1
00:00:02,800 -->
00:00:08,280
Welcome to the Shared Security Podcast, the longest running cybersecurity and privacy
2
00:00:08,280 -->
00:00:11,040
show for actual humans.
3
00:00:11,040 -->
00:00:17,680
No jargon, no hype, just honest analysis from industry veterans who've seen everything
4
00:00:17,680 -->
00:00:19,080
and survived it.
5
00:00:19,080 -->
00:00:24,520
Each week we break down the stories that matter, expose the nonsense that doesn't, and give
6
00:00:24,520 -->
00:00:30,120
you the tools to stay safe in a world where everything is connected and nothing
7
00:00:30,120 -->
00:00:31,760
is guaranteed.
8
00:00:31,760 -->
00:00:37,540
This is Shared Security.
9
00:00:37,540 -->
00:00:42,360
This week on Shared Security we're talking about a story that exposes a hard truth about
10
00:00:42,360 -->
00:00:43,960
digital identity.
11
00:00:43,960 -->
00:00:48,560
When a driver's license becomes the proof you need to get online, it can also become
12
00:00:48,560 -->
00:00:50,520
a high value target.
13
00:00:50,520 -->
00:00:57,200
So reporter Brian Krebs reports that a cache of purported driver's license data affecting
14
00:00:57,200 -->
00:01:00,760
153 million people is being offered for sale.
15
00:01:00,880 -->
00:01:05,600
Well we'll discuss what that says about identity verification, data brokers, and verification
16
00:01:05,600 -->
00:01:13,320
vendors, breach responsibility, and why just upload your ID, what could possibly go wrong,
17
00:01:13,320 -->
00:01:16,520
is never a simple security or privacy decision.
18
00:01:16,520 -->
00:01:22,440
And joining me for this conversation is my co-host, Scott Wright and Kevin Tackett.
19
00:01:22,440 -->
00:01:23,440
Welcome guys.
20
00:01:23,440 -->
00:01:24,440
Yeah, I wanna.
21
00:01:24,440 -->
00:01:29,000
Whatever, it's just another, what's 153 million people.
22
00:01:29,040 -->
00:01:30,880
In North America by the way.
23
00:01:30,880 -->
00:01:31,880
Includes it.
24
00:01:31,880 -->
00:01:33,280
Would you be worried about it?
25
00:01:33,280 -->
00:01:34,280
No.
26
00:01:34,280 -->
00:01:39,320
Yes, there are Canadians affected in this, so it's not just the United States.
27
00:01:39,320 -->
00:01:43,360
So there's been some updates to this story, so we'll link in the show notes that Brian
28
00:01:43,360 -->
00:01:46,320
Krebs actually did a little more research in it.
29
00:01:46,320 -->
00:01:51,840
Apparently this is attributed to a company called IDScan because there was some, I
30
00:01:51,840 -->
00:01:53,360
guess speculation, right?
31
00:01:53,360 -->
00:01:57,920
If this was like Department of Homeland Security or, you know, a government entity that
32
00:01:57,920 -->
00:02:02,080
was breached, because as you know, when you go to the airport, you provide your ID or
33
00:02:02,080 -->
00:02:08,280
your passports, but after further research, it seems to be this IDScan, which partners
34
00:02:08,280 -->
00:02:10,880
with a lot of different companies.
35
00:02:10,880 -->
00:02:17,720
I think this one in particular was like some marijuana dispensary in Las Vegas, apparently.
36
00:02:17,720 -->
00:02:19,560
So like, this is a.
37
00:02:19,560 -->
00:02:20,560
Not too shady.
38
00:02:20,560 -->
00:02:23,280
No, I mean, if it's legal, right?
39
00:02:23,280 -->
00:02:26,840
But you still have to present your ID and then that ID gets scanned and then
40
00:02:26,920 -->
00:02:28,280
it goes somewhere.
41
00:02:28,280 -->
00:02:34,960
So this is beyond, I think, what we've been talking about on this podcast about online
42
00:02:34,960 -->
00:02:38,240
age verification and the problems with that.
43
00:02:38,240 -->
00:02:44,520
But this now expands on to when you're physically handing your ID to somebody to,
44
00:02:44,520 -->
00:02:47,160
I mean, it could be you could be going to a concert.
