SN 1008: HOTP and TOTP - SyncThing, Auto-Updates, Sci-Fi Recs

Security Now (Audio)

Leo Laporte

Cyber Crime, Malware, Technology, Encryption, Steve Gibson, Security, Hacking, Twit, Spyware, Leo Laporte

4.6 • 2.1K Ratings

🗓️ 14 January 2025

⏱️ 170 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Meta winds down 3rd-party content filtering. Is encryption soon to follow?
Taking over abandoned Command & Control server domains (strictly for research purposes only).
IoT devices to get the "Cyber Trust Mark" — Will anyone notice or care?
"SyncThing" receives a (blessedly infrequent) update.
Government email is not using encryption? Really?
Email relaying prevents point-to-point end-to-end encryption and authentication.
Just because Let's Encrypt doesn't support email doesn't mean it's impossible.
What Sci-Fi does ChatGPT think I (Steve) should start reading next?
To auto-update or not to auto-update? — is that one question or two?
And, until today, we've never taken a deep dive into the technology of time-varying 6-digit one time tokens.

Show Notes - https://www.grc.com/sn/SN-1008-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Transcript

Click on a timestamp to play from that location

0:00.0	It's time for security now. Steve Gibson is here. We have a, one of Steve's favorite propeller
0:06.9	Ed episodes. There's, of course, some security news. He answers some of your questions.
0:12.6	And then he's going to go into, he's actually going to answer a listener question from Max who says,
0:18.2	yeah, I look at my 2FA, my authenticator app, and there always seems to be
0:22.8	like non-random repetitions of numbers in there. Are these numbers really random? It's an interesting
0:29.4	question, but it prompted Steve to go into a deep dive on how these one-time time-based passwords
0:36.5	are generated, and you won't believe what a cluge it is.
0:41.5	It's mind-bending.
0:43.9	Stay tuned. Security Now is coming up next.
0:48.6	Podcasts you love.
0:50.4	From people you trust.
0:52.9	This is Twitter.
0:58.1	This is Security Now with Steve Gibson, episode 1008, recorded Tuesday, January 14th, 2025.
1:07.1	H-O-T-P and T-O-T-P.
1:10.8	It's time for security now, the show we cover your security, your privacy online.
1:15.9	We cover all of the stuff that you want to know about with computing,
1:20.4	because this guy right here is the king of computing, Mr. Steve Gibson, gRC.com.
1:27.0	Hi, Steve. Hello, my friend. I was getting the fire report
1:31.6	from you and you're safe and sound. Yes, I'm safe. A number of our listeners wrote to say, hey,
1:37.4	you know, all I know about you is that you're somewhere in California, are your feet toasty?
1:43.5	And the good news is we're about an hour and a half south of the,
1:49.9	well, I don't want to call it the action or excitement or anything. I mean, it's devastation.
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Leo Laporte, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Leo Laporte and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.