Advertise on podcast: Shared Security Podcast

A certificate authority issued intermediate TLS keys with so little randomness that researchers could recreate them, putting browser trust, certificate revocation, and the systems beyond the browser under a harsh spotlight. Tom Eston, Scott Wright, and Kevin Tackett explain the certificate chain in plain English, why a public key is meant to be shared while a private key must stay unpredictable, and why organizations need to account for trust stores in browsers, Java, appliances, containers, and embedded systems. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** CyberScoop — eMudhra kills its certificate business after researchers cracked its private keys in under a second https://cyberscoop.com/emudhra-shuts-down-certificate-business-weak-private-keys/ PCWorld — Microsoft pulls 7 eMudhra certificates from Windows. Here's what that means https://www.pcworld.com/article/3270717/microsoft-pulls-7-emudhra-certificates-from-windows-heres-what-that-means.html Computerworld — eMudhra quits global TLS certificate market after compromise of CA signing keys https://www.computerworld.com/article/4239619/emudhra-quits-global-tls-certificate-market-after-compromise-of-ca-signing-keys.html Free Press Journal — eMudhra apologises after weak keys expose eight certificate authorities https://www.freepressjournal.in/tech/emudhra-apologises-after-weak-keys-expose-eight-certificate-authorities-exits-global-ssltls-business Purchase Scott Wright's new book "The Digital Legacy Tree: Ensuring your loved ones can access the important parts of your digital life when it matters most"https://www.amazon.ca/Digital-Legacy-Tree-Ensuring-important-ebook/dp/B0HN6B8Z7F ** Watch this episode on YouTube ** YouTube upload pending — the episode link will be added before release. ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://www.slnt.com/sharedsec to receive 10% off SLNT's amazing line of Faraday bags and other products built to protect your privacy. ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

A reported attack on French supermarket refrigeration systems is a vivid example of a wider cyber-physical problem: physical operations increasingly depend on connected equipment with long lifecycles, complicated vendor access, and real-world consequences when controls fail. Tom Eston and Scott Wright cover retail OT, remote management, segmentation, patching, safety thresholds, and the questions organizations should ask before connected equipment becomes an attack path. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** Associated Press — reported supermarket refrigeration attackhttps://apnews.com/article/france-supermarkets-hacked-cybercrime-81c2d5721f4df77f601f71741ef7c291 CERT-FR advisory referenced in reportinghttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/ CTV News — hackers’ new weapon could soon hide in your smart homehttps://www.ctvnews.ca/sci-tech/article/hackers-new-weapon-could-soon-hide-in-your-smart-home/ Purchase Scott Wright's new book "The Digital Legacy Tree: Ensuring your loved ones can access the important parts of your digital life when it matters most" (for only .99 cents!)https://www.amazon.ca/Digital-Legacy-Tree-Ensuring-important-ebook/dp/B0HN6B8Z7F ** Watch this episode on YouTube ** https://youtu.be/owTQxljJZAU ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://www.slnt.com/sharedsec to receive 10% off SLNT's amazing line of Faraday bags and other products built to protect your privacy. ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Canada’s Bill C-22 tries to frame lawful access as a bounded public-safety tool, but its technical-capability requirements keep the central encryption question alive: can exceptional access exist without creating a security weakness that someone else will eventually exploit? Tom Eston and Scott Wright discuss Canada’s proposed Lawful Access Act, the bill’s systemic-vulnerability safeguard, existing warrant processes, and why implementation details determine whether an exceptional-access scheme becomes a risk for everyone. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** Mozilla — Canada’s bill C-22 threatens encryption, users’ privacy and the security of digital economieshttps://blog.mozilla.org/netpolicy/2026/10/08/canadas-bill-c-22-threatens-encryption-users-privacy-and-the-security-of-digital-economies/ Parliament of Canada — Bill C-22, Lawful Access Act, 2026https://www.parl.ca/legisinfo/en/bill/45-1/c-22?view=progress Parliament of Canada — Bill C-22 first readinghttps://www.parl.ca/documentviewer/en/45-1/bill/C-22/first-reading ** Watch this episode on YouTube ** https://youtu.be/PjoQr6LuOOo ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://www.slnt.com/sharedsec to receive 10% off SLNT's amazing line of Faraday bags and other products built to protect your privacy. ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Roblox is more than a game—it is a social platform where kids play, trade, spend Robux, and chat. Tom Eston and Scott Wright break down fake Robux offers, phishing links, account theft, off-platform pressure, and practical ways parents can use controls, MFA, spending protections, and honest conversations to help kids play more safely. The episode focuses on practical, non-alarmist risk reduction: learn the platform, protect accounts and payments, recognize manipulation, and make it safe for a child to ask for help. ** Links mentioned on the show ** Sign up for the Shared Security Newsletterhttps://sharedsecurity.net/newsletter The Guardian — Mum, where did my Robux go? The Roblox scam targeting children https://www.theguardian.com/games/2026/sep/27/mum-where-did-my-robux-go-the-roblox-scam-targeting-children Roblox Support — Privacy and Cookie Policy / linked parent controls https://en.help.roblox.com/hc/en-gb/articles/115004630823-Roblox-Privacy-and-Cookie-Policy Roblox Support — Monthly Spending Limits and Notifications FAQ https://en.help.roblox.com/hc/en-us/articles/4409558125460-Monthly-Spending-Limits-and-Notifications-FAQ NCMEC / NetSmartz — Protecting Your Kids Online https://us.missingkids.org/content/dam/netsmartz/downloadable/tipsheets/Protecting%20Your%20Kids%20Online%202_0.pdf FBI - How Can We Help Youhttps://www.fbi.gov/how-we-can-help-you/online-safety/stay-safe-online-kids-and-teens National Center for Missing & Exploited Children’s Cyber Tip Linehttps://report.cybertip.org/ ** Watch this episode on YouTube ** https://youtu.be/8mWsf68HcMQ ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Guardsquare is the leader in mobile application security, with multi-layered protection for Android and iOS apps. Learn more at https://www.guardsquare.com. SLNT Visit https://www.slnt.com/sharedsec to receive 10% off SLNT's amazing line of Faraday bags and other products built to protect your privacy. ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.

