1
00:00:02,800 -->
00:00:08,280
Welcome to the Shared Security podcast, the longest running cyber security and privacy
2
00:00:08,280 -->
00:00:11,040
show for actual humans.
3
00:00:11,040 -->
00:00:17,680
No jargon, no hype, just honest analysis from industry veterans who've seen everything
4
00:00:17,680 -->
00:00:19,080
and survived it.
5
00:00:19,080 -->
00:00:24,520
Each week we break down the stories that matter, expose the nonsense that doesn't, and give
6
00:00:24,520 -->
00:00:31,760
you the tools to stay safe in a world where everything is connected and nothing is guaranteed.
7
00:00:31,760 -->
00:00:37,040
This is Shared Security.
8
00:00:37,040 -->
00:00:41,720
This week on Shared Security, Scott Wright joins us to walk through his digital legacy
9
00:00:41,720 -->
00:00:49,600
tree or DLT framework and the ideas behind his upcoming book, The Digital Legacy Tree,
10
00:00:49,600 -->
00:00:54,880
ensuring your loved ones can access the digital accounts they need when you die.
11
00:00:54,880 -->
00:00:58,800
Now it's an uncomfortable topic, but a practical one.
12
00:00:58,800 -->
00:01:03,600
What happens to your accounts, photos, files, money, business assets, devices, recovery
13
00:01:03,600 -->
00:01:10,520
codes and online identity if you die, become incapacitated, get sick, or are suddenly unavailable?
14
00:01:10,520 -->
00:01:16,320
We spend years making our accounts harder to break into and of course that's good security,
15
00:01:16,320 -->
00:01:21,560
but without a continuity plan it can become a painful problem for the people who need
16
00:01:21,560 -->
00:01:23,440
to pick up the pieces.
17
00:01:23,440 -->
00:01:26,960
So we're going to talk to Scott about how the digital legacy tree helps people
18
00:01:26,960 -->
00:01:32,760
think beyond passwords, organize what matters, and make sure the right people can access
19
00:01:32,760 -->
00:01:39,880
the right things at the right time without creating a security hole while you are alive.
20
00:01:39,880 -->
00:01:45,320
And I have not just Scott, but I also have Kevin Tackett here to join us for this great
21
00:01:45,320 -->
00:01:46,320
conversation.
22
00:01:46,320 -->
00:01:47,820
Hey, Tom.
23
00:01:47,820 -->
00:01:51,840
My only question is, I got to ask before we get started and I'm afraid that this
24
00:01:51,840 -->
00:01:54,960
might get us a trademark strike or something.
25
00:01:54,960 -->
00:02:00,120
Is this where Scott announces his new animated movie, All Good Data Goes to Heaven?
26
00:02:00,480 -->
00:02:02,480
I didn't want you to mention that, Kevin.
27
00:02:02,480 -->
00:02:04,480
Oh, Kevin, you ruined it.
28
00:02:04,480 -->
00:02:06,480
Sorry, no, sorry.
29
00:02:06,480 -->
00:02:08,480
What is good data?
30
00:02:08,480 -->
00:02:09,480
That's a whole other topic.
31
00:02:09,480 -->
00:02:11,480
That's a whole other episode, yeah.
32
00:02:11,480 -->
00:02:12,480
That happens.
33
00:02:12,480 -->
00:02:13,480
Yeah.
34
00:02:13,480 -->
00:02:14,480
Yeah.
35
00:02:14,480 -->
00:02:19,520
So Scott, talk a little bit about, I mean, we've had this topic once before a long
36
00:02:19,520 -->
00:02:20,520
time ago.
37
00:02:20,520 -->
00:02:22,640
We'll actually link it in the show notes of this episode.
38
00:02:22,640 -->
00:02:25,880
If you're on YouTube, you can click the link above to check that out.
39
00:02:25,880 -->
00:02:32,840
But what was the thought process behind digging back into this topic and then writing a book
40
00:02:32,840 -->
00:02:33,840
about it?
41
00:02:33,840 -->
00:02:34,840
Yeah.
42
00:02:34,840 -->
00:02:40,800
So it actually started maybe 10 years ago and I used to do a lot of presentations for
43
00:02:40,800 -->
00:02:44,960
financial advisor groups, you know, like they all have their professional associations
44
00:02:44,960 -->
00:02:47,000
where they do their chapter meetings and stuff.
45
00:02:47,000 -->
00:02:50,520
And I would go in and do talks about cybersecurity and then at the end, I had just read an
46
00:02:50,520 -->
00:02:55,480
article at one point about this idea of digital legacy as a new concept.
47
00:02:55,920 -->
00:03:00,840
It was, you know, protecting your accounts so that people can get access to them if you
48
00:03:00,840 -->
00:03:01,840
die.
49
00:03:01,840 -->
00:03:04,600
And nobody had really ever thought about that before at that point.
50
00:03:04,600 -->
00:03:10,320
So I just put a slide in my deck and every time I got to that at the end of the presentation,
51
00:03:10,320 -->
00:03:15,280
there'd be so many questions and stories and things like, wow, that's really cool.
52
00:03:15,280 -->
00:03:16,280
How would that work?
53
00:03:16,280 -->
00:03:19,760
You know, and I just sort of had it as a little throwaway thing at the end that
54
00:03:19,760 -->
00:03:21,320
made people kind of remember me.
55
00:03:21,320 -->
00:03:27,440
But I think more recently, I guess maybe in the last year, I've had a number of people
56
00:03:27,440 -->
00:03:34,120
that I've had to help who've reached out and said, you know, I'm an executor and, you
57
00:03:34,120 -->
00:03:39,320
know, my associate passed away and I'm trying to figure out how to help his widow get access
58
00:03:39,320 -->
00:03:45,960
to their Gmail, which is interesting because as I started to dig into that, I learned,
59
00:03:45,960 -->
00:03:50,440
you know, Gmail is not that easy and they're not just going to give access to somebody
60
00:03:50,440 -->
00:03:53,320
and they're not, they don't, even if you can prove who you are, they don't give full
61
00:03:53,320 -->
00:03:54,320
access, right?
