Cybersecurity Hotline Special

We asked listeners to send in all their questions related to cybersecurity for this special Vergecast Hotline episode. David Pierce talks to Nilay Patel and Russell Brandom to get you the best advice for staying safe online. Email us at [email protected] or call us at 866-VERGE11, we'd love to hear from you. We are conducting a short audience survey to help plan for our future and hear from you. To participate, head to vox.com/podsurvey, and thank you! Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  This episode is brought to you by On Investing, an original podcast from Charles Schwab. Each week, hosts Lizanne Saunders, Schwab's chief investment strategist, and Colin Martin, head of fixed income research and strategy for the Schwab Center for Financial Research, bring you fresh insights on what's happening in the markets and why, and what the implications might be for your portfolio. Join Colin and Lizanne as they explore questions like, how do you evaluate corporate bonds that look interesting? And what sectors are on the move right now? Download the latest episode and subscribe at schwab.com/oninvesting or wherever you get your podcasts.

• 0:56David Pierce?

  Welcome to The Vergecast, the flagship podcast of turning off Wi-Fi on all of your devices and putting on tinfoil hats. I'm your friend David Pierce. Russell Brandam is here. Hi, Russell. Hi. And this is a, this is very special Vergecast episode. This is, is this the second week of Cybersecurity Week, Russell? Is this like Infrastructure Week? It's kind of every week? It's hard because for me, every week is Cybersecurity Week. That's fair. And it should be for you, too. But here, here on The Vergecast, today is Cybersecurity Week, I guess. Yeah, yeah, exactly. And we were thinking about a bunch of things to do, and we decided that the best thing we could do is just see what everyone wanted to know about. So we opened up the Vergecast hotline. We got a bunch of really great questions. You and I have been doing a bunch of research and prep and talking to folks, and we are going to just roll through

• 1:41David Pierce?

  some of the most interesting and popular questions we got. It's going to be fun. I'm, I'm very excited. I have been in some weird rabbit holes in getting ready for this that I did not expect. I don't know how it's been for you, but it's, I'm in a weird corner of the internet. Oh, yeah. I've, I've learned about myself and cybersecurity. It's beautiful. Isn't that, it's really the same thing, if you think about it. It's really beautiful. No, no, they're different. All right, let's get to our first question, which I think, let's just start with, I think, the one that is actually, in a strange way, the easiest to answer, which is from Alex.

• 2:10Speaker 02

  Hey there, this is Alex from Madison, Wisconsin. I'm walking my dog in the brisk Wisconsin evening, and I have a question about a browser malware extension. So I recently cleaned my computer of something called Bundle, and it was really weird. It sort of, it hit itself by making it so that whenever I tried to access the page to manage my extensions, it just wouldn't go there. It would redirect the traffic. The question I have is, whenever I tried to search for something in the Chrome search bar, it would redirect my search to Bing. Why would it do that?

• 2:53Speaker 02

  What benefit does some malware program have of redirecting my search through Bing instead of Google? Also, who uses Bing? Thank you.

• 3:02David Pierce?

  Malware victims. There's so many good questions in here. Yeah, who uses Bing is no one on purpose, but sometimes it happens. We've all been there. You just end up on Bing. You don't know how you got there. You don't know where you are, but it's dark outside, and you're bleeding from somewhere. And you don't know.

• 3:22Speaker 03

  Yeah, so there's a lot to dig into here. I will say the thing that I was kind of coming around to, listening to this, is a lot of people being savvy about security is sort of knowing implicitly what to trust. So it's like, is it sketchy if, you know, I'm reading my credit card number out over the phone?

• 3:45David Pierce?

  Yep.

• 3:45Speaker 03

  And it's like, well, if you called the restaurant and their thing is down, like, that's not actually that weird. Like, you're probably okay. It's okay to put your credit card number into amazon.com. Like, it's fine. And then, like, there's other things where I got a weird email and lots of stuff is misspelled, and it's like, that's obviously sketchy. You should be careful. I think browser extensions, and particularly bundled browser extensions, because he mentioned that he got this bundle. People who work in this stuff have known for a while that this is a real sort of place where scams happen and just it's a mess in there and you shouldn't trust anything. But I don't know if the average user has really gotten around to like the vast majority

• 4:28Speaker 03

  of browser extensions are actively exploitative and harmful and bad.

• 4:32David Pierce?

  Well, I'm not vast majority might be slightly overstated, but it is.

• 4:37Speaker 03

  There's a lot of, there's a lot of crap.

• 4:38David Pierce?

  There's a lot of crap. Yeah. Well, and it's, and it's tricky because like over the years, Google Chrome in particular has sort of devoted more and more resources to fighting that. But even still, it's basically like an automated system. And the thing that's crazy about Chrome extensions and browser extensions in general is when you install them, most of them require you to give them access to everything you do inside of your browser. Like in order to do the very basic thing that they want to do, you have to, because there's no like middle setting in many cases, you have to turn on like, sure, read later app, you can see every single thing I do in my browser. And that's just bonkers. And it's like systemically, this is not right.

• 5:20Speaker 03

  Not just see, but like you can replace what I'm seeing on the screen with other stuff.

• 5:25David Pierce?

  Yes.

• 5:26Speaker 03

  So, you know, they're like the classic joke extension is like, we made it so it replaces the word millennial with snake people like, ha, ha, isn't that funny? It's like, no, this is, you're looking at the website and what you're seeing is something different from what the website is trying to show you. Like, do you not see how this is potentially a problem?

• 5:45David Pierce?

  We had one of those when I was at Wired, this was during the 2016 election and somebody had downloaded a bunch of like jokey political extensions onto their computer. And one of them replaced every mention of Donald Trump with the phrase tiny hands. And, and it's like a very funny joke because you're reading the internet, but then they filed a story about Donald Trump and missed one of the times where the browser had changed like in our CMS to tiny hands. So we published a story in which this person had typed Donald Trump and it spit out tiny hands. It was really, it was really something special.

