Adam Levin:
Travis?
Travis Taylor:
Yes?
Adam Levin:
Beau?
Beau Friedlander:
Yeah?
Adam Levin:
I am overwhelmed by the excitement level that my compatriots are demonstrating today, but for all our listeners, we are suffering from a common problem.
Beau Friedlander:
Yes.
Adam Levin:
It’s called allergies.
Beau Friedlander:
There is a tree right outside my window right now, Adam, and it is covered with millions of pain causing things. It’s blooming and I am mucus man.
Travis Taylor:
And I’m allergic guy.
Beau Friedlander:
And, Adam, would you have allergy? You don’t have allergies out in the desert.
Adam Levin:
Of course I do. You know, in the old days it would be like, “Come to the desert. Your sinuses will thank you.” And then they planted stuff. And it blooms. And when it blooms, I die.
Beau Friedlander:
I got you. I thought you were only allergic to scorpions and other creepy problems.
Adam Levin:
Well, I’m allergic to that. I’m allergic to waking up in the morning. I have a list of things that I’m allergic to. But when I think about how we are impacted by allergies, they are sort of a nasal denial of service attack.
Travis Taylor:
Pretty much. I think every morning when I have to use the windshield wipers to clean the pollen off my car, I know I’m going to have a rough day.
Beau Friedlander:
Well, but that’s so devious. The trees are actually like they’re ganging up on us and they’re figuring out-
Adam Levin:
They are.
Beau Friedlander:
… how to say, “No air for you.” So, Travis, you know what else I’m allergic? Phishing emails.
Travis Taylor:
Same. Yeah. I think the thing I’ve been hearing about and reading about that’s going round of late is something that tends to happen around the same time as allergies actually, being from tax season.
Adam Levin:
Yeah. I got an allergic response to taxes. I’m sure you guys do as well.
Beau Friedlander:
He’s not talking about that though.
Travis Taylor:
Right.
Beau Friedlander:
So you’re talking about people who are reaching out and trying to get people to do something dumb so they can scam them?
Travis Taylor:
Yeah. Apparently there are a lot of emails that are getting to sent out, claiming to be sent on the part of the IRS. That really isn’t anything new as such. It’s just something saying like, “Please open this document.” The document will be called something like W9 or W2.pdf. This scary thing here is that a lot of these emails that are going around this tax season and this allergy season for that matter are reportedly coming from the Emotet botnet or spreading the Emotet malware.
Speaker 4:
The sophisticated malware virus known as Emotet, wreaking havoc on the internet for years now.
Travis Taylor:
It used to be called the most dangerous malware in the world or the most dangerous botnet, because it was such an effective banking trojan a few years ago.
Speaker 4:
One of the most dangerous global…
Travis Taylor:
There’s a huge effort on the part of law enforcement and the cybersecurity community to shut down the Emotet botnet. And then a few months later, Conti figured out a way to bring it back. And so Conti being the infamous Russian ransomware gang is just sort of presenting us with a malware turducken because it’s a super dangerous form of malware that can spread. It’s coming on the heels of IRS phishing email season, and one of the groups behind it, or at least the primary group that they’re finding behind it right now is one of the most infamous ransomware gangs in the world.
Beau Friedlander:
I was interested this week, Adam, in just a new twist on the phishing game, which is a lot of companies are getting better at educating their employees about how to avoid phishing emails. But so some criminals have taken, threat actors I should say, have taken to using contact forms on websites to send an email. So I’ll be like, “Hey Adam,” or not even, “Hey Adam,” “To whom this may concern, I’m interested in buying one of your giant AC units. I want to learn more.” They send something back. As the threat actor, I send them a response to what they send me and say, “Well, this is actually what I’m looking for with an attachment.” Boom. I win.
Adam Levin:
Wasn’t you, Beau, that did that for me when you sent me something?
Beau Friedlander:
What do you know about this, Travy?
Travis Taylor:
Well, one of the reasons why it’s so effective is that if you see a contact form on a website, you know it’s going to someone. And for contact forms on websites, a lot of the time, especially if it’s offering some sort of customer service or tech support, they will also allow attachments.
Adam Levin:
And don’t a lot of people think that contact forms are just safer than providing an email?
Travis Taylor:
Yeah, that’s kind of the irony is just because people by and large stopped or at least phased out putting an email address on a website, because there were so many hacking groups out there that would just comb websites for contact emails. They say like a contact form is technically supposed to be giving you a little… one more barrier between that and access. But what that also means is you know for a fact that this is going to an email address, at least one email address with an organization. And if you get your story right or if you fill something out properly, they will get back to you.
Beau Friedlander:
That’s one way to get an attachment to somebody, but there is a much more devious way to get an attachment opened on a computer at work. And Adam pointed this out earlier to me, which is March Madness.
