Hell hath no fury like a jealous clarinetist’s girlfriend! Your Google ChromeCast could be letting stalkers find out where you live! And why on earth is Graham recommending people write their passwords down in a book!?
Join cybersecurity veterans Graham Cluley and Carole Theriault on a shorter episode of the “Smashing Security” podcast than normal, as they’re awfully busy touring up and down the country doing things in front of live audiences.
0:00
0:00
0:00
0:00
Show full transcript ▼
This transcript was generated automatically, probably contains mistakes, and has not been manually verified.
So, I kind of agree with you in a bit. People do crazy things when they're in love, right? And they don't want it to go wrong.
Well, and young.
And when they're young as well. But this—
I certainly did, you know.
Oh, why aren't we talking about that? Smashing Security, Episode 83: Fake Email Derails Clarinetist's Dream. Ransomware Phishing with Carole Theriault and Graham Cluley.
Hello, hello, and welcome to Smashing Security episode 83. My name is Graham Cluley.
Hello, hello, and welcome to Smashing Security episode 83. My name is Graham Cluley.
I'm Carole Theriault.
How are you doing, Carole?
Great, thank you. Bit tired. Busy month this month, isn't it?
It has been a busy month, and that's why this week we haven't got a special guest. It's just you and me flying solo on location here in Manchester.
Tomorrow we are on the next step of our tour. Very exciting.
Tomorrow we are on the next step of our tour. Very exciting.
I think I should share the view from my hotel window with our listeners. Obviously I can't do that. I suppose I could do it on Twitter.
Yes, I'm actually looking at Old Trafford's cricket ground. Quite amazing to have that view outside your window.
Yes, I'm actually looking at Old Trafford's cricket ground. Quite amazing to have that view outside your window.
I know, you got— we got one of those little balconies so we can look out at it.
And yeah, you take a photograph, put it in the show notes, and then everyone else will be able to see. I don't actually understand cricket. Do you?
And yeah, you take a photograph, put it in the show notes, and then everyone else will be able to see. I don't actually understand cricket. Do you?
I do, I do. In my younger days, I used to date a cricketer, so there you are.
Oh really? Well, when you were in Canada—
For another time, a story for another time.
Canadian cricketer.
This episode of Smashing Security is sponsored by LastPass. LastPass Enterprise makes password security effortless for your organization.
LastPass Enterprise simplifies password management for companies of every size with the right tools to secure your business with centralized control of employee passwords and applications.
But LastPass isn't just for enterprises. It's an equally great solution for business teams, families, and single users.
Go to smashingsecurity.com/lastpass to see why LastPass is the trusted enterprise password manager of over 33,000 businesses. Let's get the meat out of the way.
LastPass Enterprise simplifies password management for companies of every size with the right tools to secure your business with centralized control of employee passwords and applications.
But LastPass isn't just for enterprises. It's an equally great solution for business teams, families, and single users.
Go to smashingsecurity.com/lastpass to see why LastPass is the trusted enterprise password manager of over 33,000 businesses. Let's get the meat out of the way.
Well, Carole, I want to tell you a story about a man called Eric.
Okay.
Eric Abramovitch. Do you play any musical instruments at all? As if I don't know.
I attempt to play the guitar.
Exactly.
On a regular basis.
Now, I don't know how old you were when you started to learn to play the guitar. I know you've been learning for quite some time, but Eric—
It's been an on and off experience.
Eric Abramovitz was 7 years old when he learned to play the clarinet, and by the time he was 20, he had become an award-winning clarinetist, and he was studying with top elite teachers in Canada and even performed a solo with—
Oh, a Canadian! You didn't mention that. You said you want to talk to me about Eric. You should have mentioned. I'd be paying much more attention if I knew he was Canadian.
Yes, he's played solos with Quebec's finest symphony orchestras. In fact, I have got a little YouTube link of him playing his clarinet so you can get an idea.
Let's hear it.
Of just how good he is.
Oh my God, he's amazing!
He's amazing. He clearly knows how to toot a clarinet, right? Not bad at all.