45
00:02:47,160 -->
00:02:50,800
You could be going to, you know, a marijuana dispensary is one of many
46
00:02:50,800 -->
00:02:53,840
things that ask you for your ID.
47
00:02:53,840 -->
00:02:59,640
I think this is this is the transition from the bouncer at the club, making sure
48
00:02:59,640 -->
00:03:04,480
you're 18 or 21 by looking at your ID and verifying it as a.
49
00:03:04,520 -->
00:03:06,800
Yeah, this looks real, right?
50
00:03:06,800 -->
00:03:12,440
Not that I've ever printed fake IDs, but, you know, back in the day, supposedly,
51
00:03:12,440 -->
00:03:16,560
hypothetically, that that was something you could do that transitioned
52
00:03:16,560 -->
00:03:19,400
to a technological solution.
53
00:03:19,560 -->
00:03:22,840
And I think that what we're seeing is the same thing we've seen
54
00:03:22,880 -->
00:03:27,360
with so many different, oh, we have to do some things, right?
55
00:03:27,680 -->
00:03:31,720
We we roll out a solution, a company says, I can do that.
56
00:03:31,720 -->
00:03:33,680
And they build very quickly.
57
00:03:33,680 -->
00:03:37,960
And then nobody holds them to a standard that's reasonable, right?
58
00:03:38,360 -->
00:03:43,720
I've talked to, you know, companies that do this type of ID verification.
59
00:03:43,920 -->
00:03:48,120
We've worked with customers that are using them.
60
00:03:48,360 -->
00:03:52,080
And we've said for years, this mechanism
61
00:03:52,080 -->
00:03:54,800
doesn't appear to be secure and I want to be very clear.
62
00:03:54,800 -->
00:04:00,400
I'm not I'm not claiming that somehow Evan was smarter than the average bear, right?
63
00:04:00,800 -->
00:04:05,400
We've heard this from the industry as a whole, that they're running down this path.
64
00:04:05,600 -->
00:04:09,560
The only thing holding them to a level of standard, typically,
65
00:04:09,920 -->
00:04:14,040
is the contract they have with whoever they had it with that says
66
00:04:14,040 -->
00:04:18,560
they should do good things, you know, be secure, whatever.
67
00:04:18,840 -->
00:04:21,120
Right. I'm I'm laughing at it right now.
68
00:04:21,160 -->
00:04:23,880
We're dealing with it security is with a customer
69
00:04:24,200 -->
00:04:30,120
that is asking us why we don't have certain controls they think are reasonable
70
00:04:30,120 -->
00:04:34,640
at the same time that there's a conversation about breaches they've been part of.
71
00:04:35,000 -->
00:04:38,120
Right. That's what in my opinion, that's what happened here.
72
00:04:38,280 -->
00:04:41,320
We had a company that stood up something to solve a problem
73
00:04:41,480 -->
00:04:46,400
and they solved the problem and secure themselves well enough.
74
00:04:46,400 -->
00:04:47,280
Yeah.
75
00:04:47,320 -->
00:04:52,080
This will continue to happen for as long as we don't hold people accountable
76
00:04:52,720 -->
00:04:53,720
for the loss.
77
00:04:53,720 -->
00:04:57,000
And I mean, effectively accountable, not just, oh, man,
78
00:04:57,000 -->
00:05:00,160
everybody got a year of free credit monitoring, because that's where it'll
79
00:05:00,160 -->
00:05:02,720
come out of this. We'll all get another three year.
80
00:05:03,040 -->
00:05:07,120
I think I'm currently a year four thousand that I've been right.
81
00:05:07,200 -->
00:05:09,560
I've lost track. Right.
82
00:05:09,560 -->
00:05:12,120
My my favorite is they don't stack.
83
00:05:12,880 -->
00:05:14,000
Right. Like you don't.
84
00:05:14,000 -->
00:05:16,240
OK, so I've got 2026 covered.
85
00:05:16,240 -->
00:05:18,280
Do I get 2027? No, no, no, no, no.
86
00:05:18,280 -->
00:05:20,600
You just get 2026 covered again.
87
00:05:21,320 -->
00:05:23,080
Yeah, I know. Yeah.
88
00:05:23,080 -->
00:05:27,160
I think it's really interesting and going back into the age verification
89
00:05:27,280 -->
00:05:32,480
debate, there are so many of these companies out there now that are doing
90
00:05:32,840 -->
00:05:37,440
ID verification, age verification, whatever flavor of verification
91
00:05:37,440 -->
00:05:39,000
you want to call it.
