Firewalls Don't Stop Dragons Podcast

There are a ton of messaging apps on the market – and there are actually quite a few that are very secure and private. I would argue that there is no such thing as a “perfect” secure messaging app. There are several threat models to account for, each with different requirements. Today we’re going to talk about the pros and cons of decentralized messaging with the co-founder of Session, Kee Jeffreys. These messaging apps don’t rely on a set of servers hosted by the provider, but rather on a mesh of nodes run by hundreds or thousands of others. We’ll also discuss the importance of protecting metadata and the notion of “permissionless access”. Session just announced support for key features in the upcoming version 2 of their protocol, including Perfect Forward Secrecy (PFS) and post-quantum encryption. Interview Notes Get the Session app: https://getsession.org/ Session adds PFS, post-quantum crypto: https://getsession.org/blog/session-protocol-v2 xkcd $5 wrench (“Security”): https://xkcd.com/538/ Further Info Annual Listener Survey!!! https://fdsd.me/survey2026 New Patron Promotion!! https://firewallsdontstopdragons.com/new-patron-promotion/ Generate passphrases using d02’s: https://d20key.com/#/ My book: https://fdsd.me/book My newsletter: https://fdsd.me/newsletter Support the mission: https://fdsd.me/support Give the gift of privacy and security: https://fdsd.me/coupons Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents 0:00:13: Intro 0:01:12: Promotion teasers 0:01:54: Interview setup 0:03:33: Lingo 0:05:07: Why did you create Session? 0:11:01: How does the location of a company’s HQ matter? 0:18:58: Why do regular people need this level of security? 0:22:01: How does Session work? 0:29:59: Why does permissional account creation matter? 0:35:55: How does Session compare to other apps? 0:45:27: Why didn’t Session have Perfect Forward Secrecy originally? 0:53:50: When will PFS roll out? 0:58:37: How does cryptocurrency factor into Session’s network? 1:03:32: What happens if $SESH price goes way up or way down? 1:07:19: How does Session sustain itself? 1:13:34: Why is private messaging so important? 1:19:49: Wrap-up 1:22:34: Patron podcast preview 1:23:44: New patron promotion 1:27:14: Annual listener survey

Every week, I record a special, private bonus podcast for my patrons. Normally all of that content is restricted to my supporters. But today I’ve got a sampler platter of some of the best snippets from my bonus Q&A with my interview guests. You’ll hear from Yael Grauer (Consumer Reports), Josh Summers (All Things Secured), Lisa LeVasseur (Internet Safety Labs), Josh Corman (UnDisruptable27), Andy Liddell (EdTech Law Center), Carissa Véliz (author, professor), Eamonn Maguire (Proton), Grace Menna & Adrien Ogee (Cyber Resilience Corps). Enjoy! Original Interview Links Ep416: Yael Grauer: https://podcast.firewallsdontstopdragons.com/2025/02/17/security-planner/ Ep420: Josh Summers: https://podcast.firewallsdontstopdragons.com/2025/03/17/all-things-secured/ Ep422: Lisa LeVasseur: https://podcast.firewallsdontstopdragons.com/2025/03/31/microscoping-our-apps/ Ep428: Josh Corman: https://podcast.firewallsdontstopdragons.com/2025/05/12/shelter-from-the-storm/ Ep426: Andy Liddell: https://podcast.firewallsdontstopdragons.com/2025/07/07/defending-student-privacy/ Ep438: Deviant Ollaf: https://podcast.firewallsdontstopdragons.com/2025/07/21/passport-lawyer-locksmith/ Ep446: Carissa Véliz: https://podcast.firewallsdontstopdragons.com/2025/09/15/on-the-ethics-of-ai/ Ep453: Eamonn Maguire: https://podcast.firewallsdontstopdragons.com/2025/10/27/privacy-focused-ai/ Ep454: Grace Menna & Adrien Ogee: https://podcast.firewallsdontstopdragons.com/2025/11/10/becoming-cyber-resilient/ Security Planner: https://securityplanner.consumerreports.org/ App Microscope: https://appmicroscope.org/ Take 9: https://pausetake9.org/ Meshtastic: https://meshtastic.org/ Previous dragon coin promo: https://firewallsdontstopdragons.com/dragon-coin-promo/ CISA Bad Practices: https://www.cisa.gov/news-events/news/bad-practices-0 Further Info My book: https://fdsd.me/book My newsletter: https://fdsd.me/newsletter Support our mission! https://fdsd.me/support Give the gift of privacy and security: https://fdsd.me/coupons Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents 0:00:07: Intro 0:03:55: Ep416: Yael Grauer 0:10:51: Ep420: Josh Summers 0:16:36: Ep422: Lisa LaVasseur 0:22:21: Ep428: Josh Corman 0:30:03: Ep426: Andy Liddell 0:35:49: Ep438: Deviant 0:41:55: Ep446: Carissa Veliz 0:47:12: Ep450: Jake Braun 0:52:55: Ep454: Grace Menna & Adrien Ogee 0:55:44: Wrap-up