I do love the clarinet, actually. I love that sound.
Yeah, it's pretty good.
Almost as good as the oboe.
So pretty impressive, I think you'd agree. And by the age of 20, you would imagine that he had a glittering musical future awaiting him. Now he was studying at McGill University.
Ooh, yes, a good Canadian university. One of the best, Carole, or not?
Ooh, yes, a good Canadian university. One of the best, Carole, or not?
Oh yeah, I wish I'd gone to McGill actually. I got in and ended up going somewhere else.
Well, he wanted to go to the world-famous Colburn Conservatory of Music in Los Angeles.
I don't know as well as the conservatory whether they also have a dining room and an orangery. But he was after a scholarship, right?
And if you get a scholarship to Colburn, that means you're covered for your tuition, your room and board, your living expenses. It's a complete dream come true.
I don't know as well as the conservatory whether they also have a dining room and an orangery. But he was after a scholarship, right?
And if you get a scholarship to Colburn, that means you're covered for your tuition, your room and board, your living expenses. It's a complete dream come true.
Yeah. And you can just focus on your skill and your music and become one of the world's best.
And he was hoping to study under Yehuda Gilad, who I'm sure you know is an internationally renowned clarinet professor.
I didn't know that.
Did you not know that? Ah.
No, I know.
I know.
I obviously live under a rock.
He only accepts two new students every year.
And anyway, Abramovitz was spending hours every night practicing, and he went to his live audition in Los Angeles in February 2014, and he was confident that he would be accepted.
And anyway, Abramovitz was spending hours every night practicing, and he went to his live audition in Los Angeles in February 2014, and he was confident that he would be accepted.
Okay.
So you can imagine—
I'm so dying to understand how this is going to tie into security.
Right. Okay. Cybersecurity.
So you can—
It's not that it's Carole Theriault. It's burying the lead here. Seriously, his clarinet was not IoT-enabled or anything.
It wasn't— they hadn't downloaded patches to cover his tooting holes, nothing was going on.
But some weeks later, after his audition, he received an email from Professor Gilad telling him he hadn't been selected.
It wasn't— they hadn't downloaded patches to cover his tooting holes, nothing was going on.
But some weeks later, after his audition, he received an email from Professor Gilad telling him he hadn't been selected.
Oh, so this is the professor he wanted to study under, and he— the one who accepts only 2 students a year, and he was rejected.
That's right. And he was—
Okay, fair enough.
And obviously he was crestfallen. He's, oh well, right?
Why don't you try a bit harder, right?
Well, exactly. That's what I would have thought as well. Anyway, so he ended up finishing his bachelor's degree at McGill and delaying his professional musical career.
Okay.
Two years later, he thinks, you know what, I really wanted to go to Colburn. So he gets in contact with Yehuda Gilad, right? The clarinet professor.
The one who said no, you're not good enough.
The one who said no before. And do you know what he says to him?
What?
Well, Professor Gilad, the clarinet professor, says, hang on, you rejected us. We didn't reject you. We wanted you to come along. And there's a little bit of a mystery here, right?
What on earth happened? Well, this is the computer security angle, Carole. That's what's happening.
What on earth happened? Well, this is the computer security angle, Carole. That's what's happening.
Finally.
Because there was a lot of bafflement, and eventually Abramovitz sent the professor his rejection email. And the professor said, I never sent this. This isn't from me.
That isn't even my email address.
That isn't even my email address.
Oh.
And Abramovitz began to put two and two together, and he remembered his girlfriend at the time who he split up with about 6 months after he had been rejected from going to Colburn.
And he was just curious, and so he tried to log into the email account that had sent him the rejection using the same password that his now ex-girlfriend had used for her other accounts.
And he was just curious, and so he tried to log into the email account that had sent him the rejection using the same password that his now ex-girlfriend had used for her other accounts.
I love this, Graham. This is yet another reminder why people should use different unique passwords for every different account.
Exactly.
And not share them with your loved ones.
Yeah, no, don't share them with your loved ones and use different passwords if you're going to conduct some kind of fraud.
