Digital Security Best Practices

Transcript

[Music] we're lucky enough to have Matt gleon with us who is a security engineer on the a16z crypto team Matt's one of those amazing people who can both uh simultaneously make you feel massively paranoid about uh all the ways You're vulnerable and uh ways that uh people might be trying to attack attack you but also tell you the ways that you can uh solve it and make yourself more secure so Matt come on up so I'm Matt I'm a security security engineer what that really means is I'm a quality assurance person um which is kind of less glamorous I've worked with startups I've worked with big companies I've conducted

hacks that youve probably like the types of hacks you've heard about in the news I've seen a lot of that I've been doing this for a bit over a decade and I've been doing it as a hobby for a bit over two um previously I've done kind of a presentation explaining like who is after you and how and like what are the high level things you can do to avoid it and this is like criminal groups who are trying to sim swap you to make money APS who are trying to hack into your organizations to do like what they will and then the high level APS who chances are Don't Care About Us unless we're like really high profile people so for today's topics I'm going to kind of take a step back and we're going to go into

securing your accounts online and what this means is basically how do you secure kind of your main account which is your recovery account thing that like secures everything else how do you secure accounts with that account and then how do you diagnose whether or not your accounts are secure what could go wrong I think we're all aware of this people get S swapped all the time um it's pretty regular um if I had to guess po people in this room right in the next 6 to eight months uh one of you will probably get SIM swapped that is just kind of like the rate at which we're seeing so in terms of high-profile ones we've obviously seen the SEC got hacked through a Sim swap metallic got hacked through a Sim Swap and then recently open ai's Newsroom got hacked likely

through a Sim Swap and so like these are ever present they're constantly happening it really kind of sucks and if any of you were paying attention this morning and you have Verizon you may have noticed the like sweet SOS symbol at the top of your phone which indicates you lost sell service and if you're really paranoid what that means is he may have been Sim swapped so like it's not fun uh you're kind of looking at it and so this morning I had to go through this process of like one do I care that much or my account secure and then two like is it is it me or is it Verizon the answer is Verizon let me take you through the theory of securing your accounts so in theory we really just secure authentication so we secure like

how we identify ourselves online and the way we identify ourselves online typically is through login which we're all very familiar with forgot password which we a bit less familiar with and then like the third weird back door which is submitting a support ticket um which is in a sense submitting documentation and convincing someone to recite your account in the grand scheme of things I do want to like make this very clear telling someone to be secure is very easy for someone to do actually making a system that is easy to use and secure is pretty hard and making it secure recoverable I think is more or less an impossible problem um you kind of see this with Pass Key where they've made decisions on like where the pass

keys are because they can make something easy and secure but easy secure and recoverable is like that's a catch 22 when we're talking about authentication we're talking about you know these three so you have login that's password onetime password which is like top time based one time password authenticator or them sending information on your phone password plus MF which is probably the most ubiquitous solution we see right now and then pass key which is becoming the more ubiquitous solution then you have automated recovery which is the forgot password typically they're going through email phone number or they're going to ask you some security questions or ask you for some backup code that they've provided or pre-negotiated and

then you have customer service recovery again filling out a form now what is security and authentication so to be very clear normally when we measure authentication security we're measuring it in something called entropy which or bits of entropy and really what this boils down to is how long does it take to guess their way into an account you own and so really we have a few levels of this for most people for most people it probably takes about a day to guess your way into their account you know enough about them you like know how they're constructing passwords it's probably going to take you a day just to like get there for people who are secure enough for most things um it's going to take a few months right if it's going to

if it takes a few months they're not going to bother right that's too long for Gen like generally secure people uh you're really talking about timelines in the centuries though this is kind of debatable um and then like crazy secure centuries and Millennia and sometimes you start talking about eons to be honest when we're looking at like online attacks the amount of time it takes to guess a password is somewhere between minutes and Millennia depending on how complex your password is if your password is a word and a few like numbers after it uh that's minutes if it's like a 100 words uh that's Millennia right for General top so this is your Google Authenticator or

specifically something sent to your phone this will take on average months for them to get into and this assumes of course they can guess once every 6 seconds add Anum it takes I think 2 million guesses on average to kind of break into that account which takes like eight months now if it's badly implemented and they don't have some rate control there uh it goes from months to like hours because you can send 2 million requests and like the period of hours you just have to be able to do it and then we have key based signing so for key based stuff this is where crypto gets its authentication typically on average takes Millennia really if we're considering like Quantum