92
00:05:39,000 -->
00:05:43,920
And there is no regulation or, you know,
93
00:05:43,920 -->
00:05:47,000
laws around how this this information is stored.
94
00:05:47,000 -->
00:05:51,440
And so to your point, Kevin, about a breach, like this is going to
95
00:05:51,440 -->
00:05:52,680
continue to happen.
96
00:05:52,680 -->
00:05:57,080
And it's kind of scary to think about that any random company
97
00:05:57,080 -->
00:06:00,760
can now just partner with these organizations and it's going to vary
98
00:06:00,760 -->
00:06:04,320
by state and institution and business and all these things.
99
00:06:04,320 -->
00:06:08,240
And this is just another way to expand out the attack
100
00:06:08,280 -->
00:06:14,120
surface of very personal and, you know, these are driver's licenses.
101
00:06:14,120 -->
00:06:20,480
And I it just blows my mind that here we are again talking about this
102
00:06:20,480 -->
00:06:22,040
and it's only getting worse.
103
00:06:22,040 -->
00:06:24,000
Well, like we've talked about in the past,
104
00:06:24,000 -->
00:06:27,000
what was that dude that was running the business out of his apartment
105
00:06:27,000 -->
00:06:29,720
that was just doing data collection and selling it to marketing?
106
00:06:30,320 -->
00:06:32,760
Yep. Well, we've seen through lots of these companies
107
00:06:32,760 -->
00:06:35,880
and I don't know about this one, but they are data brokers
108
00:06:35,920 -->
00:06:38,760
in and of themselves, whether they're doing it for marketing
109
00:06:38,760 -->
00:06:42,360
or whether they're doing it for verification, they are a data broker.
110
00:06:42,640 -->
00:06:48,240
And as long as we allow anybody, private organization, individuals,
111
00:06:48,240 -->
00:06:53,120
government agencies, what have you to collect data unfettered.
112
00:06:53,400 -->
00:06:59,080
And then when there's a breach, we just go, oh, man, that sucks.
113
00:06:59,080 -->
00:07:02,360
I go deal with that because I tell you right now,
114
00:07:03,120 -->
00:07:06,480
I can't go to Florida and say my driver's license
115
00:07:06,480 -->
00:07:09,040
has been compromised, give me a new number.
116
00:07:09,040 -->
00:07:10,560
That is not an auction.
117
00:07:10,560 -->
00:07:11,800
Nope. Right.
118
00:07:11,800 -->
00:07:15,760
As far as I know, I don't know any state that allows you to say
119
00:07:15,760 -->
00:07:18,040
my driver's license was compromised, give me a new number.
120
00:07:19,200 -->
00:07:20,320
Unless you lost it.
121
00:07:20,320 -->
00:07:25,120
But if you let it expire, you have the same driver's license.
122
00:07:25,120 -->
00:07:27,320
You get the same number, though. Yeah, you're right.
123
00:07:27,320 -->
00:07:29,960
Yes. So my address is the same.
124
00:07:29,960 -->
00:07:31,200
My date of birth is the same.
125
00:07:31,200 -->
00:07:33,200
The day it was issued is the same.
126
00:07:33,200 -->
00:07:34,880
You know, originally issued.
127
00:07:34,880 -->
00:07:38,040
Every piece of personal identifiable information on a driver's license
128
00:07:38,920 -->
00:07:41,640
stays the same no matter what.
129
00:07:41,640 -->
00:07:43,440
So there is no validation.
130
00:07:43,440 -->
00:07:46,440
So at what point do we then say, OK,
131
00:07:46,680 -->
00:07:49,200
driver's license are no longer good for ID
132
00:07:49,200 -->
00:07:51,360
because they've been compromised so many times.
133
00:07:51,360 -->
00:07:52,920
What's next?
134
00:07:52,920 -->
00:07:55,120
Fingerprints. Well, digital ID,
135
00:07:55,120 -->
00:07:57,600
which has already been rolling out.
136
00:07:57,720 -->
00:07:59,680
Some states actually have this now
137
00:07:59,680 -->
00:08:02,200
where you can have your digital ID on your phone
138
00:08:02,200 -->
00:08:05,520
and you can go through security at the airport with it.