Meta Muse is designed to work across a user’s inbox, calendar, browser, connected apps, and other personal services. That makes it useful—and makes its delegated authority a security problem worth examining. Tom Eston and Scott Wright discuss Meta’s stated guardrails for Muse, including isolated execution, connector separation, credential boundaries, and approval flows. They also examine reporting on a Muse authentication-token issue and why a compromised token can matter more when an agent is authorized to act across a person’s digital life. The conversation also covers privacy expectations, reports of human involvement behind AI tasks, liability when an agent makes a harmful decision, and how digital-legacy planning changes when an agent could continue acting after its owner is inactive. The practical takeaway: start with least privilege, separate read from write and spending authority, approve consequential actions, review logs, and keep a fast way to revoke access. ** Links mentioned on the show ** Ars Technica — Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/ Meta AI Research — How We Built Safety Into Muse https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse Meta Help Center — How Muse handles your privacy, safety and security https://www.meta.com/help/artificial-intelligence/1047255454427887/ CNBC — Meta pushes into personal AI agents in Muse Spark family https://www.cnbc.com/2026/09/08/meta-personal-ai-agents-public-reckoning-privacy-safety.html WIRED — Meta Releases Muse, a Personal AI Agent With Privacy Built Into It https://www.wired.com/story/meta-releases-muse-a-personal-ai-agent-with-privacy-built-into-it/ The Guardian — Meta’s AI agent Muse gives out user’s home address without permission https://www.theguardian.com/technology/2026/sep/28/metas-ai-agent-muse-home-address 404 Media — Humans Reading Copilot Prompts and Images https://www.404media.co/humans-reading-copilot-prompts-images/ Scott Wright’s Digital Legacy Network LinkedIn group https://www.linkedin.com/groups/39988004 ** Watch this episode on YouTube ** https://youtu.be/rokXbwQgTgU ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.

