Firewalls Don't Stop Dragons Podcast

We’re all busy people with busy lives. We only have so much time and energy. So when security people dole out to-do lists, we really need to focus on the tips with the most bang for the buck. Conversely, we need to avoid wasting people’s precious resources on advice that is no longer valid or worth the effort. Today, we’ll debunk several of these “Hacklore” tips with security guru Bob Lord.

Interview Notes

Hacklore: https://www.hacklore.org/letter 

Hacklore resources: https://www.hacklore.org/resources 

Elevator (un)safety analogy: https://medium.com/@boblord/psa-elevator-un-safety-7ac69a9498de 

DNC Security Checklist: https://democrats.org/security/ 

CISA Secure by Design: https://www.cisa.gov/securebydesign 

MITRE’s 2007 Unforgivable Vulnerabilities (PDF): https://cwe.mitre.org/documents/unforgivable_vulns/unforgivable.pdf 

Take 9: https://pausetake9.org/ 

Consumer Reports Security Planner tool: https://securityplanner.consumerreports.org/ 

EFF security planning: https://ssd.eff.org/module/your-security-plan 

Removing online data: https://firewallsdontstopdragons.com/data-diet-introduction/ 

Generate passphrases with d20 dice! https://d20key.com/#/ 

Dragon coupons: https://fdsd.me/coupons/ 

Rafifi (film): https://www.imdb.com/title/tt0048021/ 

Xkcd password strength: https://xkcd.com/936/ 

Further Info

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:14: Intro

0:00:25: Survey, promo wrap-up

0:01:30: Interview setup

0:02:22: Lingo definitions

0:02:52: What drove you to launch Hacklore?

0:07:12: Is this advice truly wrong?

0:11:51: 1) Avoid public WiFi

0:17:38: 2) Never scan QR codes

0:22:43: 3) Never charge devices from public USB ports

0:24:38: 4) Turn off Bluetooth and NFC

0:28:25: 5) Regularly clear cookies

0:32:47: 6) Regularly change passwords

0:38:19: Why do we not have web password standards?

0:44:24: Any bad tips that didn’t make the cut?

0:45:53: WIll Hacklore be regularly updated?

0:46:32: What has been the response to Hacklore?

0:48:08: So what are the actual top security tips?

0:49:56: How do we shift the onus to software makers?

0:53:14: What other resources can you recommend?

0:55:40: What’s next for you?

0:56:53: Wrap-up

1:00:40: Generating passphrases

1:02:00: Accessing show notes

1:03:08: Dragon coupons

1:03:40: Patron podcast preview

1:04:24: Looking ahead

There exist many interesting technical tools which can greatly improve our privacy while still allowing us to use very personal data. In the next installment of my series on Privacy Enhancing Technologies, we’ll look at zero-knowledge proofs – what they are, how they work and what types of privacy problems they can address. Specifically, we’ll show how you can prove that you know a secret without actually revealing the secret.

In other news: Florida may be implementing an age-gating law; the UK government is now considering a ban on VPNs; 17 more people browser plugins that steal your data; popular apps used to harvest data using real-time bidding; police unmask millions of surveillance targets due to Flock redaction failures; AI company sued for secretly scoring job seekers; Microsoft gives BitLocker keys to FBI; and the FTC finalizes restrictions on GM car data gathering and sharing.

Article Links

Oppose Florida’s AI age verification bill, protect your privacy https://www.miamitech.club/oppose-sb-482/

UK government targets VPNs in online safety consultation as Lords vote for ban https://www.techradar.com/vpn/vpn-privacy-security/uk-government-targets-vpns-in-new-online-safety-consultation-as-lords-vote-for-ban

If You’ve Installed Any of These 17 Browser Extensions, Delete Them Now https://lifehacker.com/tech/delete-malicious-ghostposter-browser-extensions

Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location https://www.wired.com/story/gravy-location-data-app-leak-rtb/

Police Unmask Millions of Surveillance Targets Because of Flock Redaction Error https://www.404media.co/police-unmask-millions-of-surveillance-targets-because-of-flock-redaction-error/

AI Company Eightfold Sued Helping Companies Secretly Score Job Seekers 2026 01 21 https://www.reuters.com/sustainability/boards-policy-regulation/ai-company-eightfold-sued-helping-companies-secretly-score-job-seekers-2026-01-21/

Microsoft Gave FBI BitLocker Encryption Keys, Exposing Privacy Flaw https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers’ Informed Consent https://www.ftc.gov/news-events/news/press-releases/2026/01/ftc-finalizes-order-settling-allegations-gm-onstar-collected-sold-geolocation-data-without-consumers

Tip of the Week: https://firewallsdontstopdragons.com/how-zero-knowledge-proofs-work/ 