139
00:08:05,520 -->
00:08:07,840
And I'm seeing this more now.
140
00:08:08,240 -->
00:08:10,280
But then just like everything else,
141
00:08:10,280 -->
00:08:11,840
what happens when you lose your phone,
142
00:08:11,840 -->
00:08:14,000
which people lose their phones all the time.
143
00:08:14,000 -->
00:08:18,560
So it's, you know, wallet or phone, physical piece of paper
144
00:08:18,560 -->
00:08:21,480
or ID card versus a digital version.
145
00:08:21,800 -->
00:08:23,880
I think to your point, Kevin, it's going to stay the same.
146
00:08:23,880 -->
00:08:25,880
If I lose my phone, they're just going to issue
147
00:08:25,880 -->
00:08:28,760
another digital ID with the same number.
148
00:08:29,360 -->
00:08:33,160
Right. Well, what we need to do, in my opinion,
149
00:08:33,920 -->
00:08:38,840
what we need to do is hold people accountable
150
00:08:39,600 -->
00:08:41,120
for the damage they've done.
151
00:08:41,120 -->
00:08:42,040
It's that simple.
152
00:08:42,040 -->
00:08:43,640
Yeah, it really is.
153
00:08:43,640 -->
00:08:46,320
The minute you start and I know
154
00:08:46,560 -->
00:08:49,520
I willingly be called the hypocrite that I probably am here
155
00:08:49,680 -->
00:08:52,360
because there is a level of victim blaming that I'm doing.
156
00:08:52,600 -->
00:08:55,360
This organization is the victim,
157
00:08:55,840 -->
00:08:58,160
is a victim because they were hacked.
158
00:08:58,400 -->
00:09:00,000
And we don't know about this specific one,
159
00:09:00,000 -->
00:09:02,760
but we, you know, as well as I do that in the past,
160
00:09:02,760 -->
00:09:05,520
we have seen that they don't have even the basic security
161
00:09:05,520 -->
00:09:08,400
controls that we would expect an organization to have.
162
00:09:08,720 -->
00:09:10,800
I don't know about this one, right?
163
00:09:10,800 -->
00:09:13,400
At what point do we say, OK, you're no longer the victim,
164
00:09:13,400 -->
00:09:15,560
you're part of the problem.
165
00:09:15,960 -->
00:09:17,920
Yeah. And I don't know where that line is,
166
00:09:17,920 -->
00:09:21,120
but I think it needs to be figured out somewhat soon.
167
00:09:21,600 -->
00:09:25,000
I think it's interesting to me when we talk about physical IDs,
168
00:09:25,040 -->
00:09:29,040
like this used to be so simple, like literally,
169
00:09:29,040 -->
00:09:33,400
like just like 10 years ago, maybe even further in 10 years.
170
00:09:33,400 -->
00:09:36,200
But I'm just thinking like we didn't we were never recording
171
00:09:36,200 -->
00:09:38,920
people's driver's license when you went to go rent a car
172
00:09:38,920 -->
00:09:41,880
or when you went to show your ID at a restaurant
173
00:09:41,880 -->
00:09:44,520
or, you know, purchasing alcohol, what like.
174
00:09:45,360 -->
00:09:48,280
That's not true. No. Sorry.
175
00:09:48,280 -->
00:09:51,600
We were recording driver's licenses when you rented a car
176
00:09:52,360 -->
00:09:53,960
the 27 years ago.
177
00:09:53,960 -->
00:09:56,920
And I only know that because I worked at Alamo 27 years ago.
178
00:09:56,920 -->
00:09:58,760
OK, so their quick rent system.
179
00:09:58,760 -->
00:10:04,320
We were storing credit card drivers license numbers then. OK.
180
00:10:04,320 -->
00:10:08,680
But. But the rest of what you said is absolutely correct.
181
00:10:08,920 -->
00:10:13,240
When you walked into a restaurant and showed ID to pick up your reservation,
182
00:10:13,240 -->
00:10:16,680
which I've had to do not always, but there are times you have to do that.
183
00:10:17,120 -->
00:10:18,320
They don't record it.
184
00:10:18,320 -->
00:10:21,760
I just read an entire rent by somebody on Reddit.
185
00:10:21,880 -->
00:10:24,640
I think it was where they went into.
186
00:10:24,960 -->
00:10:28,000
I think they send Kroger's, but I don't know.
