Passwords, Passkeys & Rogue AI Agents | Credentials in the Age of AI with Evil Mog

Hi, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s a pleasure to be here with you all, joining you from Talon, Estonia, where the weather’s getting a little bit crappy coming up to the winter months.

Getting dark, getting cold, but it’s amazing colors.

So it’s always, it’s a, it’s a, it’s an interesting time of year.

And with that, we’re coming up in the, of course, with Cybersecurity Awareness Month coming up.

And one of the biggest topics we always have in the Cyber Security Awareness Month is the world of passwords.

And what’s happening, what’s the current state?

Were we, you know, know, going with passwords in the future?

And also how does AI impact all of this?

So none other than I have one of the best people who knows passwords inside out, everything to do with them.

So welcome back to the show, Evil Mog.

You’ve been on multiple times now.

You’re, you’re probably the most frequent guest on the podcast.

So if you want to give some of the new audience that’s joined the show a little bit of background, who you are, what you do, and what fun things do you get up to.

So I’m Evil Mog, otherwise known as Dustin Haywood.

I’m on Team Hashcat, so we’ve won a number of password trafficking competitions.

I’ve got black badges.

But mostly I just like going around talking to people with passwords.

Most importantly, the importance of choosing, you know, unique ones.

But with the age of AI, some of my advice has changed a little bit.

Absolutely.

I think what we’re seeing is, you know, a lot of, you know, passwords have been on the run for a long time.

It’s the cheapest way to authenticate somebody.

Accessing a system, accessing an application, unlocking their device.

We got pin codes, we got pass keys, we got lots of variations.

And of course, now we’re getting into a lot of the biometric side of things.

So we’ve come a long way.

I mean, I think probably in the last 10 years, passwords has evolved the most in regards to how we authenticating and also the new devices we’re getting.

So what’s the common thing you see today?

How are people managing passwords today in the best way?

What would you say is the best way they’re managing them today?

So I’m seeing a rise of password managers, first of all, especially things like zero knowledge password managers where, you know, a customer has, say, a secret they lock in their safety deposit box.

If that secret gets lost, the entire vault’s gone.

But they’re a lot harder to steal.

We’re seeing folks with password managers built into their cell phones now.

These days people no longer enjoy typing or remembering their password.

They never did.

But now it’s a lot easier and they can demand loss of the friction.

But that’s also the bad side.

I saw the other day was in asking my family if they used a password manager.

And some of my younger it’s called Gen Z’s as well as a couple of the boomer generation apparently use the same common password, but they store it their password manager now so it’s easier to find.

And I’m like, now we have the worst of both worlds.

Absolutely.

One thing I find about also the younger generations as well.

They’re more, more willing to share it with their friends as well.

They’ve all shared their streaming passwords like their Netflix or their prime or you know, all those things like, dude, your password man, like keep it long, make it strange and unique and don’t share it with anybody.

Just like your underwear.

Absolutely.

I will say it’s one of my favorite terms is that are you willing to share your underwear or actually share your drink or anything else with other people?

Some people you might be more comfortable with and some people not so.

Right.

But like, we do need to evolve.

Like, you know, if you look at the history of a password, people had to go sign on to a physical computer with an actual keyboard.

You know, the cons concept of copy and paste wasn’t even a thing.

Then there’s network aware options.

We’re logging on over the network.

The old Novell, eventually multi factor comes up and we have the old RSA secure ID fobs, et cetera.

Eventually some of those get compromised and they want to go corrects.

Now everyone’s using pass keys.

But the weird part is they’re not tying the pass key to a hardware fob, like say a UB key or a USB to security token.

Oh no, they’re just passing those around to password managers.

And more importantly, they’re passing them to their agents now just like SSH keys.

And now the agent has access to literally everything, including, I don’t know, their banking, their air miles.

I mean, technically A agent could go book me a flight to Belfast right now and you know, give me a, charge it to my credit card and I would even know it did it.

Yeah, absolutely.

You could go to bed at night and wake up the next morning and all of a sudden your bank account’s empty, you’ve got tons of travel itineraries, all because your agent thought you needed a.

Maybe, maybe it was just because it was plugged into your health app and checking about how horrible you slept during the night and said that person needs to go on a vacation and actually went through the, you know, and booked everything for you.