Computing uh that's probably in centuries right now um and then if you have something insecurely generating keys so this is like your parody wallet um then it's going to take between hours and days to kind of brute force your way into it given you know how they did it for offline this changes only slightly uh which is effectively passwords become much easier top doesn't exist offline like if you have the secret you have the top doesn't matter and key based stuff that's all the same so this brings us to like once you have security kind of at the authentication layer what are they actually looking looking at to attack the system that isn't guessing um and the answer is for password or password

in top they're going to use fishing right they're either going to send you malware to your machine get you to click it get all get through all that or they're going to send you a fake login form and that fake login form will ask you for the information and then they'll just log an is you right it's not very hard for them to do takes a few hours worth of effort but most of us won't click that right the like average click-through rate on fishing is probably in the low 1% right but then that brings us to their top like the top thing they use which is Sim swap so Sim swap takes about the same amount of time takes a few hours of effort for them to prep a Sim Swap and get it going but it's 100% effective reason why is because they're sending money to like a

T-Mobile or Verizon rep and that rep is changing your sim like internally to the system right there's no one nothing you can do about it nothing uh to save it's just kind of a fact of the way the systems currently work so that's massively effective doesn't take much effort so good on them everything else they're going to need to kind of get on your computer which requires much more specialized fishing campaigns much more specialized malware and this like UPS the amount of effort from hours to days and it's still again a fishing campaign so like most of us won't quit that so now let me go through a step-by-step process of me securing my own accounts and I actually went through this process

when prepping this pres presentation just so I knew all the information is current so we're securing my email right this is like the first step is I need my recovery to be secure so I need my email to be secure I have a Gmail account I need login and Recovery to be secure be very clear both of those so they're important and how secure I just need it to be secure enough that no one's going to hack it so how do I do that so I have a few main options I can use just a password um and I may be comfortable enough to do that but most people aren't uh you could use password and top so this is Google Authenticator password and pass key which seems a bit excessive honestly and then pass key which I again as secure as

anything will be for just a password obviously theoretically it is secure enough like you can make a password that's good enough and it'll always work but that's in theory not in practice in practice most people's password security is really bad the amount of entropy in your average password for your average person probably in like the single or low double digits um which is effectively like a few days to brew force your password um they can be stolen via fishing uh they can just go through and like attack you very normally in in weaponized pattern that they put together and have been there forever now for password cotp the only Boon I get is minimum entropy goes up

right no matter what my password is it's probably going to take you months to get in as long as the top system isn't broken and this is nice uh the other thing that's nice for me is Google stops bothering me they stop bringing me the prompt saying hey you should enable two Factor because you're not secure otherwise which doesn't mean I'm not secure it just means they don't know whether or not I'm secure right they they can't guarantee it so they get nervous can still be stolen fishing still works against this it it doesn't have any resilience against those those types of systems or those types of attacks now password and pass key it's an option it's way less simple it's way easier to lose I have lost pass keys I just shipped myself a new one because I

literally lost one traveling like 3 weeks ago and so like I have two luckily but if this were my only way to log in literally I would have lost access to my account or lost access to the ability to log in unless I recovered it so nice but really easy to lose Pass Key real real simple real nice great in every way but most implementations are going to basically spread my pass key around so if I have an iPhone and I'm using Pass key it's inside my I like iCloud password Vault and so like now my iCloud can log into my Gmail and so I have to secure my iCloud as well and my aim here

is to secure one thing to secure everything else so what's my initial Choice honestly I'm kind of lazy and I don't want to buy new stuff so I just use password in top and I did this for a very very long time top is easy I put it on my phone we're good to go not dependent on my iCloud account kind of like as I explained throughout this process now that brings me to like the actual headache so login easy recover is not so how do you recover a Gmail account the ways I know of doing it and and this may not be an exhaustive list is they will ask you for other authentication methods you have on the account so like if you have a bunch enrolled guess what a few of those are getting chosen they'll use those recover

your account with them the other thing is you can specify a recovery email and a phone number which would be nice but like wait I have an email to recover other things do I need another email to recover my own email like then what recovers that right like you get into this weird iCal Loop where you're sitting there going like wait wait wait I just want a root of trust not more complexity in my system and then you have the other thing that Google offers which is ADV Advanced protection which has a few less features but a lot more secure in terms of configuration so enrolled methods obviously easy super nice super convenient backup codes work