62
00:03:54,320 -->
00:03:57,280
They'll say, what information do you need, right?
63
00:03:57,280 -->
00:04:01,920
But actually, since I started talking about this 10 years ago, the major platforms I've
64
00:04:01,920 -->
00:04:06,520
actually made a bit of progress in terms of allowing you to designate people as
65
00:04:06,520 -->
00:04:09,960
emergency alternate contacts.
66
00:04:09,960 -->
00:04:12,440
And that's really the cleanest way to do it.
67
00:04:12,440 -->
00:04:16,560
And you know, if I had one message for people from this episode is get your legacy
68
00:04:16,560 -->
00:04:21,120
or emergency contacts set up for your most critical accounts.
69
00:04:21,120 -->
00:04:25,040
So anyway, all that to say, I started thinking about this, you know, in the last six months
70
00:04:25,040 -->
00:04:26,040
or so.
71
00:04:26,040 -->
00:04:32,560
And then I realized each platform like Apple and Facebook and Microsoft and Google, they
72
00:04:32,560 -->
00:04:37,960
all do things a little differently when it comes to how you might enable this.
73
00:04:37,960 -->
00:04:43,080
And as a lot of us in security, you know, we work to secure things, as you said,
74
00:04:43,080 -->
00:04:46,400
and we don't think about what would happen to people who actually had to get into
75
00:04:46,400 -->
00:04:47,560
these things.
76
00:04:47,560 -->
00:04:51,200
So I started to think maybe this would be a good topic for a book, you know, to do some
77
00:04:51,200 -->
00:04:55,240
research, because I think there's enough different ways to look at this and things
78
00:04:55,240 -->
00:04:57,080
that could trip people up.
79
00:04:57,080 -->
00:05:00,640
And so that's what I basically started doing six months ago.
80
00:05:00,640 -->
00:05:03,640
And it's been a fun project, actually.
81
00:05:03,640 -->
00:05:06,200
And I've got people doing what we call beta reviews now.
82
00:05:06,200 -->
00:05:08,240
And most of the feedback has been very good.
83
00:05:08,240 -->
00:05:10,960
You know, I'm looking for the where, where does, where do people get tripped
84
00:05:10,960 -->
00:05:11,960
up?
85
00:05:11,960 -->
00:05:12,960
Where does it get confusing?
86
00:05:13,000 -->
00:05:16,920
Where are the, you know, things I disagree with, you know, and Kevin hasn't
87
00:05:16,920 -->
00:05:17,920
reviewed it yet.
88
00:05:17,920 -->
00:05:18,920
So I don't have many of those.
89
00:05:18,920 -->
00:05:21,920
So yes, that is to come.
90
00:05:21,920 -->
00:05:22,920
But yeah.
91
00:05:22,920 -->
00:05:27,320
I mean, it's really tough for people to spend time thinking about how the
92
00:05:27,320 -->
00:05:31,200
unthinkable might happen to them, you know, in your world, things seem to
93
00:05:31,200 -->
00:05:32,200
be going smoothly.
94
00:05:32,200 -->
00:05:36,560
But imagine, you know, your, your spouse or partner, you know, sitting at
95
00:05:36,560 -->
00:05:40,600
the kitchen table after an emergency, not knowing if or when you're ever
96
00:05:40,600 -->
00:05:42,400
going to be able to access this stuff again.
97
00:05:42,400 -->
00:05:44,040
Maybe they do know.
98
00:05:44,040 -->
00:05:48,920
But at that point, you know, all they know is that your, your online bills get
99
00:05:48,920 -->
00:05:53,040
paid somehow and you've got social media accounts where you've been updating
100
00:05:53,040 -->
00:05:55,120
people on how you're doing.
101
00:05:55,120 -->
00:05:56,680
And they want to access those things.
102
00:05:56,680 -->
00:06:00,200
And if you haven't done a little bit of preparation, and it's, it's not
103
00:06:00,200 -->
00:06:03,840
just about passwords, as you said earlier on, I've learned there's a
104
00:06:03,840 -->
00:06:07,360
lot of dependencies and that's kind of what evolved this idea of a
105
00:06:07,360 -->
00:06:08,360
tree concept.
106
00:06:08,360 -->
00:06:11,560
So, you know, I'll leave it at that and you can sort of let me know if
107
00:06:11,600 -->
00:06:13,200
you've got questions about that.
108
00:06:13,200 -->
00:06:18,360
Yeah, I kind of wanted for you to explain the, the framework that you kind
109
00:06:18,360 -->
00:06:22,800
of talk about in the book and how obviously it relates to a tree, but
110
00:06:22,800 -->
00:06:25,360
maybe can you talk a little bit about that from a.
111
00:06:25,360 -->
00:06:26,360
Yeah, for sure.
112
00:06:26,360 -->
00:06:30,680
So the way I started thinking about it, well, we, in order to access
113
00:06:30,680 -->
00:06:32,040
anything, you need the passwords, right?
114
00:06:32,040 -->
00:06:37,240
So we, and one of the things that I found when I looked at what
115
00:06:37,240 -->
00:06:40,960
books had actually been written on this, almost every one of them says,
116
00:06:41,000 -->
00:06:43,320
do a full inventory of all your accounts.
117
00:06:43,640 -->
00:06:47,880
And I can't think of anything more daunting or demotivating and sitting
118
00:06:47,880 -->
00:06:49,480
down and trying to go through that.
119
00:06:49,480 -->
00:06:53,240
And I have like over a thousand accounts in, in Bitwarden right now.
120
00:06:53,520 -->
00:06:54,920
So how do you decide?
121
00:06:54,920 -->
00:06:57,480
And, and if somebody has to take over that, how do they know
122
00:06:57,480 -->
00:06:58,400
which ones to start with?
123
00:06:58,400 -->
00:06:58,640
Right.
124
00:06:58,640 -->
00:07:02,160
So I started by just saying, let's look at this from something
125
00:07:02,160 -->
00:07:04,280
that evolves and grows kind of like a tree, right?
126
00:07:04,280 -->
00:07:07,560
You start with something very small, like the critical mass.