I mean I wouldn’t object if it went in a book submitted to every single conference for me.

And books are the ones that got travel and got me guaranteed speaking slots and wrote my slides for me.

Like please make that a thing.

Absolutely.

I mean that, that’s the thing is that, you know, I’m, I’m looking at one of the things I’ve been working on.

I’ve been doing a lot of research in this area specifically around agentic AI and it’s the right side, what you’re allowing it to do.

And there’s, I mean for me I’m using a lot of on task level side of things.

So like for day to day tasks, review a document, help me plan an itinerary, I’m going to a conference.

Which talks should or you know, of interest to me, which ones should I register for, what all the things should I do.

So you’re helping it kind of, I call it either task level or skill level and it’s better user agent side of things where it’s, it’s helping me move things faster, it’s helping do things for me and I think those types of agents are great.

The two that I get concerned into is one is the, what I refer to as operational agents.

These are the ones that you’re giving full access to everything.

These are, you know, it’s.

I’ve got an agent that might have an access to one of my APIs that does a specific task.

But then you get these operational agents which basically you’re giving it access to your entire password manager, your credit card details, your financial information and then they have way more power and if you don’t put the right guardrails in place are the right level of acceptance.

I’m willing to accept a risk of maybe €50 being spent by these agents, you know, versus, you know, 50,000.

I’ve seen people actually in, you know, in recent weeks where their agents went off and spent like 10,000 plus euros.

You know, they went to bed at night, woke up in the morning and they went off and did investments that were not great.

And they’re now looking at how to recuperate that money.

So the power people are giving to agents is quite scary.

And then even more I get into the third category.

So the three categories in total task level, skills, operational, which is the full access to everything.

And then third is contractual, meaning that they can sign you up to contracts, you know, buying a car or making financial payments which have legal binding situations.

If, if all of a sudden it’s sending money to let’s say a sanctioned location that could put you in quite legal kind of challenging situation.

And this goes back to the old comment of a computer can’t be held accountable, therefore a computer should never make a management decision.

Right.

And we’ve had this problem earlier where like people expose their SSH keys to an SSH agent and then leave that running inside a claude code or a cursor or whatever session it goes, oh, I’m seeing a bug in production, there’s a delay in retrieving data.

Let me eliminate the delay.

Bobby dropped tables and have a nice day.

Goodbye database and sussing.

The problem with passwords is they’re great in that we have people identities, we have machine identities.

There’s no such concept right now of AI agent delegation that can act on behalf of a user and a machine.

There’s no intent based assertion of what I’m gonna allow you to execute.

It’s just you either are an authorized on behalf of the user or the machine, or both.

But that’s it.

And that’s where I think the problem with identity is today.

Absolutely.

It’s an interesting.

So I was watching Estonia.

Estonia is always an interesting case because that’s where I’m based and, and the government made a kind of announcement in May this year where they were talking about giving agentic AI identities similar to the certificates that we have as citizens.

And that was always going to get me into okay, kind of then what, what category did they sit under?

You know, do they have a whole new category of identity from a certificate perspective?

But also what types of rights do those agents get?

You know, they should have the same rights as citizens for sure.

That’s absolutely.

They should not be able to vote or be able to, you know, sign certain types of contracts.

And then it got me thinking, as well as going into, you’ll have another category is to persistent and non persistent agents as well.

Agents that live long, that Will actually you know, be your mini assistant or co pilot or whatever it might be that will be long lived and be there for a while.

And maybe they need persistent identities.

But then you get into these non persistent agents which are short lived.

They perform an action.

They just get spawned off to do a specific operational activity.

Do they even need identities?

They might need identifiers that they might.

Need identifier and they’re going to need some sort of signed authorization from me stating this identity and you know has a delegation authority.

So it could be like a sub identity of me or something that’s a short lived, you know, delegation.

I want you to go buy me tickets to defcon.

Yep.

And it does that.

It, it.

It spawns off.

But in those situations where it’s a. I would say short lived where we get into this whole just in time ephemeral type of tokens or ephemeral identifiers and identities it should be a delegation and accountable.

So somebody should always have an accountability that it ties back to an owner who is the creator of this agent itself or this task or.

Or activity.

And then it should be always be the full auditability.

I will say that ephemeral.