Adam Levin:
You know, everyone loves to play March Madness. They get brackets. They fill out brackets. Almost every company’s got a bracket going on. Groups of friends have brackets going on. There’s no more perfect way during March Madness to get into some company’s network than to have somebody download an attachment.
Travis Taylor:
Oh, sure. I mean, the main threat here is, yeah, to your point, that people are emailing attachments left and right. And March Madness versus a lot of other annual events is something that is taking place in a lot of workplaces. So if you have, say, one compromised email account, if you manage to guess one person’s or even just buy access to one person’s email address at a business, you can just out an email saying like, “Hey everyone, here’s my updated bracket,” and people will open it. You don’t really need to have much more of an explanation than that because people are sending their brackets back and forth to one another. So that’s one way to do it.
Adam Levin:
You know, this is the genius of hackers. They always take a situation that people expect and that people will be eager to respond to, and they disguise their malware, their phishing attacks as part of whatever this is.
Beau Friedlander:
Now, and if you don’t get what we’re saying here, because you’re like, “Well, that’s a phishing attack and that’s a phishing attack and that’s a phishing attack,” go back a few decades, quite a few to the old Pink Panther movies and think Inspector Clouseau because you know what? That Inspector Clouseau could wear a million different disguises, but he was always Clouseau, and phishing’s the same way. It dresses up different, can look a little different. That’s the trick. People are constantly finding new ways to disguise it.
Adam Levin:
And in honor of Inspector Clouseau, let me say, does your email bite?
Beau Friedlander:
There are companies that have intellectual property that aren’t huge, especially in the biotech business. So you’ll have one scientist will start a company to sell one drug that they’re developing, and there’s literally 10 employees there. So when you go through that contact form, you are hitting somebody who’s connected to somebody who can get you what you want, especially if you are a state sponsored threat actor. As we know, there are some countries out there that will go unnamed that prefer to steal stuff rather than develop it.
Adam Levin:
No. Really?
Beau Friedlander:
Well, I heard that there was a country somewhere about the size of Russia, but not Russia, maybe a lot bigger than Russia population wise.
Adam Levin:
Does it have an initial that might be somewhere between a B and F?
Beau Friedlander:
A B and an F. No.
Adam Levin:
The first initial.
Beau Friedlander:
I’m bad at math and I’m bad at logic questions, but yes it does. I take it back.
Adam Levin:
Okay. So now here’s a question, and this is for all of our listeners, what is the one letter that does not exist in the name of any state of the United States?
Beau Friedlander:
It’s not Z.
Adam Levin:
Nope. Well, this is one of those things where it would take… It’s going to take a long time. So if anyone is listening to the show right now, because I know that you are dying to write a review, and this is a chance where you can not only write a review, but spread knowledge and wisdom. So in your review, give us five stars and tell us the letter that does not appear in the name of any state in the United States. And if you’re really impatient, because for me, instant gratification isn’t fast enough, we’ll give you the answer at the end of this episode.
Adam Levin:
Welcome to What the Hack, a show about hackers, scammers, and the people they go after. I’m Adam, cyber allergist.
Beau Friedlander:
I’m Beau, cyber allergen.
Travis Taylor:
And I’m Travis, cyber sneezy.
Beau Friedlander:
We’ll fix you.
Adam Levin:
And today we’re talking again with one of our favorites, Jack Rhysider, from Darknet Diaries, who’s coming back for chapter two.
Adam Levin:
Jack, it would be helpful to find out a little bit more about you that we can share with our listeners.
Jack Rhysider:
Yep. Yep.
Adam Levin:
Depending upon how much you’re willing to let us share with our listeners.
Jack Rhysider:
Sure.
Adam Levin:
But for instance, where are you other than floating around the ether right now?
Jack Rhysider:
Yeah. I don’t like giving locations because I’m a little bit afraid of putting identities and information out on the internet. That kind of stuff can come back and bite you.
Adam Levin:
True.
Jack Rhysider:
Which I’ll share some stuff later about why I’m pretty hesitant to do that. So I’ll just say I’m US based.
Beau Friedlander:
You’re not sharing your image right now in the video that we’re all on because of the same reason. You don’t want anyone to have a beat on you.
Jack Rhysider:
Right. I don’t like having any photos of me out there and this kind of thing. And yeah. I mean, I’ve been in network security for a long time. I’ve seen the news of what can happen if somebody gets your information and what can they do. And there’s, for a few years now, there seems to be a war on journalists and stuff like that. So I just kind of want to step back from that kind of heat and not be the low-hanging fruit that’s easy for people to target. At least that if you want to target me, it’s going to be a little bit difficult.
Beau Friedlander:
And do you get targeted at all? I mean, I assume that people try to phish you and otherwise get your attention.