187
00:10:28,840 -->
00:10:32,200
They went to buy something and it required ID,
188
00:10:32,200 -->
00:10:34,120
whether it was alcohol, cigarettes, I don't know.
189
00:10:34,560 -->
00:10:37,400
And they took the ID and they scanned it through the register.
190
00:10:37,680 -->
00:10:40,600
And the person was complaining that that grocery store,
191
00:10:40,600 -->
00:10:44,920
whichever one it was, yep, doesn't have a privacy policy about what they're doing.
192
00:10:44,920 -->
00:10:46,240
What are you getting off of that?
193
00:10:46,240 -->
00:10:48,000
Versions that you're scanning.
194
00:10:48,040 -->
00:10:49,320
Where are you storing it?
195
00:10:49,320 -->
00:10:50,120
Where are you putting that?
196
00:10:50,120 -->
00:10:52,880
Are you, you know, every bit of that?
197
00:10:53,400 -->
00:10:55,440
And those answers aren't available to us right now.
198
00:10:55,440 -->
00:10:59,800
And we just keep running down the throwing out a tangent here, but related.
199
00:11:00,000 -->
00:11:02,680
We going down the loyalty path, right?
200
00:11:02,680 -->
00:11:04,800
Yeah, do you have a loyalty program with that grocery store?
201
00:11:04,800 -->
00:11:07,640
Do you have a lawyer program with that marijuana dispensary?
202
00:11:07,640 -->
00:11:10,120
Do you how did you verify that it was you?
203
00:11:10,120 -->
00:11:12,200
How did you get right?
204
00:11:12,200 -->
00:11:14,160
Yeah, it's just getting worse and worse.
205
00:11:14,760 -->
00:11:17,800
And we're being told it's for our own safety.
206
00:11:18,800 -->
00:11:20,760
And to protect the children, of course.
207
00:11:20,760 -->
00:11:23,040
Well, absolutely. Yeah.
208
00:11:23,040 -->
00:11:27,320
Yeah, so Scott, I think you had an interesting angle to this story, didn't you?
209
00:11:27,320 -->
00:11:31,200
Yeah, I mean, first of all, you know, my background in risk management stuff
210
00:11:31,200 -->
00:11:35,560
is interesting because what we're really talking about is transferring risk, right?
211
00:11:35,720 -->
00:11:39,520
In this business model where you go into a rental car company,
212
00:11:39,840 -->
00:11:42,000
they don't really want to have to go through all the process
213
00:11:42,000 -->
00:11:43,800
of verifying exactly who you are.
214
00:11:43,800 -->
00:11:47,600
They want to outsource that process of verifying your identity, right?
215
00:11:47,600 -->
00:11:49,560
So that's the transfer of risk.
216
00:11:49,560 -->
00:11:54,880
And what Kevin's talking about is really how do you minimize the data exposure, right?
217
00:11:54,880 -->
00:12:00,160
And so if you can minimize the information that's being stored centrally,
218
00:12:00,160 -->
00:12:04,000
especially, then that solves, you know, part of the problem.
219
00:12:04,520 -->
00:12:07,600
The other part, of course, if you do it totally decentralized
220
00:12:07,600 -->
00:12:10,200
is the problem of what happens if you lose your your device.
221
00:12:10,520 -->
00:12:13,160
So it's still a risk management problem.
222
00:12:13,160 -->
00:12:17,320
But the real issue is because, you know, when the stuff gets stolen,
223
00:12:17,560 -->
00:12:19,160
you risk impersonation, right?
224
00:12:19,160 -->
00:12:22,840
And that can have many other kinds of impacts on people,
225
00:12:23,160 -->
00:12:26,120
not just that you can go and, you know, set up a loan account
226
00:12:26,120 -->
00:12:29,480
or some other high value account in someone's name,
227
00:12:29,480 -->
00:12:32,880
but you could impersonate people and do lots of damaging things.
228
00:12:33,440 -->
00:12:38,240
And I think your comment about the digital ID is really important.
229
00:12:38,240 -->
00:12:41,440
It's certainly an area we haven't really heard a lot about.
230
00:12:41,440 -->
00:12:44,240
I know you guys know of many solutions out there.
231
00:12:44,600 -->
00:12:48,800
I would like to mention there's one here in Ottawa in Canada called Blue Inc.
