecting? 0:09:21: LinkedIn will use your data to train AI 0:14:23: ChatGPT’s new Altas browser 0:21:46: Phishing scam uses fake death notices 0:25:32: Gmail has NOT suffered a massive password breach 0:27:57: Man finds smart vacuum sending maps of home 0:33:41: More Cellebrite capability details leak 0:38:28: Flock inks deal with Ring cameras 0:42:57: Flock Safety buys drone company 0:46:52: Half of satellite comms are unencrypted 0:51:26: Tip of the Week 1:00:01: Patron podcast preview 1:00:18: Looking ahead 1:01:39: New patron promotion coming?

AI chatbots like ChatGPT have made quiet a splash. Companies are tripping all over themselves in a rush to add “AI” to everything, heedless of the security risks. But perhaps more insidious are the privacy risks. Most AI processing is done in the cloud, meaning that your queries and chats are subject to inspection, sharing, storing and monetizing. These AI systems are incredibly expensive to train and operate. And AI companies are desperate to feed them every scrap of data they can find. It’s a recipe for privacy disaster. But there are ways to make it more private and today we’ll discuss these approaches with Proton’s head of AI, Eamonn Maguire. Interview Notes Lumo privacy and security model: https://proton.me/blog/lumo-security-model  AI privacy concerns: https://proton.me/blog/ai-privacy-concerns  How to build a private AI: https://proton.me/blog/how-to-build-privacy-first-ai  LaTeX: https://en.wikipedia.org/wiki/LaTeX  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:12:22: Defining some terms 0:15:29: What are the main privacy issues with modern AI? 0:22:53: What are the dangers of training AI models on personal data? 0:27:57: How do we make AI chatbots safer to use? 0:35:31: What are Proton’s goals with Lumo? 0:42:41: How can Lumo protect a user’s privacy? 0:52:19: Can we do more to anoymize cloud LLM queries? 0:56:50: What can we do to increase trust and transparency with AI? 1:02:55: Where does Proton store and process AI data? 1:10:35: Which LLM models does Lumo use? 1:15:38: Will Proton offer a local-only version of Lumo? 1:20:36: What’s next for Lumo and AI at Proton? 1:27:59: Will Lumo ever be part of Proton pricing bundles? 1:31:24: Wrap-up 1:35:14: Patron podcast preview 1:36:04: Looking ahead

Now that we’ve tracked down all our old online accounts, it’s time to make them more secure and review the data they contain. We should download a copy of that data for safe keeping before we ultimately delete or suspend the accounts. We’ll discuss this next step in our journey of reducing our online data footprint – our Data Diet. In the news: Windows 10 support has officially ended; seniors targeted with malware from Facebook groups; Tile trackers can also track you; massive Salesforce data leaked after refusing to pay ransom; dangerous Discord breach; Apple, Google to reluctantly comply with new Texas age law; California enacts age-verification law; EU Chat Control defeated; California makes GPC universally available; largest CCPA fine to date levied against TSC. Article Links Windows 10 support “ends” today, but it’s just the first of many deaths https://arstechnica.com/gadgets/2025/10/windows-10-support-ends-today-but-its-just-the-first-of-many-deaths/ Seniors targeted in global Facebook scam spreading new Android malware https://therecord.media/seniors-targeted-facebook-android-malware-scam Tile Tracking Tags Can Be Exploited by Tech-Savvy Stalkers, Researchers Say https://www.wired.com/story/tile-tracking-tags-can-be-exploited-by-tech-savvy-stalkers-researchers-say/ ShinyHunters Leak Data from Qantas, Vietnam Airlines and Others https://hackread.com/shinyhunters-leak-data-qantas-vietnam-airlines-others/ The Discord Hack is Every Users’ Worst Nightmare https://www.404media.co/the-discord-hack-is-every-users-worst-nightmare/ Apple and Google reluctantly comply with Texas age verification law https://arstechnica.com/tech-policy/2025/10/apple-and-google-reluctantly-comply-with-texas-age-verification-law/ California enacts its own internet age-gating law https://www.theverge.com/news/798871/california-governor-newsom-age-gating-ab-1043 Citizen Protest Halts Chat Control https://www.patrick-breyer.de/en/citizen-protest-halts-chat-control-breyer-celebrates-major-victory-for-digital-privacy/ California Governor signs first-in-the-nation privacy bill into law https://advocacy.consumerreports.org/press_release/california-governor-signs-first-in-the-nation-privacy-bill-into-law CPPA fines Tractor Supply Company $1.4 million for privacy violations https://therecord.media/ccpa-tractor-supply-privacy-fine Tip of the week: https://firewallsdontstopdragons.com/secure-old-accounts/  Further Info How to freeze your credit: https://firewallsdontstopdragons.com/credit-freeze-now-is-the-time/  Setting up Global Privacy Control: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/  My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support our mission! https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:00:28: News preview 0:02:31: Win10 support ended 0:08:19: Seniors targeted with malware from Facebook groups 0:12:00: Tile trackers can also track you 0:19:51: Massive Salesforce data leak 0:26:50: Dangerous Discord breach 0:32:35: Apple, Google to comply with new Texas age law 0:39:47: CA enacts age-verification law 0:44:56: EU Chat Control defeated! 0:49:33: CA makes GPC universally available 0:55:02: Largest CCPA fine to date 0:57:02: Tip of the Week 1:01:41: Wrapping up 1:02:29: Looking ahead