Jack Rhysider:
Well, I mean, I make a show about hackers and cyber crime, and I’m sure there are a lot of people who would love to have the feather in their hat of like, “Oh, I hacked Jack Rhysider. Look at I got his stuff,” and whatever. And I’ve also exposed some nation state actors and some cyber criminals, this kind of thing. So I think there’s maybe some places out there that don’t like me. So yeah, I think that there are some people trying to do something at different various degrees of why, but yeah, I do have a story that kind of scared the pants off me when I first got into this online content creation.
Beau Friedlander:
Where were you? Where was the first place you landed when you were doing content creation?
Jack Rhysider:
So yeah, I mean, I’ve been internet savvy ever since I had AOL, right? So it’s been a long time and I’ve always wanted to put stuff online, do things. I just didn’t know what. Every project was like 99% of the way done and then it never got finished. But yeah, somewhere along the way I was a network security engineer, and so I was learning about these things and decided, “Okay, I’ll blog about this sort of thing.” And I was blogging about network security, and I said, “Oh, you know what? I might as well make some videos too about kind of a lecture or a talk about this particular topic.”
Jack Rhysider:
And so I was putting some videos on YouTube, and yeah, I decided, well, I’ve got some other things that I’m interested in besides this cybersecurity stuff. And so I just started posting really strange videos. I found some styrofoam and I decided to see what I can make out of it. Could I use it to make a boat out of it? And could I use it to make a house out of it? I was just building different things in it, because I had these huge styrofoam panels. That was one video. Another video was like solar panels that I was building. And I was trying to make some, I think some like water filtration device in my backyard. So I was taking my washing machine and taking the water from that to try to recycle the water and then use it in the garden. And I had this big video on how to do that. So these were just some of the videos I was posting at the time. And when I was posting it, I had my face fully there and was not shy of being on camera.
Beau Friedlander:
Now, were you at the time a homesteader or doing some gardening at your place? What was the reason for that water project? I’m just curious.
Jack Rhysider:
No, I wasn’t quite a homesteader. I do like the idea of trying to be less reliant on the outside world, and so I was just playing around with different gardening things, but it wasn’t enough to survive on.
Beau Friedlander:
But your videos were not necessarily about InfoSec at the time or hackers.
Jack Rhysider:
Yeah, it was a little mix, right? There was some talks that I would give, and then there was this kind of wild. Just what are you doing on the weekend? Look at this project I did.
Adam Levin:
Were you nervous to show your face back then? Or you felt pretty secure?
Jack Rhysider:
No. I think I wanted to create like a brand of me of like, “I am this content creator, I’m this blogger. Here I am. I’ll give talks at conferences and stuff.” So I kind of wanted my face and my name to get out there. So I thought it was okay to do.
Adam Levin:
How many followers did your YouTube channel have back in those days?
Jack Rhysider:
Oh, like a few thousand, 3,000 or so.
Beau Friedlander:
You must have had some fans, maybe even some stans.
Jack Rhysider:
It was more like I had a video that… I think it was an electronics project about XBs and I decided to put that out. And that did create quite the traction. A lot of people picked it up. So 100,000 views from this and people are like, “Oh, I’ll subscribe,” and stuff. So yeah, I mean, there were fans, but I don’t think anybody was a fan of all the videos, right? They were a fan of some of the videos.
Jack Rhysider:
Now, in these videos, I really put my character in there, right? So I would dress up with funny hats and funny glasses and wear strange scarfs and clothes and say really strange things. And then every now and then, maybe I’d have like a puff of smoke in the background to make it look like something’s burning behind me and I’m just totally ignoring it. And I thought it was like a funny joke.
Beau Friedlander:
Can you give an example of a strange thing you would say?
Jack Rhysider:
It was just funny things in the background, props I had had, very strange glasses on, very strange hats. I would sometimes just sit on the roof and talk in the camera. It was really strange, but I never acknowledged any of the strangeness. I went straight for, “Okay. Look, when we’re dealing with solar panels, we’ve got to deal with ohms and amps and let’s do the math here.” And I was very serious about the calculations I was doing on a lot of the stuff. And so it was kind of funny to have the visuals be very odd, but then the content be very serious.
Beau Friedlander:
And it was accurate. You knew what you were talking about.
Jack Rhysider:
Yeah.
Adam Levin:
So, Jack, were you trying to be provocative or humorous or both?
Jack Rhysider:
Yeah, I think interesting I would say. Just interesting.
Beau Friedlander:
It sounds interesting. Definitely.