So it turned out that his girlfriend had created a fake account from Jill to send to her parents saying they had been rejected.
And she also logged into her then-boyfriend's account to say, "No, actually, I don't want your scholarship.
I'm going to be elsewhere." And so both sides thought that the other one had rejected them.
So it turned out that his girlfriend had created a fake account from Jill to send to her parents saying they had been rejected.
And she also logged into her then-boyfriend's account to say, "No, actually, I don't want your scholarship.
I'm going to be elsewhere." And so both sides thought that the other one had rejected them.
Right. And why? Do we have any idea why?
Well, apparently, the girlfriend in all this simply didn't want her boyfriend moving away and was worried that she would lose him. And so she wrecked his musical career effectively.
Well, she didn't wreck it.
Well, it certainly—
He still made it.
It certainly delayed it. And can you imagine the tens of thousands of dollars that he spent at his McGill bachelor's degree?
Yeah, yeah, true.
I imagine that costs a bit to do all that. So she's effectively screwed him over, right?
Now Abramovitz wasn't very happy about this, and so he took it to court, and the judge has just awarded him $350,000 Canadian dollars. I don't know how much that is in real money.
Apparently in American money it's $260,000, so not to be sneezed at. The judge has called her behavior reprehensible betrayal of trust.
Now Abramovitz wasn't very happy about this, and so he took it to court, and the judge has just awarded him $350,000 Canadian dollars. I don't know how much that is in real money.
Apparently in American money it's $260,000, so not to be sneezed at. The judge has called her behavior reprehensible betrayal of trust.
And she was what, 18 at the time though?
Well, he was about 20, 21, something like that.
Right, so she's around the same age, so a kid.
Yes, but it seems like a pretty big— I mean, I understand what you're saying, but it seems like an unfortunate— you're going to stick up for her, are you?
Yes, but it seems like a pretty big— I mean, I understand what you're saying, but it seems like an unfortunate— you're going to stick up for her, are you?
You're going to stick up for—
No, I just think that— I think what I would say is if you get a rejection letter in this case, I think you should call them up and verify.
I think that's what this is telling me to do.
I think that's what this is telling me to do.
I don't like what I hear.
Just validate that that's exactly the message.
I've received this rejection. I just want to be sure that you really have rejected me. I just find it implausible.
No, you might be able to say, I'd just like to have more information why you rejected me.
For example, you could, you know, be a little bit more gentle, gentle approach, a little bit more gentle.
For example, you could, you know, be a little bit more gentle, gentle approach, a little bit more gentle.
Well, there has been— he's never going to see that money anyway unless she's loaded.
Exactly. Well, here's the interesting thing, right? Although she's now been told, or he's been awarded, $350,000 Canadian dollars, she has scarpered. Nobody knows where she is.
No one knows how to get in contact with her.
They split up 6 months after the whole email incident anyway, and she's defriended him, blocked him on Facebook, which is of course the ultimate way of going dark, isn't it, on the internet?
No one knows how to get in contact with her.
They split up 6 months after the whole email incident anyway, and she's defriended him, blocked him on Facebook, which is of course the ultimate way of going dark, isn't it, on the internet?
Yeah, except now she has all the Canadian authorities having her name in a database as someone who didn't show up.
So the Canadian Mounties right now are on her trail with their jodhpurs trying to catch her. So there you go. So I kind of agree with you in a bit.
People do crazy things when they're in love, right? And they don't want it to go wrong.
People do crazy things when they're in love, right? And they don't want it to go wrong.
Well, and young.
And when they're young as well. But I certainly did. Oh, why aren't we talking about that? Let's forget this one. Let's talk about you, Carole.
Carole, what have you got for us this week?
Carole, what have you got for us this week?
Well, I would like to talk about a Google snafu, or is it? Be interesting to see what your opinion is.
So we know it's big business for the Googles, Amazons, and Facebooks of the world to collect, catalog, and correlate information on all aspects of our lives, right?
Mostly in the name of ad revenue. In fact, these guys are often snarfling up our personal data and most of us don't even know what they're grabbing from us, right?
