Firewalls Don't Stop Dragons Podcast

As with many consumer protection laws, California is leading the way with regard to data privacy. In recent years, with the Delete Act and the DROP tool (Delete Request and Opt-out Platform), California residents have gained a lot more power over who can collect their personal data and even been given a simple, one-stop site for requesting deletion of all their data from third parties. And thanks to CA, we will all have the ability to globally request that websites not collect or share our personal data with a simple browser setting. I’ll be discussing these wonderful tools with the Executive Director of CalPrivacy, Tom Kemp, and how they can even help non-residents to claw back some control of their data on the web.

Interview Notes

CalPrivacy: https://privacy.ca.gov/ 

DROP tool: https://privacy.ca.gov/drop/ 

Global Privacy Control: https://globalprivacycontrol.org/ 

States honoring GPC: https://cookiechimp.com/blog/global-privacy-control-gpc 

Enable GPC: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 

Data broker deletion: https://firewallsdontstopdragons.com/dragon-hacks-opt-out/ 

PHP checker: https://github.com/PrivacySafe/security-patches 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:18: Intro

0:01:21: Interview setup

0:03:45: What’s it like bring on the inside?

0:10:37: Are companies complying or resisting?

0:14:41: Do states lead the way if feds can’t?

0:21:18: How does GPC work?

0:25:57: What states currently honor GPC?

0:32:27: What did we learn from Do Not Track?

0:35:03: How do we curb tracking in the real world?

0:39:45: How does DROP work?

0:46:39: Have these laws impacted the data broker industry?

0:51:03: Does transparency drive action?

0:55:44: So what can we do?

0:58:18: What’s next for CalPrivacy?

1:00:46: Wrap-up

1:03:48: Patron podcast preview

1:04:35: Looking ahead

In the past, we’ve been told that “there’s an app for that” – meaning, if you search the app store, surely you can find a pre-existing app that does what you’re looking for. But maybe it does a lot of stuff you don’t want, too. Maybe it’s chock full of ads or extracts your personal info. Maybe it just costs too much or requires a subscription. But you now have the power to create your own custom apps, without knowing a single thing about coding. I’ll explain how.

In the news: Microsoft fixes a record 1400+ bugs this month; US shuts down dozens of North Korean laptop farms; how to validate Amazon messages; Google starts linking all your accounts to your phone; European solar, wind farms vulnerable online; your car shares lots of your data; AI can pinpoint dwellings from a single internal photo; Amazon rolling out smart glasses to drivers; Google is saving your voice, video, photos from AI; OK judge rules ALPR searches require warrants; creator has vibe-coded replacements for Adobe, Microsoft suites.

Article Links

Microsoft Patches More Than 1,400 Security Flaws: https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud: https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html

PSA: How to check if that Amazon call, email, or text message is a scam: https://this.weekinsecurity.com/how-to-check-if-that-amazon-call-email-or-text-message-is-a-scam

PSA: Google is silently linking your phone number across all signed-in accounts: https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117

Thousands of European wind and solar power systems exposed online: https://www.reuters.com/technology/thousands-european-wind-solar-power-systems-exposed-online-dutch-researchers-say-2026-10-06

Your Car Is Sharing Data With Big Tech Companies, Study Finds: https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962

AI Company Lets Cops Pinpoint Specific Houses Based on a Single Interior Photo: https://www.404media.co/ai-company-lets-cops-pinpoint-specific-houses-based-on-a-single-interior-photo

Amazon Drivers’ Smart Glasses Are Going to Be an Image Problem: https://www.bloomberg.com/opinion/articles/2026-09-30/amazon-drivers-smart-glasses-are-going-to-be-an-image-problem

Google Just Quietly Started Saving Your Photos and Voice: https://medium.com/@mohameddosou/google-just-quietly-started-saving-your-photos-and-voice-61eb37ced542

Oklahoma judge’s Flock ruling shows the power of Supreme Court’s digital evidence decision: https://therecord.media/oklahoma-flock-ruing-supreme-court-chatrie-decision

Creator of free Adobe clones unveils open-source Microsoft Office replications: https://www.tomshardware.com/software/microsoft-office/creator-of-free-adobe-clones-unveils-open-source-microsoft-office-excel-powerpoint-and-word-replications-autodesk-tools-and-other-subscription-based-services-may-come-next

Tip of the Week: https://firewallsdontstopdragons.com/build-your-own-apps-with-ai/ 

Further Info

Google’s My Activity settings: https://myactivity.google.com/myactivity 

ArtCraft apps: https://getartcraft.com/apps 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support our mission! https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:07: Intro