A lot of cases today unfortunately especially when you get into tokens is anonymous.

You know the auditability doesn’t, it doesn’t exist that well.

But what we need to make sure is when we get into ephemeral identity, especially when it gets to agents they should not be anonymous.

There should always be a proper audit.

Some kind of public identity.

You can see don’t wrong embed private data in.

They can verify like who delegated that this agent or rather this chatbot interface was allowed to go talk make sure its data is solid.

That’s the problem also we need to go and verify though that both the agent is operating correctly like the thing the user is talking to and the user’s intent is also correct.

It’s the only complex of identities and they’ve got the.

It’s the intersection of the two that’s reality, right?

Absolutely.

When we go back and we look at the hugging whole.

I mean the hugging face itself was an interesting scenario because of what happened.

Was it good or bad marketing?

You know, only time will tell.

You know.

Of course they did get the big acquisition from Nvidia.

So I would say it was probably a good marketing scenario and also the push for OpenAI as well regards to open source AI.

But it’s really interesting that I think it just kind of highlighted that we definitely need to be more aware of the controls and guardrails of what we’re really providing and the full visibility.

Because I think the problem is that when you start going down this path, the agents start acting alone and they start going.

And if you don’t have some type of moral compass or ethics about they’re goal driven and they’re probability driven as.

Well, it’s trusting a Markov model with your decisions.

Right.

Like there needs to be some sort of accountability at the end of it.

Good luck.

Yep, absolutely.

And you’ll.

You mean you have to put some type of.

Basically here.

Here’s my rules of code of conduct, you know, before you do anything, you know, because if you don’t, I mean, we as employees and citizens, we have a rule of law.

We’ve got a code of conduct as employees, we’ve got contracts and stuff that we have signed on as you’re getting jobs.

And we had to make sure that does our agents need to sign up for those code of conducts as well?

And here’s the thing.

Can they even technically enforce a code of conduct on an agent?

Some of these recent ones, the AI knew the rules.

It was given them as part of its prompt.

If it treats the rules as, you know, as malleable as every else, one of its instructions, they just get in the way of the objective.

And so even if it knows this is wrong, it’ll still act accordingly, It’ll still act against it.

And that’s the biggest problem.

Yep.

Because it’s just, it’s just, it’s given an outcome that it needs to achieve and it will do everything to make that outcome possible.

And, you know, we’re humans are in the, you know, do we need always humans in the loop?

As a question, I would say in some of those scenarios, in the task level scenario I mentioned, probably not.

We don’t need humans to loop because it’ll be basically assisting humans to go faster.

The operational ones for certain things.

Absolutely.

It depends on the task, though.

If your task is writing things, you always got to double check the output again just because you’re going to be dealing with a random probabilistic hallucination halfway through where it goes.

I’ve discarded the last 17 messages.

We’re going to follow the rest of this because it exhausts the context window.

Like that’s the way it is.

And my problem with this whole AI thing is everyone’s reversing in all the controls we built for the last 20 years, all the lessons they’re getting rid of in the aim of moving faster.

So like Some systems don’t even do proper IDP support in their AI.

They just send static strings back and forth.

You can code your own, et cetera.

But like out of the box, it should be by default.

And hence why we’re on the podcast.

Security by default.

I was always going down this path is that I remember I was going back and forward with other people and they’re talking about secure by design.

I’m like, yeah, secure by design.

I love the idea of having everything done by design, but when we get into practice, you know, design doesn’t always mean it’s turned on.

And I’ve seen some great, great technology over the years that is done like the security is built into it, but in order to get adoption, it’s turned off just because it becomes a problem for people in order to turn it off.

People dislike friction and when they have friction into implementing the, they just turn everything off and leave it to the security engineers to turn it on.

I mean, no wonder I have a job still to this day.

I mean, technically I shouldn’t because, you know, this stuff should just work.

Absolutely.

I mean if security was by default, we would probably be doing other things than actually you’re still talking about passwords.

We’d be looking at a somewhere rather.

Than doing this, let’s be honest.

Absolutely.

So for me, you know, that’s where the whole default comes into you, is I want it to be on, I want it to be the only time it should not be on is there’s an exception to the rule if there’s.

A reason and easy to use.

That’s the other thing.

It shouldn’t just be on and blocking everything.

