WEBVTT
1
00:00:01.040 --> 00:00:04.599
This program is designed to provide general information with regards
2
00:00:04.639 --> 00:00:07.599
to the subject matters covered. This information is given with
3
00:00:07.679 --> 00:00:12.039
the understanding that neither the hosts, guests, sponsors, or station
4
00:00:12.240 --> 00:00:17.440
are engaged in rendering any specific and personal medical, financial,
5
00:00:17.800 --> 00:00:21.600
legal counseling, professional service, or any advice.
6
00:00:21.960 --> 00:00:24.039
You should seek the services.
7
00:00:23.519 --> 00:00:29.239
Of confident professionals before applying or trying any suggested ideas.
8
00:00:30.239 --> 00:00:33.640
The information contained in this podcast is intended for informational
9
00:00:33.640 --> 00:00:37.119
purposes only and is not a substitute for individual professional
10
00:00:37.240 --> 00:00:41.000
legal advice. The podcast information was carefully compiled from vetted
11
00:00:41.079 --> 00:00:45.240
sources and references. However, Rose Resources outreach to safeguard the
12
00:00:45.280 --> 00:00:48.359
elderly cannot guarantee that you will not fall victim.
13
00:00:48.119 --> 00:00:49.520
To a scam.
14
00:00:50.320 --> 00:00:54.200
Let's talk about scams. It's the must listen show for
15
00:00:54.520 --> 00:00:57.679
anyone who wants to protect themselves and their loved ones
16
00:00:57.679 --> 00:01:02.200
from scams. Every Tuesday am Pacific time on K four
17
00:01:02.359 --> 00:01:06.840
HD Radio, Joyce Petrowski, founder of Rose, and her guests
18
00:01:07.159 --> 00:01:11.319
will provide valuable insights and practical tips on how to
19
00:01:11.359 --> 00:01:16.400
recognize and protect yourself from scams. And now here is
20
00:01:16.439 --> 00:01:18.680
your host, Joyce Petrowski.
21
00:01:19.799 --> 00:01:21.159
Hi, everyone, welcome back.
22
00:01:21.200 --> 00:01:25.040
I'm Joyce Petrowski, President, board president and founder of Rose
23
00:01:25.120 --> 00:01:28.359
Resources Outreach to safeguard the elderly. You can find more
24
00:01:28.359 --> 00:01:33.200
information on our website at Roseadvocacy dot org. You'll find
25
00:01:33.239 --> 00:01:35.319
all of our social media channels at the top of
26
00:01:35.400 --> 00:01:38.879
the homepage. Scroll down to the bottom of the homepage
27
00:01:38.920 --> 00:01:40.840
and you'll find where you can sign up for our
28
00:01:40.920 --> 00:01:44.879
emailed newsletters, and we also do one in the mail
29
00:01:45.159 --> 00:01:48.560
as well, and we have a safety checklist that you
30
00:01:48.599 --> 00:01:51.560
can download there as well.
31
00:01:53.640 --> 00:01:56.359
Today, we have a guest with.
32
00:01:56.280 --> 00:02:02.560
Us and we're going to be talking about passwords and
33
00:02:02.719 --> 00:02:07.040
password managers and pass keys and updates to your devices.
34
00:02:08.039 --> 00:02:13.159
So our guest is David Hawkins, and he had with
35
00:02:13.319 --> 00:02:17.680
deep roots in both physical and cybersecurity. David's skills cover
36
00:02:17.800 --> 00:02:23.319
everything from identity management and access control to compliance and
37
00:02:23.479 --> 00:02:29.080
risk solutions. He has conducted hundreds of workshops and thousands
38
00:02:29.120 --> 00:02:35.520
of pocs in vendor cyber risk management. So let's welcome David.
39
00:02:36.759 --> 00:02:41.199
Hello. How I'm doing pretty well? How are you today?
40
00:02:41.560 --> 00:02:41.960
Good?
41
00:02:43.639 --> 00:02:47.319
Why don't you take a few minutes and tell everyone
42
00:02:48.240 --> 00:02:50.120
a little bit more about you and what you do?
43
00:02:51.000 --> 00:02:55.319
Sure, so, I've had a pretty long career of different
44
00:02:55.400 --> 00:02:59.360
things I was military early early in my career. Then
45
00:02:59.360 --> 00:03:03.199
I went into it. And when I was in it,
46
00:03:03.560 --> 00:03:07.360
one day I was working with a sales team and
47
00:03:07.560 --> 00:03:10.919
the sales team said, we're having a problem with this software.