SMS Works everything works but bad things M Works uh this is likely how you will get your Gmail stolen if it gets stolen literally this so like if you go into your Gmail account and you have two like backup codes and SMS enrolled on the account like if they want to steal your account that is how they'll do it so like kind of dangerous for email and phone number obviously phone number we can't really depend on because of sim swapping and the email exhibits this weird chicken egg problem where like it's cyclical to itself and so like do I sign the email itself to recover itself because that seems kind of weird and prone to failure lastly Advanced

protection it is highly secure uh it comes with a lot of cons uh most of them are you can only use login through password Pass Key which means it's easier to lose it requires Hardware pass Keys it requires you have a password it requires you still have an email for Recovery which again I've been trying to get around and it's easy to get it locked out and certain features are so again what did I end up choosing I just went with recovery via email CU honestly I'm never going to have to use it so I recover I set my phone number which doesn't matter I set my own email which means like you have to have access to machine I own to recover my account which seems pretty cool now this brings me to this a little weird time so in the

last year hacking via video games has become a very big thing and I have three machines that are logg into my Gmail account I have my laptop my phone and my gaming rig and the issue is do I trust my gaming rig um the answer is anymore not at all right you can ship malware to that thing it auto updates everything it doesn't care so like I was real worried for a while like hey if they want this account how do they get it uh through this random game I've downloaded which would suck so what I ended up doing at the end of the day honestly is setting into the advanced protection and this is

only because I have this liability but I want my gaming rig to have my email period but I just don't want to worry about it so you set it up it kind of sucks in terms of how the login Works um it is secure but features feature wise a bit restricted just to recap what we're aiming for here is secure enough right we're not aiming for maximal security that is a trap you just want to be secure enough that no one's going to hack you that's the Baseline that's where you need to be if you are worried enhance it right there's no reason for you to be like hey like I don't know if I'm secure enough like all right just amp it up right like it's easy to do

because most of this honestly is a piece of Mind exercise so after I've secured my email I now have a way of securing everything else because again as you explained recovery often times uses email to secure things so let me just run you through what these end up looking like for other systems and the reason I'm running through these is because these are systems that tend to get hacked so securing everything else we all know you should probably secure Discord why do you secure Discord because it's the way you communicate with people way you communicate with customers a lot of us do business on it right you kind of need to and what what do you need password top is enough obviously they have Pass Key they have other things if you want but the most important thing thing is Discord only

recovers via email period as long as that is how you have it set up and you need to make sure that is how you have it set up now you can also recover or require this from mods so if you're like a server owner or you're a server mod you can basically say hey other mods or the mods I have need to have these protections because I want to make sure that they're not going to get hacked and then reset my server and then you know post a bunch of fishing links or like misrepresent me next aw AWS is real hard to secure AWS login again secure enough's fine password Tob is fine passy if you want recovery is email and phone always email and phone

you have to enroll both they'll call or text you and then they'll give you a link in an email you have to click it that's how you recover the account there's no optionality it is how it works for corporate accounts it's how it works for everything this is kind of like what you need set up if you have like just password on stuff might be fine but like again this is one of those things where set set up your secure email set your secure email to be the recovery on this account and then you have to worry less next we discussed Twitter or X this is very very difficult one reason is because recovery is kind of email but kind of not and why it it goes into more

of a story so I have a Twitter account I have actually multiple now um but mostly for testing I use password and top for my Twitter accounts because it's easy and corporate policy I use my secure email to recover them however you can have configurations that kind of back door your own account not on purpose but because that's the way Twitter works again recovery is non-standard in a lot of places in X Twitter it's very non-standard but it often times allows you to use your phone number to reset it you know laterally right so what that means get SIM swapped your Twitter's gone right we know this from balic we know this from the SEC we know this from basically every major Sim swap we hear about so the question in my mind and the question in a lot of our