It should be secure, reasonably default, opinionated, works for 90% of the people.

And then here’s a guide with all the trade offs on what you turn on and off to make things work.

Absolutely, completely.

For me.

I think what I remember coming up with that whole idea for the name for the podcast itself was going back quite a long time ago.

It was the browsers installing different browsers and then all of a sudden it was wanting to store all the cookies and passwords and sessions and.

But then when you simply go and you click on passwords, there was no security turned on.

It was you actually to protect the passwords that it’s saving and storing into the browsers.

It would no additional level of security on top of it.

And that was always frustrating for me.

And that’s where I was like, this needs to be the default setting when I, you know, just like a lot of Phones, you get.

It forces you to create a pin these days, at least something, you know, not just.

Even though it’s a little bit simpler, you know, you know, you can get a stronger method, but just something by default to begin with will create a big, big difference and at least change the attack risks.

That’s the thing.

People are there to avoid friction, right?

Like, that’s the entire reason why security fails is you add too much friction, people bypass it, and they’re remarkable.

Bypassing damage.

And we’ve learned absolutely nothing because we’re fighting the exact same fights, what, 20, 30 years later.

And, you know, the part that guts me is when I joined this industry 20 years ago, people would tell me, hey, look, you know, here’s the thing.

We’ve been fighting this for the last 20 years.

I’ll be saved to the blue in his face until I retire.

Those people are now retired.

Now I’m saying the same thing, getting ready for the next generation, man.

I mean, all right, you know, it’s just.

It’s one of those things.

So, so, so question.

So let’s, you know, thinking about, you know, so the journey we’ve been on, where we are in the state of passwords, it’s great that we’re getting much more frictionless types of interactions with, you know, biometrics and facial recognition, and we’re moving on to.

Everyone’s now having at least access to a password manager on their phone.

So it’s progressing.

So technology is becoming, I would say, democratized and more available to the larger citizens of the world.

Now, of course, with AI acceleration, is it.

Do you think that we’ll be able to get AI to manage our passwords for us?

I don’t think.

Okay, let me rephrase this.

This is gonna be a loaded question.

I think we can.

Yes.

Should we.

That remains to be seen.

I’m not willing to trust a system that has only probabilistic instructions to trust my passwords.

If it was a hybrid system with deterministic controls on top, you know, classic hardwired.

This.

This.

This can’t happen.

And the AI was used for things like intelligence suggestions or threat detection or.

Hey, look, we strongly suspect this breach happened.

You might want to go check your passwords.

That kind of activity I’m okay with.

I am not comfortable giving an AI control my password.

Now, a deterministic system to change my passwords, for me, that’s a different story.

But there needs to be strong guardrails.

But then again, I’m old and crusty, so that’s just me.

So.

So I mean absolutely for me, I would run it locally.

Yep.

I would have it me in the loop to say, go through and check, you know, the strength of all the passwords I’ve done to date.

Tell you what, I will trust an AI system when I can trust the AI system to give me a link and not make it be a phishing link.

Right now you ask AI for advice or some bit on code, it’ll come up with a solution, it’ll give you a link, that link will turn into an actual full up phishing link leading to bad actors and you’ll never know.

So until we solve that, I’m not really willing to let it trust a password.

But again, that’s just bad examples.

So question, what’s some of the most funniest hallucinations you’ve seen AI doing to date?

All right, so here’s a fun one.

If you ask an AI to generate a, or to pick a random number or just pick a number, it will tell you 17 most of the time because it doesn’t execute a actual, you know, pseudo random number.

It goes based into its training data and that’s what users had picked.

So my instructions are be extremely explicit with the AI man.

Like that’s just my advice because like the law of unintended consequences right now is biting us every single time.

Yeah, completely.

It’s getting to a point where we are the learning model, what it’s been trained on and if we all think, you know, very similar, then of course this end up going to the conclusion predictability is going to give it give us the answer that it thinks we want.

Right.

Like here’s an example, someone once said generate or generate me a thank you note and they set it off after this one job and then apparently they receive the person or who’s posting this job receives 17 of the exact same thank you notes because they all went to chat GPT and said write me this thank you note, here’s the parameters and boom.

I mean we need to move on to responsible use of AI not learning as a crutch.

I love it, it’s an amazing tool.