Jack Rhysider:
It’s like when a lawyer wears, like a man lawyer wears colorful pink underwear. Like they’ve got this little thing inside them that they know they’re funny and unique and they don’t really want to show the world. Well, here is that thing coming out, right? I’m like, “You know what? I’m a funny guy, I’m a unique guy. Here’s some of the things that is going on in my world. But by the way, I’m not going to acknowledge any of that. I’m just going to talk about the interesting thing that I want to bring you today.”
Beau Friedlander:
I think that’s brilliant. Are these YouTube videos still around? Or I assume since you said your face was in some of them, they’re not up anymore?
Jack Rhysider:
Yeah. The only ones that remain are the XB ones, which if there was my face in it, I’ve blurred it out at this point.
Beau Friedlander:
How long ago was this, Jack?
Jack Rhysider:
Six years ago.
Beau Friedlander:
How vulnerable were you when you were doing that to OSINT, to open source intelligence type work if someone was trying to figure stuff out about you?
Jack Rhysider:
Yeah. I was still doing network security, so I kind of knew the dangers, right? So I wasn’t giving my street address. I wasn’t trying to give much more information than I needed. I wasn’t forthcoming with private information, if that’s what you’re asking.
Adam Levin:
Jack, when you were making these videos, were you tracking stats, like how many viewers, what your growth was? Were you really trying to grow an audience?
Jack Rhysider:
Mm-hmm (affirmative). Yeah, I wanted to.
Adam Levin:
Because the real question here, and somebody with your background would absolutely know this cold, but how do you balance being a public figure with being safe and secure?
Jack Rhysider:
Yeah, I think you want to use your name as least amount as possible, right? So use a fake name if you can. Don’t provide details such as your location, your age, your interests, your family status, who you’re related to, who your friends even, because people can target them to try to get to you and stuff like that. So yeah, you just kind of want to really pull back on all the possible things and just talk about very common things like the weather online if you’re on social media and stuff, right? Because the more you divulge about yourself, the more that somebody can build some sort of targeting package to you. And when you have situations like where people are saying that they’re Bitcoin investors or they’re big into Ethereum or something, well, now you know that this person probably has a lot of Bitcoin and you can say, “All right, well, how can I social engineer this person to get what I need out of them.” And people have lost millions of dollars in Bitcoin this way.
Jack Rhysider:
So you’ve got to kind of see what could potentially go wrong. Sometimes you have something that other people think is valuable, and if they can steal it digitally or even pressure you into just giving money, because they’ve conned you. I’ve seen catfishing scams and stuff like this where people are like, “Well, now I have your photos. Give me $500 or else I’m going to publish it to the world.” Yeah, it’s a dangerous world. So I just try to stay out of that light and just have a professional persona that I put out there instead, which doesn’t always match my real persona.
Adam Levin:
Did you have experiences where someone tried to get more information about you by going to family members or at least trying to trick family members?
Jack Rhysider:
Well, I haven’t had that experience, but I’ve seen that used many times. There was a talk at DEFCON I remember specifically where I think it was titled How I Hacked Your Girlfriend. And it was somebody was trying to hack another hacker, and they couldn’t get to him because that guy was very secure, but they figured out who his girlfriend was and got into her Facebook account, which connected to his, and that’s how he was able to get everything out of this person.
Adam Levin:
We try to tell people the fact that sometimes they may not be after you, they may be after somebody with whom you’re connected.
Beau Friedlander:
Yeah/ or you’re only as secure as your four year old kid on your tablet.
Adam Levin:
That’s right.
Jack Rhysider:
Yeah. So everything was going good on this YouTube channel. Things were growing, it was going nice, but I was still working. And I went to work one day and I saw this email that said…
Speaker 6:
Hi, Jack, I’m your biggest fan. Love your stuff on YouTube.
Jack Rhysider:
And this was my work email address. This is not connected to my real life. And the hairs on the back of my neck went up and I was like, “Why are you emailing me at work? There’s no way that you got my work email from YouTube.” And I asked him and he wrote an email back to me, and I’m going to read parts of these emails.
Speaker 6:
All right, Jack, I’ll try to explain. I saw your video about the solar panels, and I watched it over and over and over again. And I just absolutely love your channel and I’ve watched all your videos, and I think you’re fantastic. And-
Jack Rhysider:
He’s even asking…
Speaker 6:
I wonder where that smoke is coming from in the background on there. That’s always, it’s made me wonder.
Jack Rhysider:
But then he says…
Speaker 6:
I see that there’s like a highway near where you’re living and I can hear it in the videos. And so I also saw that there was a lake in one of your videos, and I was able to see the sign of what the lake was, what the name of the lake was, and from there I kind of got your general location. And then once I got which town you were in, I typed in your name into Google with that town, and then that showed me that you are a member of a juggling club.