Further Info

Annual Listener Survey!!! https://fdsd.me/survey2026 

New Patron Promotion!! https://fdsd.me/promo126 

Data Privacy Week: https://www.staysafeonline.org/data-privacy-week  

HaveIBeenFlocked: https://haveibeenflocked.com/ 

404 Media FOIA Forum: https://www.404media.co/foia-forum-archive/ 

NextDNS: https://nextdns.io/ 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support our mission! https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:07: Intro

0:00:51: Last call for survey, dragon coin

0:02:17: Winter storm

0:03:14: News preview

0:05:02: Proposed FL age-gating bill

0:11:33: UK government targets VPNs

0:15:42: More malicious browser extensions

0:21:22: Popular apps leaking personal info (again)

0:31:26: Have I Been Flocked?

0:41:37: AI company sued for secretly scoring job seekers

0:46:41: Microsoft give BitLocker keys to FBI

0:56:05: FTC restricts GM from selling car data

0:59:34: Tip of the Week

1:10:49: Wrap-up

1:12:16: Patron podcast preview

1:12:42: Looking ahead

Having data privacy laws are great. But if those laws can’t be practically enforced or your rights easily asserted, they’re not very useful. Modern cars are chock full of sensors, many of which are used to monitor the passengers and collect personal data. But cars are subject to privacy laws, too. Opting out of data collection or requesting data deletion should be straightforward. Andrea Amico and Merry Marwig from Privacy4Cars just completed a massive study on this, and the vast majority of auto brands had horrible user experiences for data management. They will share their findings with us on today’s show.

Interview Notes

Privacy4Cars: https://privacy4cars.com/ 

California UX whitepaper: https://privacy4cars.com/ux-california/ 

Vehicle Privacy Report tool: https://vehicleprivacyreport.com/ 

Company auto info: https://Privacy4Cars.com/CISO 

GDPR auto info: https://Privacy4Cars.com/GDPR 

Opt Out Code: https://optoutcode.com/

IoT on Wheels talk: https://instituteofprivacydesign.org/2025/08/11/cars-iot-endpoints-on-wheels-privacy-engineering-technology-education-discussion-peted-recording/ 

Data Diva car data graphic (slide 16): https://www.nist.gov/system/files/documents/2024/05/15/V3_2024_May_IoTAB%20%20-%20Monroney%20Sticker%20Presentation_Privacy_subteam_compressed%20508.pdf 

IoT Advisory Board Report: https://www.nist.gov/system/files/documents/2024/10/21/The%20IoT%20of%20Things%20Oct%202024%20508%20FINAL_1.pdf 

Enable Global Privacy Control: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/ 

Further Info

Annual Listener Survey!!! https://fdsd.me/survey2026 

New Patron Promotion!! https://fdsd.me/promo126 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:14: Intro

0:01:06: Listener survey reminder

0:01:53: Patron promo reminder

0:02:30: Lingo definitions

0:03:14: What’s changed since our last talk?

0:08:15: What data do cars collect?

0:12:56: How could car data affect my insurance rates?

0:15:51: What was the purpose of your recent study?

0:23:01: How do authorized agents work?

0:28:01: How does Opt Out Code work?

0:33:21: What’s the response been to your report?

0:36:13: How do we make car data more obvious?

0:40:23: Does GDPR apply to cars?

0:45:17: What are some other cases to consider?

0:48:45: What’s the EU Data Act?

0:54:08: How do I limit my auto data sharing?

0:56:44: How remove car data before selling?

0:59:56: What’s next for you?

1:01:43: Wrap-up

1:03:25: Enable Global Privacy Control

1:05:24: Patron podcast preview

1:06:52: Looking ahead

AI has many problems, but also has promise. Today I’m going to focus on one particular problem that has some viable solutions: privacy. Chat bots like ChatGPT, Gemini and Claude all require your queries to be processed in the cloud. All the personal questions we ask are probably being logged against our identity and could be used to train future AI models or to present us with targeted ads. But there are alternatives that protect your data – I’ll give you a handful of solid options.

In other news: a Texas court has blocked the app store age verification law; Flock’s people-tracking cameras have horrible security; PornHub confirms data leak due to third party; stalkerware maker pleads guilty; Texas sues 5 TV makers over data collection; Wegman’s grocery using facial recognition in NYC; New York’s surveillance pricing transparency law goes into effect; DROP tool debuts in California for deleting broker data; two Chrome extensions caught stealing chat bot session text; ChatGPT rolls out new Health tool.