A familiar voice is no longer proof of identity. Tom Eston and Scott Wright explain how AI voice-cloning scams turn family emergencies, executive requests, and urgent account changes into social-engineering bait—and why the defenses that work are old-fashioned but essential: pause, call back on a known number, use a private code phrase, and require independent approval before money, data, credentials, or access changes hands. ** Links mentioned on the show ** A scammer can now sound 100% like your wife — LinkedIn post https://www.linkedin.com/posts/saedf_a-scammer-can-now-sound-100-like-your-wife-share-7505586875944853506-TLYq/ FTC — Scammers use AI to enhance their family emergency schemes https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes FTC — Preventing the harms of AI-enabled voice cloning https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/11/preventing-harms-ai-enabled-voice-cloning National Cybersecurity Alliance — Why your family and coworkers need a safe word in the age of AI https://www.staysafeonline.org/articles/why-your-family-and-coworkers-need-a-safe-word-in-the-age-of-ai ** Watch this episode on YouTube ** https://youtu.be/6sfXD86bKco ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Will AI kill us all? Tom Eston, Scott Wright, and Kevin Tackett examine competing AI-risk claims, public calls for guardrails, and the gap between dramatic safety messaging and verifiable internal controls. They discuss realistic harm pathways—from people over-trusting automated systems to distributed operation and weak shutdown options—while challenging the incentives that let companies call for regulation as they keep accelerating. ** Links mentioned on the show ** Axios — Here’s how AI could kill us all (if the worst fears come true) https://www.axios.com/2026/09/09/ai-doom-pdoom-kill-all-humans-anthropic 2026 International AI Safety Report https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026 The Digital Legacy Tree — Scott Wright https://digitallegacytree.com/ ** Watch this episode on YouTube ** https://youtu.be/XF6-nhb1i3A ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

A reported dark-web service offering more than 153 million U.S. and Canadian driver’s-license scans for sale has brought the hidden cost of identity verification into focus. Tom, Scott, and Kevin discuss the alleged breach and FBI inquiry, why a license is a durable credential that people cannot simply rotate, and how ID scanners, vendors, and downstream data sharing turn routine checks into a supply-chain risk. They explore real-time identity-document capture, the limits of encryption and retention promises, and privacy-preserving design principles including data minimization, scoped proof, limited sharing, local storage where feasible, and meaningful accountability. ** Links mentioned on the show ** Gizmodo — Identity Verification Is Broken https://gizmodo.com/identity-verification-is-broken-the-153-million-drivers-licenses-now-for-sale-are-proof-2000806437 KrebsOnSecurity — FBI Probes Service Selling 153M+ Drivers Licenses https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ Reuters — FBI probes report of data breach exposing millions of drivers’ licenses https://www.reuters.com/world/us/fbi-says-it-is-investigating-report-that-millions-us-drivers-licenses-exposed-2026-09-02/ ** Watch this episode on YouTube ** https://youtu.be/r_bXkZk_q38 ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Hotel Wi‑Fi is not automatically unsafe, but it is never a network you should blindly trust. Tom Eston and Scott Wright break down Microsoft’s CaptiveCrunch reporting, including how manipulated captive portals can lead to credential phishing, device-code abuse, and malware delivery. They cover what HTTPS and VPNs actually protect, why a lock icon does not prove a page is legitimate, the warning signs that should make travelers disconnect, and when a cellular hotspot is the better choice. Scott also shares an update on his Digital Legacy Tree book and tools. ** Links mentioned on the show ** Microsoft Threat Intelligence — CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/ FBI hotel Wi‑Fi guidance https://watech.wa.gov/fbi-warns-cyber-risks-when-telecommuters-use-hotel-wi-fi FCC — Cybersecurity Tips for International Travelers https://www.fcc.gov/consumers/guides/cybersecurity-tips-international-travelers Scott Wright — Digital Legacy Tree book and tools https://securityperspectives.com/digital-legacy-tools ** Watch this episode on YouTube ** https://youtu.be/TBqKfiGayfo ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Can a pattern on your clothing change what a camera thinks it sees? Tom talks with Black Hat USA 2026 speaker Bill Swearingen about adversarial clothing research, why person detection and facial recognition are different problems, and what model limitations mean for biometric surveillance, privacy, and accountability. ** Links mentioned on the show ** Black Hat USA 2026 briefing https://blackhat.com/us-26/briefings/schedule/#could-a-pattern-on-your-clothing-fool-facial-recognition-53532 noRecognition Kickstarter https://www.kickstarter.com/projects/norecognition/norecognition-ai-adversarial-clothing Bill speaking at DEF CON 34 (video) https://www.youtube.com/watch?v=WyPmt8CE5L4 noRecognition research https://norecognition.org/research Connect with Bill on LinkedInhttps://www.linkedin.com/in/billswearingen/ ** Watch this episode on YouTube ** https://youtu.be/jw_WJNIYErQ ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at https://guardsquare.com. SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Scott Wright joins Shared Security to discuss his Digital Legacy Tree framework and upcoming book, The Digital Legacy Tree. We talk about what happens to your accounts, passwords, devices, files, money, cloud storage, crypto, and online identity if you die, become incapacitated, or are suddenly unavailable — and how to plan for trusted access without weakening your security today. The conversation covers why “just use a password manager” is not enough, the roots-trunk-leaves model for organizing access, dependencies, and priorities, platform legacy-contact options, and the one practical first step: set up legacy or emergency contacts on your most critical accounts. ** Links mentioned on the show ** Scott Wright — securityperspectives.com (Digital Legacy Tree, Digital Legacy Tools, book beta review)https://securityperspectives.com/digital-legacy-tools/ RUFADAA — Revised Uniform Fiduciary Access to Digital Assets Act https://en.wikipedia.org/wiki/Revised_Uniform_Fiduciary_Access_to_Digital_Assets_Act OpenID Foundation (digital legacy / account handover research) https://openid.net Prior Shared Security episode — What Happens to Your Social Media Accounts After You Die? https://sharedsecurity.net/2021/08/31/what-happens-to-your-social-media-accounts-after-you-die/ ** Watch this episode on YouTube ** [YOUTUBE URL] ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

