WEBVTT 1 00:00:00.000 --> 00:00:02.759 Hey everyone, and welcome to another deep dive. Today. We're 2 00:00:02.759 --> 00:00:04.799 going to get into some of the nitty gritty of 3 00:00:04.960 --> 00:00:09.240 keeping ourselves safe online, you know, building those digital defenses. 4 00:00:09.320 --> 00:00:11.080 Yeah, like a digital fortress exactly. 5 00:00:11.480 --> 00:00:15.839 Our source material today is personal digital security, protecting yourself 6 00:00:15.839 --> 00:00:18.039 from online crime, and we're going to arm you with 7 00:00:18.079 --> 00:00:21.320 the knowledge to protect your data and privacy online. 8 00:00:21.640 --> 00:00:23.760 Think of us like your cybersecurity guides. 9 00:00:24.399 --> 00:00:27.440 Perfect. So let's get started with the foundation of our 10 00:00:27.440 --> 00:00:32.119 digital fortress, the operating system. And I have to admit 11 00:00:32.200 --> 00:00:34.880 this was a bit of a shocker to me. Thousands 12 00:00:34.880 --> 00:00:38.799 of hackers are constantly scanning for vulnerable computers. It doesn't 13 00:00:38.840 --> 00:00:40.439 matter if it's Windows seven or ten. 14 00:00:40.679 --> 00:00:41.920 Nope, they don't discriminate. 15 00:00:42.200 --> 00:00:43.799 So how do we lock down our os? 16 00:00:44.159 --> 00:00:47.039 Regular security patches are key, even on brand new computers. 17 00:00:47.039 --> 00:00:49.640 Think of it like keeping your software up to date. 18 00:00:49.880 --> 00:00:52.520 Most versions of Windows can handle this automatically. 19 00:00:52.920 --> 00:00:55.560 That's good to hear, But to be sure, how can 20 00:00:55.640 --> 00:00:57.880 listeners double check that everything is set up properly? 21 00:00:58.079 --> 00:01:00.719 So for Windows seven, go to the store button, than 22 00:01:00.799 --> 00:01:05.200 control panel, then Windows Update, click on change settings and 23 00:01:05.239 --> 00:01:07.920 make sure all the boxes are checked for automatic updates. 24 00:01:09.000 --> 00:01:09.840 And for Windows ten. 25 00:01:09.959 --> 00:01:13.079 It's similar head to settings, then update and security, and 26 00:01:13.159 --> 00:01:16.879 finally Windows Update ensure those automatic updates are. 27 00:01:16.799 --> 00:01:19.400 Switched on GOTA. So that's our OS taken care of. 28 00:01:19.719 --> 00:01:20.599 But is that enough? 29 00:01:20.959 --> 00:01:21.159 Yeah? 30 00:01:21.159 --> 00:01:22.920 I feel like we need more layers of protection. 31 00:01:23.120 --> 00:01:25.599 Yes, you're right, Securing your OS is like having a 32 00:01:25.599 --> 00:01:28.560 strong front door, but you also want a security system 33 00:01:28.640 --> 00:01:30.159 for that extra piece of mind. 34 00:01:30.200 --> 00:01:32.879 Okay, makes sense. So what are our options for building 35 00:01:32.959 --> 00:01:34.439 this digital security system. 36 00:01:34.719 --> 00:01:37.359 Well, first, you probably already have Windows Defender, especially if 37 00:01:37.400 --> 00:01:40.439 you're running Windows seven or Vista. It's probably active in 38 00:01:40.480 --> 00:01:42.120 the background right now as we speak. 39 00:01:41.920 --> 00:01:43.560 Like it's silent Guardian exactly. 40 00:01:43.640 --> 00:01:45.560 Yeah, but we want to bolster that. We need some 41 00:01:45.680 --> 00:01:48.359 serious anti virus software. And the good news is you 42 00:01:48.359 --> 00:01:51.239 don't have to spend a fortune. There are great free 43 00:01:51.680 --> 00:01:53.599 antivirus solutions out there. 44 00:01:54.280 --> 00:01:56.280 Really are they really as effective as the baid ones? 45 00:01:56.319 --> 00:02:00.319 Though, absolutely, especially if you can figure them properly. The 46 00:02:00.400 --> 00:02:04.239 key is keeping them updated. Outdated antivirus software is like 47 00:02:04.239 --> 00:02:07.159 wearing a bulletproof vest with holes in it. Not very effective. 48 00:02:07.599 --> 00:02:10.319 Okay, that's a pretty vivid image and a little scary. 49 00:02:10.719 --> 00:02:13.520 So updated software it is anything else we should be 50 00:02:13.520 --> 00:02:13.879 aware of. 51 00:02:14.560 --> 00:02:17.840 Yes, don't fall into the trap of thinking more is better. 