Article Links

Judge blocks Texas app store age verification law https://www.theverge.com/news/849752/texas-app-store-accountability-act-age-verification-injunction

Flock Exposed Its AI-Powered Cameras to the Internet. We Tracked Ourselves https://www.404media.co/flock-exposed-its-ai-powered-cameras-to-the-internet-we-tracked-ourselves/

PornHub Confirms Premium User Data Exposure Linked to Mixpanel Breach https://thecyberexpress.com/pornhub-data-breach-premium-users/

Founder of spyware maker pcTattletale pleads guilty to hacking and advertising surveillance software https://techcrunch.com/2026/01/06/founder-of-spyware-maker-pctattletale-pleads-guilty-to-hacking-and-advertising-surveillance-software/

Texas sues 5 smart TV manufacturers over data collection practices https://therecord.media/texas-sues-5-smart-tv-makers-over-acr-tech

Popular grocery store chain uses biometric surveillance on shoppers, raising privacy concerns https://www.aol.com/articles/popular-grocery-store-chain-uses-130056099.html

How New York’s Personalized Pricing Law Affects Consumers And Retailers https://www.forbes.com/sites/anishasircar/2025/12/03/new-yorks-algorithmic-pricing-law-what-it-does-and-why-it-matters/

This Tool Deletes Your Info From Data Broker Sites (If You Live in One State) https://lifehacker.com/tech/california-new-data-removal-tool

Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users https://thehackernews.com/2026/01/two-chrome-extensions-caught-stealing.html

Why I Won’t Be Giving ChatGPT Health My Medical Records https://lifehacker.com/tech/dont-give-chatgpt-health-your-medical-records

Tip of the Week: https://firewallsdontstopdragons.com/ai-chat-privacy/ 

Further Info

Annual Listener Survey!!! https://fdsd.me/survey2026 

New Patron Promotion!! https://fdsd.me/promo126 

Flock You project: https://github.com/colonelpanichacks/flock-you 

Shodan: https://www.shodan.io/dashboard 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support our mission! https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch

Table of Contents

0:00:07: Intro

0:00:36: Listener survey

0:01:24: Dragon coin promo

0:02:11: News rundown

0:04:00: Court blocks Texas app store age check

0:09:52: Flock exposed its AI cameras to internet

0:21:04: Some PornHub user data leaked

0:26:22: Stalkerware maker pleads guilty

0:33:57: Texas sues 5 TV makers over data collection

0:39:39: Wegmans grocery is using facial recognition

0:44:33: NY personalized pricing law goes into effect

0:47:28: CA tool mass-deletes broker data

0:50:49: Two Chrome extensions steal AI chat records

0:54:56: ChatGPT unveils new Health feature

0:58:25: Tip of the Week

1:07:28: Wrap up

1:07:47: Patron podcast preview

1:08:23: Looking ahead

There are a ton of messaging apps on the market – and there are actually quite a few that are very secure and private. I would argue that there is no such thing as a “perfect” secure messaging app. There are several threat models to account for, each with different requirements. Today we’re going to talk about the pros and cons of decentralized messaging with the co-founder of Session, Kee Jeffreys. These messaging apps don’t rely on a set of servers hosted by the provider, but rather on a mesh of nodes run by hundreds or thousands of others. We’ll also discuss the importance of protecting metadata and the notion of “permissionless access”. Session just announced support for key features in the upcoming version 2 of their protocol, including Perfect Forward Secrecy (PFS) and post-quantum encryption.

Interview Notes

Get the Session app: https://getsession.org/ 

Session adds PFS, post-quantum crypto: https://getsession.org/blog/session-protocol-v2 

xkcd $5 wrench (“Security”): https://xkcd.com/538/ 

Further Info

Annual Listener Survey!!! https://fdsd.me/survey2026 

New Patron Promotion!! https://firewallsdontstopdragons.com/new-patron-promotion/

Generate passphrases using d02’s: https://d20key.com/#/ 

My book: https://fdsd.me/book 

My newsletter: https://fdsd.me/newsletter 

Support the mission: https://fdsd.me/support 

Give the gift of privacy and security: https://fdsd.me/coupons 

Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch 

Table of Contents

0:00:13: Intro

0:01:12: Promotion teasers

0:01:54: Interview setup

0:03:33: Lingo

0:05:07: Why did you create Session?

0:11:01: How does the location of a company’s HQ matter?

0:18:58: Why do regular people need this level of security?

0:22:01: How does Session work?

0:29:59: Why does permissional account creation matter?

0:35:55: How does Session compare to other apps?

0:45:27: Why didn’t Session have Perfect Forward Secrecy originally?

0:53:50: When will PFS roll out?

0:58:37: How does cryptocurrency factor into Session’s network?

1:03:32: What happens if $SESH price goes way up or way down?

1:07:19: How does Session sustain itself?

1:13:34: Why is private messaging so important?

1:19:49: Wrap-up

1:22:34: Patron podcast preview

1:23:44: New patron promotion

1:27:14: Annual listener survey