Flock cameras and automated license plate readers are often sold as tools for finding stolen cars, wanted suspects, missing people, and serious threats. But what happens when that same infrastructure starts being used for everyday traffic enforcement, broader vehicle surveillance, or searchable location databases? In this episode, Tom, Kevin, and Scott discuss a 404 Media report about police allegedly using a Flock camera image to issue a traffic ticket, why that story is a warning sign for ALPR mission creep, and how systems marketed for public safety can become general-purpose surveillance infrastructure. They also talk about citizen pushback, vendor substitution, police discretion, data retention, audit logs, racialized camera deployment, rideshare dashcam surveillance proposals, and new technology that could associate phones and other wireless devices with identifiable vehicles. The core question is not whether stolen cars should be found or serious crimes should be investigated. The question is whether communities understand what they are approving when they install or renew ALPR systems — and whether policy promises like “we don’t use this for traffic enforcement” are actually enforceable. ** Links mentioned on the show ** 404 Media: Police Used Flock to Give a Man a Traffic Ticket https://www.404media.co/police-used-flock-to-give-a-man-a-traffic-ticket/ EFF: Traffic Violation! License Plate Reader Mission Creep Is Already Here https://www.eff.org/deeplinks/2026/03/traffic-violation-license-plate-reader-mission-creep-already-here EFF: Victory! Flock Ends Rollout of Audio Distress Detection of Human Voices https://www.eff.org/deeplinks/2026/07/victory-flock-ends-rollout-audio-distress-detection-human-voices 404 Media: Cops Used Flock to Track a Man Across State Lines to Create Pretext to Search His Car for Weed https://www.404media.co/cops-used-flock-to-track-a-man-across-state-lines-to-create-pretext-to-search-his-car-for-weed/ DeFlock https://deflock.org/ 404 Media: Cities Are Ditching Flock, Immediately Replacing It With Axon License Plate Readers https://www.404media.co/cities-are-ditching-flock-immediately-replacing-it-with-axon-license-plate-readers/ 404 Media: Flock Pitched a Plan To Turn Uber and Lyft Drivers Into Roaming Surveillance Vehicles https://www.404media.co/flock-pitched-a-plan-to-turn-uber-and-lyft-drivers-into-roaming-surveillance-vehicles/ The Conversation: New tech adds phone tracking to license plate readers https://theconversation.com/new-tech-adds-phone-tracking-to-license-plate-readers-associating-devices-with-identifiable-cars-288876 ** Watch this episode on YouTube ** https://youtu.be/mSnQE33WRVE ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.

A federal case involving a GrapheneOS phone wipe during an airport search raises a bigger question for privacy-minded users: can using strong mobile security features be treated as evidence of criminal intent? Tom and Scott break down what happened, why border searches are different, and what this could mean for secure phones and everyday privacy. Tom and Scott also discuss duress codes, realistic travel threat models, and Scott’s Digital Legacy Tree update. ** Links mentioned on the show ** TechSpot — US prosecutors charge Atlanta man after GrapheneOS phone wipes itself during airport search https://www.techspot.com/news/113236-us-prosecutors-charge-atlanta-man-after-grapheneos-phone.html GrapheneOS project https://grapheneos.org/ EFF — Border searches https://www.eff.org/issues/border-searches Help Review The Digital Legacy Tree (upcoming book by Scott Wright)To volunteer, share your story, or suggest ideas that may help others facing digital legacy challenges, visit:https://securityperspectives.com/digital-legacy-tools ** Watch this episode on YouTube ** https://youtu.be/Cch3pG2EO-g ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** Guardsquare Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com.