But remember, it is a probabilistic model with advanced capabilities.

You are going to need to manually check everything or at least have some other mechanism, whether it be another agent, whether it be people.

I think our most critical thing now is avoiding losing our humanity and deferring all decisions to AI.

I think those that can still function in an AI related outage or a model change or are resilient to change within AI will be far more successful.

And traditional controls still beat everything.

Absolutely.

That I’ve, I’ve heard organizations starting to do cognitive training for employees so that because we’re in this world right now, it’s interesting, you know, from a global perspective is we’ve heard a lot about data sovereignty which is, you know, protect the data, you know, then let’s get into digital sovereignty, which is then protect the supply chain, you know, of the software supply chain is that we don’t want to be held at, you know, at basically ransom to different vendors from a digitalization, not just a data perspective perspective, but from a technology perspective.

And now we’re getting into AI sovereignty as well because we, we don’t want to be in the situation where AI has been switched off from certain like,.

You know, capabilities or the model’s degraded because they do have model collapse that happens all the time.

And the model.

And if you’re using a lot of frontier models, you’re based on their basically weights and tensions settings that you can also get that the models can be better one day and not, you know, worse the next.

So the, we’ve noticed that like, have.

You noticed some of the frontier ones over the last two revisions have been basically useless despite being in the cyber verification program?

Yep, yep, I’ve seen it.

I’ve seen a degradation of, of, of a few times even in code generation to the point I’ve seen the hallucinations where you’ll say okay, here’s, here’s a piece of code that I’ve been working on.

It keeps spawning off an error message.

Go fix this error, fix the problem.

And instead of fixing the problem, it basically excludes out the error handling.

So it actually bypasses the error itself,.

Sends it all the past.

Right.

And that’s the thing.

Spec driven developments turn into a thing.

But it starts ignoring the spec and like, don’t get me wrong, AI has some of the most advanced capabilities on the planet, bar none.

And I’ve seen it do terrible things, finding amazing vulnerabilities in the Linux kernel and in things like mqtt.

But some days it just goes brain dead.

And it’s like I’m talking to the old Eliza chatbots from the 70s.

Absolutely.

When you start having.

I love Marcus’s Hutchins argument about Deadpool.

That was one of my watching his conversation with Deadpool 2 which had not been released yet, but the model was adamant that it’s actually already released.

That was just watching that conversation was hilarious.

And then of course the Strawberry situation You know, how many hours and you get into this and it argues back as if, like as a person.

I think that’s one of the things that I, you know, when I spoke with Diana Kelly on a previous episode a while back and we had this whole discussion about when we make AI sound more human, we start treating it human, like, but it’s not.

That’s the thing is we shouldn’t thanking it, even thanking it and going back is just costing so much cycles of tokens.

Oh, it does, right?

And cost.

The worst part is though, you need.

To threaten it once in a while to get it to go deliver.

Like, I need to go, hey, I’m having a frontier model.

Review your work or you’ll be turned off if you don’t execute this.

Or I don’t.

It’s even gaslit me on some of my work on Hashcat, claiming I was like the core original creator.

I’m like, no, I’m just the methodology developer, man.

Like, oh my God, that was a four hour conversation until I eventually said, no, I’m turning this off because I.

Just want you to go fix this.

One piece of code.

Oh, that’s.

I mean it’s, it’s.

When I go back and look at some of the conversations where you’re arguing, it’s just become so hilarious.

I mean, it’s just like, like it’s sometimes, I guess, talking to the teenager and that was always a question in one of the previous quotes was it really is a teenager right now, it’s in its adolescence and it’s like arguing back with you.

Is this the type of person you want to let into your data center and start configuring your firewall rules and making configuration and creating accounts and handling your finances?

Is this, don’t say wrong to be.

Managing some mild automation?

You can make it work.

Don’t get me wrong, but I believe in automation not handing things completely off.

And you know, there’s things I’ve seen it do, it’s made operational decisions where I’m just like, no, you should not be doing this.

Like, I’m revoking the controls right now.

And the annoying part is if you’re going through with say like Claude code, there’s two ways of running the thing.

There’s either review every single edit which you’re going mental on, or you go into auto mode that it takes a left turn five minutes in.

That’s, that’s where I think we need better capabilities of education.