• 6:20Speaker 03

  Man. Yeah. Okay. So, so what he said bundle, this is, I did want to, I wanted to see on this too, because a lot of what happens is you're talking about Chrome. So like. Chrome is a very popular browser, as you know. It's free and a common scammy thing is people will bundle free software with this predatory unwanted software. If we're allowed to call it malware, spyware, adware, it gets into weird legal territory. But basically, there's the software you want and you should just get that. But instead, you're getting this bundle that has a bunch of other bad things in it. And that happens very often with browsers.

• 7:01Speaker 03

  I suspect that what is happening here, the reason it's sending him to Bing, is there is some... I don't think Microsoft is purposefully paying this adware company. Like, I don't think that that's what's happening. But it is broadly true that, like, Google pays Mozilla to have the default Firefox search go to google.com. Because Google makes money through advertising when people search things on google.com. And so, for a while, they were paying Apple. I mean, they're still paying Apple, right? For the iPhone searches that direct to google.com. Billions of dollars.

• 7:41Speaker 03

  So I suspect that, one way or another, that money is going from Bing to these scammy people with lots of intermediaries that make it hard for Bing to know who exactly they're paying.

• 7:56David Pierce?

  Yeah, I think that's right. And that, like, to be clear, all of that can be done without Microsoft doing anything nefarious or even anything at all. Like, I think it's very unlikely that Microsoft is loading adware into Chrome extensions. It'd be amazing if that were true. But it'd be amazing.

• 8:10Speaker 03

  I think it's probably a Microsoft executive who had had too much and sort of went Joker mode. And then they're like, we don't know what happened to him.

• 8:19David Pierce?

  Just call it bundle, leave it alone.

• 8:20Speaker 03

  He just makes adware now.

• 8:22David Pierce?

  No, but it is... One of the main things that these extensions do is they will insert ads onto websites in such a way that if you then click those ads, they make money, right? So like, the main two things a browser extension that you don't want will do is collect all of your data and sell it to somebody, or put ads into your Experience or replace the ads you're seeing with other ads and make money that way. So it's like 98% of the time, it's like if some hack is happening on the internet, it's somebody trying to find like a cheap way to make money, right? Like, that's usually what this is. And in this case, that is kind of the overwhelming thing. And one of the things that I've seen a lot of, and there was this big story, I forget when,

• 9:04David Pierce?

  relatively recently, where McAfee found a bunch of really well-known Chrome extensions, including the one Netflix Party, where you can like co-watch Netflix with your friends. What Netflix Party was doing was all the things Netflix Party was supposed to do, but then also doing things like adding affiliate links when you go to e-commerce websites, so that it makes money. And all this is just like sneakily happening in the background. And you never see it because it's able to get in between you and the browser, because that's what Chrome extensions do. And so it's just that kind of thing that it's like, often you might not even notice, but they are, they are aware of what you're doing and they're either changing it in some way or taking something from you. So my read of it is not that like all Chrome extensions are dangerous.

• 9:46David Pierce?

  I do think the fact that they automatically update in the background without telling you is dangerous, but also like it is the kind of thing that you should be super, super, super aware of what you're downloading and make sure. The advice I always give people is never search in the store. Always go from like, if you're looking for an app's Chrome extension, go to the app and find the link to the Chrome extension from there. Because if you go into the Chrome Web Store and search for an app, you're going to get 100 things that all look the same. 99 of them are scammy and one of them is real. And it's often very hard to know. So if you need to have a Chrome extension and you should use only the bare minimum for all the reasons we've been describing, like find it from somewhere else. Don't just go hunting through the Chrome Store for things that seem cool, because like there be dragons.

• 10:26Speaker 03

  And, and if you're listening to this and, and being like, what can I do? Like, go to your Chrome, you know, check out what the extensions are. It's chrome colon forward slash, forward slash extensions, right? But you can see, it'll just show you everything and you can like absolutely delete anything you do not recognize or that you're like, oh, I sort of remember installing that, but I don't really use it, like. You should really have as few as possible.

• 10:54David Pierce?

  Yeah, 100%. If you don't use it like every day, you probably shouldn't have it. It's worth the like extra two clicks in the browser to not have this stuff sitting between you and everything you do on the internet is my general read.

• 11:08Speaker 03

  Totally. All right. Should we do another one?

• 11:09David Pierce?

  Yeah, let's move on. So let's see, we have a couple in a row about passwords. So let's knock those out first. First, we have one from Eduardo. Let's hear that.

• 11:20Speaker 04

  Hello, the Verstin. So I got a question about passwords. I use different passwords for every single app or website that I log into. But I'm deeply into the Apple ecosystem. So my question is, should I go into the suggested passwords? Or should I just keep using my own different passwords for everything? Is there any drawback on going into the Apple passwords? Or will I be able to do everything I've been doing so far? Thanks.

• 11:59David Pierce?

  Okay, so first of all, Eduardo, kudos for using different passwords for everything. That immediately puts you ahead of almost everybody. So congratulations. This is the question that sent me down the deepest, weirdest rabbit hole of any of the questions we got. But before I get real weird about random number generators, which is going to happen, what are your thoughts, Russell?

• 12:18Speaker 03

  Yeah, I mean, I think so partially, this is like a question about password strength, right? Because if he's coming up with these different passwords, they're presumably sort of human comprehensible passwords, not just random strings. And so it's like, is it better to use the random strings that Apple is using? And I don't think it's a huge deal. I think the main... So the place where your password strength is most likely to be tested is you can't just guess millions of passwords at once on like the Gmail login screen. Like they will catch on. It seems like a robot is just doing one, two, three, and then the next one.

• 13:01Speaker 03

  But occasionally hashes hashed versions. So a hash is what the website is checking your password against. It sort of has a hashing function that does a special dance to the password that you inputted and then it checks it against, well, this is what all, this is what the correct password should look like after the special dance, so that it doesn't just immediately know what your password is and have that information for everything. And so you're not supposed to be able to work back from the hash to the actual password. But if you already know what the password is, or you have, if you like, check a bunch of really common passwords, and then that can help you crack the hashing algorithm and undo the other ones, then it's a problem. But like, the

• 13:45Speaker 03

  difference between a fairly uncommon word that's in the dictionary and a couple like random characters, and the complete gobbledygook that Apple spits out, is just really not that significant, and I wouldn't worry about it. I think the main question is like, are you more likely to lose it because it's not automatically being logged by Apple's password manager? But that also doesn't seem like a huge difference, since it sounds like this system is working for him.

