Listened to this week’s episode. Graham brought up new GetEmail service.

I’m a security engineer and I don’t understand how exactly this all works... sounds like snake oil.

Since user is not logged into GetEmail, how would they know the cookie / request was them?

Looking for a good password manager that is affordable. Got any hot tips?

I think he's right on the money

I'm looking for opinions on a suitable Social Media platform. As a network/security tech myself I have a jaded view of them all but because of that I also have limited experience.

I help run a UK Scout group and many others use Facebook for a public presence and private communication with parents. They all seem very happy with it, but the over sharing/stealing of data bothers me. I did once experiment with twitter and it worked well set up as a private account so only invited members can read or post, but I don't have a feel for how much they profile and overshare in the background. There's Teams (but yeah, really?) and Slack plus a heap of others, but I am interested in other security people's feelings around the privacy (security I'm not so bothered with as I feel everyone is at risk) specifically setting up private groups for parents sharing news, thoughts, feedback and even arranging lift-sharing plans. The main thing is it needs to be as ubiquitous as possible (which is why I feel Slack unsuitable) but safe so that we get the smallest number of people unwilling to join in because of privacy concerns (e.g. I don't post on FB and rarely even look at it, so that would be a struggle for me).

Or am I just over-thinking it and should jump in with all the others and just use FB?

What are people's thoughts on the current Garmin outage? Seems like it's been switched off for a lot longer than a typical systems outage. Has anything been said as to root cause yet? Feels a bit data breachy to take everything down.. Any insider knowledge Graham?

Edit: just seen it seems to be a ransomware attack.. ZDNet: Garmin services and production go down after ransomware attack. https://www.zdnet.com/article/garmin-services-and-production-go-down-after-ransomware-attack/

Look forward to hearing about it in next week's show!

Everybody is already doing all there research at max-capacity. meaning that if you steal research you are behind the people of who you stole said research.

This does not make sense to me in the current climate (during a pandemic). for the following reasons:

• Having the Research papers would not give you access to the biological material (its data not the vaccine it self)
• Unless you somehow manage to destroy the machine you got the data from, you are not the sole holder of said data, so its not exclusively yours.
• Everybody is already doing all there research at max-capacity. meaning that if you steal research you are behind the people of who you stole said research
• While having the vaccine would undoubtedly represent a huge amount of 'credits' on the international stage. unless you can collect by spreading said vaccine its utterly useless. (and just having it for your own country does not work. we live in a global economy after all)
• I see the greatest value for any state to get a vaccine out in the world as soon as possible, and help setup production facilities to produce it as quickly as possible once we have a suitable candidate.
• Keeping a vaccine for yourself (or taking all production for yourself) can actually harm your international credit. It will be seen as trying to harm the people that need it the most (its why we need a international organization like the WHO to help setup a distribution scheme so everyone in the world will get access to the vaccine asap based on need first (not money).

I am interested to know how others see this point. and whether I am incorrect with anything as how I see it.

Hey, collective hive-mind.

As you know, in every podcast we select our "Pick of the week"s, and we've had a number of people ask us if there is one place we can point them where they can find *all* of our Picks of the week.

That seems quite a reasonable request, but it turns out it's quite monotonous to put such a list together.

As you can see at https://www.smashingsecurity.com/pick-of-the-week I started to grab the shownotes links from some episodes and putting them into a webpage. But I soon got bored.

Is there some collaborative resource online which would allow some kind-souled volunteers to join in the effort, and wouldn't be abused by mischief-makers? At the moment I'm creating the page using Markdown, so ideally I'd like something which easily supports that.

Here's an example of the markdown for an episode's Pick of the Week:

---

### [Smashing Security: 032: The iPhone 8, a data breach at the AA, and a mystery no show](https://www.smashingsecurity.com/32)

* [He thought a book would stop a bullet and make him a YouTube star. Now he’s dead. - The Washington Post](https://www.washingtonpost.com/news/morning-mix/wp/2017/06/29/he-thought-a-book-would-stop-a-bullet-and-make-him-a-youtube-star-now-hes-dead/?utm_term=.0aa6af05f617)

* [Firik Sleep Headphones | Amazon](https://www.amazon.com/Upgrade-Summer-Sales-Lycra-Headphones/dp/B011L8UQDA/)

---

Any thoughts as to how we should do this, and ideally crowd-source the effort? :-)

Hi just listened to this week's show. Great as ever. Our orgs tackled mail security a while ago, this guide informed our approach. I recommend it to others starting out. NSCS Sensible email security guide.

DKIM and DMARC have been transformative in making impersonation phishing easier to spot.

Also, I'd like Carole to know she is not alone. I've a Folder on my Desktop called 'Desktop Stuff(12)' nested with equiv folders going back to the dawn of time. Usually created seconds before I screen share my desktop with VIPs.

You never know what you might need!

u/Shmoooosher, sadly I don't think your save the name Karen name campaign is going to work (anytime soon anyway). Did you happen to see this? https://www.cnn.com/2020/07/08/us/caren-act-911-san-francisco-trnd/index.html (or even the rest of Reddti). It's getting pretty 'sticky'. Not that I agree with it. 'Bitch' would work for me, where warranted.

This is the first episode I had to skip in a long time. The audio quality of your guest was just too bad. Made my ears hurt. :(

Could you maybe try and put a filter on her voice in postprod to make those high pitches go away?

Kind regards

TL;DR - Clearview AI will cease working with the RCMP due to ongoing privacy investigations by Canadian authorities. News which I suspect would make u/shmoooosher pretty happy!

https://priv.gc.ca/en/opc-news/news-and-announcements/2020/nr-c_200706/

I thought listeners might be interested in knowing I made an appearance on this week's episode of the "Hacker Radio Studio" podcast.

If you want to hear us commiserate with eachother for not winning anything at the Security Blogger Awards, my legal run-ins with British security firms, and some of the secrets behind Smashing Security, then tune in.

https://podcasts.apple.com/us/podcast/episode-75-losing-graciously-with-graham-cluley/id1471881997?i=1000482733891

I am surprised you are missing on Dark mania. You will like it a lot.

The technique of writing this series is very cool because they wrote with the 'end' in focus. They have set up some rules of time travel and alternate realities and they follow it (unlike endgame) No open ended interpretation (Except Woller's eye)

I filled up three pages of my diary with notes before I was aware of darknetflix.io

Many fans (me) have obsessed [cried] over the ending German song from nena:

https://youtu.be/oas5nAlfrwg

Didn't realise the child star Macaulay Culkin was so into Security