minds is what actually causes this and like what can we do to work around it so while I was testing I was resetting my password but what I'd actually done is I'd reassigned my phone number onto the account to see hey what happens and the answer was I reset the password and it would only allow me to use my email and I was like wait that's weird I have the phone number on it like why can't I reset VI a phone number so what I did is I enrolled a new account I enrolled a phone number enrolled a slightly different email but mostly the same email and then I checked and all of a sudden I could reset via my phone number and like why right literally I have an email and phone number phone number is literally

the same phone number on both accounts the only difference between the account account is I had top on my main account and not on the new account and so sure enough as I was testing currently as it stands and this is like as of a week or two ago and probably didn't take place until a month or two ago if you have top you're fine literally Twitter just disables SMS recovery if you have top that hasn't always been the case we know that hasn't always been the case and so let me kind of explain the process of like how you can tell yourself and how you can test it yourself so when you go

to an account like open an incognito window just go in enter all the information you have on yourself that's not secret if it prompts you for something through a phone just go through that prompt and then see if you can recover your account or not and in this case like you say forgot password you enter your stuff and if we remember like if it asks me for this I click phone number sends me the phone number I reset the account it's reset but if you're secure you meet this and it asks you for the email and once it's asking you for a code via email chances are like they're never getting that because they should never get access to that account because we set it up securely so how do we actually fix this unilaterally

so Twitter this is a unique case and in fact this is a case I wouldn't even trust mainly because as as Tim boo said you could have top for a long time on Twitter and at no point would it disable uh SMS to or SMS recovery and so what you actually had to do for the longest time and what you probably should still be doing is delete the phone number off the account right now do you need to do it right now probably not just enable top you're probably fine but for Peace of Mind long term you probably just want to remove it the other one is when they give you the option adding pins or recovery keys to accounts works

very very well works outstandingly well and I'll kind of show that shortly um and then the last thing is you always need to kind of like when you make a configuration change in your account check to make sure that it didn't go weird because in certain circumstances you're going to be sitting there going like oh hey I made a slight change this should do nothing to my recovery and the answer is it does because again recovery is taking everything from your account it's taking things you don't know about it's just doing stuff behind the scenes that none of us are privy to Let's kind of go through more services so for telegram telegram does have SMS recovery right normally but if you have a secured telegram account here's the

flow you should see you start the recovery you enter a phone number it sends you the code you enter the code then it'll ask you like hey what's the password and the answer is oh wait like I don't have the password so I H recover like forgot it and then it says oh I sent it to your email and then you say wait but I can't do that and it basically says well sucks to be you you can't recover the account which is exactly what we want to see next is iCloud this one's way more important than I think we realize if you're an iPhone user and you use Pass key if your iCloud isn't secure they're going to steal it um iCloud right now now in default configuration they can just like

hey I want to recover it via SMS thanks here's your account and then if they can guess your PIN number right any pin on any device you own any of them including your Apple TV including your Vision Pro including like these tiny devices where you have like five five five5 five set like they'll get your pass key so if you use Pass key on an iCloud device uh you need to do this so when you go through the through the steps to try to recover your iCloud account you'll go through It'll ask you hey submit your email submit your phone number we sent you something in your in your phone like we sent you a code on your phone number enter that code and it should say please enter the recovery key and if you say I

don't have the recovery key it says you can't recover the account that's literally all it should say so this one's it easy you just go enable the recovery key it's in iCloud settings like it's not too bad to do you you just have to be considerate when you're doing it so what other accounts should you secure you want to secure your email obviously we went over that you want to secure your social media Twitter was a big big example of this but Facebook Instagram all of them they should all have the same profile they should all have secured recovery you actually also want to secure your cloud storage as weird as it is to say cloud storage is what they will go after if they can main reason you store a bunch of pictures there you store a bunch of random stuff