• 14:15David Pierce?

  Yeah, I think I agree with all of that, actually. And I think the, the two parts of this just jumped out to me are, one, the like, convenience thing you just talked about. And I think, to me, the biggest downside of using Apple's, the, the whole like, keychain system within Apple is, it's very convenient, but it's also tied to all of your other Apple stuff, right? And like, one very common sense cybersecurity piece of advice is, don't have all your eggs in one basket. And so, the idea of if somebody gets into my iCloud, they can also get into my passwords, should make you nervous. And there's a, there are good ways to get around that by like, protecting your iCloud and multi-factor authentication and all that stuff. But like, I would, I would say the only reason not to do it is that, A, it's not very cross-platform, so if you use other

• 14:56David Pierce?

  devices, past, uh, keychain doesn't work all that well, and it is attached to all of your other Apple stuff. So do with that what you will. To your point about the randomness, I think you're exactly right. I think my worry would be that for somebody like our friend Eduardo here, that when they say, I have different passwords for everything, what they actually mean is like, variations on a theme, where it's like, I have one password that is like, cool kids, and then I have another one that's cool kids with two S's, and then I have one that's cool kids six. And that is not great password hygiene. It's better than having the same password for everything, but it's not great password hygiene. Because-

• 15:30Speaker 03

  Yeah, and it's worth going into what the attack is there. So there are these like LinkedIn was breached in like 2009 or something, 2011. It was a while ago. This is all public. This is I'm not blowing up any spot. But then this means that like anyone on the internet who wants it basically by now has the LinkedIn password I was using in 2011. Right. And so if I was using that for anything else, when they were able to get to it, they probably went through, you know, well, what's Russell's Gmail account? What's Russell's other account? Let's see if the same password works. Right? And a lot of times they have this password and the breach isn't public.

• 16:13Speaker 03

  No one knows about it. And so they're likely to have sort of find out about it before you do. Now, are they going to try? Well, okay, what about Russell's password? But the number is slightly different. Exactly. What about Russell's password? And there's some extra S's. On one hand, like, they're doing this with 10 million passwords and just running through the list, because it's fairly, it's rare that you get a hit. It's just like, it's worth it if we get a hit. On the other hand, they have a lot of time and not a lot of these breach things. So they're probably going to try as much as they can get away with. And that's, that's why the password hygiene of like, here's this slight alteration is not great if a password very,

• 16:57Speaker 03

  very similar to that gets breached.

• 17:00David Pierce?

  Yeah, I think that's right. And I think the, the deep rabbit hole I went down was about pseudo random number generators. And this idea that even things that purport to give you random sets of characters are not random, right? Like, computers on their own can't do random. There is a logic. So what they do is they start basically from what's called a seed and then run an algorithm to do what is this, what looks a lot like randomness. But if you can figure out what that seed is, you then know where the randomness started from and you can start to figure it out. So Bruce Schneier, who is a security researcher who has done a lot of work on this over the years, I think he talks about that I like, and I think is a useful framework to think about all of this is basically like degrees of entropy, right? Like if I, if All of my passwords are one last character off. That's one degree of entropy, right?

• 17:45David Pierce?

  If you know all of my password except that one character, all you have to do is figure out one thing. But if you don't know any of my password, because it's all different, you're starting from nothing. And suddenly the like work you have to do to get there is much, much stronger. So I think in a case like this, what I went, the rabbit hole I really went down is like, is Apple's pseudo random number generator better than the competition's pseudo random number generators? And the answer is like, not really. There are a lot of very good ones out there. And the real question is just about a lot of other things that actually like the random number generators are not likely what's going to screw up your passwords over time.

• 18:19Speaker 03

  Yeah, that's like, that's like you're, you're like, is this plane I'm getting on safe? And they're like, well, let's look at the fuel.

• 18:27David Pierce?

  Exactly.

• 18:28Speaker 03

  Who's using the best fuel? It's like, it's, it's, it's probably, it's not going to come down to that.

• 18:32David Pierce?

  Is it information? Yes, but is it, is it going to be the difference? Almost certainly not. But generally, like what I would say is, is think about entropy, right? And if you want to keep your password as secure as possible, have as much entropy between your different passwords as you possibly can. And if that means letting Apple fill it out for you and save it in ways that everyone agrees are solid and secure, that works. I use one password, which I love very much. I will stand for one password to anyone who listens. It's a really good password manager. There are a lot of good ones out there. And I think having them be randomly selected for me, I don't know most of my passwords and I like it that way. And I feel like that's, that's where everyone should be. Let it, let a system know my passwords and then I don't have to.

• 19:12Speaker 03

  Absolutely.

• 19:13David Pierce?

  All right, let's move on.

• 19:14Speaker 03

  So what's the, what's the other? Yeah, what's the other password? I mean.

• 19:17David Pierce?

  Our next one is even weirder and I'm very excited. It's from Leon. Let's hear it.

• 19:22Speaker 05

  Hey, Vergecast team. It's Leon from Virginia. What's up with websites having a maximum character limit for their passwords? Like, why do I have to create a password with a maximum of eight or 12 characters? Why is that safe? Thanks.

• 19:40David Pierce?

  This is the other question that sent me down a crazy rabbit hole.

• 19:42Speaker 03

  Yeah.

• 19:43David Pierce?

  And it was deeply unsatisfying.

• 19:44Speaker 03

  I mean, it's not safe, right? Like broadly, these limits are bad. Security people don't like them. I think that the reason that you see them is kind of, has to do with making life easier for the architects of these systems, more than like, security fundamentals. But it sounds like, David, you have a lot of research to spill out.

• 20:06David Pierce?