127
00:07:08,280 -->
00:07:10,960
I think of it in terms of, first of all, your primary email
128
00:07:10,960 -->
00:07:13,280
address is probably one of the top things people are going to
129
00:07:13,280 -->
00:07:16,440
need your mobile device, because all of your two factor
130
00:07:16,440 -->
00:07:18,600
authentication is going to go through that.
131
00:07:19,160 -->
00:07:21,280
And then if you have one, a password manager.
132
00:07:21,280 -->
00:07:25,560
So those three things together will get you a long way, you
133
00:07:25,560 -->
00:07:28,880
know, into finding the things that you actually need.
134
00:07:29,280 -->
00:07:31,400
But that's what I would call the roots, right?
135
00:07:31,400 -->
00:07:33,520
So those are the basic things you're really going to need.
136
00:07:33,520 -->
00:07:35,080
And they're not very well organized.
137
00:07:35,080 -->
00:07:37,120
If somebody just looks at it from that point of
138
00:07:37,120 -->
00:07:40,160
view, if they're given access, so it kind of looks like a
139
00:07:40,160 -->
00:07:41,880
mess of roots, you know, tangled up everywhere.
140
00:07:42,280 -->
00:07:45,640
The idea of the trunk of the tree is to make it reliable
141
00:07:45,640 -->
00:07:49,160
so that you can look at where are the dependencies?
142
00:07:50,040 -->
00:07:52,200
What device does this account rely on?
143
00:07:52,200 -->
00:07:54,560
What two factor authentication, you know, you might
144
00:07:54,560 -->
00:07:56,880
actually have more than one two factor authentication
145
00:07:56,880 -->
00:07:58,320
app on your phone and do it.
146
00:07:58,320 -->
00:07:59,200
Does anybody know that?
147
00:08:00,160 -->
00:08:00,400
Right.
148
00:08:00,400 -->
00:08:03,080
So there's a whole bunch of dependencies that I
149
00:08:03,080 -->
00:08:05,520
discovered that could trip people up.
150
00:08:05,520 -->
00:08:07,520
And so the idea of the trunk is to take, start
151
00:08:07,520 -->
00:08:11,280
organizing the access, the basic access stuff to make
152
00:08:11,280 -->
00:08:12,200
it more reliable.
153
00:08:12,720 -->
00:08:15,680
And then at the top, it's really, what do people need?
154
00:08:15,800 -->
00:08:18,320
And what are they looking for rather than just a bunch
155
00:08:18,320 -->
00:08:18,960
of passwords?
156
00:08:18,960 -->
00:08:21,800
And one of the best things that I learned as I
157
00:08:21,800 -->
00:08:24,080
was researching this, I talked to one of the
158
00:08:24,080 -->
00:08:26,280
people I was helping, I said, if they, if they
159
00:08:26,280 -->
00:08:29,200
had a, if the person who passed away had a drawer
160
00:08:29,200 -->
00:08:32,080
with a little note or a books that they'd written in
161
00:08:32,080 -->
00:08:33,520
there, what would you have wanted to see in it?
162
00:08:33,920 -->
00:08:35,480
And he said, that's a good question.
163
00:08:35,520 -->
00:08:37,200
He says, I would like to have seen a section that
164
00:08:37,200 -->
00:08:39,080
says, how I live my life.
165
00:08:39,880 -->
00:08:41,720
And I thought that was really interesting because
166
00:08:41,960 -->
00:08:43,600
it's like, what are your priorities?
167
00:08:43,680 -->
00:08:45,840
You know, how do you treat this particular
168
00:08:45,840 -->
00:08:48,480
email account versus this social media account?
169
00:08:48,480 -->
00:08:49,600
Which one's more important?
170
00:08:50,400 -->
00:08:52,520
So that's kind of what the whole idea of the
171
00:08:52,520 -->
00:08:53,640
tree growing.
172
00:08:53,640 -->
00:08:55,760
And it's not just the fact that there's roots
173
00:08:55,760 -->
00:08:59,320
and trunk and the leaves I call it, but the
174
00:08:59,320 -->
00:09:01,960
fact that it grows and you re, you update it
175
00:09:01,960 -->
00:09:04,160
every once in a while and you don't have to do it
176
00:09:04,160 -->
00:09:04,640
all at once.
177
00:09:04,640 -->
00:09:06,880
You start with just your critical accounts and
178
00:09:06,880 -->
00:09:08,800
you get that working so that it's immediately
179
00:09:08,800 -->
00:09:09,800
usable by somebody.
180
00:09:10,040 -->
00:09:12,240
And that's how the tree kind of evolves.
181
00:09:14,310 -->
00:09:16,870
Mobile apps are just part of everyday life now.
182
00:09:17,190 -->
00:09:19,950
Banking, healthcare, shopping, entertainment, you
183
00:09:19,950 -->
00:09:20,390
name it.
184
00:09:20,390 -->
00:09:23,310
And with that comes a lot of trust because
185
00:09:23,310 -->
00:09:25,070
users are putting their personal data
186
00:09:25,070 -->
00:09:26,870
directly into your app.
187
00:09:27,150 -->
00:09:28,190
But here's the reality.
188
00:09:28,270 -->
00:09:30,110
Mobile apps are a growing target.
189
00:09:30,430 -->
00:09:33,630
A recent survey found that 72% of organizations
190
00:09:33,630 -->
00:09:36,470
experienced a mobile app security incident
191
00:09:36,470 -->
00:09:40,030
last year and 92% say threats are only
192
00:09:40,030 -->
00:09:42,150
increasing and the way attackers are going
193
00:09:42,150 -->
00:09:44,390
after apps is pretty sophisticated.
194
00:09:44,510 -->
00:09:46,990
They're reverse engineering them, modifying
195
00:09:46,990 -->
00:09:49,270
them and redistributing fake versions
196
00:09:49,270 -->
00:09:51,710
through phishing campaigns, side loading
197
00:09:51,790 -->
00:09:53,790
and even third party app stores.
198
00:09:54,190 -->
00:09:56,630
So from a user's perspective, everything
199
00:09:56,630 -->
00:09:58,590
can look completely legitimate.