0:00:23: Book update

0:02:21: News rundown

0:04:38: Microsoft patches 1400+ bugs

0:07:05: FBI shuts down NK laptop farms

0:09:21: PSA: Amazon Message Center

0:11:30: Google linking all accounts to number

0:14:01: European solar, wind facilities found vulnerable

0:17:29: Cars collect and share lots of data

0:25:58: AI app IDs homes from interior pics

0:35:55: Amazon driver glasses and privacy

0:45:23: Google training on your media

0:53:43: Judge says ALPR searches require warrant

1:00:43: AI recreates MS Office, Adobe suite

1:07:28: Tip of the Week

1:16:43: Wrap-up

1:17:29: Patron podcast preview

1:17:50: Looking ahead

Residential proxy networks have become very popular ways for bad guys to launder their illicit activities through our normal home network traffic. By mixing in their traffic with ours, they are able to use (and abuse) the good reputation of our home IP address. Many of us have unwittingly allowed this to happen by using cheap streaming boxes or installing shady apps on our smart TVs. Today we’ll discuss residential proxies and botnets with Dan Goodin, Senior Security Editor at Ars Technica.

Interview Notes

Dan Goodin: https://arstechnica.com/author/dan-goodin/ 

Dan on router security: https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/ 

Brian Krebs story: https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/ 

Greynoise IP reputation: https://check.labs.greynoise.io/ 

OpenWRT: https://openwrt.org/docs/start 

Shields Up!: https://www.grc.com/shieldsup 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:16: Intro

0:02:03: Lingo

0:05:01: How did you get into security?

0:08:59: What is a residential proxy?

0:15:08: Who’s behind these proxy networks?

0:19:12: What is a botnet?

0:22:03: How are home devices compromised?

0:30:01: Can I be liable for proxied attacks?

0:33:00: How do you take down a botnet?

0:39:12: Should the gov’t unhack our devices?

0:43:03: Can we detect proxy devices?

0:47:43: Wrap-up

0:53:28: Patron podcast preview

0:53:47: Looking ahead

Meta has released a very powerful new AI agent app called Muse. Likewise, OpenAI has released a similar app called Dots. Both apps feature charming, friendly and decidedly non-threatening avatars to perhaps assuage your fears of AI. But these agents ask for extensive access to your data and devices, which in my view is – as for right now – too dangerous. We’ve already seen these agents doing things their owners were not expecting and did not want. I’ll tell those stories and give you my advice on using AI agents.

In other news: Android 17 adds welcome security features; weakness found in important encryption algorithm; update TeamViewer ASAP; some Samsung fridges bricked by SW update; CA closes data broker law loophole; USPS trialing cameras on vehicles; iPhone inactivity reboot thwarted? ; malware steals water utility credentials; US military and FBI employee records stolen; Amazon blocks Meta’s AI agent; Muse reads user’s Apple Messages;

Article Links

News Briefs

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools. [thehackernews.com – The Hacker News]: https://thehackernews.com/2026/10/android-17-advanced-protection-locks.html

New Attack Against RSA – Schneier on Security. [schneier.com – Bruce Schneier – Sep 28, 2026]: https://www.schneier.com/blog/archives/2026/09/new-attack-against-rsa.html

TeamViewer urges users to patch severe flaws “as soon as possible”. [bleepingcomputer.com – Sergiu Gatlan]: https://www.bleepingcomputer.com/news/security/teamviewer-urges-users-to-patch-severe-flaws-as-soon-as-possible

Owners mourn spoiled food after firmware update bricks Samsung smart fridges. [arstechnica.com – Scharon Harding – Sep 23, 2026]: https://arstechnica.com/gadgets/2026/09/owners-mourn-spoiled-food-after-firmware-update-bricks-samsung-smart-fridges

California Expands Privacy Protections by Strengthening Deletion Rights. [privacy.ca.gov – nicolecameron – Sep 27, 2026]: https://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights

USPS To Put Cameras in Trucks That Scan Roads for ‘Community Safety’. [404media.co – Joseph Cox – Sep 30, 2026]: https://www.404media.co/usps-to-put-cameras-in-trucks-that-scan-roads-for-community-safety

Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims. [404media.co – Lorenzo Franceschi-Bicchierai – Oct 1, 2026]: https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey

Full Stories

Stolen passwords are exposing America’s water providers to hackers. [techcrunch.com – Zack Whittaker – Sep 22, 2026]: https://techcrunch.com/2026/09/22/stolen-passwords-are-exposing-americas-water-providers-to-hackers

Hackers stole millions of US military personnel records during months-long data breach. [techcrunch.com – Zack Whittaker – Sep 30, 2026]: https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach

‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees. [404media.co – Joseph Cox – Sep 22, 2026]: https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees

Amazon Blocks Meta’s Muse AI Assistant. [daringfireball.net]: https://daringfireball.net/linked/2026/09/22/amazon-blocks-muse

Meta’s New Muse AI Agent Read My Private Messages. I Never Asked It To. [inc.com – Jason Aten – Sep 19, 2026]: https://www.inc.com/jason-aten/metas-new-muse-ai-agent-read-my-private-messages-i-never-asked-it-to/91408202 

Tip of the Week: https://firewallsdontstopdragons.com/hold-off-on-muse-dots/ 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support our mission! https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:07: Intro

0:00:49: News rundown

0:02:43: New Android 17 security features

0:04:18: RSA encryption weakened?

0:06:52: Update TeamViewer now

0:07:44: Samsung fridges bricked

0:09:23: CA closes data loophole

0:11:10: USPS trialing cameras on vehicles

0:13:23: iPhone inactivity reboot thwarted?

0:15:22: Malware steals water utility creds

0:19:27: US military records stolen

0:22:19: Massive FBI data breach

0:31:01: Amazon blocks Meta’s Muse

0:37:30: Muse reads Apple Messages

0:46:13: Tip of the Week

0:53:04: Patron podcast preview

0:53:42: Looking ahead

Today marks an incredible milestone for this podcast: 500 episodes! Not only is that a crazy long run for any podcast, but I’ve also been astonishingly consistent. I’ve managed to put out an episode of this show every single week for 500 straight weeks! Okay… I did miss one week 8 years ago… I’ll give you that story in today’s podcast. But as always for my “podcentennial” episodes, my guest is the one and only global cybersecurity guru Bruce Schneier. He’s been on the show for every 100th podcast. Today I’ll ask Bruce some deep questions about artificial intelligence and how he sees it impacting our future – not just in the technical realm, but the political and social realms, as well. We also have some special surprises and bonus content for this momentous occasion!

Interview Notes

Bruce Schneier: https://www.schneier.com/ 

Bruce’s DEF CON 34 talk: https://www.youtube.com/watch?v=eEBv0STiYhI 

Bruce’s books: https://www.schneier.com/books/ 

Inrupt’s Solid Project: https://www.inrupt.com/solid 

Apertus AI: https://www.apertus-ai.org/ 

Cap’N Crunch whistle: https://www.thingiverse.com/thing:6192416 

Citizenfour: https://www.imdb.com/title/tt4044364/ 

Techlore: https://techlore.tech/ 

The New Oil: https://thenewoil.org/en/ 

Privacy Guides: https://www.privacyguides.org/ 

Privacy Safe: https://privacysafe.social/ 

Micah’s book: https://nostarch.com/hacks-leaks-and-revelations 

UnDisruptable27: https://u27.org

Yael’s blog: https://yaelwrites.com/ 

Cult of the Dead Cow:  https://cultdeadcow.com/ 

Bob Lord’s Hacklore: https://www.hacklore.org/ 

David Ruiz: https://www.malwarebytes.com/blog/authors/davidruiz 

Melanie Ensign’s Discernible: https://www.discernibleinc.com/ 

Further Info

Help me celebrate this 500th show!!! : https://fdsd500.com 

Pay it forward and help others : https://fdsd.me/phase2 

Last chance to get #FDSD500 merch!! https://fdsd.me/merch 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Table of Contents

0:00:00: Congratulations, part 1

0:01:47: Intro

0:07:12: Congratulations, part 2

0:10:31: Intro, continued

0:12:01: Stay tuned…

0:13:16: Interview setup

0:15:26: What are the key parts of a modern LLM?

0:23:03: How do we defend against prompt injection?

0:27:09: Should AI agents only act on our behalf?

0:32:10: Who’s responsible when AI attacks?

0:35:25: Will AIs end up fighting each other?

0:41:47: How will AI’s speed and scale change security?

0:46:50: Should we own our personal AI data?

0:55:03: Can we trust AI with all our data?

0:59:24: Does AI enhance mass surveillance?

1:03:09: How do we democratize AI?

1:06:24: What can we do to manifest the best AI future?

1:11:08: Wrap-up

1:11:42: Cap’n Crunch whistle

1:13:50: Thank you patrons!!!

1:16:27: FDSD by the numbers

1:23:25: Phase 1, 2 update

1:26:17: Phase 3?

1:26:55: Special bonus guest target

1:29:18: Patron podcast preview

1:30:40: Last call for FDSD500 merch

1:31:14: Looking ahead