I’m digging into the vault for a classic interview – a blast from the past! I’ve done 460 episodes over the last nearly 9 years, and some of the best old episodes still hold up well today. I first interviewed Troy Hunt, creator of Have I Been Pwned, in February of 2019. It was Episode 102 and it was entitled “You Must Stop Reusing Passwords”. In this episode we talk a little about the origins of HIBP, password security, data breaches and brokers, and how to keep our accounts secure. I’ve added some new commentary, but the original episode is preserved in all of its glory! Interview Notes Have I Been Pwned? https://haveibeenpwned.com/ NIST updated password guidelines: https://pages.nist.gov/800-63-4/sp800-63c.html Proton summary of NIST changes: https://proton.me/blog/nist-password-guidelines Password haystacks: https://firewallsdontstopdragons.com/need-a-bigger-password-haystack/ Choosing a strong PIN: https://firewallsdontstopdragons.com/how-to-choose-a-pin/ Using passphrases: https://podcast.firewallsdontstopdragons.com/2021/05/24/how-when-to-use-a-passphrase/ On passkeys: https://podcast.firewallsdontstopdragons.com/2023/05/22/problems-with-passkeys/ Further Info My book: https://fdsd.me/book My newsletter: https://fdsd.me/newsletter Support the mission: https://fdsd.me/support Give the gift of privacy and security: https://fdsd.me/coupons Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents 0:00:07: Intro 0:00:32: Interview setup 0:02:52: What is Have I Been Pwned? 0:05:37: What is a data breach? 0:06:42: Where do you get data breach records? 0:08:18: What is the “dark web”? 0:10:35: How do YOU get breach data? 0:11:43: What were some of the worst data breaches? 0:15:09: Who is behind these breaches? 0:17:03: How often are data brokers hacked? 0:19:47: Is it that hard to protect our data? 0:21:22: Is there no liability for not protecting data? 0:24:16: What about breach disclosure laws? 0:26:00: Do class action lawsuits provide accountability? 0:29:00: How can consumers evaluate a company’s data security? 0:32:35: Is data collection inherently bad? 0:34:43: How can we best use HIBP? 0:36:59: Should sites be rejecting known-bad passwords? 0:39:37: Why do some sites limit the use of special characters? 0:41:50: How up-to-date is HIBP data? 0:44:25: What does registering for notifications do? 0:45:39: What is your “opt out” feature? 0:46:25: Can hackers use HIBP for nefarious purposes? 0:48:16: Any other password advice? 0:50:27: Which services integrate with HIBP? 0:52:19: Wrap-up 0:54:52: New password guidelines 1:01:45: Patron podcast preview 1:02:12: Looking ahead