Jack Rhysider:
Which is true. I am a member of a juggling club in that town, and that was a hobby I had. And from there, it had an old email address that said, “If you want to contact me, contact me through this email.” But that email did not work, and it looks like they tried it and it just didn’t exist. I guess that email had my last name in it as well. So they were able to get my first and last name there.
Adam Levin:
So you basically, you got re-identified, and this is something Beau and Travis and I write a lot about. And people think that they’re floating around anonymously and they have no idea, as you’ve just proven here. And we talked about is they had no idea that it wasn’t that difficult, ultimately, if somebody put their mind to it.
Beau Friedlander:
It’s actually kind of a creepy trick that catfishers use too when they’re stalking somebody. So you really were getting stalked.
Jack Rhysider:
Yes. Yes, it was. And it’s very creepy and it goes on that they used my first and last name in the city where I lived, and that brought them to the… What is it? The county records. And they were able to see my name in the county records of which house I owned.
Beau Friedlander:
And this is all open source.
Jack Rhysider:
Mm-hmm (affirmative). So from there they continued to search Google and they found where I worked. And on that… It was a particular video where I was promoting the company I was working at, “Come work here. It’s a great place.” And I guess my email address was on the video. I don’t know why it was on that video, but it was. And so they were able to find where I worked and emailed me at work and then gave me this whole thing. And what’s funny is they have screenshots of all the places where they found this information. So they were clearly building some sort of, I don’t know, Word doc of all the clues that they had discovered along the way. And I don’t know how long it took them, but yeah, this was just from a fan. This was not even somebody trying to do something malicious to me. It was just a fan, and that freaked me out tremendously.
Adam Levin:
So do you think this person, man or woman, that they were trying to show off? Or you think it was something more sinister?
Jack Rhysider:
I mean, I think that they were wanting to be friends and I think they were lonely and just said, “Oh, I really connect with this guy.” And he was from Germany and he showed me his solar panels, because we both had solar panels on our roof, and yeah, I don’t know. They just matched with my vibe and was like, “I need to know more everything I can about this guy.”
Jack Rhysider:
I also want to point out that this was before… You know when you meet people online today, maybe through dating apps or whatever, you automatically Google them and try to figure out where they are and try to find their other social accounts? This was before all that, where it was actually a little bit creepy to Google someone just on a dating app. So I was like, I don’t know, I think that’s… Do you remember those days where it was like, “Yeah, I think it’s kind of weird to Google someone’s name when you meet them”?
Beau Friedlander:
It was considered completely wrong to Google people before that, before the advent of those apps.
Jack Rhysider:
It was creepy to do.
Beau Friedlander:
Creepy.
Travis Taylor:
Do you ever express any discomfort with this person?
Jack Rhysider:
Oh yeah. Well, I actually didn’t tell them. So what happened is I made the wrong move and I felt flattered and amazed that one of my fans would do this. I wasn’t quite creeped out at first. I was just like, “Oh my gosh, that’s amazing.” I think I showed them something else, like some more pictures of the solar panels or something and actually played into this because like, “Oh yeah. Wow. It’s amazing. You reached out. That’s crazy that you found me.” And I guess they were messaging me on YouTube and I just wasn’t seeing the messages. So you talk about stan like, “I message you four times, man. You never wrote back.” But yeah, I was flattered, but then when I talked to some other people, that’s when I realized uh-oh, this is bad, this is creepy and I need to do something about this.
Adam Levin:
So this was not a Sally Field’s you love me, you really, really love me moment.
Beau Friedlander:
So what did you do about it? What was-
Jack Rhysider:
So I-
Beau Friedlander:
How do you take evasive maneuvers?
Jack Rhysider:
Yeah. I had to judge whether or not these videos were worth it, and they were really kind of crappy videos. So I just decided to take them all down off YouTube and start a new channel, I think. Or pivot or change the name or something. Right? So I feel like I ripped it clean and started fresh.
Adam Levin:
So now if the present day you could talk to the you back then, what advice would you give you?
Jack Rhysider:
Well, I think there were some identifying pieces in the scenes, right? So there was some mountains, lakes that were easily… You could see where this person is. And so I would say just do your inside or with the angle shooting downwards so you don’t see anything outside of the thing that’s supposed to be in the frame. That’s number one.
Jack Rhysider:
Number two, I wish I had a different name, a fake name that I was using. And so that would’ve been a better idea. And yeah, just divulging less and just keep it more distant. Also, have a whole different persona with a different email address as well so that if somebody decides to attack that person, that email address, whatever the case is, they get that persona and not where my bank is and all this other stuff as well.
Beau Friedlander:
So I have to ask, I don’t know how to ask this, but I think I can manage it. Anonymity and having a really popular podcast don’t seem to go hand in glove. And I don’t think of you as anonymous. I think of you actually, since I’ve listened to hundreds of your episodes, as like my best friend.