52 00:02:18.080 --> 00:02:21.120 Having multiple antivirus programs running at the same time actually 53 00:02:21.120 --> 00:02:23.919 does more harm than good. They can conflict with each other, 54 00:02:24.159 --> 00:02:27.319 slow down your computer, and even create security gaps. 55 00:02:27.400 --> 00:02:30.000 So one good one and keep it updated. Got it, 56 00:02:30.599 --> 00:02:33.599 but hold on a second. Besides antivirus, what other tools 57 00:02:33.639 --> 00:02:35.719 are out there that can help us fortify our defenses? 58 00:02:35.919 --> 00:02:39.039 Think of these as our specialized security units. First up, 59 00:02:39.080 --> 00:02:41.680 we have cea cleaner. This is great for cleaning up 60 00:02:41.680 --> 00:02:45.039 temporary files and Internet history. It's like decluttering your computer, 61 00:02:45.159 --> 00:02:48.000 which improves performance and protects your privacy. 62 00:02:47.560 --> 00:02:50.479 So it's good for both security and just general digital 63 00:02:50.560 --> 00:02:51.520 hygiene exactly. 64 00:02:51.719 --> 00:02:54.560 Then we have malware bites. This is the heavy hitter. 65 00:02:54.840 --> 00:02:58.919 It tackles a wider range of threats like viruses, worms, trojans, rootkits, 66 00:02:59.199 --> 00:02:59.759 hoole works. 67 00:03:00.039 --> 00:03:02.879 So if Seacleaner is the cleanup crew, malware bytes is 68 00:03:02.919 --> 00:03:05.840 like our special forces unit. This is starting to sound 69 00:03:05.840 --> 00:03:08.479 like a digital action movie. What else we get? 70 00:03:08.639 --> 00:03:12.639 Our final secret weapon is Spybot. Spybot is excellent at 71 00:03:12.680 --> 00:03:16.639 detecting spyware and adware. These sneaky programs try to track 72 00:03:16.719 --> 00:03:19.560 you and steal your information. And they often slip past 73 00:03:19.599 --> 00:03:21.400 traditional antivirus software. 74 00:03:21.680 --> 00:03:24.479 So spybot is our undercover agent. Okay, so we've got 75 00:03:24.520 --> 00:03:28.240 our OS updates, a solid antivirus program, and this trio 76 00:03:28.360 --> 00:03:32.599 of specialized tools, seacleaner for cleanup, malware bytes for heavy 77 00:03:32.680 --> 00:03:37.080 duty protection, and spybot for those sneaky spies. But how 78 00:03:37.120 --> 00:03:38.719 often should we be running all of these? 79 00:03:38.840 --> 00:03:40.560 A good rule of dumb is to run everything once 80 00:03:40.560 --> 00:03:43.039 a month. It's like a regular security checkup. It ensures 81 00:03:43.039 --> 00:03:45.479 your system is clean, protected and running smoothly. 82 00:03:45.639 --> 00:03:48.719 Easy enough. Now, you mentioned programs that try to steal information, 83 00:03:49.159 --> 00:03:51.039 which brings us to a topic I've always found a 84 00:03:51.039 --> 00:03:56.000 bit unsettling infected computers. Specifically, let's talk about rit's remote 85 00:03:56.000 --> 00:03:58.439 access trojans. It sounds ominous and it is. 86 00:03:58.639 --> 00:04:02.400 Imagine someone having complete control over your computer, stealing your data, 87 00:04:02.439 --> 00:04:05.360 spying on you, even wiping your hard drive. That's the 88 00:04:05.360 --> 00:04:08.319 threat of RIT. Wait they could do all that, Yeah, 89 00:04:08.479 --> 00:04:11.840 it essentially gives the attacker a backdoor into your system. 90 00:04:11.960 --> 00:04:14.479 How would they even get an RIT onto my computer? 91 00:04:14.840 --> 00:04:17.560 Well, A lot of times it's through things like phishing emails, 92 00:04:17.800 --> 00:04:22.120 malicious websites, or even downloads that look harmless you might 93 00:04:22.199 --> 00:04:24.480 think you're getting a cool new game or something, but 94 00:04:24.519 --> 00:04:26.160 you're actually letting an rat in. 95 00:04:26.319 --> 00:04:30.160 It's like unknowingly inviting a thief into your house. Yeah, 96 00:04:30.199 --> 00:04:32.240 but you said they can do some disturbing things. Can 97 00:04:32.279 --> 00:04:34.040 you give us some specific examples. 98 00:04:34.360 --> 00:04:36.600 Well, one thing they can do is lock you out 99 00:04:36.600 --> 00:04:40.519 of your computer. You go to log in and suddenly 100 00:04:40.560 --> 00:04:43.680 your password doesn't work, or you try to open a 101 00:04:43.759 --> 00:04:46.120 file and it's gone or encrypted. 