200
00:09:58,870 -->
00:10:00,710
That's why taking a proactive approach to
201
00:10:00,710 -->
00:10:02,910
mobile app security really matters.
202
00:10:03,030 -->
00:10:04,990
You want to stay ahead of these threats, not
203
00:10:04,990 -->
00:10:07,030
react after the damage is done.
204
00:10:07,310 -->
00:10:09,150
This is where Guard Square comes in.
205
00:10:09,270 -->
00:10:11,110
They provide advanced protection for both
206
00:10:11,110 -->
00:10:13,670
Android and iOS apps, along with
207
00:10:13,670 -->
00:10:15,790
automated security testing to catch
208
00:10:15,790 -->
00:10:18,470
vulnerabilities early and real time
209
00:10:18,470 -->
00:10:20,950
threat monitoring so you can actually see
210
00:10:20,950 -->
00:10:22,150
what's happening out there.
211
00:10:22,190 -->
00:10:24,510
If your mobile app is critical to your business
212
00:10:24,630 -->
00:10:27,030
and it probably is, this is something
213
00:10:27,030 -->
00:10:28,470
worth paying attention to.
214
00:10:28,590 -->
00:10:31,270
You can learn more at GuardSquare.com.
215
00:10:31,390 -->
00:10:33,430
That's GuardSquare.com.
216
00:10:35,660 -->
00:10:37,460
I really like that from a framework
217
00:10:37,460 -->
00:10:39,300
perspective. It's just easy to understand
218
00:10:39,420 -->
00:10:40,860
and I think that's going to really
219
00:10:40,860 -->
00:10:42,460
resonate with people that read the book.
220
00:10:42,460 -->
00:10:45,580
And I think I guess one question I have
221
00:10:45,580 -->
00:10:47,780
for you is like after doing all of this
222
00:10:47,780 -->
00:10:49,300
research, and I know you're kind of
223
00:10:49,300 -->
00:10:51,260
still in the middle of the book writing
224
00:10:51,260 -->
00:10:53,700
in that, but what's one thing that
225
00:10:53,740 -->
00:10:55,940
really came to light as you were
226
00:10:55,940 -->
00:10:57,700
researching this of like or one thing
227
00:10:57,700 -->
00:10:59,500
that you would offer to listeners
228
00:10:59,500 -->
00:11:00,660
to focus on first?
229
00:11:00,660 -->
00:11:02,740
I know you mentioned mobile device, right?
230
00:11:03,460 -->
00:11:05,780
Yeah, first, I mean, first of all,
231
00:11:05,780 -->
00:11:07,300
from a practical point of view, the
232
00:11:07,300 -->
00:11:08,740
first thing you should do is set up
233
00:11:08,740 -->
00:11:10,900
those legacy contacts so that somebody
234
00:11:10,900 -->
00:11:12,660
does have access that you intend them
235
00:11:12,660 -->
00:11:14,860
to access. And it's interesting how
236
00:11:14,860 -->
00:11:17,220
they've done it in a way where
237
00:11:17,460 -->
00:11:19,140
you're not just saying this person has
238
00:11:19,140 -->
00:11:20,140
access when they want it.
239
00:11:20,140 -->
00:11:21,860
It's they have to make a request
240
00:11:22,300 -->
00:11:24,820
and you can set a time horizon on it
241
00:11:24,820 -->
00:11:26,380
so that you know that you're going
242
00:11:26,380 -->
00:11:28,860
to probably be logged into, you know,
243
00:11:28,900 -->
00:11:30,540
your password manager or something
244
00:11:30,660 -->
00:11:32,260
within the next, you know, within
245
00:11:32,260 -->
00:11:33,660
three days or four days if you're
246
00:11:33,660 -->
00:11:35,260
alive or if you're not
247
00:11:35,260 -->
00:11:36,260
incapacitated.
248
00:11:36,260 -->
00:11:37,740
And if somebody makes a request
249
00:11:37,740 -->
00:11:39,460
and you don't want them to, you can
250
00:11:39,460 -->
00:11:40,460
deny that request.
251
00:11:40,500 -->
00:11:42,580
But after a certain time horizon, if
252
00:11:42,580 -->
00:11:43,900
you don't respond, then they would
253
00:11:43,900 -->
00:11:45,100
automatically get access.
254
00:11:45,100 -->
00:11:46,500
And I think that's a cool way to
255
00:11:46,500 -->
00:11:47,020
set it up.
256
00:11:47,020 -->
00:11:49,100
OK, that they're leaving it kind
257
00:11:49,100 -->
00:11:50,100
of up to you.
258
00:11:50,940 -->
00:11:53,020
But it's not an instant access
259
00:11:53,020 -->
00:11:54,500
thing. It really depends on that
260
00:11:54,500 -->
00:11:55,620
situation where you're not
261
00:11:55,620 -->
00:11:57,100
available. The other thing I
262
00:11:57,140 -->
00:11:58,980
would say that is really
263
00:11:58,980 -->
00:12:00,220
important for people to just think
264
00:12:00,220 -->
00:12:01,740
in terms of the principles around
265
00:12:01,740 -->
00:12:03,940
this is we have this
266
00:12:04,380 -->
00:12:05,340
the curse of knowledge.
267
00:12:05,340 -->
00:12:06,100
You've heard of it, right?
268
00:12:06,100 -->
00:12:07,460
So it's hard for us to imagine
269
00:12:07,460 -->
00:12:09,220
what somebody else will think
270
00:12:09,220 -->
00:12:10,220
or or experience.
271
00:12:10,660 -->
00:12:12,460
And we think we've
272
00:12:12,460 -->
00:12:13,740
got it all organized in a way
273
00:12:13,740 -->
00:12:15,340
that everybody will be able to
274
00:12:15,340 -->
00:12:16,900
just open your password manager
275
00:12:16,900 -->
00:12:17,900
and get access to things.