  No, so you're right, but you're missing one piece of the equation, which is users. The simple truth of the matter, based on all the research I've done and all the people I've talked to, is that fundamentally, if you allow people to have 500 character passwords, they will forget them, they will type them incorrectly, they will call customer service to reset their passwords more often, and that will suck for everyone involved. And so, I went down looking for, like, really useful technical answers, and what it seems like is, on the one hand, you're right, that like, and especially in the early days of the internet, there was a lot of like, technological systems that just couldn't handle that much data coming in at the same time. Like, if you're sending somebody a one megabyte password, that's a lot, and it was especially a lot many years ago, so.

• 20:51Speaker 03

  Well, and also that, like, remember, there's the hashing algorithms, like, if you can know the amount of information very precisely, it lets you, it just sort of smoothes things out.

• 21:03David Pierce?

  Totally, yeah. And then that just sort of became the norm, so people kept doing it. But then I was looking, and like, the National Institute of Standards and Technology has a bunch of rules about passwords, and what they actually recommend is that you allow at least 64 characters. Because, uh, the kind of new password theory is like, what you don't need is just a bunch of like, random hexadecimal stuff. What you need is like, a long, relatively random string of words that you can remember. That that's actually the most useful thing. Like, if it's five words in a row, you can do it.

• 21:34Speaker 03

  I will say, at the risk of compromising my own security, so this is the passphrase, right? Think of some phrase that you remember, and I'm a word guy, so I remember phrases, like, there are a lot of phrases where I'm like, oh, yeah, that one line really meant something to me. And so, when I was setting up my, like, work account for Vox Media, I did the phrase. And I was like, I'm not gonna, you know, this is gonna be in my password manager, I'm not gonna type this in that much. And then, as it went on, it sort of propagated, until now, it's the thing I need to type in every time I wake up my laptop. And it's like, it's like a bunch of words long, like, it's over 50 characters, it's,

• 22:17Speaker 03

  and, and also, if I can't see it, I'll, like, have a typo sometimes, so it'll take me, like, two or three tries, and I'm just trying to, like, mute whatever song is playing. It's really, uh, so that's a, that's a cautionary tale.

• 22:31David Pierce?

  It's just like the first chapter of Moby Dick, every time you wanna wake up your computer.

• 22:35Speaker 03

  Oh, my god, how did you guess? No, but I mean, it's really like, yeah, I'm trying not to do it, I'm not trying not to put any information out there that would, that would make it easy for the hackers, but, um, yeah, it's, uh, so, think about the fact that you'll have to maybe type this in a lot.

• 22:51David Pierce?

  But I think, yeah, in general, it is, I, I think I would agree, bad form if they only allow you to have something like eight characters. What does seem to be true is there are pretty severe diminishing returns after about 20.

• 23:02Speaker 03

  Hmm.

• 23:03David Pierce?

  I don't know if that's a magic number, but that, that one kinda came up a bunch, that like, the difference between a 20-character password and a 200-character password is not massive in terms of, like, can a regular person brute force their way into getting your password? Whereas the difference between 8 and 20 is when it goes from, like, hard but feasible to hard and sort of infeasible. So I think, yeah, if, if you're only allowed to have short passwords, you should, you should yell at them to let you have longer ones, is what I would say.

• 23:31Speaker 03

  Yeah, cool.

• 23:32David Pierce?

  Do you have short passwords? I feel like I just shamed you by accident. You're changing all your passwords right now.

• 23:37Speaker 03

  I will say, I changed from on the, in the iPhone unlock. They give you the option of four numbers, which the security people really don't like, or six numbers, which is, you know, it's powers of 10, or it's 100 times more secure. Or this alphanumeric thing which you're going to type in on a keyboard, which is probably the best thing to do, but I mean,

• 24:00David Pierce?

  Who has the time?

• 24:01Speaker 03

  I'm not gonna.

• 24:02David Pierce?

  Honestly, like, it's, I'm a four, I'm a four-digit iPhone passcode person.

• 24:08Speaker 03

  Wow.

• 24:08David Pierce?

  And I'm ashamed of it, like, I am. It's not great. And, and the best part is it defaults to six and it makes you change to four when you set up your phone. It's like, do you want to make a stupid decision right now? And every time I'm like, yes, I do. Thank you for asking. I'm very happy to do so.

• 24:23Speaker 03

  Yeah.

• 24:24David Pierce?

  All right. We need to take a break and then we're going to come back and answer a couple more questions, including with our very good friend, Neelak Patel. We'll be right back.

• 24:36Speaker 00

  This episode is brought to you by On Investing, an original podcast from Charles Schwab. Each week, hosts Lizanne Saunders, Schwab's chief investment strategist, and Colin Martin, head of fixed income research and strategy for the Schwab Center for Financial Research, bring you fresh insights on what's happening in the markets and why, and what the implications might be for your portfolio. Join Colin and Lizanne as they explore questions like, how do you evaluate corporate bonds that look interesting? And what sectors are on the move right now? Download the latest episode and subscribe at schwab.com/oninvesting or wherever you get your podcasts.

• 25:24David Pierce?

  Okay, next up, we have a question I think a bunch of us got very excited about. This is from our friend Chuck, who has a question about babies.

• 25:33Speaker 05

  Hey, guys. This might be very niche, so maybe it doesn't go on the show, but maybe it could go on an article sometime. I have a newborn and I don't know how to keep her safe from online stuff. Like, do I need to do anything? Do I do nothing? So, yeah, I just. I don't want to leave doors open, but yeah, I don't, there's nothing good out there that says, like, do this and you'll be safe. Thanks. Love the show. Bye.

• 26:02David Pierce?

  Okay. This question gives me so many feelings and you can just, you can just feel the like vibes and energy from this person. Neel Patel is here to help us answer this question.

• 26:12Nilay Patel?

  Hello.

• 26:13David Pierce?

  Neel, you are our resident baby expert. Congratulations.

• 26:15Nilay Patel?

  That's bad for America.

• 26:19Speaker 03

  You are all that stands between the horrors of the internet and the children of America and some of Canada.

• 26:29Nilay Patel?

  They are our future. The whole show to parent blogging. That's what I'm doing.

• 26:31Speaker 03

  Yeah.

• 26:32David Pierce?