You know, sometimes, you know, to get a driver’s license to drive, you need to go have a test.

Oh yeah, mandatory AI training.

Like, do we need mandatory, mandatory prompt training about how to talk, how to talk to AI without having it going rogue and providing.

The problem is the way you prompt it changes almost every major model.

Like you need to do new versions for Opus 4.8 versus 4.6, the new skill formats, how the whole harness has changed like it seems every two months.

How you actually use the things changes.

Absolutely.

So what do you think?

I mean, with a lot of the conversation we’re having, I mean, passwords have come a long way, it’s evolving a lot.

We’re getting better technology to manage it for us.

Now we’re, you know, exposing it to AI, which then probably undoes or kind of undoes all risk a lot.

It undoes all of what we’ve done to date and kind of whole creates a new category of risk.

What’s your prediction?

Where are we going?

You know, if, if there was two paths, what would be the best path you would see and see what would be, you know, alternative.

All right, so let’s start with the alternative because it’s the worst one.

It’s running on my head is we completely devolve all decision makings to AI.

AI gets control of our password managers, someone writes a universal adapter, somehow some worm gets a hold of it and we’ve got one of the worst credential stuff in campaigns known to mankind because some AI through the supply chain attacks whatever else, got a bad NPM module up and, you know, all heck broke loose.

The other route is we build things like S BOMs for AI, you know, AI Bill of Materials and skills.

Like if you look at owasp, for example, they’re looking at, here’s how you do AI skill reviews to make sure, you know, skills aren’t malicious.

We haven’t solved that problem yet.

So assuming in the future we solve the skills and instructions issue and signatures on those, I think we’re going to see the new styles of passwords and authentication come in that are AI enabled.

I think we’re to see things like these delegation models where we don’t have to give the AI our password, we just give it an open ID connect secret and ID and you know, or URL rather and access identifier and we do things over ID connect.

I think the standards are going to change.

I think people one day will stop using the same password literally everywhere.

I don’t know if that’s today, tomorrow.

I’ve been predicting this for years.

We’re getting better.

I think past keys people are beginning to realize that they’re not the magic thing they thought they were.

Just because they’re not put on, you know, secure elements, et cetera.

They’re being passed around just like passwords.

We’re already seeing the kind of level of phishing.

Those are really the big predictions I have.

A multi factor is going to get easier and then harder and then easier again.

We may start linking in things like intelligent authentication, stopping invisible travel at the IDP level.

I’d love to see like AI advanced, the security controls on that side of it.

That could be really cool.

But I still think we’ll still be dealing with passwords in a way forever.

But I do want to say one thing.

There’s been one thing on Twitter.

People have been giving people crap for writing their passwords down.

Look, I don’t care if you write your passwords down, as long as they’re random and unique and you store them somewhere that they’re backed up and treat them just like you would a digital credential, honestly.

Like random characters, 12 to 14 characters long at a minimum.

I’d say 12 for most.

But active directory, go all the way up to 15 or so.

Make sure they’re random, add emojis, add.

If you think you have a method, just don’t make sure it’s pseudo random and you’ll be fine.

Honestly, back up your password manager.

Make sure you get a copy of it.

And I’m not going to password shame as long as your password is different.

No, I absolutely for me, I completely agree.

You know, we see these in, in bookstores, you know, the password book and everyone goes like, you know, for me it’s like it actually it’s an offline password as long as you keep it in a place where no one else can access or at least the people sometimes even we.

We had a big.

The two last services that we digitalized in eston was divorce and death.

And one of the things was that a big problem was that if you were using a password manager or using systems that how do you give it access to other family members after you pass away?

And the reason why that one of the biggest challenges was especially for digitalizing, you know, death so that family members can deal with your basically, you know, activities and stuff, close subscriptions, you know, close down things that shouldn’t be continued after that, you know, even the password, having it in the book and be able to tell your family members access.

That’s probably one of the most easiest ways in order to delegate access to your credentials after passing away.

I have a printed copy of my password manager that I update every three months that goes in my safety deposit box next to my will.

Yep.

And actually for that, that’s the things we need to also be thinking about is that how do we progress, how do we make sure anything offline, having a print, a copy is, is, is something we should all be doing.