48
00:03:11.319 --> 00:03:13.800
I solved the problem, and I also showed them that
49
00:03:13.840 --> 00:03:16.879
they were doing something a little off okay, and they said,
50
00:03:17.800 --> 00:03:19.759
you should be our pre sales engineer. And I said,
51
00:03:19.759 --> 00:03:23.639
what's that? And so I said, they told me what
52
00:03:23.680 --> 00:03:24.960
it was, and I said that sounds fun.
53
00:03:25.000 --> 00:03:26.000
I'll do that, okay.
54
00:03:26.000 --> 00:03:28.039
And I've been doing that for the last twenty years,
55
00:03:28.280 --> 00:03:32.960
oh wow. And I've represented products from Semantech, RSA Security,
56
00:03:33.319 --> 00:03:37.439
Computer Associates, and Tycho Fire and Security, all of these
57
00:03:37.439 --> 00:03:40.919
different companies. Had a ton of hands on experience working
58
00:03:40.960 --> 00:03:43.800
with the tools and helping customers figure out what to
59
00:03:43.840 --> 00:03:44.879
do with those tools.
60
00:03:45.159 --> 00:03:46.080
Okay, very good.
61
00:03:46.520 --> 00:03:50.879
And I actually met you through one of Rose's advisory
62
00:03:50.919 --> 00:03:52.960
board members, Brian.
63
00:03:53.199 --> 00:03:55.280
You used to work with Brian exactly.
64
00:03:55.319 --> 00:03:56.719
As a matter of fact, he and I worked together
65
00:03:56.759 --> 00:03:57.400
at Semantec.
66
00:03:57.759 --> 00:04:00.639
Okay, all right, very good, All right.
67
00:04:00.680 --> 00:04:03.120
So we discussed this and we were going to talk
68
00:04:03.159 --> 00:04:09.000
about let's start with the passwords and password managers, and
69
00:04:09.120 --> 00:04:12.159
we can incorporate pass keys and stuff into that. So
70
00:04:12.400 --> 00:04:15.680
I actually did a presentation yesterday in a retirement community
71
00:04:16.800 --> 00:04:19.240
and there's quite a lot of people there. There was
72
00:04:19.279 --> 00:04:23.079
probably forty five or fifty. And it's interesting when I
73
00:04:23.160 --> 00:04:27.079
get to the point in the presentation about passwords that's
74
00:04:27.079 --> 00:04:30.720
in our you know, our resource our Identity, Theft Protection
75
00:04:30.839 --> 00:04:34.560
and cyber Safety resource packet, I hear this, you know
76
00:04:34.639 --> 00:04:36.360
a little bit of a groan right this.
77
00:04:36.639 --> 00:04:36.759
Uh.
78
00:04:36.800 --> 00:04:38.839
And so I always kind of make light of it
79
00:04:38.879 --> 00:04:41.959
and say, okay, who here likes passwords? Everybody's like no,
80
00:04:42.480 --> 00:04:44.839
you know, I've had one person say and it was
81
00:04:44.879 --> 00:04:48.160
a younger lady who liked tech.
82
00:04:47.920 --> 00:04:49.079
And all of that stuff.
83
00:04:49.120 --> 00:04:53.120
And so one of the things we talk about is,
84
00:04:53.199 --> 00:04:55.160
you know, every year I see this survey and I
85
00:04:55.199 --> 00:04:59.000
don't remember which company does it and puts it out,
86
00:04:59.079 --> 00:05:04.279
but they a, it's definitely over half, maybe two thirds
87
00:05:04.360 --> 00:05:07.800
of the people that they survey they are still using
88
00:05:07.920 --> 00:05:13.279
password one two three, Yeah, whether they've elected to use
89
00:05:13.319 --> 00:05:18.360
it or whatever software they're creating the account with it
90
00:05:18.439 --> 00:05:22.199
gave them that as as an initial password and then
91
00:05:22.319 --> 00:05:24.639
never made them change.
92
00:05:24.279 --> 00:05:25.720
It, so they just left it.
93
00:05:26.199 --> 00:05:31.000
But that just baffles me that people are still using
94
00:05:31.040 --> 00:05:35.360
that and and I think maybe even some of the
95
00:05:35.399 --> 00:05:38.040
people in our presentations are using it right, or they're
96
00:05:38.120 --> 00:05:43.079
using their names and their birth date or their pets name,
97
00:05:43.319 --> 00:05:46.399
or their anniversary date or you know, because it's easy to.