  I will say Neel has been threatening to do this ever since he had children. So it's, it's gonna happen eventually. Well, I feel like we, we could start almost anywhere here, but there's like, is there stock parenting advice for what you should do? Like, cause there, there, there comes a time when like your kid is gonna start wanting to be online and you have to do things about that. But we're talking even way before then. This is the like, they don't even know what the internet is yet. Do you have responsibilities to them? And which I think is a super interesting question.

• 26:59Nilay Patel?

  Yeah. Well, David, you're about to have a kid. So you're gonna become the new. Am I allowed to say that on the show? Do the people know?

• 27:05David Pierce?

  The people don't know. They know now. I would, this is, this is as good a time as any. My wife is due in December and I'm gonna be the Verge's next baby correspondent.

• 27:13Speaker 03

  Congratulations.

• 27:14Nilay Patel?

  That's great.

• 27:14David Pierce?

  Thank you.

• 27:15Nilay Patel?

  You gotta, you gotta rotate in a new one. Cause the kids keep getting relentlessly older. It's a real problem. So here's what I would say to everybody. Almost everything about being a first time parent is just how afraid you choose to be and how much you allow corporate America to prey on that fear. The best advice I ever got was from my friend Spencer Hall, some of you may know from other endeavors in the internet. And he just looked at me very seriously. I think he was like four kids and he was like, babies are more resilient than you think. And if you just hold that in your head, you're gonna be like, just remember, people did this before any technology existed. That's how you got here. So he's just like, hold on to that. The second thing I'll say much more specifically about computers is

• 27:58Nilay Patel?

  once you realize that all that's designed to prey on your fear, you realize that a lot of like computer products exist to just reassure you, but actually provide you like no additional safety. So there's like infinity baby monitors and socks and snooze that you can buy. And you just have to decide how much you want to like participate in that universe of things. Our decision was that we didn't want anything that required a user account. We just didn't want to start sharing data about our kid at any moment. So we did not buy a connected baby camera. We bought the UFI one that's on Amazon. I'm sure by now there are many iterations of it, but there was one that everyone bought.

• 28:41Nilay Patel?

  And then UFI, which is a division of Anchor, came out with like the slightly upgraded riff on that one. And we just have that one and it works great. And it is, you know, like a proprietary RF protocol. It's a rock solid in our house, no wifi involved. And it has a little piece of hardware that's great. So we carry around a little screen in our house to watch our kid. That is-

• 29:02David Pierce?

  So your, your thinking was not only like no user accounts for your kid, but no user accounts related to your kid, like, cause it wouldn't have been, it wouldn't have been your kid's name on the UFI or on the baby monitor thing, it would have been yours, but even still, like that crossed the line.

• 29:17Nilay Patel?

  Yeah, I wanted, I'll use a security term here. I wanted to air gap the baby from the internet for as long as possible.

• 29:23David Pierce?

  Oh, I love that. Okay, that's good.

• 29:25Nilay Patel?

  Right. So I didn't want anything connected to the internet near the baby for as long as I could hold off.

• 29:31David Pierce?

  Air gap your baby is a Verge t-shirt that needs to be. This is a thing, we're going to make onesies, it's going to say air gapped, it's going to be incredible.

• 29:38Nilay Patel?

  One thing you're going to want to do is track a bunch of baby stuff related to a newborn, when they eat, when they poop, when they sleep. And there's infinity apps that are, you know, you can log into and you can use them. And we don't want to use them. So we used one called Sprout, which syncs the database over iCloud to another phone using a key. There's no user accounts and they actually advertise it as having no user accounts. So this is like four years ago, we have not tracked our four year olds sleeping and pooping. We're good. She lets us know when it's going to happen.

• 30:08David Pierce?

  I mean, are you weighing it? What, what's the fine grain of the data? How much data on the poop are we collecting here?

• 30:15Nilay Patel?

  Well, so when you have a newborn, you don't sleep very often. So your memory of what happened when- Becomes very limited and you're like, did I feed the baby? And you just don't remember and you certainly don't remember how much or what you fed them. I guess like two in the morning. So like, how many ounces of milk did I feed the baby is like, you were just not going to remember this five hours from now. So you just track that stuff. Just have a log between you and your partner because ideally one of you is asleep while the other thing is happening. Ideally, I said, sometimes it's just a pure panic situation. So we just constantly made choices to keep the kid away from the internet. And at some point, your parenting choice is going to be in order to make this child eat

• 30:58Nilay Patel?

  or survive a restaurant or be on an airplane, we're going to give them a tablet. And then all of it kind of goes out the window. But for us anyhow, our choice was very much no user accounts, no wifi connected toys. None of this stuff where I have to become the IT manager of like a very helpless human beings internet presence. Because once you open the door, you're just fully down the road.

• 31:23David Pierce?

  Yeah, the, the only other big picture question I can think of that it would be useful to ask or to like, have answers to pretty early on would be like, how do we take and share pictures of our child in a way that makes us comfortable?

• 31:37Speaker 03

  Yeah, I, I will say, so my, I have two nieces and my brother, I think, I was impressed by this, although I think maybe some people would be worried about it. But basically they didn't want to be on Facebook or putting like, have for Facebook to have an accessible record of various pictures of, of the girls. And so, but you want to share it with family. And so they set up this Tumblr that is public to the internet, but that like only cert, like only the family members really have the address to, and it doesn't have their names on it or any like words whatsoever. It's just a public facing webpage on the internet, which I think worked out for them.

• 32:19Speaker 03

  I mean, the main thing is like grandma doesn't have to get a Facebook account or like maintain access to a Facebook account, which I think is probably good and like. You know, Grandma doesn't really wanna see, Grandma doesn't wanna go on Facebook. She just wants to see pictures of her grandchildren. So it's fine.

• 32:37Nilay Patel?

  Yeah.

• 32:38Speaker 03

  Yeah. So I don't know if that's like, if that solves every problem, but that is a baby picture hack I have heard.

• 32:45Nilay Patel?

  So that one, I buy it, right? Cause you, you're not inside of big tech. Like Tumblr is not big tech. It's like small, struggling tech.