232
00:12:48,800 -->
00:12:50,360
B-L-U-I-N-K.
233
00:12:50,360 -->
00:12:53,000
So if you're looking for a Canadian solution that does digital IDs,
234
00:12:53,000 -->
00:12:54,520
that's a it's a good place to go.
235
00:12:55,280 -->
00:12:58,160
But the really nice thing from a risk management point of view
236
00:12:58,160 -->
00:13:02,920
and data minimization is they're not storing data centrally, right?
237
00:13:02,960 -->
00:13:07,920
They do some scanning of your things, capture some information
238
00:13:07,920 -->
00:13:10,040
and then encrypt it and keep it locally.
239
00:13:10,040 -->
00:13:12,840
So the service itself never has that information
240
00:13:12,840 -->
00:13:15,880
and the customers of the service never have that information.
241
00:13:16,280 -->
00:13:19,520
So I think it's an elegant solution, but yeah, you're right.
242
00:13:19,520 -->
00:13:22,080
We've got to solve the issue of what happens if you lose your device.
243
00:13:22,080 -->
00:13:23,960
There's got to be backup processes.
244
00:13:23,960 -->
00:13:26,840
I don't have a whole lot of information about how the Blue Inc.
245
00:13:26,840 -->
00:13:30,280
service works, but if I get any, I'll pass it on to Tom.
246
00:13:30,280 -->
00:13:33,960
We can talk about that or provide some resources on it.
247
00:13:34,080 -->
00:13:37,720
But I think the whole idea is that way, as Kevin says,
248
00:13:37,720 -->
00:13:41,360
way too many people are storing data and not being held accountable for it.
249
00:13:41,560 -->
00:13:45,360
And I think that I was trying to think of like, what would we tell
250
00:13:45,360 -->
00:13:48,720
listeners of like, what to do about this, right?
251
00:13:49,200 -->
00:13:51,560
Yeah. And there isn't anything you can really do
252
00:13:51,560 -->
00:13:53,760
except for don't give your ID over, but then.
253
00:13:53,960 -->
00:13:57,440
Yeah, I mean, actually, there's a use case I went through recently
254
00:13:57,440 -->
00:13:59,280
where, you know, they didn't use Blue Inc.
255
00:13:59,280 -->
00:14:02,680
or digital ID as far as I know, but I had to, you know,
256
00:14:02,680 -->
00:14:05,280
to recover a Facebook account or something like that, right?
257
00:14:05,280 -->
00:14:09,160
You've got to show your front and back of your driver's license, scan it.
258
00:14:09,280 -->
00:14:11,640
It goes somewhere. I don't know where.
259
00:14:11,640 -->
00:14:14,760
I don't know what, what, you know, did I read the terms of, you know,
260
00:14:15,440 -->
00:14:17,600
privacy policies or anything like that?
261
00:14:17,600 -->
00:14:20,320
So that kind of stuff is really common now.
262
00:14:20,320 -->
00:14:24,160
And so I think you have to ask yourself, you know, where if you're
263
00:14:24,160 -->
00:14:26,600
concerned about this stuff, where is the data being stored?
264
00:14:26,960 -->
00:14:28,720
What data are they storing?
265
00:14:28,720 -->
00:14:30,520
How is it being protected?
266
00:14:30,520 -->
00:14:32,280
How is it being used or shared, right?
267
00:14:32,280 -->
00:14:36,640
And what accountability or penalties are there on them for losing it?
268
00:14:37,000 -->
00:14:39,640
Yeah, and that's just really hard to do when you're, you know,
269
00:14:39,640 -->
00:14:43,320
trying to access a service and you just like, OK, I just want to get this thing done.
270
00:14:43,320 -->
00:14:46,680
Well, I got five minutes, I'm not going to read it, 20 page privacy policy.
271
00:14:46,680 -->
00:14:50,240
And so like, and I think it was interesting about this particular attack.
272
00:14:50,240 -->
00:14:54,520
And if you read the article that was talking about how this was happening
273
00:14:54,520 -->
00:14:58,200
in real time, so the attackers actually had access to this system
274
00:14:58,200 -->
00:15:01,960
and new IDs were coming in like all the time.
275
00:15:02,080 -->
00:15:05,000
And so they had a real time feed to this access.