So we know it's big business for the Googles, Amazons, and Facebooks of the world to collect, catalog, and correlate information on all aspects of our lives, right?
Mostly in the name of ad revenue. In fact, these guys are often snarfling up our personal data and most of us don't even know what they're grabbing from us, right?
Yeah. Yeah.
And often we don't even know what they're snarfling up from us. You know, there's this metadata, there's location, geolocation data, all devices we're using.
There's so much we don't even we can't even keep up with it all.
But there's some new research from Tripwire from a researcher called Craig Young, who on Monday this week discovered an authentication weakness that leaks incredibly accurate location information from Google Home's Home Assistant and Chromecast.
Chromecast is a bit like Apple TV. It simplifies the streaming of TV shows, movies, games to a TV or whatever.
There's so much we don't even we can't even keep up with it all.
But there's some new research from Tripwire from a researcher called Craig Young, who on Monday this week discovered an authentication weakness that leaks incredibly accurate location information from Google Home's Home Assistant and Chromecast.
Chromecast is a bit like Apple TV. It simplifies the streaming of TV shows, movies, games to a TV or whatever.
Yeah.
So Young, Craig Young, said that the attack works by asking the Google device for a list of nearby wireless networks and then sending that list to a Google geolocation lookup service.
In fact, Brian Krebs, who Craig Young spoke to, said that anyone who wants to see this in action needs only you can turn off data and remove the SIM card from your smartphone to see how well navigation apps figure out where you are.
I've never done that, but I think that sounds like a great experiment. Of course, the problem with this is the feature could theoretically be taken advantage of by an attacker.
So Young told Krebs on Security, quote, an attacker can be completely remote as long as they can get the victim to open a link while connected to the same Wi-Fi or wired network as the Google Chromecast or Home device.
The only real limitation is that the link needs to remain open for about a minute before the attacker has a location.
So in other words, your Google Home or Chromecast is connected to a Wi-Fi network, you too are connected to it, and if an attacker sends you a specific link, maybe by a web page or a poisoned ad or a tweet, and you open it and happen to leave that page open for at least one minute, then according to Young, it's potentially game over for you.
In fact, Brian Krebs, who Craig Young spoke to, said that anyone who wants to see this in action needs only you can turn off data and remove the SIM card from your smartphone to see how well navigation apps figure out where you are.
I've never done that, but I think that sounds like a great experiment. Of course, the problem with this is the feature could theoretically be taken advantage of by an attacker.
So Young told Krebs on Security, quote, an attacker can be completely remote as long as they can get the victim to open a link while connected to the same Wi-Fi or wired network as the Google Chromecast or Home device.
The only real limitation is that the link needs to remain open for about a minute before the attacker has a location.
So in other words, your Google Home or Chromecast is connected to a Wi-Fi network, you too are connected to it, and if an attacker sends you a specific link, maybe by a web page or a poisoned ad or a tweet, and you open it and happen to leave that page open for at least one minute, then according to Young, it's potentially game over for you.
This is—
You may speak.
This is horrendous. I mean, for privacy, this is so imagine the scenario.
If I was, for instance, an abusive partner and my wife or, you know, girlfriend had left me or something and I wanted to know where she was, I could maybe forge an email or even send her one from myself with a link in it.
Then I would find out where she was. Or if I was some celebrity stalker, if I really fancied Marion Cotillard, for instance, or something like that.
I would be able to tweet her, send her to a page, and I'd know where she was.
If I was, for instance, an abusive partner and my wife or, you know, girlfriend had left me or something and I wanted to know where she was, I could maybe forge an email or even send her one from myself with a link in it.
Then I would find out where she was. Or if I was some celebrity stalker, if I really fancied Marion Cotillard, for instance, or something like that.
I would be able to tweet her, send her to a page, and I'd know where she was.
If she opened it and left it open for a minute.
Well, imagine I took her to a page where I asked her to fill out a form, you know, I asked her questions for my interview.
Yes.
For my personality quiz. For my fan site. Or, you know, I could open a little, maybe I could open a little window underneath. I could have a pop-under window, right?