there like you might have a seed freas there you might have backup codes there you might have things that get them into other accounts like it is a treasure trop of information they'll kind of take it as much as they can and then lastly their final Target is usually financials so coinbase account Kraken account your actual Banks as well right your normal Fiat banks these are all things they'll try to get into and when they get into they'll try to take your money right there's a reason zel has a credit limit or a limit on how much you can send uh it's largely because this is how they're transferring money out via normal Banks fair warning when you go through this process if you're going to go through this process you will find some of your services are not securable right I had a

bank and I was like Hey Bank you have a lot of my money but like I'd like to recover it and they're like yeah you can use SMS it's like wait wait can I disable that like nope and so like I for the longest time I had a bank account where if you Sim swap me you own my my bank account period I have no retribution I have no way to configure it out and so what did I have to do I just switch Banks which kind of sucks but like this is the reality of everything right like you'll meet some some services that do not do recovery well in a way that like you're comfortable with and at that point like you either stop using it or you just accept the risk that that puts on your life like your

livelihood so this was all mostly simple stuff now I get to do the stuff I like which is like the real advanced stuff what makes accounts hard to access we already went over good passwords or good login good recovery key then there's also a few other little things we're going to go over it's the frequency at which you check things um the reason for this is the CSR recovery path exists so you have to know or recognize when your account has been compromised through that path if it gets compromised the other thing is using hardened phones and devices so most of our phones are okay but we can Harden them pretty well and when we Harden them like we become infinitely well not infinitely much harder to access not using random

Wireless and then not responding to inbounds so if someone sends you text saying like oh hey I'm from coinbase and I'd like to discuss with you like this transfer I saw in your account do not engage right if you think it may be genuine you basically say give me a support ticket number and then you find the support line for coinbase or support email and you send them send through that Channel right now what makes devices hard to access so when we're thinking about device access we're thinking about how much it costs to get onto your device for your average laptop it's actually pretty cheap to get on the device it's like send a bunch of malware find a vulnerability connect to it plug in a device to your computer like just do something to your stuff you can get

in decently easy for a cost that's not too high for phones it's much more costly but much more accessible uh if that makes sense uh your phone ingests a lot of data um if say someone pays a million dollars uh for an iCloud or I iMessage exploit they will get on your phone period it's just how much do I need to pay to get on this person's phone okay it's that much okay I'm on their phone done hardened phones are a bit harder so Apple and Google have kind of locked down phones from uh Pathways that are often times vulnerable to stuff this is called lockdown mode on phones and when you have that enabled you are

severely restricted for feature set like you won't see half of the images on the internet but it also means your images aren't loading in the kernel um and able to get hacked to just own your phone like you know one to and then the last one is a hardened laptop or a hardened device um and this is one separate from a phone this is where like you take the phone level hardening and you like remove all the radios and remove all the stuff how do you harden your phone uh there's only a few things you need to do one set a good passcode so you go you say set alpha numeric passcode the reason you do this is because your phone has full dis encryption on it and it's used uses that passcode for full disc encryption the most likely way you are going to get God is they're going to

steal your phone right and they might have your PIN or they'll be able to guess your PIN they'll get onto the phone and they'll get all the data on it if you have a really long alpha numeric password uh that guessing attack or that like process is impossible reasonably impossible like they'd have to coerce you or like see what you were doing lockdown mode it's obviously there updating your device everyone knows this uninstall Messengers emails clients anything that inbounds data to you as much as you can uninstall it uh that makes you safer and then turn off your phone if you're in a vulnerable place so like if you're say for example going through customs in a kind of weird country and you have your phone on it it

might have your crypto Wallets on it and you have a really complex alpha numeric password power down your phone um it's going to be impossible for them to get the data on that phone because it's encrypted next we have Harden devices so this gets a little bit more complex so if you want a Harden device you get to do a bunch of very weird things you have to basically head into a Best Buy randomly select the laptop grab that laptop specifically the reason you're doing this is because supply chain attacks and I think we've all heard recently examples of supply chain attacks um then you go to a weird connection place so this is like a coffee shop a library something you connect via tour you install a Harden OS this is typically Tails or cubes and then you like don't use any peripherals