• 32:53Speaker 03

  Yeah, small to medium tech, I think.

• 32:55Nilay Patel?

  But public to the internet terrifies me, right? Like, that's it. That's just a URL on the internet that could get picked up. The ClearView AI is looking at pictures. Who knows? You can't see what's happening.

• 33:04Speaker 03

  Well, it's not tied to their names.

• 33:06Nilay Patel?

  Right.

• 33:06Speaker 03

  So it's just these pictures of people on the internet. It's true, it could get scraped though. I mean, they didn't.

• 33:12Nilay Patel?

  So one day, this family is gonna be in a Walmart, looking at like empty photo frames and being like, well, that is us.

• 33:18Speaker 03

  Yeah.

• 33:20Nilay Patel?

  Very unfortunate. So we, we kinda went the other way, which requires more trust, but feels more closed. So we, we started with Apple Photos, which seemed very closed, share photo streams. And then more people wanna be involved. And then in particular, this thing like Grandma wanting to see the photos. We wanted to set up digital photo frames that just had the newest photos on them for various people in our family. So then we switched to Google Photos, which Google will insist is a closed, private ecosystem. But we were able to just set up Google Homes and then lots of digital photo frames, like just the ones you can buy, have Google Photos connections. So they just, we just have one album that we add photos to, and it shows up on picture frames in our various family members' house.

• 34:05Nilay Patel?

  They don't have to do anything. And the more that I, and that feels like I am just in control of that database of pictures and I am in control of who has access to it. And that feels important to me. As she's gotten older, as Max has gotten older, I've stopped posting her Instagram as much. I feel like babies are fine. And now she's like a person with a personality and I feel very like exploitative for personality. Like, that's just a choice that she's gonna have to make over time and I'm gonna tell her not to do it, but.

• 34:34Speaker 03

  Well, I mean, if you're, if you're going to the Gerber sponsorship.

• 34:37Nilay Patel?

  When she was first born.

• 34:38Speaker 03

  Brand deals.

• 34:39Nilay Patel?

  And she was first born.

• 34:40Speaker 03

  Gotta be on the gram.

• 34:41Nilay Patel?

  We gotta get this kid in the catalog. And then it turns out Benetton doesn't exist anymore. So my one target was gone.

• 34:49David Pierce?

  I don't know, she's got good hair. You could work with that.

• 34:51Nilay Patel?

  Yeah.

• 34:51David Pierce?

  A lot of places to go. Any, are there any other, like, I'm just even trying to think about like, what are the questions you should be asking early on and like conversations you should be having? Are there other big ones we haven't hit on yet?

• 35:01Nilay Patel?

  The main ones are really just how public do you want your child's life to be?

• 35:07David Pierce?

  Yeah.

• 35:07Nilay Patel?

  Right? Like you start to have all these experiences and it turns out being a parent is like, among the most universal experience you can have. You can relate to all kinds of people just by talking about your child. That's why people talk about their kids so much. It's very annoying before you have a kid and then you have a kid and you realize why it keeps happening. There's a reason people want to show you photos.

• 35:24David Pierce?

  It's kids in the weather. Like those are the only two things.

• 35:26Nilay Patel?

  Yeah.

• 35:27David Pierce?

  Lots and lots of people.

• 35:28Nilay Patel?

  It's all, which is great, but there's an instinct to do it very publicly on the internet. There's an instinct to profit from it for some people. Like you could be a parent YouTuber, like all this stuff. And you gotta make that decision early and like, hold on to it because otherwise you're, I, I think a lot of people are gonna grow up and their parents have been talking about them in public for a very long time. And they are not like, they lose it. They might lose a sense of agency over who they get to be. Cause there's this rich backstory about their life. And I think you just have to make that decision. That I've thought about that a lot with our kid. I've talked to other parents who think about that a lot. I think there's a rich and varied debate about that in the world of

• 36:08Nilay Patel?

  the internet, like in the world of internet parenting. And so that's the one that I would just encourage people to think about. It's like really hard to see when you have a newborn. It's just a picture of a newborn. Like, that is kind of a story about you and how much you're not sleeping, but soon it becomes a story about them and you gotta flip that switch.

• 36:25David Pierce?

  Yeah, I will say the, the point that the internet is just there to make you afraid and sell you stuff is a useful one to remember. And it's been very useful for me to remember, even in this, like, we're in the phase now of like, trying to figure out like, what happens when you give birth and all the things you have to do. And it's like, I've started reading about sleep training and the only thing I've learned about sleep training is no matter what you do, you're wrong and you're a bad person and you hate your kids and it costs millions of dollars to buy all the right products to solve all of their problems. And so I just like, every time I go on the internet now, I have to just be like, the internet is here to lie to me and sell me things. And that is what this is for. And I, I am now like, I am everyone's target demo. Like new parents are everyone's target demo.

• 37:03Nilay Patel?

  Cause you're terrified.

• 37:04David Pierce?

  Yeah, yeah.

• 37:04Nilay Patel?

  And you, and you, whatever, whatever you might say about modern society, you don't have all the people around you to keep you from being terrified. Which is like a real thing.

• 37:13David Pierce?

  All right, Neelai, we need to let you go. We have some more questions to get to, but thank you and, and you know, good luck to all of us.

• 37:19Nilay Patel?

  Yeah, good luck, dude. I'll buy you some booze.

• 37:22David Pierce?

  All right, Russell, we have a couple more. We're just gonna, we're gonna blow through these really fast. One that we didn't technically choose to do here, but I just want to talk about quickly because this, this is a thing that comes up a lot in conversations that we have with like regular people thinking about cybersecurity is VPNs. Liam, do we have Ben's question we can play about VPNs?

• 37:41Speaker 07

  Hey, Virg, uh, this is Ben. I've been thinking about subscribing to a VPN service, but it's very unclear which one is the best. Some of the most promoted ones like Express and NordVPN have questionable audits. And yeah, just very curious about what VPN service people should subscribe to. Thanks.

• 38:07David Pierce?