So she wouldn't even know that I'm just giving people ideas here. I can't imagine she's the sort of person to have a Google Chromecast.
So she wouldn't even know that I'm just giving people ideas here. I can't imagine she's the sort of person to have a Google Chromecast.
You're just insane today, aren't you?
If you had a Google Home device or one of those, then this is, I think this is really serious. What on earth are they going to do about this?
Let me just provide you another quote here from Chris Young. The difference between this and a basic IP geolocation is the level of precision.
So for example, if I geolocate my IP address right now, I get a location that's about 2 miles from my current location at work, he says.
From my home internet connection, the IP geolocation is only accurate to about 3 miles.
With his attack demo, however, he's been consistently getting locations within about 10 meters of the device. So effectively, your home is pinpointed.
So for example, if I geolocate my IP address right now, I get a location that's about 2 miles from my current location at work, he says.
From my home internet connection, the IP geolocation is only accurate to about 3 miles.
With his attack demo, however, he's been consistently getting locations within about 10 meters of the device. So effectively, your home is pinpointed.
Yeah.
So I agree, it is scary stuff.
And presumably this has been driven by some of the data which Google slurped up years ago when they sent their Google cars up and down people's streets sniffing out what Wi-Fi was available at different locations as well.
You know, Google and Android have been working on this for years and years, haven't they?
You know, Google and Android have been working on this for years and years, haven't they?
Yeah.
Now, apparently Young, you know, after he did his research, he reached out to Google this May about his findings, and the company replied by closing his bug report with the status "won't fix intended behavior" message.
So no one can be surprised that Mr. Chris Young decided to contact Krebs from Krebs on Security.
And apparently as soon as he did so, Google changed its tune saying it planned to ship an update to address the privacy leak in both devices.
Now, apparently Young, you know, after he did his research, he reached out to Google this May about his findings, and the company replied by closing his bug report with the status "won't fix intended behavior" message.
So no one can be surprised that Mr. Chris Young decided to contact Krebs from Krebs on Security.
And apparently as soon as he did so, Google changed its tune saying it planned to ship an update to address the privacy leak in both devices.
The power of the media.
When an organization doesn't listen to you, when you explain there's a privacy vulnerability, go to the press, go to someone like Krebs or The Register or Ars Technica, and then they will begin to prick up their ears and take notice and hopefully fix it.
So we all have to wait now.
So if you've got one of these Google Home devices or this Google Chromecast in your house, you've got to wait for your update now, I suppose, which will be automatically pushed out.
When an organization doesn't listen to you, when you explain there's a privacy vulnerability, go to the press, go to someone like Krebs or The Register or Ars Technica, and then they will begin to prick up their ears and take notice and hopefully fix it.
So we all have to wait now.
So if you've got one of these Google Home devices or this Google Chromecast in your house, you've got to wait for your update now, I suppose, which will be automatically pushed out.
Yeah, turn it off, put it out in the garage.
Stamp on it.
In fact, put it in the bin until Google gets in touch with you.
Feed it to the dog.
I mean, everyone knows my opinion on these at the moment remains, don't, just don't have one of these in your home.
You know, the thing that annoys me most about these things, I was at a friend's house recently who had some Echo, which works in the same way, presumably.
But they're sitting there on their couch about 10 feet from the device and going, "Turn down!" But, you know, they're screaming at it and it never understands properly.
And it really ruins the mood for me.
You know, the thing that annoys me most about these things, I was at a friend's house recently who had some Echo, which works in the same way, presumably.
But they're sitting there on their couch about 10 feet from the device and going, "Turn down!" But, you know, they're screaming at it and it never understands properly.
And it really ruins the mood for me.
Oh, really? They're not actually very good at the voice recognition?
Well, I suspect in a family where there's many voices, that may still be a problem with it.
So I think for those that live on their own and use it on their own, it might be a lot faster to be able to pick up your voice, but it may be more difficult in that situation.
So I think for those that live on their own and use it on their own, it might be a lot faster to be able to pick up your voice, but it may be more difficult in that situation.
And of course, you've actually got a friend called, that is a real name.