276
00:12:18,300 -->
00:12:20,300
But there are sometimes when people
277
00:12:20,300 -->
00:12:21,660
don't even know account accounts
278
00:12:21,660 -->
00:12:23,460
exist. And if if it's something
279
00:12:23,460 -->
00:12:25,300
like, you know, cryptocurrency or
280
00:12:25,300 -->
00:12:27,020
even online banking, I don't
281
00:12:27,060 -->
00:12:28,900
necessarily store in my password
282
00:12:28,900 -->
00:12:30,300
manager, because I
283
00:12:31,180 -->
00:12:32,500
I don't really want that to be,
284
00:12:32,500 -->
00:12:34,220
you know, in any way vulnerable.
285
00:12:34,660 -->
00:12:36,700
And so people can't access things
286
00:12:36,700 -->
00:12:37,700
they don't know exist.
287
00:12:38,140 -->
00:12:38,980
And I think that's a really
288
00:12:38,980 -->
00:12:40,460
important principle is you have to
289
00:12:40,460 -->
00:12:41,980
be able to start by documenting
290
00:12:42,300 -->
00:12:44,260
what does exist and from the most
291
00:12:44,260 -->
00:12:45,740
important on down.
292
00:12:46,060 -->
00:12:47,580
Yeah, I can also see this, you
293
00:12:47,580 -->
00:12:49,620
know, if you or a person
294
00:12:49,620 -->
00:12:51,020
you know that might encounter
295
00:12:51,020 -->
00:12:52,140
something, you know, obviously
296
00:12:52,140 -->
00:12:53,300
we're all going to die one day.
297
00:12:53,900 -->
00:12:54,900
It's inevitable, Tom.
298
00:12:54,900 -->
00:12:56,100
You know, it is inevitable like
299
00:12:56,100 -->
00:12:57,300
death and taxes, but
300
00:12:57,620 -->
00:12:58,940
like it's a really good point you
301
00:12:58,940 -->
00:13:00,580
made about, you know, if people
302
00:13:00,580 -->
00:13:02,580
have businesses, side businesses,
303
00:13:02,580 -->
00:13:04,380
they have all these things tied to
304
00:13:04,380 -->
00:13:06,220
their email and, you know,
305
00:13:06,820 -->
00:13:08,740
the authentication piece alone.
306
00:13:09,140 -->
00:13:10,780
We don't think about that and
307
00:13:10,780 -->
00:13:12,340
prepare our loved ones
308
00:13:12,340 -->
00:13:13,820
and in that for these
309
00:13:13,820 -->
00:13:14,900
situations.
310
00:13:15,580 -->
00:13:17,380
Like I came in imagine
311
00:13:17,620 -->
00:13:19,340
like the chaos that there's
312
00:13:19,340 -->
00:13:21,260
just so many things I discovered
313
00:13:21,260 -->
00:13:22,340
that I think need to be
314
00:13:22,340 -->
00:13:23,700
documented somewhere that for
315
00:13:23,700 -->
00:13:24,980
people to learn. And I did
316
00:13:25,020 -->
00:13:26,580
create a resource page on our
317
00:13:26,580 -->
00:13:28,020
website. Before I forget, I'll
318
00:13:28,020 -->
00:13:30,020
mention security perspectives.com.
319
00:13:30,300 -->
00:13:31,340
I'll have a little banner there
320
00:13:31,340 -->
00:13:32,580
where you can get to the digital
321
00:13:32,700 -->
00:13:34,140
I call it digital legacy tools
322
00:13:34,140 -->
00:13:36,540
page. But in there, you know,
323
00:13:36,540 -->
00:13:38,420
it's all the different ways that
324
00:13:38,420 -->
00:13:40,660
some of these platforms operate
325
00:13:40,660 -->
00:13:41,860
or in terms of what you need to
326
00:13:41,860 -->
00:13:42,900
do to set things up.
327
00:13:43,140 -->
00:13:44,700
And what's really interesting I
328
00:13:44,700 -->
00:13:46,580
discovered, you know, you
329
00:13:46,580 -->
00:13:49,020
and I know that some platforms
330
00:13:49,020 -->
00:13:49,980
don't use passwords.
331
00:13:50,380 -->
00:13:51,540
You put in your email and they
332
00:13:51,540 -->
00:13:53,260
send you a magic link.
333
00:13:54,060 -->
00:13:55,780
And if somebody's looking for how
334
00:13:55,780 -->
00:13:57,460
to get into this particular
335
00:13:57,460 -->
00:13:58,980
account and they see, well,
336
00:13:58,980 -->
00:14:00,060
here's the email, but there's no
337
00:14:00,060 -->
00:14:01,380
password. Oh, my God, there's no
338
00:14:01,380 -->
00:14:02,380
password. What am I going to do?
339
00:14:02,580 -->
00:14:03,580
And they don't even try.
340
00:14:03,900 -->
00:14:05,660
So if you don't document how
341
00:14:05,660 -->
00:14:07,340
some of these things have
342
00:14:07,340 -->
00:14:09,380
unique access processes,
343
00:14:09,420 -->
00:14:11,020
it could actually be stressful
344
00:14:11,020 -->
00:14:12,340
and frustrating for people as
345
00:14:12,340 -->
00:14:13,340
well. Yeah, I'm just thinking
346
00:14:13,340 -->
00:14:14,380
of all the different ways,
347
00:14:14,380 -->
00:14:15,780
right? Like, you know, mobile
348
00:14:15,780 -->
00:14:17,300
authentication app or text
349
00:14:17,300 -->
00:14:19,060
message or magic link.
350
00:14:19,060 -->
00:14:20,980
Or I mean, it goes on and
351
00:14:20,980 -->
00:14:22,260
on and on. And then there's
352
00:14:22,260 -->
00:14:24,020
of course, you know, whether
353
00:14:24,020 -->
00:14:25,740
people store passwords in a
354
00:14:25,740 -->
00:14:28,100
password manager or not,
355
00:14:28,140 -->
00:14:29,940
right? Because like we talked
356
00:14:29,940 -->
00:14:31,140
about in the show too is, you
357
00:14:31,140 -->
00:14:32,580
know, a lot of older people
358
00:14:33,020 -->
00:14:34,300
keep, you know, passwords written
359
00:14:34,300 -->
00:14:36,100
down. Written. So where is that?