102 00:04:46.240 --> 00:04:48.800 So it's not just about stealing data, it's about disrupting 103 00:04:48.879 --> 00:04:50.279 our digital lives as well. 104 00:04:50.360 --> 00:04:52.560 Right, and then of course there's the data theft itself. 105 00:04:53.000 --> 00:04:57.160 Bank accounts drained, credit cards maxed out, social media taken 106 00:04:57.199 --> 00:05:00.480 over all because RITI was recording your keystroe and stealing 107 00:05:00.519 --> 00:05:01.720 your passwords in the background. 108 00:05:01.839 --> 00:05:03.680 This is getting a bit too real for my liking. 109 00:05:04.000 --> 00:05:06.079 Are there any warning signs that we've been hit with 110 00:05:06.120 --> 00:05:06.680 an rat? 111 00:05:07.240 --> 00:05:11.399 Sometimes? Yeah, you might notice your computer slowing down, programs 112 00:05:11.439 --> 00:05:15.519 crashing more than usual, or strange network activity. Maybe you 113 00:05:15.560 --> 00:05:18.759 see files or programs you didn't install, So. 114 00:05:18.759 --> 00:05:21.360 Keep an eye out for anything out of the ordinary. 115 00:05:22.120 --> 00:05:24.800 But let's say the worst happens and our computer does 116 00:05:24.839 --> 00:05:26.920 get infected. What can we do. 117 00:05:27.720 --> 00:05:31.399 First thing? Disconnect from the Internet immediately. This stops the 118 00:05:31.439 --> 00:05:35.480 attacker from having further control. Then run a full scan 119 00:05:35.600 --> 00:05:37.639 with your anti virus and malware bytes. 120 00:05:38.240 --> 00:05:41.439 Okay, good first steps, but what if they've already stolen data? 121 00:05:41.560 --> 00:05:44.680 You need to change your passwords for everything, especially banking 122 00:05:44.680 --> 00:05:47.759 and financial accounts, and contact your bank and credit card 123 00:05:47.839 --> 00:05:49.480 companies to report possible fraud. 124 00:05:49.680 --> 00:05:52.600 It's like a digital disaster recovery plan. But you know 125 00:05:52.680 --> 00:05:54.879 you mentioned ats can be used for more than just 126 00:05:55.160 --> 00:05:56.879 malicious attacks. What did you mean by that? 127 00:05:57.040 --> 00:06:00.399 Believe it or not, Sometimes riturs are just pranks, maybe 128 00:06:00.399 --> 00:06:04.000 from a mischievous friend. Imagine your screen flipping upside down, 129 00:06:04.120 --> 00:06:06.560 your CD ROM tray opening and closing on its own, 130 00:06:06.879 --> 00:06:08.199 or your mouse button switching. 131 00:06:08.399 --> 00:06:11.160 Okay, that's more annoying than terrifying. Yeah, but it shows 132 00:06:11.199 --> 00:06:14.240 how much these programs can do. But let's get back 133 00:06:14.279 --> 00:06:17.199 to the serious stuff. We can't talk about infected computers 134 00:06:17.399 --> 00:06:18.879 without discussing ransomware. 135 00:06:19.079 --> 00:06:22.800 Ransomware is the digital equivalent of kidnapping. It holds your 136 00:06:22.839 --> 00:06:26.720 data hostage, encrypts it, and demands payment for the decryption key. 137 00:06:27.040 --> 00:06:30.079 The book shows a picture of a ransomware website, and 138 00:06:30.120 --> 00:06:32.800 it is chilling. It looks like a legitimate business. 139 00:06:32.920 --> 00:06:35.879 Yeah, it can be unsettling. They use scare tactics and 140 00:06:35.959 --> 00:06:38.879 threats to pressure you into paying. But the thing is, 141 00:06:39.040 --> 00:06:41.279 even if you pay, they might not actually give you 142 00:06:41.319 --> 00:06:42.240 the decryption key. 143 00:06:42.720 --> 00:06:46.240 So prevention is key. We've talked a lot about software protection. 144 00:06:46.319 --> 00:06:48.240 What about the physical security of our computers. 145 00:06:48.480 --> 00:06:51.199 That's something people often overlook. You could have the best 146 00:06:51.240 --> 00:06:54.560 digital defenses in the world, but if someone steals your computer, 147 00:06:54.759 --> 00:06:57.680 or even just your hard drive, all that software protection. 148 00:06:57.439 --> 00:07:00.600 Won't help, especially in shared workspaces. Easy to let your 149 00:07:00.600 --> 00:07:01.240 guard down. 150 00:07:01.160 --> 00:07:04.120 Exactly, and one of the most common threats, believe it 151 00:07:04.199 --> 00:07:07.199 or not, comes from USB drives. The book has a 152 00:07:07.240 --> 00:07:10.319 story about a penetration tester who used a simple trick 153 00:07:10.360 --> 00:07:12.600 to breach even the most secure networks. 