Yes, apparently at their house they call it Echo because there are two names you can go by. There's a little known fact.
Oh, fascinating.
Now all this made me kind of chuckle slightly with this Google Home thing because I don't know if you heard, but this week, Google has changed its code of conduct.
You may remember that it had a very famous phrase for as long as I remember. Do you know what the phrase is?
You may remember that it had a very famous phrase for as long as I remember. Do you know what the phrase is?
File not found. I don't know. Error 404.
Don't be evil.
Don't be evil. Absolutely.
They've always had don't be evil. It turned out, I had to do a little look, but it turns out it's been in use since 2000.
Ah, bless them.
However, the phrase was removed sometime in April or May according to Wayback Machine, says Gizmodo. So they removed it from their code of conduct.
So that's, that's a little concerning, I think.
So that's, that's a little concerning, I think.
So they quietly, they quietly rubbed it out.
They quietly got rid of don't be evil.
La la la la, don't take notes on this. We'll just get rid of it.
This episode of Smashing Security is sponsored by LastPass. LastPass simplifies password management for companies of every size, but it isn't just for enterprises.
It's equally a great solution for business teams, families, and single users. Learn more at smashingsecurity.com.
It's equally a great solution for business teams, families, and single users. Learn more at smashingsecurity.com.
And welcome back. Can you join us at our favorite part of the show, the part of the show that we like to call Pick of the Week?
Pick of the Week is the part of the show where everyone chooses something that they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a website, or an app. A podcast.
Pick of the Week is the part of the show where everyone chooses something that they like.
Could be a funny story, a book that they've read, a TV show, a movie, a record, a website, or an app. A podcast.
Is this list getting longer?
No, I'm trying to do it in the right order because of the person who didn't like me say— he thought it was Apple Web Store.
That's very kind.
You know, he's revised his review. He's now given us 5 stars because we've—
That's very exciting. Well done.
The important thing though for everyone listening is that Pick of the Week does not have to be security related necessarily.
It should not be. Definitely not be.
Well, my Pick of the Week is a bit security-related, and dare I say—
Why are you breaking your own rules?
It is— no, I said not necessarily. And dare I say it's somewhat controversial.
Now, Carole, I've put into our show notes here a link to a YouTube video which I would now like you to watch.
Now, Carole, I've put into our show notes here a link to a YouTube video which I would now like you to watch.
Okay.
Online passwords, there's just too many, and who can remember all those tricky combinations? So you stick them on your monitor or you hide them in a drawer, but not anymore.
Introducing PasswordMinder, the personal logbook that takes the hassle out of passwords.
Introducing PasswordMinder, the personal logbook that takes the hassle out of passwords.
This is ridiculous. Sticky notes or scraps of paper, because PasswordMinder has been specifically—
Is this for real?
Organize and safely store passwords. It is for real.
It looks like it's for real.
It is for real. It is an infomercial selling a book which is for your passwords and it has a very helpful A to Z and 0 to 9.
So you can quickly look up which website and which password that you need. And most handily of all, there is actually on the front of it a legend saying passwords.
So you're not going to lose this book.
So you can quickly look up which website and which password that you need. And most handily of all, there is actually on the front of it a legend saying passwords.
So you're not going to lose this book.
Now, so it's kind of like a physical digital password manager without a lock.
Yes. And without encryption, of course.
Right. And not even invisible ink.
Now, some people are going to wonder why am I talking about this infomercial? Well, the reason is this.
Although obviously we're big fans on the Smashing Security show of password managers, I would recommend them to everyone.
I do occasionally come across certain people, certain members of society who even when they try to use a password manager, somehow just don't get it.
Maybe they aren't the most tech-savvy people in the world.
Although obviously we're big fans on the Smashing Security show of password managers, I would recommend them to everyone.
I do occasionally come across certain people, certain members of society who even when they try to use a password manager, somehow just don't get it.
Maybe they aren't the most tech-savvy people in the world.
Yeah, they're not very Luddite-friendly yet, I don't think either.