276
00:15:05,000 -->
00:15:09,000
So even if the company says, yeah, yeah, we delete your ID
277
00:15:09,000 -->
00:15:14,560
after so many days or whatever, like this reminds me of mage card, Kevin,
278
00:15:14,560 -->
00:15:18,200
like, you know, when you had a checkout system compromised
279
00:15:18,200 -->
00:15:21,920
and attackers are getting credit cards as the transactions are happening.
280
00:15:22,320 -->
00:15:24,760
Even if they do the right thing of like, hey, we're only capturing
281
00:15:24,760 -->
00:15:26,800
certain information or encrypting it.
282
00:15:26,800 -->
00:15:30,800
This is all happening before those processes actually start.
283
00:15:30,800 -->
00:15:36,960
So this is like the worst case scenario, in my opinion, of of how this attack is happening.
284
00:15:37,120 -->
00:15:39,880
This is the problem with application security that we have.
285
00:15:40,080 -->
00:15:42,120
Totally. And three years, right?
286
00:15:42,520 -->
00:15:48,520
The app at some point as the data, whatever we do, right?
287
00:15:48,520 -->
00:15:53,320
And we've always we've always historically talked about Alice and Bob
288
00:15:53,320 -->
00:15:57,560
and right, like transmission of data in somewhere
289
00:15:57,600 -->
00:16:02,800
where I see a huge gap in understanding is that if one end is compromised,
290
00:16:02,800 -->
00:16:06,280
what happens, you know, and yeah, this is a fun one.
291
00:16:06,480 -->
00:16:08,400
Oh, yeah, really exciting.
292
00:16:08,400 -->
00:16:10,920
Oh, well, we're going to get out of all the driver's license.
293
00:16:10,920 -->
00:16:15,560
Well, I was not at a dispensary in Las Vegas.
294
00:16:15,560 -->
00:16:21,080
I do know my driver's license has been scanned and pen into lots of systems.
295
00:16:21,080 -->
00:16:22,560
Oh, everybody's. Yeah.
296
00:16:22,560 -->
00:16:26,120
Well, mine has been more than average
297
00:16:26,640 -->
00:16:30,320
because of the name chain, the number of systems.
298
00:16:30,520 -->
00:16:33,040
Right. And I give you a good example.
299
00:16:33,040 -->
00:16:36,400
I had to change my Hilton number, my name on my Hilton account.
300
00:16:37,240 -->
00:16:41,680
I have never given Hilton my driver's license to change my name.
301
00:16:41,680 -->
00:16:43,680
I had to send them a copy of my driver's license. Wow.
302
00:16:44,360 -->
00:16:46,320
Right. And I understand why they asked for it.
303
00:16:46,320 -->
00:16:50,920
Right. Like I get the reasoning and I'm not complaining about Hilton here.
304
00:16:50,920 -->
00:16:55,680
But this is anybody who has had to go through that type of system recently.
305
00:16:56,160 -->
00:16:57,120
Tag, you're in it.
306
00:16:57,120 -->
00:16:59,880
Yeah, especially Hertz, Target, FedEx, Motorola.
307
00:17:00,480 -->
00:17:02,440
Yeah. All the ones that Brian Krebs named, right?
308
00:17:02,440 -->
00:17:04,480
Caesar's Entertainment. That's right. Yeah.
309
00:17:04,720 -->
00:17:06,400
Yeah. It's a huge list.
310
00:17:06,400 -->
00:17:13,440
And it's very hard as a consumer to, you know, unless you just literally say,
311
00:17:13,440 -->
00:17:18,120
I'm not giving you my ID and then therefore you're just not going to use these services.
312
00:17:18,120 -->
00:17:22,680
I mean, I even had my ID scanned for a reservation at a restaurant.
313
00:17:23,120 -->
00:17:26,880
Like it's insane how much this is happening now.
314
00:17:26,880 -->
00:17:30,000
So we just don't have great advice for everybody.
315
00:17:30,480 -->
00:17:33,120
Sorry. The advice is how this sucks.
316
00:17:33,320 -->
00:17:34,840
Yeah, it just sucks, right?
317
00:17:34,840 -->
00:17:39,000
Until there is more legislation or, you know, something changes.
318
00:17:39,000 -->
00:17:42,160
But I don't see this getting any better, unfortunately.
319
00:17:42,160 -->
00:17:44,000
And you know my opinion of legislation.