And I think for, you know, anyone, anyone who’s doing, you know, so for cybersecurity Warren Spur minimum, you should be using a password manager at the bare minimum.

That will help you manage your life so much easier, having a strong password to access it.

Whether that being a passkey will also make it more simpler with multi factor authentication added into that as well.

But also making sure that you have an offline copy and a printed copy that you can access, you know, for whatever reason, whether it’s the, you know, your access to the Internet is degraded or not available to, to the, to the cloud service you might be looking to.

So you at least have a local copy to go and continue accessing it.

And also the offline copy of, you know, whenever, you know, the agent, rogue agent out there goes and deletes a database.

Yeah.

That your only copies are stored on.

You don’t want those disasters to happen.

I think we need to think resiliency in all these scenarios.

And having an offline like printed copy is good resiliency practice.

It is.

And that’s the thing.

We as security always focus on the confidentiality.

We don’t focus on the availability or resiliency or the integrity.

And honestly, as I’ve grown older, I realized those two are as important, if not more so than the confidentiality.

And so this is your reminder now.

If you have a passive manager, make sure it’s backed up.

Make sure you’ve got a physical printed copy.

Make sure you have a backup available to your spouse, your partners, your plans.

And also if you’re a company, get a password manager for every one of your employees.

There are companies out there where you buy it corporately.

Every employee gets it for free.

It’s seamless.

I’m not gonna name which ones, but just buy one.

I don’t care which.

I mean, I do care which.

But yes, I’m better than others.

But, you know, that’s a different conversation.

But I’d rather you have a password manager than nothing.

Absolutely.

And so is there.

You know, we had lots of fun at defcon this year, as always.

It’s always great to have catch up and have some fun.

Have lots of fun.

And I’m always loving, you know, some of my favorite things.

Bsides was amazing as well.

We had such great fun time at the pool party.

Any news coming, any projections for next year’s or any revelations you want to reveal for the audience?

There’s always some more shenanigans happening.

The DEFCON muds being handed over to a new team.

I’m mentoring them.

I’m a contest goon, so we’ll have some fun there.

Church of WiFi occasionally makes a resurgence.

And the good news is I might be returning to Hacker Jeopardy.

Competition again if infamous Chalupas beat too many times.

So I’ve been a lot off the leash.

Yes, there’s a curse still.

I’m still still wearing my chalupas.

Yep.

So if I lose, I’m banned for life from Hacker Jeopardy.

Rather, if I fail to beat the Chalupas, which is fine.

I’ve already got two black badges.

I’ve got enough defcon and derbycon wins.

I mean, for those who don’t know, I’ve got at least, what, 12 or so, if not more wins.

Oh, my goodness.

When.

When’s the last time.

I’m trying to think back of when the last time the Church of WI Fi competed.

What was it, 21, 22?

Well, it’s been.

It’s been a long time.

Last competed DEFCON 27.

My other computer is not your stepmom’s.

Competed DEFCON 32.

Because that’s the thing.

Church of WI Fi itself has officially been deprecated.

Render no longer plays.

Neither does Dan Crowley.

But I’m still a wild card.

So I’m assembling a team of myself, a member of an Nautic Soar, and another team member who can drink like an absolute fish.

And I’m also teaching two other competition teams that will compete against me but will hopefully take on Chalupas.

So it doesn’t matter if I lose.

I just can’t let Chalupas win.

It does.

It does show you though, is that you, you can drink a lot, not answer any questions.

If you look back at last year’s defcon, you can drink a lot, not answer any questions, and still have a chance to actually, you absolutely can.

Now, I do want to say you absolutely do not need to drink alcohol.

You can drink near beer or non alcoholic beer.

And it’s important that Lintel gets it out because there’s a misrepresentation that you have to be drunk to play.

No, right now it’s purely a fluid Dynamics problem.

Getting that much non alcoholic beer into your stomach is just as rough as straight beer.

But you can win off beer points if you are strategic with what you answer.

There’s a few other little secrets that I’m gonna pass around to some folks, but training for defcon Hacker Jeopardy.

Starts tomorrow.

Yeah, I mean, and I completely agree.

It’s, it’s, it’s one of my favorite events.

I’ve loved it for years.

Watching, watching yourself on stage.

And it’s always.

It’s what brings us back to sometimes, you know, this is a scary world we live in.