Well, it's just, I mean, some people literally have problems loading files and saving things and writing Word documents. Some people are just simply browsing, right?
And so a password manager may be a little bit tricky for them still.
In those rare cases, I do think there is something to be said for doing what many of us would find completely absurd, which is—
And so a password manager may be a little bit tricky for them still.
In those rare cases, I do think there is something to be said for doing what many of us would find completely absurd, which is—
It's not absurd! I would happily use one of those things and throw it into a safe.
The only problem is, it'd have to be a fireproof safe, because I guess that's the biggest worry you have at home. But otherwise, why not?
The only problem is, it'd have to be a fireproof safe, because I guess that's the biggest worry you have at home. But otherwise, why not?
I think the problem with keeping your passwords in a book are, like you said, fire and flood and those sort of natural disasters and things like that.
You're obviously not a road warrior either, right?
Yeah, well, exactly. Are you going to take it out with you?
In a travel safe?
Because, you know, you're going to lose it in the back of a cab or, you know, exactly.
So it's definitely not for everyone, but if it helps just a few people use different passwords for different websites, then I think that is a win.
And maybe they would go from something like this to a password manager, which I still believe for most people is the best solution.
So it is rather heretical for us to be talking about this infomercial. The infomercial is lots of fun, and it really is, as far as I can tell, utterly genuine.
Anyway, that is why the password management book is my pick of the week.
So it's definitely not for everyone, but if it helps just a few people use different passwords for different websites, then I think that is a win.
And maybe they would go from something like this to a password manager, which I still believe for most people is the best solution.
So it is rather heretical for us to be talking about this infomercial. The infomercial is lots of fun, and it really is, as far as I can tell, utterly genuine.
Anyway, that is why the password management book is my pick of the week.
Well, it is controversial.
Yeah, I like to be a bit racy sometimes, Carole.
I've never seen you race in your life. I'm waiting for you to introduce mine.
What have you got?
So my pick of the week is an episode from a podcast that needs really no introduction. Radio show turned podcast, NPR's This American Life. I know, they need advertising, right?
But episode number 647, episode title LaDonna, I just thought was awesome.
So the whole episode revolves around a security guard named LaDonna Powell, and she ends up working at JFK for Allied Universal. This is the largest security company in the States.
But episode number 647, episode title LaDonna, I just thought was awesome.
So the whole episode revolves around a security guard named LaDonna Powell, and she ends up working at JFK for Allied Universal. This is the largest security company in the States.
All right.
Now, LaDonna talks about what she experiences as she climbs the ranks, but also what she's subjected to and how she handles it. "He's like, I'm a Russian badass.
And he had the— it's like a baseball cap flipped backwards. Like, we're supposed to wear it forward with the— and he flipped it backwards and he opened his shirt.
He said, I'm a Russian bad boy. You know I'm a badass, right? And I was like, I have no idea who you are. Like, today's my first day. I don't know who this guy is.
He's freaking me out already." After checking cargo vans and trucks for a while, the guy told LaDonna that he was going to be inside the security booth by himself for a bit.
She should stay outside by herself and wait. It is kind of harrowing, but it's also— I found it really moving and inspiring.
And he had the— it's like a baseball cap flipped backwards. Like, we're supposed to wear it forward with the— and he flipped it backwards and he opened his shirt.
He said, I'm a Russian bad boy. You know I'm a badass, right? And I was like, I have no idea who you are. Like, today's my first day. I don't know who this guy is.
He's freaking me out already." After checking cargo vans and trucks for a while, the guy told LaDonna that he was going to be inside the security booth by himself for a bit.
She should stay outside by herself and wait. It is kind of harrowing, but it's also— I found it really moving and inspiring.
Is this because she's a woman? Is that what she's dealing with? Is there sexism?
Yeah. Well, I think so. I think there's sexism, there's racism. There's just a lot of rampant ugly stuff going on.
A lot of isms.
Yeah, a lot of isms. But she ends up getting to the point where she can kind of speak indirectly to the CEO of Allied Universal at the end of the episode.
And that is really worth it. That's the juicy bit. So I know our Pick of the Weeks aren't supposed to be serious and all that, but I just get it. And I think most women get it.