320
00:17:44,000 -->
00:17:45,840
Oh, I know. It's not going to help.
321
00:17:45,840 -->
00:17:49,280
No. No matter what country it is, it's probably not going to help.
322
00:17:50,040 -->
00:17:55,000
All right. Well, last thing really quick, again, we'll plug Scott's book.
323
00:17:55,200 -->
00:17:57,160
So we'll have links in the show notes.
324
00:17:57,160 -->
00:18:01,080
We love plugging the book because you're continuing to get feedback, which is good.
325
00:18:01,080 -->
00:18:01,840
Yeah, absolutely.
326
00:18:01,840 -->
00:18:05,600
Getting some great review comments from people who've been listeners to the show.
327
00:18:05,600 -->
00:18:08,240
So thank you, everybody, for that.
328
00:18:08,240 -->
00:18:11,440
I'll share just a little tidbit of wisdom for people.
329
00:18:11,680 -->
00:18:16,240
You may have heard of the, you know, all the legacy contact solutions
330
00:18:16,240 -->
00:18:20,400
that are out there for Google and Facebook and Apple and Microsoft, et cetera.
331
00:18:20,400 -->
00:18:24,800
Right. So the Google solution is called the Google Inactive Account Manager.
332
00:18:25,320 -->
00:18:30,280
And once it makes it so much easier if you can set up these things.
333
00:18:30,280 -->
00:18:33,120
But just as an example, how they all work so differently.
334
00:18:33,720 -->
00:18:35,720
It's great if you set this up with Google.
335
00:18:35,720 -->
00:18:40,040
You can say, I want Tom to be my legacy contact.
336
00:18:40,040 -->
00:18:44,640
And if I if he makes a request for my access
337
00:18:44,640 -->
00:18:49,200
to my Google account information and I don't respond
338
00:18:49,560 -->
00:18:53,840
within a period of time, then Tom gets granted access.
339
00:18:53,840 -->
00:18:55,320
So that that makes sense.
340
00:18:55,320 -->
00:18:59,680
But what I've learned and what might be interesting to people is the minimum
341
00:18:59,960 -->
00:19:05,600
period that Google allows for that to happen is 30 days, which is a long time.
342
00:19:06,080 -->
00:19:09,960
For my point of view, I mean, if I'm out of action
343
00:19:09,960 -->
00:19:13,080
for five days, then somebody should be able to take over, right?
344
00:19:13,080 -->
00:19:16,040
And so anyway, just thought I'd pass that on.
345
00:19:16,760 -->
00:19:18,280
Yeah, that's good to know.
346
00:19:18,280 -->
00:19:21,360
It means you've got to think more about, you know, what do you want to happen
347
00:19:21,360 -->
00:19:22,680
in that period of time?
348
00:19:22,680 -->
00:19:26,720
Yeah. And I'd encourage listeners, if you want to find out more about Scott's
349
00:19:26,720 -->
00:19:29,320
book, definitely check out the link in the show notes.
350
00:19:29,320 -->
00:19:32,600
And hopefully a pre-order coming out soon.
351
00:19:32,600 -->
00:19:35,640
Yeah, we're going to be putting up a pre-order page soon.
352
00:19:35,640 -->
00:19:37,320
Yep. Nice.
353
00:19:38,360 -->
00:19:38,680
All right.
354
00:19:38,680 -->
00:19:42,800
Discounted Kindle version for for shared security listeners.
355
00:19:43,120 -->
00:19:45,280
Awesome. Awesome. All right.
356
00:19:45,360 -->
00:19:49,880
Well, thank you all for listening as always and supporting the podcast.
357
00:19:49,880 -->
00:19:51,360
We really appreciate it.
358
00:19:51,360 -->
00:19:55,280
Until next time, stay safe, stay secure and stay privates.
359
00:19:55,360 -->
00:19:57,080
Thank you for listening or watching.
360
00:19:57,080 -->
00:20:01,000
If you like this episode, hit subscribe, share it with your friends and
361
00:20:01,000 -->
00:20:05,040
colleagues or jump into our community at sharedsecurity.net
362
00:20:05,040 -->
00:20:07,680
slash supporter to keep the conversation going.
363
00:20:07,760 -->
00:20:08,560
Thanks again.
364
00:20:08,560 -->
00:20:12,440
And we'll see you next week for another episode of shared security.