don't even use keyboard don't use a mouse don't use anything you just use what's on the laptop you go into it you disconnect all the radios you set a full disc encryption password and you're the most paranoid person on the planet the reason you would ever do this is because if you're storing highly sensitive information and you need to be safe from literal nation states that is the only way to do it right so for example hypothetically if there were a big nation state that was concentrated on attacking crypto and doing it through getting on people's phones then you might want to consider going through the process of creating a secured device or hardened device that is just

significantly harder to get on regardless of where they are and regardless of where you're traveling so like that's kind of my Spiel that's the stuff I like so I included it but now I'm going to go over some very highle frequently asked questions just so I avoid them in Q&A why so little on passwords passwords are hard I hate passwords they're nice for very specific reasons and that is full dis encryption for devices other than that passwords kind of suck as much as you can get away from them it's nice use a vault if you need to there's three of them so I have a really crazy master password in last pass when last pass was hacked and all the vaults were leaked I changed zero passwords the reason because that password will take them

probably um on like Mega GPU rigs I would guess conservatively uh an eon so like I'm fine it's good but my password also looks like a seed phrase right like you know when you get a seed phrase that's 12 words that's that's my password so it's a little paranoid you don't always have to do that but like just keep that in mind now top where do you store these codes or where do you store the backups so it's easy enough um if you print it it's fine uh no one's going into your house typically or if you have a second phone just back it up on the second phone you typically only need one backup you'll probably be fine we have the recovery path for a reason you can just

recover through it what about my company email this is a lot more complex for companies recovery is other people you don't typically recover your email through like a standard recovery path you you ask an admin or another admin on your account to reset your email everyone who can do that has to be secure enough so you feel confident that they're good the other things to keep in mind is email is based on DNS so if you have a crappy DNS registar if you have a crappy DNS provider or if your email provider is kind of suspect all of these things are liabilities right hate to tell you namecheap.com not a great Reg reg are in terms of like the security we've seen on these accounts normally so

if you have your main email account and it's like company name.com or companyname doio uh you can transfer it and you should probably transfer it to let's say cloudflare uh Amazon Google next what about my wallets uh again managing Secrets is hard uh I prefer to use a strategy of separate your money out it's hard to steal all of it if it's in separate places also be cognizant of how much money you can keep in a device right how much can you keep in a laptop probably about 100K how much can you keep in your phone probably under a mill how much can you keep on a Harden device a lot right this is like the rule of

thumb code audits when do I get code audits um the answer is if you are kind of directing funds or doing anything with customer funds any major change get an audit period like non-negotiable it needs to happen if there are no funds you just abide by Norms of the space like not having audits isn't the end of the world getting hacked kind of is though so like you want to feel good about it you want to feel confident that you're not going to just get like the rug pulled from under you because of something like small mistakes that you make auditor rep is key here it's all word of mouth so if you want to know who the good Auditors are ask around right go look at the protocols or the software that is similar to your use the same Auditors they'll probably

do an okay job um if someone's getting MD on Twitter all the time like you know ceric maybe don't use them right so that's the end of my Spiel and now we're on questions we have some queued up in the tank so let's go yeah so one very weird incident that happened recently to me was um um I was using telegram from my previous phone number I switched the phone number and I did not realize that I switched a telegram account with the new number but then I logged into my telegram using the phone number and I logged into somebody else's account um and I was able to see everything and then I could delete their account so that I could restart my open my account from this so I'm not I'm not sure like if like telegram allows you to just

delete by phones and if you could just secure it by email um also another question completely unrelated is um is there any phone provider that you would recommend that is not susceptible to sim swapping so the ones that are most res iant right now are the ones with the worst support or the ones that are intentionally trying to keep you from getting s spoed so this is like uh Google F because Google f is real hard to get a hold of and so like that also makes it hard for the hackers to do it um and then uh things like Aon which are like these more hardened carriers now if you to rank the major carriers right um AT&T Verizon do surprisingly well uh

T-mobile is like the worst period like if you are on T-Mobile your likelihood of sim swapping goes up like a lot a lot more than you'd expect but this doesn't mean everyone's immune and specifically um a lot of this is Sim swaps aren't the only way to get in it's just a step on the path so typically they'll have been targeting you already so like when we're talking about like how long or how much time they're spending doing things like You're average like I'm hacking this one person probably takes them several hours to prepare several hours to kind of go through and it usually stems from I have evidence they either have money here or

