Use separate channels to verify urgent requests

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 52:24

   to the final topic i want to chat with you about which is what so so there's this issue of institutions being attacked critical infrastructure and so on that's bad enough how should ordinary people try to protect themselves what should they do differently given what you see coming in the future yeah uh this is a really tricky one i think that there are many like things that will help it's not clear to me how much they'll help there's not there is there's sort of always going to be this effect of like you know in the joke two two people are running from the bear and like one of them turns the other one is like you know you We really think we can outrun this bear. And the other one says, ah, like, you know, I don't have to outrun the bear. I only have to outrun you. This is sort of always going to be some part of the dynamic such that like if you can be like a little bit more expensive to hack than the next person, this is like likely to help you.

2. 53:23

   So, yeah, I mean, things that generally I would advocate for, like using sort of, let's see, I would say using a password manager is like a really is a pretty key one. so having some like bitwarden or or one password something like that is going to be somewhat helpful because it's quite likely if you're not using this that like your password will leak someone will like you know break break it and then use it to log into your other other systems if you're reusing passwords so you want to have well-chosen passwords aka randomly chosen long passwords stored somewhere that you can easily use them that's sort of like the the very first thing i would say to someone the second thing i guess i would say is if you to sort of like think a little bit in advance about kind of like fishing what if what it would feel like to be the

3. 54:18

   target of a fishing attack so like someone calls you on the phone they claim to be from your bank they say that there's some very urgent thing that you need to deal with right away like there's sort of this sense of pressure you like have to give them this information or else you'll lose thousands of dollars or something like this. Like banks don't actually operate this way. It's important to sort of like be aware of what pieces of information are being asked from you and whether you should trust that those questions are coming from the source that they're claiming to come from. So like from your bank or from a, from a family member, if you get a call that's, you know, very urgent seeming and they're asking for like your password or asking for a, for you to wire the money or something like that anything like even just check through some other avenue like

4. 55:11

   like there's sort of a like you want to have some sort of like quote unquote out of band communication channel that you're using to verify so if someone has to hack both your phone number and your email account this is like more expensive than if they only have to like access access you via phones so if you get a phone call you could say like okay can you send me an email with this information to from your email address and you can check like, okay, like did that person actually send me this email? Like if they can actually send you an email as that person, this is some evidence. It's not perfect evidence that like the situation you're in is real. If they can't, or if you get an email from some other email address, it's more like evidence that they, you know, trying to get something out of you and they're not really who they claim to be.

5. 55:55

   These are sort of like the classic, you know, infosec pieces of advice. I do think that like the likelihood that a randomly chosen person will face these situations is going to go up. AIs aren't just good at hacking, they're also able to clone people's voices, they're also able to, you know, basically, like, I don't know. They're getting increasingly good at all the things that they would need to do to do social engineering attacks at scale. So I think that a lot of that advice still works. There isn't much that I can say. I guess mostly just try to have your private information in fewer places if you can. So don't sort of give out your credit card number freely to random websites if you can avoid it. Like be ready to cancel your credit card information or your credit cards and things like that if there are breaches etc i would guess that like most of the like serious like

6. 56:51

   civilization scale risks there aren't many things that an individual can do except to try to sort of like have a backup plan of like if things go really wrong one day like i don't know just generic sort of like prepper advice may hold if one day the internet is down for some reason it's be good to have some water and some, you know, some extra food, uh, some toilet paper and so on. You know, I'm not, I'm not necessarily predicting that that will happen, but I, you know, it's, it's not totally crazy that one day the internet would be down because of some crazy AI thing.