I’ve had some truly amazing interviews this past year. For your listening enjoyment, I’ve curated a set of clips from some of the best shows, creating a sampler platter of stellar audio content from some amazing guests! If you’ve never listened to my podcast, this will give you a taste of what you’re missing! If you’re a regular listener, this will be a fun trip down memory lane, complete with new commentary. You’ll hear from Dr Paul Ashley (CEO/Founder of MySudo), Yael Grauer (Consumer Reports), Weld Pond (L0pht), Lisa LaVasseur (Internet Safety Labs), Zach Edwards (Silent Push), Bruce & Heidi Potter (Shmoocon), Deviant (physical security expert), Cory Doctorow (author, activist, EFF), Monique Priestley (VT State Rep), Carissa Véliz (author, professor), Adrian Ogee (CyberPeace Builders).Enjoy! Original Interview Links Ep414, Dr Paul Ashley: https://podcast.firewallsdontstopdragons.com/2025/02/03/controlling-your-digital-id/ Ep416: Yael Grauer: https://podcast.firewallsdontstopdragons.com/2025/02/17/security-planner/ Ep418: Chris Wysopal (Weld Pond): https://podcast.firewallsdontstopdragons.com/2025/03/03/back-to-the-l0pht/ Ep422: Lisa LeVasseur: https://podcast.firewallsdontstopdragons.com/2025/03/31/microscoping-our-apps/ Ep426: Zach Edwards: https://podcast.firewallsdontstopdragons.com/2025/04/28/riding-the-data-gravy-train/ Ep434: Bruce & Heidi Potter: https://podcast.firewallsdontstopdragons.com/2025/06/23/shmoocon-moose-you-already/ Ep438: Deviant Ollaf: https://podcast.firewallsdontstopdragons.com/2025/07/21/passport-lawyer-locksmith/ Ep440: Cory Doctorow: https://podcast.firewallsdontstopdragons.com/2025/08/04/tariffs-vs-ip-law/ Ep442: Monique Priestley: https://podcast.firewallsdontstopdragons.com/2025/08/18/im-just-a-privacy-bill/ Ep446: Carissa Véliz: https://podcast.firewallsdontstopdragons.com/2025/09/15/on-the-ethics-of-ai/ Ep454: Adrien Ogee: https://podcast.firewallsdontstopdragons.com/2025/11/10/becoming-cyber-resilient/ Best of 2025 blog/podcast: https://firewallsdontstopdragons.com/best-of-2025/ Previous dragon coin promo: https://firewallsdontstopdragons.com/dragon-coin-promo/ Further Info My book: https://fdsd.me/book My newsletter: https://fdsd.me/newsletter Support our mission! https://fdsd.me/support Give the gift of privacy and security: https://fdsd.me/coupons Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch Table of Contents 0:00:07: Intro 0:04:42: Ep414: Dr Paul Ashley 0:09:44: Ep416: Yael Grauer 0:14:27: Ep418: Weld Pond 0:20:58: Ep422: Lisa LeVasseur 0:28:27: Ep426: Zach Edwards 0:34:38: Ep434: Bruce & Heidi Potter 0:38:36: Ep438: Deviant 0:42:51: Ep440: Cory Doctorow 0:51:10: Ep442: Monique Priestley 0:58:28: Ep446: Carissa Veliz 1:05:38: Ep454: Adrien Ogee 1:14:59: Wrap-up 1:15:40: Looking ahead

Way before the world wide web, computer enthusiasts were sharing information via digital bulletin board systems (BBS). This amounted to attaching a modem to your home computer and allowing other people to dial in from their computers (one at a time) to download “textfiles” and share “warez” – or cracked software applications, often games. This scene gave rise to several electronic “zines” that published articles on hacking and phone phreaking techniques. One of the most popular zines, Phrack, was started in 1985 and is still going strong forty years later. Today we’ll discuss the colorful and storied history of this pioneering zine with two Phrack editors, skyper and TMZ. Interview Notes Phrack magazine: https://phrack.org  Phrack Wikipedia page: https://en.wikipedia.org/wiki/Phrack  Hacker Manifesto: https://phrack.org/issues/7/3 Smashing the Stack for Fun and Profit (Aleph One): https://phrack.org/issues/49/14 E911 Document Leak: https://phrack.org/issues/24/5 Texfiles archive: http://www.textfiles.com/  DEF CON: https://www.youtube.com/watch?v=TW-D1I27E08  HOPE: https://www.youtube.com/live/7ZeN53mKhbE?t=26726s  WHY 2025 talk: https://www.youtube.com/watch?v=EtyzTsOtx4A  WHYcast: https://www.youtube.com/watch?v=nwY1q3aEFS0  Cap’N Crunch whistle: https://www.thingiverse.com/thing:3193749  Further Info My book: https://fdsd.me/book  My newsletter: https://fdsd.me/newsletter  Support the mission: https://fdsd.me/support  Give the gift of privacy and security: https://fdsd.me/coupons  Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch  Table of Contents 0:00:13: Intro 0:01:31: Interview setup 0:03:13: Lingo definitions 0:05:32: How did Phrack Magazine start? 0:09:14: How did BBS systems give rise to phone phreaking? 0:15:59: How did Phrack compare to other zines? 0:19:35: How do you define “hacker”? 0:25:10: What goes into making an issue of Phrack? 0:30:00: What’s the story behind Phrack’s famous “hacker manifesto”? 0:33:32: Why was your E911 article so controversial? 0:36:27: What does it mean to “smash the stack”? 0:41:41: What are there ethical issues around releasing hacking tools? 0:45:46: Is the original hacker ethos still alive today? 0:50:18: How has hacking evolved in the last 40 years? 0:52:51: How will AI impact hacking? 0:54:24: Wrap-up 0:56:55: Patron podcast preview 0:57:39: Looking ahead