154 00:07:12.759 --> 00:07:14.120 Wait, it's a penetration tester. 155 00:07:14.399 --> 00:07:18.000 It's an ethical hacker hired by companies to find security weaknesses, 156 00:07:18.439 --> 00:07:20.720 like a security check up for your digital fortress. 157 00:07:20.800 --> 00:07:23.319 Okay, I get it. So what did this penetration tester 158 00:07:23.480 --> 00:07:24.759 do with USB drives? 159 00:07:24.959 --> 00:07:28.839 He would leave a USB drive labeled reward if found 160 00:07:29.319 --> 00:07:31.800 somewhere out in the open, like in a parking lot. 161 00:07:31.839 --> 00:07:33.360 And I'm guessing a lot of people plug them in. 162 00:07:33.480 --> 00:07:35.439 Oh yeah, who wouldn't want to return a lost drive 163 00:07:35.480 --> 00:07:39.680 and get a reward? But these drives were far from harmless. 164 00:07:39.879 --> 00:07:42.959 They contained a program that would automatically run when plugged in. 165 00:07:43.439 --> 00:07:45.800 It would open up a terminal window with a message 166 00:07:45.879 --> 00:07:49.480 like one hundred dollars reward if found, Please email Jim 167 00:07:49.519 --> 00:07:52.199 Williams Dooja at gmail dot com with your name and 168 00:07:52.199 --> 00:07:53.199 where you found the drive. 169 00:07:53.399 --> 00:07:56.800 Oh wow, that's clever, So it seems completely legitimate. What's 170 00:07:56.839 --> 00:07:57.279 the catch? 171 00:07:57.680 --> 00:08:00.720 Well, while the person is typing that email, the program 172 00:08:00.800 --> 00:08:03.439 is silently stealing their passwords and sending them to the 173 00:08:03.480 --> 00:08:07.040 penetration tester's email account. The whole thing from plugging in 174 00:08:07.079 --> 00:08:09.879 the drive to the passwords being sent took about thirty seconds. 175 00:08:09.959 --> 00:08:13.040 Wow. So not only does it steal your passwords, but 176 00:08:13.120 --> 00:08:15.600 it uses your own email to send them exactly. 177 00:08:16.120 --> 00:08:18.519 The author of the book even uses his real email 178 00:08:18.560 --> 00:08:21.199 address in the example to show how convincing it can be. 179 00:08:21.800 --> 00:08:24.319 I'm never looking at a USB drive the same way again. 180 00:08:24.600 --> 00:08:28.040 So the takeaway here is don't plug in random devices, 181 00:08:28.560 --> 00:08:32.120 especially not at work. You never know what they might contain. Now, 182 00:08:32.159 --> 00:08:35.159 thinking about these USB tricks and sneaky programs. Leads to 183 00:08:35.200 --> 00:08:37.639 another question, what about keyloggers. 184 00:08:38.159 --> 00:08:42.399 Ah, keyloggers the silent spies of the digital world. They 185 00:08:42.399 --> 00:08:46.159 can be hardware or software, and both are equally concerning. 186 00:08:46.720 --> 00:08:49.679 So hardware keyloggers we're talking about like a little device 187 00:08:49.720 --> 00:08:51.639 that sits between your keyboard and your computer. 188 00:08:51.720 --> 00:08:53.519 R Yeah, like some sort of secret recording device. 189 00:08:53.639 --> 00:08:57.120 Yeah, you got it. They're small and they log every keystroke. 190 00:08:57.200 --> 00:08:59.759 But to install one you need physical access to the computer, 191 00:09:00.120 --> 00:09:02.480 so they're not as common as software keyloggers. 192 00:09:02.600 --> 00:09:05.120 Okay, so software keyloggers those are the ones that really 193 00:09:05.159 --> 00:09:07.600 watch out for. But how would you even know if 194 00:09:07.639 --> 00:09:08.759 you had one in your computer? 195 00:09:09.000 --> 00:09:12.720 That's the scary part. They can be completely invisible, silently 196 00:09:12.799 --> 00:09:17.320 recording everything you type, emails, passwords, credit card numbers, private messages, 197 00:09:17.600 --> 00:09:18.519 literally everything. 198 00:09:18.799 --> 00:09:22.399 Okay, now that is creepy. The book actually shows some 199 00:09:22.559 --> 00:09:26.279 visuals of what a keylogger can capture. Figures one point 200 00:09:26.360 --> 00:09:29.440 one five and one point one six show a normal 201 00:09:29.519 --> 00:09:32.639 email and then the text file created by a keylogger 202 00:09:32.720 --> 00:09:35.080 with every single letter and number. It's a lot of 203 00:09:35.120 --> 00:09:38.559 sensitive information. So how do these things even get onto 204 00:09:38.600 --> 00:09:39.360 our computers? 