Beau Friedlander:
Now, I’m definitely not a stan, so I’m not going to engage in trying to find you. But I wonder, when I think of Darknet Diaries and you, Jack, I think, “Oh, that I know that guy. I mean, I know how he thinks. I love the way he puts together a story,” yada, yada, yada. But now that I think of it, you are basically anonymous. How do you do that? Do you do public speaking engagements? I mean, do you just absolutely stay out of public?
Jack Rhysider:
So there’s a few people that I look to for advice in this situation. If you look at the LockPickingLawyer, for example, this guy has been made famous for showing us how to pick lock on YouTube. However, he only shows his hands and he only calls himself the LockPickingLawyer. He’s giving talks around the nation. He’s giving keynote speeches in front of large crowds, but he’s doing it in such a way that he’s saying, “Please don’t take photographs.” And they’re actually making the stage manager only have lights on the background of the stage so that you only see a silhouette of him from the audience. And so he’s doing things like that.
Jack Rhysider:
You’ve got podcasters such as Casefile, which is a completely anonymous podcast. The host has never revealed his name. And so he’s still able to make a very successful… I think it’s one of the biggest shows out there. So maybe in the top 200, but it’s those things that’s he was able to go from absolutely nobody up to complete stardom.
Jack Rhysider:
And then there’s people like Michael Bazzell who creates a podcast. I don’t remember what it’s called, The Privacy and OSINT Show or something like that, but he creates a book called Extreme Privacy. So he talks about how to stay anonymous online, stay hidden online, stay out of reach of people, and he gives talks as well on stage in front of people. And so I ask him, “How do you do this?” And he says, “I make sure that the conference understands 100% that no photography is allowed, and we’re going to get the stage set up in a certain way that it’s going to be difficult for them to photograph me.”
Jack Rhysider:
And so yeah, I mean, you can still be these big people online as creators today, and even give talks in person and meet people and still can preserve your anonymity. And these are my heroes, right? These are the people that I’m just like, “This is great. We’re not completely lost at being private online. There are ways that we can still be someone popular and still people know us in person and still not really know who we are.” Which is kind of another strange thing because then when you go to your dentist and your dentist asks you, “What do you do?”, oh man, you actually know my real name. I’m not going to tell you what I really do and stuff like that. So it’s a bit trickier.
Travis Taylor:
Well, privacy is definitely a bit of a hot button topic these days, and I think one thing that I’d have to wonder, given how much you clearly value your privacy is what recommendations do you have for keeping private online? Do you use any specific browsers or plugins or anything like that?
Jack Rhysider:
Yeah, I use a bunch of tools. So I’m just going to rapid fire list some stuff here. I’m not really sure what’s the biggest-
Travis Taylor:
Yeah, please do.
Jack Rhysider:
… bang for the buck. But I like to use a firewall to block as much traffic as I can just at the perimeter. I like use DNS filters such as DNS filter or the pie hole, raspberry pie thing. So now we’re blocking a lot of just DNS requests that we don’t need, right? So that’s trackers, that’s advertisers. I like to use a host based firewall as well, such as Little Snitch that just says, “Do want your computer to connect to Adobe right now?” Well, I don’t have any Adobe products open, so no, you’re not getting an Adobe connection, right? So that blocks a lot of traffic as well. And so just there I’ve already blocked 50% of the stuff that’s coming in and out of my computer.
Jack Rhysider:
On top of that, I like to use privacy centric email providers such as ProtonMail, Guerrilla Mail, 10 Minute Mail, things that you can just spin up and put down or whatever. Like some of them are throwaway accounts. Some are encrypted beyond the long arm of the law kind of reach kind of thing. Then there are being safe as far as using a very complex different password on every website you go to. And I’m graduated beyond that and I’m using different email addresses. I’ve got over a dozen email addresses that I use for different things, because if somebody gets into my main email account and that’s connected all of my social medias and Facebook, banks, crypto accounts, everything, that’s my entire life, right? So I want to segment that and compartmentalize it.
Jack Rhysider:
This email is just for my crypto stuff, right? So that will never show up in a breach unless that crypto company gets into a breach. That’s the only time that’s ever going to be in a breach. So that really reduces the exposure that that could have by getting somewhere. So nobody even knows that I own that account. Because, I mean, when you email someone and now they have the first half of your login, right? If you’re like, “Oh yeah, there’s your email. I bet that might work on…” You go to coinbase.com, say, “I want to register a new user,” type in that email address and then a password, and they’ll say, “Actually, that user’s already registered here.” Ah, now you know the first half of their login. So yeah, I want to keep that away as well. I mean, there are a whole bunch of little things I do like this and it just goes on and on I suppose.