And I think most men should listen to it. And I'm not trying to be all preachy preachy. It's just good.
And that is really worth it. That's the juicy bit. So I know our Pick of the Weeks aren't supposed to be serious and all that, but I just get it. And I think most women get it.
And I think most men should listen to it. And I'm not trying to be all preachy preachy. It's just good.
Yeah.
And you know, can I say, it was an episode of This American Life that actually got me into podcasting in the beginning. Oh, I was trying to find the episode in their archives.
And it was about this family that adopted some kind of primate, and basically the primate grew up and got kind of a bit older and a bit more violent.
And it was, anyway, it was, it was, but it was a harrowing episode and it was great. And I think that's what got me totally sucked in. So it's a great episode.
Hat tip to This American Life, episode 647, Ladonna. Check it out.
And it was about this family that adopted some kind of primate, and basically the primate grew up and got kind of a bit older and a bit more violent.
And it was, anyway, it was, it was, but it was a harrowing episode and it was great. And I think that's what got me totally sucked in. So it's a great episode.
Hat tip to This American Life, episode 647, Ladonna. Check it out.
So your advice is listen to the podcast and don't adopt a chimpanzee.
There you go.
Well, on that bombshell, Carole, I think it's about time to wrap up the show really, isn't it? It's just been a quick one this week because we are on tour.
We'll be presenting in Manchester this week, and then next week I think we're off to Edinburgh. So we look forward to seeing some listeners there as well.
We'll be presenting in Manchester this week, and then next week I think we're off to Edinburgh. So we look forward to seeing some listeners there as well.
Why doesn't everybody just come over?
Yeah, wouldn't that be fantastic? Just everyone, wherever you are in the world, come to the Smashing Security live show.
Hey, maybe one day we will host a Smashing Security day somewhere. Wouldn't that be cool?
Oh, somewhere big like the Hollywood Bowl.
It'd be like Smashy, Smashy, Smashy Curie Con. We have to have a cute con name.
If you want to follow us on Twitter, you can follow us at SmashinSecurity, no G. Twitter wouldn't allow us to have a G.
And you can buy t-shirts and stickers and mugs and all sorts of merchandise like that at smashingsecurity.com/store. And you can find past episodes at smashingsecurity.com as well.
Until next time, cheerio, bye-bye, later everybody!
And you can buy t-shirts and stickers and mugs and all sorts of merchandise like that at smashingsecurity.com/store. And you can find past episodes at smashingsecurity.com as well.
Until next time, cheerio, bye-bye, later everybody!
Should I do it one more time?
Yeah, and I'll shut the fuck up.
Please.
Hosts:
Graham Cluley:
@grahamcluley.com
@
/ grahamcluley
Carole Theriault:
Show notes:
- View from Carole's hotel room in Manchester
- Eric Abramovitz plays the clarinet – YouTube
- McGill music student awarded $350,000 after girlfriend stalls career
- Eric Abramovitz vs Jennifer (Jooyeon) Lee – Court documents
- Google’s Newest Feature: Find My Home
- Steve Gibson's Three Router Solution to IOT Insecurity
- Google Removes 'Don't Be Evil' Clause From Its Code of Conduct
- Password Minder Infomercial – YouTube
- LaDonna – This American Life
- Smashing Security merchandise (t-shirts, mugs, stickers and stuff)
- Support us on Patreon!
Sponsor: LastPass
LastPass Enterprise makes password security effortless for your organization.
LastPass Enterprise simplifies password management for companies of every size, with the right tools to secure your business with centralized control of employee passwords and apps.
But, LastPass isn’t just for enterprises, it’s an equally great solution for business teams, families and single users.
Go to lastpass.com/smashing to see why LastPass is the trusted enterprise password manager of over 33 thousand businesses
Follow the show:
Follow the show on Bluesky at @smashingsecurity.com, or visit our website for more episodes.
Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening!
Smashing security #83 top of the article, Smashing security #82 is listed to play!
Whoops – thanks for letting me know. Now fixed!