  I love this question because I find it completely impossible. And I feel like we've talked a lot about just deciding who to trust and who not to trust in the course of this episode. And I feel like this is sort of the same thing, like fundamentally, if you get a VPN, you are, it, it's like, it's like letting someone into your house, right? Like you are giving them a massive amount of theoretical access to your stuff. And a lot of them say they don't want it. A lot of them say they don't store it. But like, you just don't know for absolute certain and it is fundamentally a question of trust. But then if you don't do it, you're trusting, I don't know, all of your browser extensions and you're trusting Google and you're trusting Facebook, which has all this kind of information. Like you just can't browse the internet without somebody knowing.

• 38:51David Pierce?

  And at some point, you just have to decide who you trust the most. And I feel like it gets very nihilistic for me from there, but that's kind of where I land.

• 38:59Speaker 03

  Yeah, it's funny. I was, I was writing about, actually in the Wi-Fi coconut piece, there's this question of like, how much control does like a router? Like if the bad guy is controlling the router that you're logging in through, like that's not good. How much of a threat is that? And one of the, I was thinking about it and I realized one of the fundamental things you see in internet technology at all sorts of different levels is you're basically using encryption to secure infrastructure. So it doesn't matter who's controlling the router. It doesn't matter who's at the ISP. You know, the router, you, you'll have like WPA keys that are keeping it from, from sort of. Being a point of attack, the ISP, ideally you have SSL and that's that level of encryption.

• 39:44Speaker 03

  The VPN is kind of like adding another one. And so there's a sense in which the attacks that it helps against are if you are working for a company, like it's corporate security and they're like, these are the plans to our next hot new airplane. And the bad guys want to steal the plant. And so we know exactly where the perimeter is of like who we trust and who we don't. And if the VPN is running through the company, then ideally you're not expanding the trusted, you know, at all, because it's, it's running through that same infrastructure. It's the same group of people who are going to have access to it.

• 40:24Speaker 03

  But you can have sort of an extra layer of protection to log in through the conference wifi and not get injected because the only thing you connect to is this wifi, you know, this VPN service, which then hardens the tunnel through the rest of it. Having said that, that is not generally how I see people talking about why they're using VPNs. Oh, honestly, the most, maybe this is because I'm hanging with a sketchy crowd, but like the most common thing is people like, well, this will keep me from getting sued for pirating movies or something.

• 40:58David Pierce?

  Oh, absolutely. Or this is how I can watch stuff on Netflix that's only available in another country. Those are the two things I hear the most.

• 41:05Speaker 03

  Right. Well, I, I mean, so the Netflix geolocation thing, that might be robust. I don't think that Netflix is really cracking down on it yet because it would just be so, it would be so much of a pain for them without, they don't really care if this is happening anyway. So, but anything illegal you're doing, if you're paying for a commercial VPN service, it's just another subpoena that the police have to send. So they subpoena the VPN service to then subpoena the ISP to then get to you. And like, Maybe it's in Switzerland and so it's harder. But like, if you're the Dread Pirate Roberts or something, this is not going to help you. And I see people talking as if it is.

• 41:46Speaker 03

  And that, to me, is like my main experience of engaging with VPNs. Very rarely do I see it lining up with the actual threat model it could protect against.

• 41:58David Pierce?

  Yeah, that, that totally tracks. And I think in general, we talked a little bit about VPNs with McKenna a while ago on this show. And one of the things I heard over and over, even from VPN people, is that if you're just a regular person doing regular internet things, you probably don't need one. And even to your point about like, what if the bad guys are on the router? Like, thanks to things like HTTPS, like, they can start to know what website I went to, but not what I did there. And that stuff is increasingly encrypted and the internet is, is much harder as a result. And so the, the advice I've gotten from folks is basically like, if you know you have a specific thing that either you need to avoid being seen for, or you have a specific thing you

• 42:41David Pierce?

  need access to that you can't get access to, those are good reasons to get a VPN. But if you're just like a person in a coffee shop worried about security, a VPN, to your point, is not actually going to solve that sort of same mainstream problem.

• 42:54Speaker 03

  Yeah. Also, I trust my coffee shop more than I trust my family. That's, to me, that's the pinnacle of, they're so nice.

• 43:03David Pierce?

  Shout out to Russell's coffee shop. Somewhere in deep upstate New York, I think. I don't know. Who's to say? Russell doesn't tell us where he is. That's his real cybersecurity trick.

• 43:13Speaker 03

  Yeah, I, I keep operational security. No one knows where I am at any time.

• 43:16David Pierce?

  Yeah, he's in a, he's in a dark room with a black background and no one's allowed to know what he's doing. All right, let's move on. We have one more question to do before we get out of here. It is from Emmanuel. Let's hear it.

• 43:26Speaker 08

  Hey, Virg, this is Emmanuel. I had a question related to your security podcast that's coming up. I I've always wondered what could a bad website do to me? So for example, I I clicked on a on a bad ad on on Google search results. And I stayed on the website, didn't do anything, then closed my browser, closed the window. What is the worst thing that could have happened to my machine? Could could and what could be installed? Like, what do I have to worry about? Thanks.

• 43:54David Pierce?

  This is such a good question and made me realize I also have this question.

• 43:57Speaker 03

  It made me very worried for Emmanuel's safety. Like, we're gonna find out this is the last communication anyone got.

• 44:04David Pierce?

  Emmanuel's just clicking every link everywhere just to see. What could happen? What's the worst? So what's the answer? What is the worst that could happen?

• 44:12Speaker 03

  Um, I, to me, it's like, it's like, what if the brakes stopped working on your car? It's like, there are so many bad things that could happen. I almost don't even want to think about it. It's like, no, you should be able to use the brakes.

• 44:25David Pierce?

  All right, well, let's let's frame this slightly differently then, like.

• 44:27Speaker 03

  Yeah.

• 44:27David Pierce?

  It's, I think, one, one obvious bad thing that can happen to you on a computer is that, like, you go to a website and it installs a keylogger and takes your credit card information, right? Like, that we grant. But I think the, what seems to me to be implicit in this question is if I go to a bad website and I leave that bad website before I do anything, can it do anything to my computer after I leave the website? And the answer to that, I think, is like unequivocally, yes, absolutely, right?