205 00:09:39.799 --> 00:09:42.039 A lot of times it's through drive by downloads. You 206 00:09:42.120 --> 00:09:45.399 visit a website, maybe one offering free stuff, but hidden 207 00:09:45.399 --> 00:09:48.279 in that download is a keylogger that installs itself without 208 00:09:48.279 --> 00:09:48.960 you ever knowing. 209 00:09:49.559 --> 00:09:51.879 So those two good to be true offers often are. 210 00:09:52.759 --> 00:09:54.960 But is there anything we can do to protect ourselves 211 00:09:54.960 --> 00:09:55.919 from these keyloggers? 212 00:09:56.120 --> 00:09:59.279 Yes, thankfully. Remember those tools we talked about earlier, malware 213 00:09:59.279 --> 00:10:01.919 bytes and spy I bought. They're really good at detecting 214 00:10:02.000 --> 00:10:05.159 and removing keyloggers. That's why having multiple layers of security 215 00:10:05.200 --> 00:10:06.240 is so important, like. 216 00:10:06.200 --> 00:10:09.159 Having a digital security guard always on the lookout. Okay, 217 00:10:09.159 --> 00:10:11.639 I gotta ask about Max. Are they immune to all 218 00:10:11.639 --> 00:10:13.840 this stuff or are they just as vulnerable as Windows. 219 00:10:14.159 --> 00:10:17.279 Max are generally considered to be more secure, but that 220 00:10:17.320 --> 00:10:20.080 doesn't mean they're invincible. They can still get viruses in 221 00:10:20.120 --> 00:10:23.679 malware just like any other computer. The difference is the 222 00:10:23.759 --> 00:10:27.679 number of threats targeting MAX is way lower compared to Windows. 223 00:10:27.799 --> 00:10:30.000 Can you quantify that difference? Like, what are we talking 224 00:10:30.039 --> 00:10:30.519 about here? 225 00:10:30.639 --> 00:10:33.120 The book says there was something like twenty to thirty 226 00:10:33.240 --> 00:10:36.960 Mac attacks per year compared to a whopping sixty five 227 00:10:37.039 --> 00:10:39.080 thousand Windows attacks per day. 228 00:10:39.360 --> 00:10:42.120 Wow, that's a massive difference. I know you mainly use 229 00:10:42.159 --> 00:10:44.840 Windows machines for your work. But have you ever had 230 00:10:44.919 --> 00:10:46.120 a virus on a Mac? 231 00:10:46.279 --> 00:10:49.000 Actually? Yeah, but it was on purpose. I was doing 232 00:10:49.000 --> 00:10:51.320 research on a specific Mac virus and I wanted to 233 00:10:51.360 --> 00:10:53.200 see how it worked firsthand. In that case, it was 234 00:10:53.240 --> 00:10:55.519 super easy to get rid of. I just deleted the 235 00:10:55.559 --> 00:10:56.480 file and that was it. 236 00:10:56.720 --> 00:10:59.399 So MAX might be a little safer for basic browsing 237 00:10:59.480 --> 00:11:01.919 and email. Well, but it's still important to be careful. 238 00:11:02.480 --> 00:11:05.799 But regardless of what operating system you're using, strong passwords 239 00:11:05.879 --> 00:11:08.759 are absolutely essential, right, Absolutely. 240 00:11:08.960 --> 00:11:11.679 A strong password is your first line of defense against 241 00:11:11.799 --> 00:11:14.559 any hacking attempt. And I don't mean password one, two 242 00:11:14.559 --> 00:11:15.759 three or your dog's name. 243 00:11:16.039 --> 00:11:18.600 Yeah that those are basically an open invitation for hackers. 244 00:11:19.320 --> 00:11:21.879 So how do we create passwords that are both strong 245 00:11:22.120 --> 00:11:25.480 and memorable, because with all the accounts we have these days, 246 00:11:25.639 --> 00:11:28.399 it's impossible to remember a bunch of complex passwords. 247 00:11:28.679 --> 00:11:31.159 The book has a good suggestion. You can build a 248 00:11:31.200 --> 00:11:34.120 strong password around a word you already know. Like let's 249 00:11:34.159 --> 00:11:36.679 say the word is Apple. You could make a strong 250 00:11:36.720 --> 00:11:40.120 password by adding some capital letters, special characters, and numbers, 251 00:11:40.559 --> 00:11:44.240 something like apple at twenty thirteen three would be really 252 00:11:44.240 --> 00:11:44.919 hard to crack. 