Our critical infrastructure is vulnerable and under attack by nation state actors, either for profit or perhaps even to establish a beachhead for future cyber conflict. During the pandemic, many of our core systems were automated and connected to the internet for remote administration, but this just created a larger attack surface. The federal government hasn’t done nearly enough to protect these systems. Groups like DEF CON Franklin are working to find cyber volunteers to bring our national critical utilities above the ‘cyber poverty line’. Today we’ll explore the problems and solutions with Franklin co-founder Jake Braun, including what we can all do to help. Interview Notes DEF CON Franklin: https://defconfranklin.com/  For more info or help, email “defconfranklin” at gmail.com. Volt Typhoon: https://en.wikipedia.org/wiki/Volt_Typhoon  Initial Franklin trials: https://harris.uchicago.edu/news-events/news/first-water-utilities-take-volunteer-cyber-help  Franklin Almanac: https://defconfranklin.com/almanack.html  Franklin launch (DEF CON 32): https://www.youtube.com/watch?v=0TdY9JUaybc  DEF CON 33 Franklin update: https://defconfranklin.com/water_cybersec.html  Jake’s books: https://www.amazon.com/s?i=digital-text&rh=p_27%3AJake%2BBraun  More help: https://www.cybervolunteers.us/en  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:03:19: Why did you start the DEF CON Franklin project? 0:07:58: Why did you focus on protecting water systems? 0:12:41: Why target our water systems? 0:17:10: How do protect 50,000+ water facilities? 0:22:01: What are key takeaways from your first trials? 0:24:53: What are some of challenges you’ve faced? 0:29:13: Why did we ever put critical infrastructure on the internet? 0:31:05: Are there third parties involved in facility security, too? 0:32:45: How do you coordinate your efforts with other, similar orgs? 0:36:32: How do you know when your job is finished? 0:39:14: Are you getting support from the US government? 0:41:31: What’s next for Franklin? How can we help? 0:43:38: What’s the long term roadmap for Franklin? 0:45:00: Interview wrap-up 0:46:54: Patron podcast preview 0:47:52: Looking ahead 0:49:11: My other stuff

There are literally billions of devices connected to the internet today – many of them cheap, insecure IoT devices… smart thermostats, doorbell cameras, webcams, cheap WiFi routers and other smart appliances. As we like to say, the “S” in “IoT” is for security. And when insecure devices are no longer supported, the security bugs will never be fixed. We’ll discuss the implications of this growing problem and potential solutions with a passionate right-to-repair advocate and the founder of the Secure Resilient Future Foundation, Paul Roberts. Interview Notes Secure Resilient Future Foundation: https://secure-resilient.org/  The Security Ledger: https://securityledger.com/  Tech Timebombs: https://www.youtube.com/watch?v=koZERADCyug  Secure Repairs: https://securepairs.org/  Paul’s Congressional testimony: https://judiciary.house.gov/committee-activity/hearings/there-right-repair   FULU Foundation: https://fulu.org/  US PIRG: https://pirg.org/  Institute for Security and Technology: https://securityandtechnology.org/  NIST 800-232: https://csrc.nist.gov/pubs/sp/800/232/ipd  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Send me your questions! https://fdsd.me/qna  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:01:42: Interview terminology 0:03:22: How did you come to found SRFF? 0:08:24: Why are abandoned IoT devices “tech time bombs”? 0:16:53: What are the dangers of hacked IoT devices? 0:18:28: Is there any real liability for making insecure IoT devices? 0:23:36: How important is transparency to law making? 0:29:07: How does the right to repair interact with IoT security? 0:38:33: How should consumers be made aware of abandoned devices? 0:43:56: Can we rely on ISP’s to block insecure devices? 0:46:42: What other groups are working on improving IoT security? 0:52:24: Should the gov’t be funding research into securing IoT devices? 1:01:20: What can we do to help? 1:06:58: Patron podcast preview 1:07:31: Looking ahead

It’s rare these days to find a well-designed and useful application that was made to be private from the get-go. Too many apps today view your personal data as a cash cow to be mercilessly milked, claiming to value your privacy when they really value the extra revenue they can make off of your private data. When I find useful apps that are private by design, especially ones that can replace more popular apps that harvest our data, I like to call attention to them: in this case, Ente Photos. Today I’ll ask the founder and CEO why privacy is important to him and how it influenced his design approach. Interview Notes Ente Photo: https://ente.io/ Ente Auth: https://ente.io/auth/  Ente’s Machine Learning: https://ente.io/ml/  Ken Thompon’s lecture on trust: https://dl.acm.org/doi/10.1145/358198.358210  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:00: Intro 0:04:08: interview terminology 0:06:44: Why did you start Ente and why do you care about privacy? 0:15:23: Why should we trust Ente with our private data? 0:20:14: What private information does Ente collect? 0:25:12: How hard is it for 3rd party apps to integrate with the OS? 0:29:39: Is Ente more private than Apple Photos with ADP enabled? 0:31:40: How hard is it to migrate from Google or Apple Photos to Ente? 0:34:30: Is facial recognition metadata in a standard, portable format? 0:35:51: How hard is it to export photos from Ente? 0:37:57: Does Ente Auth allow for easy export and backup? 0:39:28: How do you backup your Ente photos? 0:41:12: How much of Ente’s AI photo processing is purely on-device? 0:45:51: How do you vet third party software libraries for privacy? 0:49:07: What data could Ente give, if required, to law enforcement? 0:52:43: How can we pass on our legacy of memories to our kids? 0:54:55: What’s next for Ente? 0:59:43: Interview wrap-up 1:00:56: Patron podcast preview 1:01:36: Looking ahead