360
00:14:36,140 -->
00:14:37,860
Where is that book of passwords
361
00:14:37,860 -->
00:14:38,940
that's written down and that
362
00:14:38,940 -->
00:14:40,260
kind of thing? You can put it
363
00:14:40,260 -->
00:14:41,460
in a safe. But how many people
364
00:14:41,460 -->
00:14:42,340
do you know that actually have
365
00:14:42,340 -->
00:14:43,940
a safe? And then you need to
366
00:14:43,940 -->
00:14:45,380
code the safe and the safe that
367
00:14:45,380 -->
00:14:46,980
you buy at, you know, we're
368
00:14:46,980 -->
00:14:47,660
going to get pushed back
369
00:14:47,660 -->
00:14:49,180
because safe you buy at Staple
370
00:14:49,180 -->
00:14:50,820
or, you know, we're business
371
00:14:50,820 -->
00:14:52,700
depot, whatever, aren't
372
00:14:52,700 -->
00:14:53,700
necessarily if they're under
373
00:14:53,700 -->
00:14:54,820
two or three hundred dollars,
374
00:14:54,820 -->
00:14:56,740
they're probably not really
375
00:14:56,740 -->
00:14:58,500
security safes. They're more
376
00:14:58,500 -->
00:15:00,780
like opportunistic avoidance
377
00:15:00,940 -->
00:15:02,820
safes, right? But the idea
378
00:15:02,820 -->
00:15:04,380
that you should put stuff, your
379
00:15:04,380 -->
00:15:05,820
password notebook in a safe
380
00:15:06,260 -->
00:15:07,460
isn't necessarily that
381
00:15:07,460 -->
00:15:08,780
practical. And I'm not in the
382
00:15:08,900 -->
00:15:10,260
book, I'm not teaching people
383
00:15:10,260 -->
00:15:11,740
about security of, you know,
384
00:15:12,020 -->
00:15:12,900
all these things. I'm just
385
00:15:12,900 -->
00:15:14,540
saying this is what you may
386
00:15:14,540 -->
00:15:16,740
have. And do your best to
387
00:15:16,740 -->
00:15:18,660
try and make it a place you
388
00:15:18,660 -->
00:15:20,260
can get too easily or that
389
00:15:20,260 -->
00:15:21,260
somebody could get too easily,
390
00:15:21,260 -->
00:15:22,700
but isn't obvious for people.
391
00:15:22,980 -->
00:15:24,380
So it's a little bit of, you
392
00:15:24,380 -->
00:15:25,300
know, contradiction from a
393
00:15:25,300 -->
00:15:26,820
security point of view, but you
394
00:15:26,820 -->
00:15:28,140
have to have that tradeoff.
395
00:15:28,660 -->
00:15:29,660
Well, I love that you're doing
396
00:15:29,660 -->
00:15:31,340
this, Scott. I think this is so,
397
00:15:31,340 -->
00:15:32,900
so important. It's something
398
00:15:32,900 -->
00:15:34,900
that most of us don't even
399
00:15:34,900 -->
00:15:37,500
think about. And everyone
400
00:15:37,500 -->
00:15:38,940
is left scrambling when
401
00:15:39,060 -->
00:15:40,380
something happens to loved
402
00:15:40,380 -->
00:15:41,300
ones. It doesn't have to be
403
00:15:41,300 -->
00:15:42,580
death, either, like you said,
404
00:15:42,580 -->
00:15:43,900
like if somebody is
405
00:15:43,900 -->
00:15:45,820
incapacitated because of an
406
00:15:45,820 -->
00:15:47,180
accident or a health
407
00:15:47,180 -->
00:15:48,940
condition, or there's so
408
00:15:48,940 -->
00:15:50,940
many situations that this is,
409
00:15:50,980 -->
00:15:52,420
this is sorely needed.
410
00:15:52,420 -->
00:15:54,420
So, yeah, thank you for doing
411
00:15:54,420 -->
00:15:56,260
this. And I think, you know,
412
00:15:56,260 -->
00:15:57,500
you had a call to action too,
413
00:15:57,500 -->
00:15:59,340
right? You have got a request
414
00:15:59,340 -->
00:16:00,220
for people to help out.
415
00:16:00,260 -->
00:16:02,100
Yeah, as I haven't yet
416
00:16:02,100 -->
00:16:03,140
published the book, it'll be
417
00:16:03,140 -->
00:16:05,220
self published, but I am going
418
00:16:05,220 -->
00:16:06,700
through this process of beta
419
00:16:06,700 -->
00:16:08,180
reviewing. And I've invited
420
00:16:08,180 -->
00:16:09,980
you guys, but it's still
421
00:16:09,980 -->
00:16:11,820
open. If people go to my
422
00:16:11,820 -->
00:16:13,820
website, securityperspectives.com
423
00:16:13,820 -->
00:16:15,300
you'll see a banner or pop
424
00:16:15,300 -->
00:16:17,100
up to end the comma, put
425
00:16:17,100 -->
00:16:18,060
a link to directly to the
426
00:16:18,060 -->
00:16:20,180
page. But there is a form
427
00:16:20,180 -->
00:16:21,420
there that you can actually
428
00:16:21,420 -->
00:16:23,420
volunteer to, you know, do
429
00:16:23,420 -->
00:16:24,900
a review of the manuscript as
430
00:16:24,900 -->
00:16:26,660
it is right now and or sign up
431
00:16:26,660 -->
00:16:28,700
for a discounted pre-release
432
00:16:28,700 -->
00:16:30,740
copy that I'll probably issue
433
00:16:30,740 -->
00:16:31,700
in the next month or two.
