We’re all busy people with busy lives. We only have so much time and energy. So when security people dole out to-do lists, we really need to focus on the tips with the most bang for the buck. Conversely, we need to avoid wasting people’s precious resources on advice that is no longer valid or worth the effort. Today, we’ll debunk several of these “Hacklore” tips with security guru Bob Lord.

Interview Notes

Hacklore: https://www.hacklore.org/letter
Hacklore resources: https://www.hacklore.org/resources
Elevator (un)safety analogy: https://medium.com/@boblord/psa-elevator-un-safety-7ac69a9498de
DNC Security Checklist: https://democrats.org/security/
CISA Secure by Design: https://www.cisa.gov/securebydesign
MITRE’s 2007 Unforgivable Vulnerabilities (PDF): https://cwe.mitre.org/documents/unforgivable_vulns/unforgivable.pdf
Take 9: https://pausetake9.org/
Consumer Reports Security Planner tool: https://securityplanner.consumerreports.org/
EFF security planning: https://ssd.eff.org/module/your-security-plan
Removing online data: https://firewallsdontstopdragons.com/data-diet-introduction/
Generate passphrases with d20 dice! https://d20key.com/#/
Dragon coupons: https://fdsd.me/coupons/
Rafifi (film): https://www.imdb.com/title/tt0048021/
Xkcd password strength: https://xkcd.com/936/

Further Info

My book: https://fdsd.me/book
My newsletter: https://fdsd.me/newsletter
Support the mission: https://fdsd.me/support
Give the gift of privacy and security: https://fdsd.me/coupons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch

0:00:14: Intro
0:00:25: Survey, promo wrap-up
0:01:30: Interview setup
0:02:22: Lingo definitions
0:02:52: What drove you to launch Hacklore?
0:07:12: Is this advice truly wrong?
0:11:51: 1) Avoid public WiFi
0:17:38: 2) Never scan QR codes
0:22:43: 3) Never charge devices from public USB ports
0:24:38: 4) Turn off Bluetooth and NFC
0:28:25: 5) Regularly clear cookies
0:32:47: 6) Regularly change passwords
0:38:19: Why do we not have web password standards?
0:44:24: Any bad tips that didn’t make the cut?
0:45:53: WIll Hacklore be regularly updated?
0:46:32: What has been the response to Hacklore?
0:48:08: So what are the actual top security tips?
0:49:56: How do we shift the onus to software makers?
0:53:14: What other resources can you recommend?
0:55:40: What’s next for you?
0:56:53: Wrap-up
1:00:40: Generating passphrases
1:02:00: Accessing show notes
1:03:08: Dragon coupons
1:03:40: Patron podcast preview
1:04:24: Looking ahead

Interview Notes

Further Info

Table of Contents