98
00:05:46.360 --> 00:05:47.279
Remember, right.
99
00:05:47.759 --> 00:05:50.519
Absolutely, So one of the things we talk to them
100
00:05:50.560 --> 00:05:55.839
about is, you know, having a phrase and then changing
101
00:05:55.920 --> 00:05:59.399
the phrase to having some symbols and some numbers. But
102
00:06:00.639 --> 00:06:04.959
even that, right, I mean, what's your thoughts on that?
103
00:06:05.639 --> 00:06:09.399
Sure? So one of the first things is a lot
104
00:06:09.399 --> 00:06:14.360
of people don't understand what is vulnerable when it comes
105
00:06:14.360 --> 00:06:20.319
to the passwords. Now, when it comes to hacking a password,
106
00:06:20.759 --> 00:06:24.360
there are two real methods. The first method is brute force,
107
00:06:24.399 --> 00:06:28.240
which means, yes, some software in the background going to
108
00:06:28.319 --> 00:06:31.639
just try one hundred thousand passwords until it figures which one.
109
00:06:32.680 --> 00:06:36.480
Generally speaking, if you use that method of attack, what
110
00:06:36.519 --> 00:06:40.879
we've discovered is that it would take something like a
111
00:06:40.959 --> 00:06:45.160
thousand years of a typical attempt, one after another for
112
00:06:45.600 --> 00:06:50.240
a password that's longer than sixteen characters. So the length
113
00:06:50.279 --> 00:06:52.399
of your password is probably one of the most important
114
00:06:52.399 --> 00:06:55.040
parts to defeat that brute force attack.
115
00:06:55.360 --> 00:06:56.519
Okay, that's interesting.
116
00:06:56.879 --> 00:06:59.560
Okay, now here's the second part, and this is the
117
00:06:59.560 --> 00:07:02.439
better part of the world where I came from, which
118
00:07:02.480 --> 00:07:06.040
is all of the companies out there. There's a couple
119
00:07:06.079 --> 00:07:09.279
different parts of why you use a password that matters.
120
00:07:09.680 --> 00:07:13.160
First one, you log into your computer. That one there,
121
00:07:13.720 --> 00:07:17.759
brute force is almost impossible, because you're going to try,
122
00:07:17.800 --> 00:07:19.839
You're going to try, You're going to try five times,
123
00:07:19.879 --> 00:07:22.399
your system locks you out. It takes twenty minutes. It's
124
00:07:22.399 --> 00:07:24.279
going to take a thousand years if it was a
125
00:07:24.360 --> 00:07:28.800
random number. Now here's the other part that gets difficult
126
00:07:28.800 --> 00:07:32.839
when it comes to passwords, which is people use something
127
00:07:32.920 --> 00:07:34.800
like you said, the name of their dog, the name
128
00:07:34.839 --> 00:07:38.480
of their the name of their family town or whatever,
129
00:07:39.279 --> 00:07:43.920
and that is hackable, not because of multiple tries, but
130
00:07:44.040 --> 00:07:47.560
because you end up sharing that information on social media.
131
00:07:47.600 --> 00:07:48.199
Absolutely.
132
00:07:48.879 --> 00:07:51.680
Yeah, you know who's my dog Spot and you know
133
00:07:51.680 --> 00:07:52.600
it's Spot one, two.
134
00:07:52.600 --> 00:07:55.199
Three, Yeah, I want to wish my dog Spot a
135
00:07:55.240 --> 00:07:56.079
happy birthday.
136
00:07:56.120 --> 00:07:57.519
He's ten years old today.
137
00:07:57.639 --> 00:08:00.680
Well, boom, you've just given your password out right exactly.
138
00:08:00.839 --> 00:08:01.000
Yeah.
139
00:08:01.279 --> 00:08:05.480
I've seen these videos where somebody will be, you know,
140
00:08:05.600 --> 00:08:09.759
doing interviews, and they're really trying to see how quick
141
00:08:09.839 --> 00:08:13.319
somebody gives up their password, and literally within a minute
142
00:08:13.439 --> 00:08:18.360
or two, just by engaging in friendly conversation, they will
143
00:08:18.399 --> 00:08:22.240
have given up there. They'll not actually say it, but
144
00:08:23.079 --> 00:08:26.240
through prompting they'll be like, oh, yeah, I use my
145
00:08:26.800 --> 00:08:30.600
dog's name and my birth date, and then the person
146
00:08:30.639 --> 00:08:34.919
will go, oh, so your password is, and they'll say it.