253 00:11:45.159 --> 00:11:47.879 That's a great tip. It's way easier to remember if 254 00:11:47.879 --> 00:11:50.720 you start with a familiar word. But even with tricks 255 00:11:50.759 --> 00:11:53.639 like that, managing a ton of different passwords is a pain. 256 00:11:54.000 --> 00:11:55.519 I mean, who can keep track of all that? 257 00:11:55.519 --> 00:11:58.200 That's where password management tools come in handy. They're like 258 00:11:58.399 --> 00:12:01.600 digital vaults that store all your passwords securely and make 259 00:12:01.639 --> 00:12:03.240 them easy to access when you need them. 260 00:12:03.399 --> 00:12:05.320 So it's like a master key for all your online 261 00:12:05.320 --> 00:12:06.360 accounts exactly. 262 00:12:06.399 --> 00:12:09.159 There are two popular ones, key Pass and last Pass. 263 00:12:09.759 --> 00:12:12.360 Key Pass stores your passwords locally on your device, so 264 00:12:12.399 --> 00:12:14.720 if you're worried about privacy, that's a good option. 265 00:12:15.039 --> 00:12:17.440 So your passwords stay under your control, you don't have 266 00:12:17.480 --> 00:12:20.360 to trust the third party with them. What about last pass? 267 00:12:21.120 --> 00:12:23.320 Last pass is a little different. It has a free 268 00:12:23.399 --> 00:12:26.159 version for your desktop and a paid version for like 269 00:12:26.480 --> 00:12:29.279 twelve dollars a year. With the paid version, you can 270 00:12:29.320 --> 00:12:32.080 access your passwords from your phone, and it supports ubikey, 271 00:12:32.279 --> 00:12:34.399 a hardware device for two factor authentication. 272 00:12:34.559 --> 00:12:37.519 That's a good point. Speaking of security risks, what about 273 00:12:37.559 --> 00:12:41.559 auto saving passwords in web browsers. I'll admit I love 274 00:12:41.600 --> 00:12:44.159 the convenience, but it always felt a little risky. 275 00:12:44.559 --> 00:12:48.480 You're right to be cautious. Especially on public computers. Auto 276 00:12:48.559 --> 00:12:51.759 saving passwords on a public computer is basically giving anyone 277 00:12:51.759 --> 00:12:54.639 who uses that computer after you access to your accounts. 278 00:12:55.159 --> 00:12:57.759 There's actually a software mentioned in the book called web 279 00:12:57.840 --> 00:13:00.279 browser Passview, and it can show you all the safe 280 00:13:00.320 --> 00:13:02.840 passwords and a browser instantly. 281 00:13:02.440 --> 00:13:04.840 So anyone could get into my bank account, my social 282 00:13:04.879 --> 00:13:06.559 media everything just like that. 283 00:13:06.879 --> 00:13:10.039 Yep. The author even talks about how he's found saved 284 00:13:10.080 --> 00:13:13.960 passwords on computers in hotel business centers. It's scary how 285 00:13:13.960 --> 00:13:14.519 easy it is. 286 00:13:14.600 --> 00:13:18.399 Okay, I'm definitely rethinking my password saving abbots. So convenience 287 00:13:18.440 --> 00:13:20.840 should not come at the cost of security exactly. 288 00:13:21.120 --> 00:13:24.080 It's a simple setting to change too. The book actually 289 00:13:24.200 --> 00:13:27.360 lists the steps for how to disable password saving and 290 00:13:27.440 --> 00:13:32.679 all the major browsers Chrome, Firefox, Safari, even Internet Explorer. 291 00:13:32.919 --> 00:13:34.519 Okay, I'm adding that to my to do list. 292 00:13:34.639 --> 00:13:34.919 Yeah. 293 00:13:35.000 --> 00:13:38.320 So we've talked about creating strong passwords and protecting them, 294 00:13:38.759 --> 00:13:41.559 but what happens if someone tries to crack our passwords 295 00:13:41.679 --> 00:13:44.360 using some brute force method? Is that even possible? 296 00:13:44.480 --> 00:13:48.000 Unfortunately? Yeah, it is. There are password cracking tools out 297 00:13:48.039 --> 00:13:51.360 there like offcrack that are used by forensic investigators, but 298 00:13:51.840 --> 00:13:53.480 they can be used by hackers as well. 299 00:13:53.919 --> 00:13:57.320 Off crack That sounds intense. What is it and how 300 00:13:57.360 --> 00:13:57.960 does it work? 301 00:13:58.080 --> 00:14:01.320 It uses something called rainbow tape, which are basically pre 302 00:14:01.399 --> 00:14:04.759 computed tables of password hashes, So instead of trying every 303 00:14:04.840 --> 00:14:08.600 possible combination, offcrack can just compare hashes, which makes it 304 00:14:08.679 --> 00:14:10.279 much faster at guessing passwords. 