Travis Taylor:
I was about to say, I think one thing that… I definitely value my privacy online, but one thing I always hear from people is when they say, “Oh, I have nothing to hide. Why would I be private?”
Jack Rhysider:
Yeah. It’s a wrong attitude to have for sure.
Travis Taylor:
Sure.
Jack Rhysider:
Our lives are so digital now, it’s easy for somebody to really disrupt date. I mean, they can mess you up so bad and you don’t want to just… You don’t want to leave your password out in the open or your pin number or these kind of things. And this is what we’re talking about is there’s things that are private to you that you don’t want to let out there because it can really ruin your life.
Adam Levin:
So do you use any platform, social media that’s the worst for privacy anonymity, but you still use it?
Jack Rhysider:
Yeah. I think Facebook is one of those cases and I use it mainly for work to contact potential guests and advertise a show, but it creeps me out every time. I use a specific computer. I only have one computer that I have, that that’s the one that I go on Facebook with.
Adam Levin:
All right. So given to what happened to you on YouTube, should we be worried about making this show?
Jack Rhysider:
I’m always worried all the time, so I don’t know. But I do see people posting way too much. So they post pictures of their kids. They post pictures of what’s in their wallet. I mean, all kinds of things that they shouldn’t be posting. And so-
Beau Friedlander:
It sort of resembles your wife, Adam.
Adam Levin:
Yeah. Who will be listening to this podcast.
Beau Friedlander:
Hi, Heather. But this does. It goes to, like you were saying earlier that you can hack somebody by hacking somebody who’s close to that person. And there have been big hacks of huge companies that have happened that way where a vendor gets hacked or someone who doesn’t think they’re a target, like a HVAC company. And then from there, they can navigate to a source. But I have a question for our listeners, which takes what we’re talking about and ties it back to the way that you got re-identified on YouTube. Obviously images that are identifiable that show this is that park, and we know that park is near your house, and we know your kid plays at that park, that’s an obvious one. But what are other ways that people can manage their private public persona and stop themselves from being re-identified?
Jack Rhysider:
Yeah. I mean, so it’s tricky as well because there’s a lot of marketing companies out there that are trying to do things and collect information. So for instance, Target has a dossier on everyone who shops there. If you shop with a credit card, when you swipe your card, your name gets tagged to the things that you just bought. And now they start saying, “Okay, here are all the things you’ve bought in the past.” And if you’re doing things like buying unscented soaps and lotions, and you’re a woman, they are going to say, “Hey statisticians, what do you think this person is up to?” And the statisticians that they have working at target say, “Oh, we think this person is pregnant, so let’s give them some coupons for baby items.” Right? And so there’s a database that says whether or not you are pregnant. Or are suspected to be pregnant.
Beau Friedlander:
I mean, it’s why people think that they’re being listened to on their phones when in fact everything they email and put out there and buy on their credit cards is getting caught in a gill net and added to a file. And then Facebook of course knows when you’re about to break up with your… you’re about to be broken up with before you do.
Adam Levin:
Wow. Well, that might be helpful for you if they tell you.
Beau Friedlander:
You can at least find an apartment. Yeah.
Adam Levin:
That’s right.
Jack Rhysider:
Tell me like three years before so I know if it’s even worth my time.
Jack Rhysider:
Yeah. I mean, so this is kind of the thing that I get like, okay, let’s do all this work to not post anything and keep our privacy private, but then it really doesn’t matter at the end of the day, because there’s all these marketing companies that are just doing everything they can to drudge up this information on you through other things. So yeah, it becomes like a struggle.
Jack Rhysider:
And I feel like maybe it’s like in the ’90s, we had an issue with environmental damage, right? We had a lot of oil spills and we had refineries exploding. I don’t know. It was just like an environmental nightmare in the ’90s, right? And it’s going to take decades for us to put that genie back in the bottle. And I feel like last 10, 20 years, it’s been like that for privacy. It’s just been an environmental disaster for privacy. We just want more features and we want more just in time information. And because of that, we’re giving up so much of our privacy and the next generation is going to be like, “What have you done? Why is all this happening?” And it’s going to take decades for us to put that back in the bottle.
Beau Friedlander:
Well, that was amazing to listen to, all of it. But I have to say the Target stuff really freaked me out, Adam. Really, really freaked me out. Because a lot of people think, they’re like, “Oh, my phone is listening to me.” And there are apps where that’s true, but more often than not, it’s just that you are a little too fast and easy with your information and companies like Target are able to know that you’re in the market for whatever.
Adam Levin:
The truth of the matter is, Beau, that people have a tendency to share so much information that it’s so easy to kind of vacuum it up, that someone doesn’t have to listen to anybody in order to get that information. They just have to carefully watch what people do, what they buy, where they go. And certainly every minute these retailers… I mean, look, we live in a surveillance economy, right?