147
00:08:35.000 --> 00:08:38.279
And then that person goes, oh, I just gave it up.
148
00:08:38.440 --> 00:08:41.759
And they also gave the tell that said, oh, by
149
00:08:41.759 --> 00:08:43.480
the way, I just gave you something valuable.
150
00:08:43.799 --> 00:08:49.039
Yes, exactly, right, exactly. But so you mentioned the more
151
00:08:49.080 --> 00:08:53.399
important thing is to have at least sixteen characters or more.
152
00:08:54.279 --> 00:08:56.879
But a lot of people talk about how you have
153
00:08:56.960 --> 00:09:01.039
to have upper and lower case letters, number and symbols.
154
00:09:01.639 --> 00:09:03.639
But then like when you go to set up a
155
00:09:03.679 --> 00:09:07.759
password with like a lot of financial institutions, they're only
156
00:09:07.799 --> 00:09:11.000
allowing you between eight and twelve characters, but they have
157
00:09:11.120 --> 00:09:14.759
to have all four of those other the symbols, the
158
00:09:15.279 --> 00:09:19.879
upper lower case, and the numbers. So how does does
159
00:09:19.960 --> 00:09:24.080
that make it just as safe if it's only twelve characters.
160
00:09:24.799 --> 00:09:28.559
It doesn't necessarily make it just as safe. The number
161
00:09:28.559 --> 00:09:33.799
of characters by default is actually the hardest thing. Now,
162
00:09:35.080 --> 00:09:38.320
so you could actually do all lowercase and no symbols
163
00:09:38.360 --> 00:09:42.639
and no numbers, and the statistical amount that people will
164
00:09:42.679 --> 00:09:45.279
have to crunch through is still pretty high, but it's
165
00:09:45.320 --> 00:09:49.039
still not a best practice. A really good password has
166
00:09:49.120 --> 00:09:54.039
upper case, lowercase numbers and symbols, right, because that is
167
00:09:54.240 --> 00:09:57.559
changing the nature of the type of thing. So instead,
168
00:09:57.759 --> 00:10:01.639
what I usually recommend is have a pass phrase, which
169
00:10:01.679 --> 00:10:05.279
you mentioned at the beginning, and the way that passphrase works.
170
00:10:05.320 --> 00:10:07.679
Most people think, oh, I got to come up with
171
00:10:07.720 --> 00:10:13.639
eight words and look around their desk and say monitor keyboard, right, yeah,
172
00:10:13.759 --> 00:10:15.519
you know, and then and then they'll take those and
173
00:10:15.519 --> 00:10:18.279
I say, I have two lights and I have one keyboard.
174
00:10:18.360 --> 00:10:21.320
So there's your numbers and your words, right, and nobody
175
00:10:21.360 --> 00:10:24.000
can see what's in front of you when you're on
176
00:10:24.039 --> 00:10:27.039
a computer like this. It's not the worst thing to do,
177
00:10:27.639 --> 00:10:29.759
But what do you How do you remember that password
178
00:10:29.799 --> 00:10:32.120
when you're not sitting in front of your desk, if
179
00:10:32.159 --> 00:10:34.039
you're on a trip and you still have to log in.
180
00:10:34.480 --> 00:10:37.879
So I do things like I like two cups of
181
00:10:37.960 --> 00:10:41.600
Lavaza coffee in the morning, right, that whole sentence. I
182
00:10:41.600 --> 00:10:44.440
can remember that pretty easily. And then what I would
183
00:10:44.480 --> 00:10:46.799
do is I got the two in there, and then
184
00:10:46.840 --> 00:10:50.679
I have I just capitalize every other word or every word,
185
00:10:50.720 --> 00:10:53.879
and I just Remember that's the method. Remember the past
186
00:10:54.200 --> 00:10:58.639
phrase and then stick a you know, like I like lavazza,
187
00:10:58.840 --> 00:11:00.639
exclamation points something like that.