305 00:14:10.360 --> 00:14:13.000 So the stronger and more unique our passwords are, the better. 306 00:14:13.159 --> 00:14:16.320 Exactly. The free version of offcrack is limited and it 307 00:14:16.399 --> 00:14:19.720 usually can't crack passwords with special characters, but the paid 308 00:14:19.759 --> 00:14:21.840 versions are more powerful, So that's why it's so important 309 00:14:21.840 --> 00:14:23.840 to use a strong password structure like the one we 310 00:14:23.840 --> 00:14:25.039 talked about earlier. 311 00:14:24.919 --> 00:14:28.799 Strong Passwords Check. Now, let's move on to email security. 312 00:14:29.840 --> 00:14:32.960 Email is connected to so many other online services, and 313 00:14:33.039 --> 00:14:35.679 it seems like a prime target for attacks, don't you think. 314 00:14:35.840 --> 00:14:38.960 Yeah? For sure, attackers know that our email accounts hold 315 00:14:39.000 --> 00:14:41.799 a ton of person and information, and they're often the 316 00:14:41.919 --> 00:14:45.240 key to accessing other accounts. That's why phishing attacks are 317 00:14:45.240 --> 00:14:45.759 so common. 318 00:14:45.919 --> 00:14:49.080 Fishing that's when someone pretends to be a legitimate company 319 00:14:49.159 --> 00:14:52.639 or organization to trick you into giving them your information, right. 320 00:14:52.720 --> 00:14:55.320 Exactly like those emails that say your account has been 321 00:14:55.360 --> 00:14:57.919 compromised or there's a problem with your order, and they're 322 00:14:57.919 --> 00:15:00.440 getting really good at making them look official. The book 323 00:15:00.480 --> 00:15:03.799 has some examples, and they're scary how convincing they look. 324 00:15:04.039 --> 00:15:05.840 So what should we be looking out for. What are 325 00:15:05.840 --> 00:15:06.639 some red flags? 326 00:15:06.919 --> 00:15:11.039 Well, one thing is unsolicited emails about fraud or account problems. 327 00:15:11.480 --> 00:15:13.840 Be wary of anything that's trying to create a sense 328 00:15:13.840 --> 00:15:18.279 of urgency or panic. Also, look closely at the website address. 329 00:15:18.320 --> 00:15:21.000 If it's even slightly different from the real one, that's 330 00:15:21.000 --> 00:15:24.879 a red flag, like if you see Bankofamerica dash security 331 00:15:25.039 --> 00:15:28.720 dot com instead of just Bankofamerica dot com. Or sometimes 332 00:15:28.759 --> 00:15:30.919 they'll use a string of numbers that looks like an 333 00:15:30.960 --> 00:15:33.519 IP address instead of a normal website name. 334 00:15:33.639 --> 00:15:35.480 So it's those little details that can trip us up 335 00:15:35.480 --> 00:15:36.080 anything else. 336 00:15:36.480 --> 00:15:39.279 Also, be suspicious of emails that ask for a ton 337 00:15:39.320 --> 00:15:42.720 of personal information. If they're asking for your social Security number, 338 00:15:42.759 --> 00:15:45.480 your beta birth, your mother's maiden name, all that stuff. 339 00:15:45.519 --> 00:15:48.080 Be very careful, and we should never respond to email 340 00:15:48.120 --> 00:15:50.799 requests for information from financial institutions right right. 341 00:15:51.039 --> 00:15:53.279 If you get an email that seems suspicious, the best 342 00:15:53.279 --> 00:15:55.440 thing to do is contact the company directly through their 343 00:15:55.440 --> 00:15:58.440 official website or phone number, don't click on any links 344 00:15:58.480 --> 00:15:59.039 in the email. 345 00:15:59.240 --> 00:16:02.480 Okay, good. So let's say our email does get hacked. 346 00:16:02.720 --> 00:16:03.480 What could happen? 347 00:16:03.720 --> 00:16:06.759 Well, hackers aren't always just interested in your emails. They 348 00:16:06.799 --> 00:16:09.600 often want to use your email to access other accounts, 349 00:16:09.639 --> 00:16:13.759 like your bank account, your social media, online stores, even 350 00:16:13.840 --> 00:16:15.039 your other email accounts. 351 00:16:15.039 --> 00:16:18.200 It's like losing the keys to your entire online life exactly. 