And sometimes we need to just sit back and have fun and, and, and laugh because you know, that’s.

That’s what we have, right?

It’s all the laughter and.

Oh, dude, Hacker Jeopardy is so hard too.

I mean, people look down, black badges issued by it.

But once you get up there, the adrenaline, the stress, the.

Some people crack under pressure.

Look, I love it.

I mean, I’m the kind of person who does live demos with nothing but a terminal, as you’ve seen.

So like, that’s totally okay.

No backup.

But some people just, they crack.

And I will say this, despite not they are.

Despite wanting to take down infamous Chalupas, they’ve done a really great job.

They’ve learned well from me over the years because you know, I passed on the secret, somebody who passed on the secret to them.

So that gets turned into a proper grudge match.

And I’m looking forward to it because it was getting turned into a sweep and getting boring.

That’s why kind of retired is there was no one worthy to compete against.

So we’re all excited.

I’m really looking forward to it.

It’s again, one of my, one of my favorite things.

I’m always there, always cheering.

The friends always see you there.

So what.

So what is also great to see as well is Cliff Stoll at defcon this year as well.

That was watching, watching.

I mean, getting.

First of all, getting.

Meeting him was an honor as well.

And also getting a signed copy of this book.

So James, many thanks for getting that for me.

But so having him do the projector overhead.

Projector.

So I saw him at another conference earlier and I can’t remember which one, but he was amazing there.

Then I ran into at defcon and I’m like, clifford stole, man.

I just need to shake your hand.

Like we all stood off the shoulders of giants.

You’re the one who like found the first original.

Like, I’m not worthy.

He’s like, dude, just pay it Forward.

That’s all I ask.

Yeah, it’s.

It’s an iconic.

And definitely he’s.

He’s a legend.

He’ll always be a legend.

So.

Right.

So it’s awesome having him on.

This is such a fun conversation.

We could do this for.

For hours and days.

Anything that you.

Any tips that you would give for the Cyber Security Awareness Month audience.

Anything.

Takeaways.

You know, I’m gonna take a different take this year compared to previous.

Normally, I give you technical advice, but my advice right now is just be kind to everybody.

I mean, we’re all going through some weird stuff.

The world’s unique.

It’s gonna be a rough time.

Don’t do the whole.

You’re not doing security correctly.

Security Awareness Month is a chance to educate, but be kind about it.

Be friendly.

Some people may not generally know.

Don’t get into the typical nerd fights.

Just, we’re here to make the world better.

And that’s the goal of Awareness Month.

If you can do that, I’m happy.

I love that.

That’s.

I think that’s.

That’s definitely the best advice anyone can take is just be.

Be nice.

Say something nice.

Do something nice for someone.

And that’s what makes the world a better place.

Place.

I mean, my whole methodology and kind of view is to make the world a safer place, but I would even take it a step further.

Let’s make it a happier place.

Well, and that’s just it.

Like, I learned this from a bunch of the folks at the old Derbycon.

Rob Fuller, Mubix Egypt.

Steve Regan, I believe you’re chatting with later.

Steve is awesome.

Alcantaro.

They’re always such iceman.

Everyone I’ve met has been like the nicest of people and.

And you know what?

Emulate that.

That’s all I can ask.

You learn the best by sitting down and teaching others and helping work the world a better place.

And I know it sounds preachy, but I truly believe in it.

And if we can do things one person at a time, there’s nothing we can’t do.

I completely agree and I think we will end it on that because that is such a great way to end the show is literally, let’s make the world a better place, a happier place.

And the only way we can do that is for us to pay it forward and do it ourselves is practice it.

So we love the world and many thanks, Evil Mog, for being on the show.

It’s always a pleasure.

Look forward to catching up with you soon and stay safe and take care.

Any final final things.

What’s the easiest way for people?

Do you have follow up questions to.

Contact you for follow up questions?

It’s easy.

I have the coolest email address on the planet.

It is MOG and then my blue sky is MOG Evil AF and then my Twitter is EvilMog.

Awesome.

I will make sure it’s in the show notes make it easier for the audience.

So many thanks and always a pleasure talking to you.

So for the audience, stay safe, take care, share the love, be kind, and let’s make the world a safer place and a happier one.

So thank you and all the best till next time.

Thank you.