434
00:16:31,860 -->
00:16:33,060
Awesome. I can ask a question
435
00:16:33,060 -->
00:16:35,580
that might be irrelevant or
436
00:16:35,580 -->
00:16:37,260
ridiculous, or may even be
437
00:16:37,260 -->
00:16:38,260
covered in the book. I haven't
438
00:16:38,260 -->
00:16:41,940
yet reviewed. Yes, during
439
00:16:41,940 -->
00:16:43,100
yesterday, I have it about,
440
00:16:43,140 -->
00:16:46,380
OK, so this is not a new
441
00:16:46,380 -->
00:16:48,500
issue. It's a new twist on an
442
00:16:48,500 -->
00:16:50,900
issue, right? We when I was
443
00:16:50,900 -->
00:16:52,260
growing up, there was always
444
00:16:52,900 -->
00:16:54,580
stories and books about the
445
00:16:54,580 -->
00:16:55,620
idea that, you know, somebody
446
00:16:55,620 -->
00:16:56,940
died and then they found out
447
00:16:56,940 -->
00:16:58,260
that they had gold buried in
448
00:16:58,260 -->
00:17:00,060
the backyard. Yeah, yeah, they're
449
00:17:00,060 -->
00:17:00,860
in the backyard. Now it's
450
00:17:00,860 -->
00:17:02,700
crypto offline wallets.
451
00:17:03,180 -->
00:17:05,860
Yeah, right? You know, and
452
00:17:05,860 -->
00:17:08,300
so I'm curious if, and this
453
00:17:08,300 -->
00:17:11,140
kind of twofold, if one, the
454
00:17:11,140 -->
00:17:13,420
variety of privacy laws
455
00:17:13,460 -->
00:17:15,140
around the world, countries,
456
00:17:15,140 -->
00:17:18,620
whatever, have or have to be
457
00:17:18,620 -->
00:17:20,140
adapted to this idea of
458
00:17:20,140 -->
00:17:23,260
after death. I know that that
459
00:17:23,260 -->
00:17:24,380
in some of the privacy laws,
460
00:17:24,380 -->
00:17:26,580
there are rules around how the
461
00:17:26,580 -->
00:17:28,860
data a company holds is
462
00:17:28,860 -->
00:17:32,380
affected by death. But that I
463
00:17:32,380 -->
00:17:33,420
don't think they really
464
00:17:33,420 -->
00:17:37,180
address the handover. And
465
00:17:37,220 -->
00:17:39,300
in second part is, are there
466
00:17:39,340 -->
00:17:41,340
any efforts? Are you
467
00:17:41,620 -->
00:17:43,500
shareholding? You're and
468
00:17:43,500 -->
00:17:44,780
that's shareholding. That's
469
00:17:44,780 -->
00:17:47,540
a new word phrase. Are you
470
00:17:47,540 -->
00:17:49,620
championing any efforts to
471
00:17:49,620 -->
00:17:52,860
build standards like, you
472
00:17:52,860 -->
00:17:56,620
know, 800 dash dead race
473
00:17:56,620 -->
00:17:58,860
that, you know, that, that
474
00:17:58,860 -->
00:18:00,780
pushes an idea of, Hey, if I'm
475
00:18:00,780 -->
00:18:02,780
building an app, like let's
476
00:18:02,780 -->
00:18:04,020
flip this around from the
477
00:18:04,220 -->
00:18:05,460
consort side to the business
478
00:18:05,460 -->
00:18:06,700
side. Is there any effort to
479
00:18:06,700 -->
00:18:07,580
say, Okay, I'm building an
480
00:18:07,580 -->
00:18:10,220
app. Let me follow this
481
00:18:10,300 -->
00:18:14,020
standard process on legacy
482
00:18:14,020 -->
00:18:15,100
accounts or stuff. Is there
483
00:18:15,100 -->
00:18:16,980
any there actually is. I just
484
00:18:16,980 -->
00:18:18,260
found something. It was
485
00:18:18,260 -->
00:18:20,060
published about almost a year
486
00:18:20,060 -->
00:18:22,500
ago in help net security. I
487
00:18:22,500 -->
00:18:23,740
don't actually have it off the
488
00:18:23,740 -->
00:18:24,780
top of my head, but I'll
489
00:18:24,780 -->
00:18:26,260
provide it to Tom. Yeah, there
490
00:18:26,260 -->
00:18:27,980
was a paper, a couple of
491
00:18:27,980 -->
00:18:30,140
papers written by the, I
492
00:18:30,140 -->
00:18:31,740
think it's the founders or
493
00:18:31,740 -->
00:18:33,820
heads of open ID foundation.
494
00:18:34,020 -->
00:18:36,260
Does that make sense? They
495
00:18:36,260 -->
00:18:37,220
actually were doing some
496
00:18:37,220 -->
00:18:38,380
research in this area and
497
00:18:38,380 -->
00:18:39,580
wrote some papers that I've
498
00:18:39,580 -->
00:18:40,620
yet to read. I've downloaded
499
00:18:40,620 -->
00:18:41,300
them, but I haven't read
500
00:18:41,300 -->
00:18:42,380
them. But it actually tries
501
00:18:42,380 -->
00:18:43,660
to address that issue. I
502
00:18:43,700 -->
00:18:45,500
believe. So it's a great
503
00:18:45,500 -->
00:18:47,340
question. And I'm going to put
504
00:18:47,340 -->
00:18:49,100
that in my tools website at
505
00:18:49,100 -->
00:18:50,980
some point as well. But I'll
506
00:18:50,980 -->
00:18:52,100
try and get the link to
507
00:18:52,620 -->
00:18:53,980
because that article links to
508
00:18:53,980 -->
00:18:55,260
a couple of those artifacts
509
00:18:55,260 -->
00:18:57,180
that they created. So yeah,
510
00:18:57,220 -->
00:18:58,580
that makes useful for for
511
00:18:58,580 -->
00:18:59,700
people. I think for a
512
00:18:59,700 -->
00:19:01,260
security and privacy
513
00:19:01,260 -->
00:19:02,660
practitioners to understand
514
00:19:02,900 -->
00:19:03,900
what what hasn't been done
515
00:19:03,900 -->
00:19:06,060
so far where it's going. I
516
00:19:06,060 -->
00:19:07,100
know that in the US,
517
00:19:07,100 -->
00:19:09,340
there's actually a law called
518
00:19:09,340 -->
00:19:10,300
Rufata. I don't know if
519
00:19:10,300 -->
00:19:11,220
you've heard about it, but
520
00:19:11,220 -->
00:19:13,020
the revised uniform
521
00:19:13,020 -->
00:19:15,540
fiduciary access to digital
522
00:19:15,540 -->
00:19:17,180
assets act. Wow, I'm amazed
523
00:19:17,180 -->
00:19:18,060
that I remembered that. But
524
00:19:18,820 -->
00:19:20,540
impressed. Not every state
525
00:19:20,540 -->
00:19:21,820
has adopted it, but many
526
00:19:21,820 -->
00:19:23,220
have. But what it really
527
00:19:23,220 -->
00:19:25,340
does is it gives the online
528
00:19:25,340 -->
00:19:27,700
platforms a framework of
529
00:19:27,700 -->
00:19:29,580
priorities, saying if you
530
00:19:29,580 -->
00:19:31,460
have a will, it takes
531
00:19:31,460 -->
00:19:32,740
precedent over whether
532
00:19:32,780 -->
00:19:34,420
somebody gets legal access
533
00:19:34,420 -->
00:19:36,220
to your accounts. And then
534
00:19:36,220 -->
00:19:37,620
if you don't have a will,
535
00:19:37,620 -->
00:19:39,060
there's other couple of
536
00:19:39,060 -->
00:19:40,380
other layers of priority
537
00:19:40,380 -->
00:19:42,180
there. And it's really good.