188
00:11:01.120 --> 00:11:05.600
Yeah, so you know some people have you know, and
189
00:11:05.639 --> 00:11:07.480
that's the one thing that we you know, tell them
190
00:11:07.559 --> 00:11:12.759
right not to use any information in your phrase that
191
00:11:12.799 --> 00:11:16.600
you would normally share online. And I had somebody once
192
00:11:16.639 --> 00:11:19.600
tell me that they used a Bible verse, and I actually,
193
00:11:21.879 --> 00:11:24.320
I actually was like, well, you got to be careful
194
00:11:24.320 --> 00:11:28.399
with that because Bibles are all online, and if it's
195
00:11:28.399 --> 00:11:33.080
a more common right Bible phrase, then that's something that
196
00:11:33.159 --> 00:11:37.320
can be easily put into this software. They can prompt
197
00:11:37.360 --> 00:11:41.080
the software to look for common Bible phrases and make
198
00:11:41.159 --> 00:11:45.639
some changes. So is it better to then like look
199
00:11:45.679 --> 00:11:48.399
around or do something like you did, as long as
200
00:11:48.440 --> 00:11:53.519
you don't let people know right on social media or whatever,
201
00:11:53.679 --> 00:11:56.600
like on if you're playing online games or if you're
202
00:11:56.600 --> 00:11:58.960
on a dating site or whatever, you don't let people
203
00:11:59.080 --> 00:12:04.039
know I like to I like lavasa or whatever if
204
00:12:04.279 --> 00:12:07.320
I said that, right, because then once you put that
205
00:12:07.440 --> 00:12:10.679
out there, then somebody could say, well, that might be
206
00:12:10.720 --> 00:12:11.600
their passphrase.
207
00:12:12.120 --> 00:12:15.919
Sure, well, think about it this way. There are a
208
00:12:15.919 --> 00:12:19.080
lot of different versions of the Bible. So if you
209
00:12:19.159 --> 00:12:23.919
said true New King James. And then what I suggest
210
00:12:24.000 --> 00:12:27.799
in this case is not to pick the most popular verse.
211
00:12:28.480 --> 00:12:30.720
Think of it as a deep cut. What is your
212
00:12:30.799 --> 00:12:33.639
favorite that is not a popular one?
213
00:12:34.000 --> 00:12:34.200
Right?
214
00:12:34.320 --> 00:12:36.320
Yeah, so that' and that's one that's not going to
215
00:12:36.360 --> 00:12:39.159
get bandied about. And you know, you might say it
216
00:12:39.240 --> 00:12:41.399
once in the blue moon, but still do they know
217
00:12:41.440 --> 00:12:42.600
which Bible you chose?
218
00:12:43.200 --> 00:12:43.799
And true?
219
00:12:44.120 --> 00:12:44.399
True?
220
00:12:45.000 --> 00:12:46.600
You know because there are right.
221
00:12:46.480 --> 00:12:49.759
There are a lot of different between all of them.
222
00:12:50.360 --> 00:12:52.519
Right, there are a lot of different versions. Again, as
223
00:12:52.519 --> 00:12:56.080
long as you're not posting online and talking about this
224
00:12:56.120 --> 00:12:59.960
is my favorite version. Or if you are a specific
225
00:13:00.440 --> 00:13:05.039
faith and they only have one whether it's a Bible,
226
00:13:05.159 --> 00:13:10.279
a book, whatever it is, right, then that's easier to
227
00:13:12.080 --> 00:13:14.279
you know, if your specific faith and they only have
228
00:13:14.440 --> 00:13:17.759
one Bible, one you know, one version of it, one book,
229
00:13:17.799 --> 00:13:21.320
one version of it, whatever it's called, that's going to
230
00:13:21.360 --> 00:13:24.600
make it easier to figure out because you don't have
231
00:13:24.639 --> 00:13:27.279
all these different versions that it could be.
232
00:13:27.440 --> 00:13:28.440
So that's that's true.
233
00:13:28.440 --> 00:13:31.320
I didn't think about that, all of the different versions
234
00:13:31.320 --> 00:13:31.759
that there are.
235
00:13:32.360 --> 00:13:34.480
You just have to think of what can I bring
236
00:13:34.519 --> 00:13:36.519
to the table that's unique. I mean, think of it
237
00:13:36.600 --> 00:13:41.240
one other way. What if that Bible was orange. Yes,
238
00:13:41.320 --> 00:13:42.799
that brown or blue or something.
239
00:13:43.000 --> 00:13:44.759
They come in all different colors exactly.
240
00:13:45.039 --> 00:13:49.159
So there's there are things that you can have in
241
00:13:49.200 --> 00:13:52.519
your life. You know, maybe you buy a special leather
242
00:13:52.600 --> 00:13:55.200
cover for yours, right, yeah, so you have all of
243
00:13:55.200 --> 00:13:57.840
these things where you customize for your own thing. I