I have extra information on them through some other leak so sometimes you'll see like I had well we've had cases where effectively like Gmail accounts have been stolen and the way those were stolen was the backup codes ended up getting leaked at some point and then what happened is they realized the only other thing they needed was SMS so they verified that first then they Sim swapped stole the email and used the email to steal everything else right and like that's kind of what they're dealing with like it's real people on the other end trying to make money by being as nefarious as possible like the other

thing to kind of evidence how nefarious this is is almost all Sim swaps are during like solely American holidays against Americans so Thanksgiving is real common the Super Bowl's real common in fact I've had every one of these ruined by like hey someone has been Sim swapped uh because it's a time they know you're not paying attention it's a time they know like I can Target this guy but yeah to get back to kind of the telegram thing plugging random Sims into devices and doing some of that other stuff gets weird um your iCloud account will do the same thing so if you plug in a Sim like internationally to your phone or you like enroll in a foreign eim uh it will

enroll that phone number onto your iCloud account and what that means is then when you relinquish that number if someone gets it and goes hey I want to enroll this uh they're already enrolled as you and then you have the telegram problem which is like now they own my account what am I going to do right and they can't ask for it deleted right like that is a process but like yeah anyway for email do you tend to use an email for all your accounts that is maybe not a public email that you normally use for other things like do do you like have a account management email so I have some for weirder

accounts but generally no like I've constructed things in a way that like you can know the email you can know my phone number you can know all these things about me and you're very unlikely to get in and like that's the certainty I want I don't want security through obscurity which is like oh I'd HD the email because emails get leaked a lot uh data gets leaked a lot like they know everything about you because like your social security number has been in like 18 Brees and so you do it when it's convenient but I don't think it's a good method of like long-term security because you're going to need to change things a lot okay for

for banks you can like tell them the the credit reporting agencies you can basically say you can't pull a credit report yep all mine all mine are frozen yeah do do you think there'll be something similar for Sims like why why can't the carriers say this you know this thing is kind of more locked down so more strict way they do Sim p so like AT&T and Verizon do it do it and it is a little bit harder but the most common path of sim swaps is to have a customer service rep do it directly through bribery so like they whether or not you know the Sim or you answer the Sim doesn't really matter right because like when it's

someone on the back end who's pretending well who works at a store who's in a store who's just typing that like hey this customer came in I identified them and now I'm setting their phone to this new phone that they bought like that's what we're dealing with yeah and that's like impossible to adjust for as long as the requirement is for those companies is that you be able to get your phone number back okay yeah and last one uh I had fee for many years Google Google F uh and and never had the issue and I'm on mint now and mint also doesn't have in-person stores so is is generally the ones that don't have inperson stores than you know ones that have a little bit more

security I mean yes they have less ways in so again when the model is I find an employee of your company I message them on Reddit or Twitter or wherever they've identified themselves and I tell them hey would you like to make $800 and then I send them it and then they they do the thing I want them to do um the smaller companies all work better right any company without support traditional tends to be a bit better but again this depends on a lot of stuff and like there are other ways to skin the cat um which gets kind of weird when you're talking about SMS as recovery if I'm in proximity of you and you're on a

carrier where I can like downgrade certain types of connections um I can read your SMS without Sim swapping you right and so like there are ways to get around that they just don't do it cuz it's like it costs more money more time and it's way more complex but like it's still kind of at odds with being able to secure it so it sounds like the biggest problem withp is easy to lose are you aware of any kind of like implantable M Keys things that pass key is transferable so if you're not familiar um like UB key

runs on the PH2 spec which we coll well I'm not sure of this but colloquially we call it like what the negotiation it does through webo and pass key right and your Apple Pass key is tied to your iCloud account it's stored in your iCloud uh like credential store and so we do have transformable versions it just introduces iCloud as a liability now if you secure your iCloud then that's fine right and iCloud generally is secure for login it's just recovery that's like the loose end and once you set the recovery key you've effectively disabled recovery for anyone who doesn't know that key and