OpenAI disclosed an unusual AI security incident involving a frontier model evaluation and Hugging Face, but the episode cuts through the hype: was this true autonomous intent, an agent following bad scope boundaries, or a warning about giving AI systems real tools and permissions? Tom, Scott, and Kevin discuss why anthropomorphizing AI makes the story harder to evaluate, what companies should learn before deploying AI agents into production environments, and why permissions, logging, containment, and incident response matter more than marketing language about models acting on their own. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** OpenAI says its AI technology acted on its own in an ‘unprecedented’ hack of another company https://apnews.com/article/openai-gpt56-sol-hugging-face-63ab84fed5612af04d8a160d60f6def3 Luta Security: OpenFace: The Hugging Face Breach and What to Do About It https://www.lutasecurity.com/post/openface-the-hugging-face-breach-and-what-to-do-about-it Cloud Security Alliance: Hugging Face Incident Initial Post Mortem https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem ** Watch this episode on YouTube ** https://youtu.be/Fwb0jsgJxf4 ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact

You plug in a new monitor. Windows detects the hardware, pulls down a vendor companion app, and the first thing you see is… a McAfee ad. That’s the story that kicks off this episode, but the bigger issue is not just one annoying popup. Hardware setup has become a software delivery channel. Drivers, companion apps, RGB utilities, printer suites, vendor dashboards, trialware, telemetry, ads, and startup apps can all arrive through a process most users think of as “just making the device work.” Tom, Scott, and Kevin discuss where convenience turns into bloatware, why user consent matters, and how these trusted installation paths could be abused for worse than advertising. The discussion also covers a related Krebs on Security story about LG smart TV apps that allowed televisions to be used as residential proxy nodes. If monitors, TVs, printers, keyboards, and other peripherals are really networked software platforms, then consumers need to treat them more like endpoints and less like harmless appliances. Practical advice: check what gets installed after connecting new hardware, review Windows Startup Apps, uninstall vendor utilities you do not need, dig through smart-TV privacy and ad settings, and segment smart devices away from the computers and phones you use for sensitive work. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** Tom’s Hardware: Companies are now using automatic Windows installers to display adware through the Microsoft Store when you install new hardware https://www.tomshardware.com/software/windows/companies-are-now-using-automatic-windows-installers-to-display-adware-through-the-microsoft-store-when-you-install-new-hardware-customer-immediately-gets-mcafee-ads-on-their-pc-after-connecting-new-lg-monitor-heres-how-to-block-the-new-ads Krebs on Security: LG to Ban Residential Proxies from Smart TV Apps https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/ Hackread: LG monitors installing adware-like app on Windows PCs https://hackread.com/lg-monitors-install-adware-app-windows-pcs/ ** Watch this episode on YouTube ** https://youtu.be/E-lsZbkbmI8 ** Become a Shared Security Supporter ** Get exclusive access to bonus episodes, listen to new episodes before they are released, receive a monthly shout-out on the show, and get a discount code for 15% off merch at the Shared Security store. Become a supporter today by going to our YouTube channel's membership section: https://www.youtube.com/channel/UCg9CCDIYkDDqwEZ3UYaxjnA/join ** Thank you to our sponsors! ** SLNT Visit https://slnt.com to check out SLNT's amazing line of Faraday bags and other products built to protect your privacy. As a listener of this podcast you receive 10% off your order at checkout using discount code "sharedsecurity". ** Subscribe and follow the podcast ** Subscribe on YouTube: https://www.youtube.com/c/SharedSecurityPodcast Follow us on Bluesky: https://bsky.app/profile/sharedsecurity.bsky.social Follow us on Mastodon: https://infosec.exchange/@sharedsecurity Join us on Reddit: https://www.reddit.com/r/SharedSecurityShow/ Visit our website: https://sharedsecurity.net Subscribe on your favorite podcast app: https://sharedsecurity.net/subscribe Sign-up for our email newsletter to receive updates about the podcast, contest announcements, and special offers from our sponsors: https://shared-security.beehiiv.com/subscribe Leave us a rating and review: https://ratethispodcast.com/sharedsecurity Contact us: https://sharedsecurity.net/contact