352 00:16:18.759 --> 00:16:21.879 The book actually describes the scenario where a hacker gets 353 00:16:21.919 --> 00:16:25.519 access to an email account and immediately starts searching for 354 00:16:25.679 --> 00:16:29.480 keywords related to banks and online stores. It shows how 355 00:16:29.519 --> 00:16:30.960 targeted these attacks can be. 356 00:16:31.159 --> 00:16:34.480 And I'm guessing that stolen information has real monetary value. 357 00:16:34.519 --> 00:16:38.120 Oh yeah, for sure. The book mentions this guy Brian Krebs, 358 00:16:38.200 --> 00:16:41.440 a cybersecurity journalist who reported on the prices for stolen 359 00:16:41.440 --> 00:16:44.440 accounts on the black market back in twenty thirteen. The 360 00:16:44.480 --> 00:16:48.200 list included prices for all sorts of accounts like iTunes, FedEx, 361 00:16:48.279 --> 00:16:51.320 United Airlines, group on, even Facebook accounts. 362 00:16:51.360 --> 00:16:54.200 Wow, it's crazy to think that even seemingly unimportant accounts 363 00:16:54.240 --> 00:16:55.960 could be valuable to hackers. 364 00:16:55.720 --> 00:16:58.919 Right, and social media accounts are especially vulnerable because we 365 00:16:58.960 --> 00:17:01.600 tend to trust them. The book shows a picture of 366 00:17:01.639 --> 00:17:04.960 a fake Facebook notification email designed to steal your login 367 00:17:05.039 --> 00:17:06.720 information and it looks so real. 368 00:17:07.000 --> 00:17:09.680 So those messages that say our account has been hacked 369 00:17:09.720 --> 00:17:12.519 or we need to confirm our password, those are often 370 00:17:12.599 --> 00:17:14.279 just phishing attempts in disguise. 371 00:17:14.480 --> 00:17:18.519 Yeah, exactly. And it's not just emails either, fake friend requests, 372 00:17:18.960 --> 00:17:21.799 links to quizzes and games, messages that say you've been 373 00:17:21.839 --> 00:17:24.079 tagged in a photo. They can all be used to 374 00:17:24.119 --> 00:17:27.240 trick you into clicking on something or giving up your information. 375 00:17:27.519 --> 00:17:30.160 It's a digital jungle out there, and it's not just 376 00:17:30.200 --> 00:17:33.359 those direct attempts either. We also need to be careful 377 00:17:33.400 --> 00:17:35.759 about file attachment attacks. 378 00:17:35.400 --> 00:17:38.279 Right right, attachments can be a way for hackers to 379 00:17:38.319 --> 00:17:41.880 deliver malware, and they're getting really good at disguising those attachments. 380 00:17:41.920 --> 00:17:44.759 They might look like a stand document, a traffic ticket, 381 00:17:45.039 --> 00:17:48.119 a notification about a package, anything that you might be 382 00:17:48.359 --> 00:17:49.880 curious about or worried about. 383 00:17:50.200 --> 00:17:53.240 So what opening and attachment could basically unleash a virus 384 00:17:53.240 --> 00:17:53.920 on your computer? 385 00:17:54.480 --> 00:17:58.240 Yeah pretty much. Zip files especially are known for having 386 00:17:58.279 --> 00:18:02.000 malware in and inside, so super careful about opening any attachments, 387 00:18:02.319 --> 00:18:04.720 especially if they're unexpected or from someone you don't know. 388 00:18:05.160 --> 00:18:07.799 It sounds like being skeptical and verifying everything is our 389 00:18:07.799 --> 00:18:08.480 best defense. 390 00:18:08.839 --> 00:18:12.359 Absolutely, pay attention to website addresses, don't click on links 391 00:18:12.359 --> 00:18:15.119 and emails you weren't expecting, and if something seems off, 392 00:18:15.200 --> 00:18:16.960 always trust your gut and double check it. 393 00:18:17.400 --> 00:18:20.839 Good advice. So we're building up a pretty solid defense here. 394 00:18:20.839 --> 00:18:24.519 But are there any other ways to protect our accounts? 395 00:18:25.200 --> 00:18:28.720 Yes, there's something called two factor authentication or two FA 396 00:18:28.839 --> 00:18:31.880 for short, and it's super helpful. Basically, it means you 397 00:18:31.960 --> 00:18:35.000 need two things to log into your account, your password 398 00:18:35.400 --> 00:18:36.799 and a code that's sent to your phone. 399 00:18:36.839 --> 00:18:39.640 So even if someone steals my password, they still can't 400 00:18:39.640 --> 00:18:41.319 get into my account without that code. 401 00:18:41.480 --> 00:18:43.559