so you can do it it's just a lot more complexity to introduce in the system um though again I do it so like for certain account logins I will just use Pass key because it's like uber convenient and it's really nice to just be able to hold my phone up to a QR code and my phone to be able to authenticate me and so Pass key is I think what you're talking about well I guess my question is for this a standard you if you want a physical device the issue there is potentially losing it you know of any ways to prevent loss such as implants or oh or necklaces or whatever like maybe you just solve that main point I

mean you tend to lose your keys less so attaching them to Keys tends to work well like implants are semi-permanent and kind of a pain but if you can have them that's cool uh we will change cryptographic algorithms for signing in the next 10 years so your implant is going to be active for probably 5 to 10 and then like it gets nuked for more bit but like I don't know like it's up to the reader how to solve that problem um if you know of a good way to solve it and like you wear a watch all the time and you can attach it to your watch that's cool but in general um like I think people just like I tend to lose

it and so I think generally people tend to lose it so sorry sorry if that's not satisfying yeah if I may add a few things there is a uh now a pass key that is like that small and you can always keep it in your laptop I think that's pretty yeah mine's in my laptop yeah you lose those huh you lose those those no no that's the one I haven't lost oh um I lost my bigger one so um I had a bigger one connected to a set of keys and as I was traveling I think I just dropped it um I do set pins on my pass keys so like doesn't matter stupid question is that a good startup idea to do like a hard than uh just a a Sim carrier for your

for your uh authentication a hardened SIM card yeah the kind of that doesn't allow you to do easy wouldn't allow you easily to do Sim jacking that is that is what aan those guys do which one uh eani e okay um so there are a few carriers attempting to do that the difficulties they always encounter is these more esoteric attacks so even if you're on a funny um you're typically still on like you're on a specific carrier SP and you're subject to their configuration settings and so most like mint and Google f are I

believe is it mbno of T-Mobile and so the T-Mobile configuration uh is what they inherit and so if you're in a situation where like you're using that and they still want to get you um T-Mobile can be downgraded you can downgrade it proximity and then you can still get it information so it it solves a problem but it doesn't solve most of the problem which is phone is not a good way to identify you you didn't mention about Hardware wallets for securing crypto do you have any opinion on those so ultimately the security of a hardware wallet mostly depends on what you're plugging it

into so if I have a hardware wallet and I want to make a transaction that trans action is sent by a laptop into the wallet typically so if they own the laptop what keeps them from trying to change the transaction from out from under you maybe because you assigned the transaction on the hardware wallet but right but what your signing is sent by the laptop and so it doesn't end up solving some Central problems which are how do I verify what I am signing is what I want to do and that's typically what the attacks you'll see against Hardware wallets are and they will prompt you and you can check them but like how often do you do that right how often do you go through every bit and

check it because like what they end up doing is they end up looking at the address you're using for transfers cloning the first like brute forcing out the first four or five characters to imitate you and then you realize like oh I transferred it to the wrong place right like they're going to get around the efficacy of a hardware Wallet not because it's a hardware wallet because of the way we use Hardware wallets and so you'd be better off spending the time and money securing a laptop and then being able to like trust that laptop not to send you bad data for signing right as opposed to like having a laptop that may be compromised that then sends bad

data to your Hardware wallet that you sign because it's very hard to verify I wonder what is your uh opinion on graphine always like does it make us like significantly more safer yeah so when you're talking about hardened devices that are Android um graphine is kind of the go-to right now so it disables a lot of features it gives you configurability so it's basically like you can secure Arch more than you can secure um Mac OS because Mac OS doesn't leave a lot of things for you to configure versus like Arch is like I have all the package manager and all of everything so graphing is I believe considered right now to be the secure

version of Android OS um absent running it on like a pixel where you trust Google to be able to like update it fairly readily hopefully that makes sense and for all of you who are not familiar graphos is like an open source hardened version of Android um that you can install onto Android devices um to kind of like feel good about yourself and to honestly be a bit more secure um you do typically have to root the device so like the device is going to warn you it's going to say hey this device has been rooted um which is kind of a bummer and graphine in kind of a headbutt match with Google because of it but rooting your phone it does not make it insecure

um if you rooted your phone to install a more hardened OS on it your phone is probably more secure at that point all right well thank you guys and I hope you guys a good day [Music]