Beau Friedlander:
100%. And so I’m curious because nowadays I imagine a company like… And I’m now going to go down the rabbit hole for sure. But, Travis, a company like Target with all this data, they must have like a Watson computer. And if you don’t know what a Watson computer is, it’s IBM’s giant thing that can figure anything out. It’s a big computer. I mean, does Target do that or do they hire a Watson to do that? Do you know?
Travis Taylor:
I don’t know about the specific hardware, but at the same time, I mean, I think it pays a huge amount of dividends for them to be able to predict what it is you’re going to buy next. But that’s the same thing with any store that has a loyalty card. When they give you a discount, if you happen to just use it because you’re a member or what have you, I mean, that they’re giving you the discount because they’re getting more data on you.
Adam Levin:
And they go out of their way. They’re very excited to tell you on your receipt the staggering amount of money you’ve saved. But that’s because they’ve just vacuumed up a staggering amount of information about you.
Travis Taylor:
Right. And they share their data with Google. It’s just one of example, where if you put something on a credit card, Google is able to match that up to whether or not you had just seen an ad online.
Beau Friedlander:
Well, I mean, that is like the tip of the iceberg for OSINT, for open source intelligence. And you don’t need to have access to the credit card companies to re-identify somebody. Sure, Google and Apple and the biggies out there, Facebook, they can re-identify you any day of the week. And they have access to credit card information, because they buy it. But you have to be careful even when you’re doing something that seems like it shouldn’t be re-identifiable. The fact is everything we do is pretty damn re-identifiable if it’s online.
Beau Friedlander:
Adam, do you like when you see new reviews and ratings on Apple Podcasts?
Adam Levin:
I love when I see new reviews and ratings.
Beau Friedlander:
I noticed, Travis, you do too. You texted us two new ones the other day.
Travis Taylor:
Yeah, it brightens up my day in the way that I operate under a permanent little thunder cloud. That was a rare little bit of sunshine. So thank you.
Beau Friedlander:
All right. So, listen, if you like the show, go on Apple Podcasts or wherever you get your podcasts, and give this podcast five stars.
Adam Levin:
And for those of you who are dying to get this answer and didn’t have time to Google it, the answer you’re looking for as to the one letter that will never appear in the name of any state is…
Beau Friedlander:
Oh, come on. I don’t… Travis.
Travis Taylor:
Yes?
Beau Friedlander:
Did you Google it?
Travis Taylor:
Oh, of course I Googled it.
Beau Friedlander:
And did you get the answer I got.
Travis Taylor:
I believe so. What answer did you get?
Beau Friedlander:
W.
Travis Taylor:
Really?
Beau Friedlander:
No, I got-
Travis Taylor:
Washington, Wisconsin.
Beau Friedlander:
Hey, hey, hey. Take it easy on me. I’m old. Q. I got Q.
Travis Taylor:
Oh, nice. What state is Z in?
Adam Levin:
Arizona.
Beau Friedlander:
Arizona.
Travis Taylor:
Oh, right. Yeah. I should have known that.
Beau Friedlander:
Anyway. So now that you guessed correctly and you got Q, even if you Googled, Adam is going to give you, every single one of you, a box of Tic Tacs. You just tell him what flavor you want.
Adam Levin:
There you go. Just let us know who you are.
Beau Friedlander:
And he’s going to send them himself. He’s going to send them in an… All right. That’s probably a lie. Adam, are you going to send them Tic Tacs?
Adam Levin:
Well, I would do that except they would have to-
Beau Friedlander:
TikToks. Tic Tacs?
Adam Levin:
They would have to provide us their address, which we’ve already covered this.
Beau Friedlander:
Scratch that. Scratch that, guys. Adam is going to do a dance for you on TikTok.
Adam Levin:
I will totally do my chicken dance on TikTok for those of you who get it right.
Beau Friedlander:
Right. So if you want to see Adam do the chicken dance on TikTok, which will involve us setting up a TikTok account for What the Heck, you have to leave a review on Apple Podcasts that says, “I want to see Adam do the chicken dance.” Can you get up and show us the chicken… Show us the chicken dance real quick. Let’s see it. Now, you can’t see. That’s the chicken dance? Wow. All right, guys, this is probably [crosstalk 00:47:03].
Travis Taylor:
That’s a mighty fine chicken dance, I don’t mind saying.
Beau Friedlander:
Chickens don’t do that. No. Adam.
Beau Friedlander:
What the Heck with Adam Levin is a production of Loud Tree Media.
Adam Levin:
It’s produced by Andrew Steven, the man with two first names.
Travis Taylor:
You can find us online at loudtreemedia.com, and on Instagram, Twitter, and Facebook at Adam K Levin.