538
00:19:42,180 -->
00:19:43,460
I was really happy to find
539
00:19:43,460 -->
00:19:44,660
that stuff and understand,
540
00:19:44,660 -->
00:19:46,060
you know, it's up until
541
00:19:46,060 -->
00:19:47,100
then I was just saying, well,
542
00:19:47,100 -->
00:19:48,420
the laws don't help you if
543
00:19:48,420 -->
00:19:50,340
you if just because you
544
00:19:50,340 -->
00:19:51,300
have legal access doesn't
545
00:19:51,300 -->
00:19:52,780
mean the platforms are going
546
00:19:52,780 -->
00:19:53,660
to do anything for you
547
00:19:53,660 -->
00:19:54,820
because it's not in their
548
00:19:55,020 -->
00:19:56,620
business model or interests
549
00:19:56,780 -->
00:19:59,300
necessarily to let people
550
00:19:59,300 -->
00:20:01,140
who have no personal data
551
00:20:01,140 -->
00:20:03,260
or posts or interactions for
552
00:20:03,260 -->
00:20:05,060
them to monetize to help
553
00:20:05,060 -->
00:20:06,140
you get access to them,
554
00:20:06,140 -->
00:20:07,300
right? But now there are
555
00:20:07,300 -->
00:20:09,500
some legal precedents that
556
00:20:09,540 -->
00:20:10,180
are starting there.
557
00:20:10,380 -->
00:20:11,140
Also, thank you.
558
00:20:11,180 -->
00:20:12,500
Nice. Good to know.
559
00:20:13,420 -->
00:20:14,780
All right. Well, we will have
560
00:20:14,780 -->
00:20:15,900
links to all this in the show
561
00:20:15,900 -->
00:20:17,540
notes. So how to contact Scott
562
00:20:17,540 -->
00:20:19,660
how to sign up if you're
563
00:20:19,660 -->
00:20:20,860
interested in helping review
564
00:20:20,860 -->
00:20:22,020
the book and all the links
565
00:20:22,020 -->
00:20:23,700
that he has talked about on
566
00:20:23,700 -->
00:20:25,500
this episode. Thank you again,
567
00:20:25,500 -->
00:20:26,820
Scott, for for doing this.
568
00:20:26,820 -->
00:20:28,580
It's so sorely needed.
569
00:20:28,740 -->
00:20:30,700
One other quick note I would
570
00:20:30,700 -->
00:20:31,740
like to squeeze in and that
571
00:20:31,740 -->
00:20:34,140
is anybody here who has a
572
00:20:34,140 -->
00:20:35,900
financial advisor or an
573
00:20:35,900 -->
00:20:37,700
estate planner, it would
574
00:20:37,700 -->
00:20:39,260
be really interesting for
575
00:20:39,260 -->
00:20:40,460
you to reach out to them and
576
00:20:40,460 -->
00:20:41,900
say, is this something that
577
00:20:41,940 -->
00:20:43,020
you should be thinking about?
578
00:20:43,300 -->
00:20:44,540
And secondly, if they'd be
579
00:20:44,540 -->
00:20:45,980
interested in collaborating
580
00:20:45,980 -->
00:20:47,460
with me or getting in touch
581
00:20:47,460 -->
00:20:48,380
because I'm actually starting
582
00:20:48,380 -->
00:20:49,620
a series of panel sessions
583
00:20:49,620 -->
00:20:51,060
for advisors as well.
584
00:20:51,060 -->
00:20:52,900
So if you know of anybody
585
00:20:52,900 -->
00:20:54,620
or if you are one, feel free
586
00:20:54,620 -->
00:20:55,820
to reach out on that.
587
00:20:55,820 -->
00:20:57,700
Awesome. All right.
588
00:20:57,700 -->
00:20:58,900
Well, thank you everyone
589
00:20:58,900 -->
00:21:00,180
for listening. And until next
590
00:21:00,180 -->
00:21:02,180
time, stay safe, stay secure
591
00:21:02,180 -->
00:21:03,300
and stay private.
592
00:21:03,300 -->
00:21:04,300
Thank you for listening or
593
00:21:04,300 -->
00:21:05,860
watching. If you like this
594
00:21:05,860 -->
00:21:08,260
episode, hit subscribe, share it
595
00:21:08,260 -->
00:21:08,940
with your friends and
596
00:21:08,940 -->
00:21:10,660
colleagues or jump into our
597
00:21:10,660 -->
00:21:12,500
community at shared security
598
00:21:12,500 -->
00:21:14,380
net slash supporter to keep
599
00:21:14,380 -->
00:21:15,700
the conversation going.
600
00:21:15,700 -->
00:21:17,140
Thanks again, and we'll see
601
00:21:17,140 -->
00:21:18,460
you next week for another
602
00:21:18,460 -->
00:21:20,420
episode of shared security.