• 44:55Speaker 03

  Yeah, because you loaded, loading the website. When when we say I'm on the website, what that means is the server has sent this information to your browser and your browser has used that information and sort of executed the files to build the thing that you're looking at, right? But that could have also included, they're like, run this code, it'll make this fancy cool ad that with the little guy who dances around, he's gonna love it. And like, it made a fancy cool ad with a guy who danced around and you did love it, but it also installed this malware, which is now like. Encrypting your entire computer and get a ransomware you,

• 45:36Speaker 03

  or just like hang out there for six months and gradually sort of expand its access in the network. I mean, I think the tricky thing is, once the perimeter has been breached, it's kind of like, well, what mischief do they want to do when they're on the inside? It's like, I don't know. I hope nothing too bad, but like, it's out of my control now.

• 45:56David Pierce?

  Yeah, I spent a lot of time in prepping for this, talking to people and reading about exploit kits.

• 46:01Speaker 03

  Oh, yeah.

• 46:01David Pierce?

  Which is just, my god, terrifying. And basically, it's exactly what you're talking about. The idea is like, you load this website and what it does is it installs software on your computer that essentially just looks for vulnerabilities, right? And it says, like, you know, "Do you have this technology to play videos in your browser? No? Do you have this one to read PDFs in your browser? Ah, you do. I'm gonna use that and just sort of open up a little hole in it and then download whatever I feel like." And it's like, and it's just, once it's in, it does sort of all this different hunting, it finds its place, and then it can just sit there. And it can wait as long as it needs to, and then it just has access to your computer. And this stuff is like, it's dormant forever, it's tiny, it's hard to find, and it just sits there, sort of waiting to be activated.

• 46:45David Pierce?

  And it's gotten really sophisticated to the point where like, like Flash, if I'm remembering this right, used to be like, the main problem here, right? And it was like, Flash was a garbage piece of software.

• 46:54Speaker 03

  It was a very big problem, yeah.

• 46:55David Pierce?

  That was full of loopholes and exploits. And every time you would load a Flash thing, it was loading an app from your computer and running it, and by doing so, they could put code in it and then load other stuff. But there are still a bunch of ways like that into your computer now.

• 47:09Speaker 03

  Yeah, I would say, I mean, the other thing that classically people were worried about, and this is something that, you know, in the time I've been working at The Verge, HTTPS adoption, including by theverge.com, has just gone from sort of zero to 60. Like, it was maybe a third of websites in 20... It was definitely below half, and now we're well over 95%. It's sort of rare that you go somewhere on the internet that doesn't have it. The result of that is these injection attacks, where someone is at the ISP, or at the router, or at sort of tapping into some cable, because they're the NSA, and they want to... You're sort of opening a legitimate website, but they are injecting malware into it as sort of turning it into a malicious website.

• 47:55Speaker 03

  You know, those are still possible, but they're much harder to do. And so it seems to be in many ways, things have gotten better, but it still is the case that you should not like clicking. The problem is clicking the link to the website.

• 48:10David Pierce?

  Right.

• 48:10Speaker 03

  Not like, once I'm on the website, what do I do? Yeah.

• 48:14David Pierce?

  But we should say, and I think, I think not to like downplay any of this stuff, but I feel like it continues to be a useful thing to remind people that like, most people get into trouble because they enter information in places that they shouldn't. And this is like what you were talking about earlier about like, don't give your credit card over the phone and this like basic stuff, but like, anytime you're going to type in your username and password, anytime you're going to click on a link in your email, anytime, you're going to type in your social security number or your home address or whatever, like, most people get into trouble because they give up information willingly to people they shouldn't. Like, the malware stuff is real, the exploit kit stuff is real, the stuff they can download is real, but like, you are much more likely to get in trouble by reading your credit card number to someone you shouldn't than by like having your router tapped by the NSA.

• 48:56Speaker 03

  Well, and also I think, I mean, even more immediately, the thing right now that people are most likely to get taken by, is someone calling you on the phone and telling you they're from tech support.

• 49:08David Pierce?

  Yeah.

• 49:08Speaker 03

  And it's like, Microsoft will not call you on the phone to, because there's a problem with your office installation, that will not happen.

• 49:16David Pierce?

  Yep.

• 49:17Speaker 03

  They, they, they have email, they're good at it, they know a lot about email, they'll send you an email.

• 49:23David Pierce?

  And mostly they're avoiding you. They don't want to call you, they don't want you to call them. Like, if, if you ever get a customer support person who's like desperate to talk to you, that should set off all your alarm bells because that is not a thing that happens in real life. I'm just saying.

• 49:35Speaker 03

  Absolutely.

• 49:37David Pierce?

  I like it. Um, all right. Any, any other like common sense security stuff we should tell people? I feel like the advice we always give is like two factor authentication is good. Do that.

• 49:44Speaker 03

  Yeah, absolutely. I would say, yeah, I mean, work on knife skills. Knife skills are always useful.

• 49:51David Pierce?

  Yeah.

• 49:51Speaker 03

  That's more of a physical security thing, but I tell everyone. You know, practice with a knife.

• 49:56David Pierce?

  Online knife skills.

• 49:57Speaker 03

  A couple of times a week.

• 49:57David Pierce?

  Yep.

• 49:58Speaker 03

  Yeah.

• 49:59David Pierce?

  I like it. All right, we should go. Russell, thank you. This has been very fun and enlightening. And if anybody ever wants to talk for many, many hours about pseudo-random number generators, I now have all of this information in my head and nothing to do with it. I know which ones are good. I know which ones are bad. I have a lot of thoughts. But anyway, follow us on Twitter. There's a ton more good cybersecurity stuff we've done at The Verge the last couple of weeks and always, because it is always Cybersecurity Week on theverge.com. Russell is RussellBrandom on Twitter. Neelai is Reckless on Twitter. I'm Pierce on Twitter. Thank you for listening. This is The Vergecast. We will be back on Wednesday and Friday with our regularly scheduled programming. We will see you then. Rock and roll.