Our weekly audio security column & podcast by Steve Gibson and Leo Laporte

TechTV's Leo Laporte and I take 30 to 90 minutes near the end of each week to discuss important issues of personal computer security. Sometimes we'll discuss something that just happened. Sometimes we'll talk about long-standing problems, concerns, or solutions. Either way, every week we endeavor to produce something interesting and important for every personal computer user.  You may download and listen to selected episodes from this page (see below), or subscribe to the ongoing series as an RSS "podcast" to have them automatically downloaded to you as they are produced. To subscribe, use whichever service you prefer . . .  Receive an automatic eMail reminder whenever a new episode is posted here (from ChangeDetection.com). See the section at the bottom of this page.  Send us your feedback: Use the form at the bottom of the page to share your opinions, thoughts, ideas, and suggestions for future episodes.  Leo also produces "This Week in Tech" (TWiT) and a number of other very popular podcasts (TWiT is America's most listened to podcast!) So if you are looking for more informed technology talk, be sure to check out Leo's other podcasts and mp3 files.  And a huge thanks to AOL Radio for hosting the high-quality MP3 files and providing the bandwidth to make this series possible. We use "local links" to count downloads, but all of the high-quality full-size MP3 files are being served by AOL Radio.

Episode Archive Each episode has SIX resources: High quality 64 kbps mp3 audio file Quarter size, bandwidth-conserving, 16 kbps (lower quality) mp3 audio file A web page with any supplementary notes A web page text transcript of the episode A simple text transcript of the episode Ready-to-print PDF (Acrobat) transcript   (Note that the text transcripts will appear a few hours later than the audio files since they are created afterwards.) For best results: RIGHT-CLICK on one of the two audio icons & below then choose "Save Target As..." to download the audio file to your computer before starting to listen. For the other resources you can either LEFT-CLICK to open in your browser or RIGHT-CLICK to save the resource to your computer.

Listener Feedback #31 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 32 MB 8.1 MB 2.1 KB 91 KB 56 KB 108 KB

Jungle Disk Leo and I invite Jungle Disk's creator, Dave Wright, to join the podcast to talk about his $20 product that allows for extremely economical, efficient, seamless and absolutely secure online storage of any user data within Amazon's high-performance, high-reliability "S3" storage facility. 22 MB 5.6 MB 2.1 KB 68 KB 42 KB 96 KB

Listener Feedback #30 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 35 MB 8.8 MB 2.1 KB 112 KB 64 KB 116 KB

Is Privacy Dead? This week Steve and Leo take a break from the details of bits and bytes to discuss and explore the many issues surrounding the gradual and inexorable ebbing of individual privacy as we (consumers) rely increasingly upon the seductive power of digital-domain services. 26 MB 6.5 MB 2.1 KB 92 KB 47 KB 102 KB

Listener Feedback #29 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 47 MB 12 MB 2.1 KB 146 KB 86 KB 135 KB

PayPal and DoubleClick Leo and I dissect the "Links" on PayPal's site with an eye toward reverse engineering the reason for many of them routing PayPal's users through servers owned by DoubleClick. We carefully explain the nature of the significant privacy concerns raised by this practice. 33 MB 8.4 MB 2.1 KB 84 KB 53 KB 104 KB

Listener Feedback #28 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 39 MB 9.8 MB 2.1 KB 120 KB 71 KB 121 KB

Even More Perfect paper Passwords Leo and I discuss the updated second version of our Perfect Paper Passwords (PPP) system and examine a number of interesting subtle questions such as whether it's better to have fully random equally probable passwords or true one-time-only passwords; and how, whether, and why attack strategies affect that decision. 26 MB 6.5 MB 2.3 KB 67 KB 41 KB 94 KB

Listener Feedback #27 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 23 MB 5.7 MB 2.1 KB 73 KB 41 KB 96 KB

Perfect Paper Passwords During this week's second half of our discussion of GRC's new secure roaming authentication system, I reveal and fully describe the unique, simple, clean, and super-secure one-time password solution I designed to provide roaming authentication for GRC's employees. I also describe our own freely available software implementation of the "PPP" system, as well as several other recently created open source implementations. 40 MB 10 MB 2.0 KB 122 KB 68 KB 121 KB

Listener Feedback #26 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 46 MB 11 MB 4.1 KB 138 KB 83 KB 132 KB

Roaming Authentication In this first of a two-part series, Leo and I discuss my recent design of a secure roaming authentication solution for GRC's employees. I begin to describe the lightweight super-secure system I designed where even an attacker with "perfect knowledge" of an employee's logon will be unable to gain access to protected resources. 27 MB 6.7 MB 2.1 KB 73 KB 42 KB 96 KB

Listener Feedback #25 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 31 MB 7.8 MB 2.1 KB 93 KB 55 KB 108 KB

OpenID Precautions Having several times addressed the value and potential of the open source, open spec., and popular OpenID system, which is rapidly gaining traction as a convenient means for providing "single sign-on" identification on the Internet, this week Leo and I examine problems and concerns, both with OpenID and those inherent in any centralized identity management solution. 20 MB 5.0 MB 2.8 KB 51 KB 32 KB 86 KB

Listener Feedback #24 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 46 MB 11 MB 2.6 KB 161 KB 85 KB 138 KB

GRC's eCommerce System Leo and I delve into some of the non-obvious problems encountered during the creation of a robust and secure eCommerce system. I explain the hurdles I faced, the things that initially tripped me up, and the solutions I found when I was creating GRC's custom eCommerce system. 46 MB 11.4 MB 2.6 KB 128 KB 77 KB 127 KB

Listener Feedback #23 Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 39 MB 9.7 MB 2.1 KB 115 KB 66 KB 127 KB

PIP & Even More Perfect Passwords Leo and I discuss two topics this week: The availability and operation of VeriSign Labs' OpenID PIP (Personal Identity Provider) beta, offering many useful features for online identity authentication; and my recent redesign of the algorithms behind GRC's popular Perfect Passwords page. 26 MB 6.4 MB 4.5 KB 69 KB 41 KB 101 KB

Listener Mailbag #2 Leo and I open the Security Now mailbag to share and discuss the thoughts, comments, and observations of other Security Now listeners. 31 MB 7.8 MB 2.1 KB 95 KB 60 KB 120 KB

Firewall LeakTesting Leo and I discuss the history, purpose, and value of personal firewall leaktesting. We examine the myriad techniques clever developers have found for accessing the Internet and sending data out of PCs even when those PCs are being protected by outbound-blocking personal firewalls. 30 MB 7.6 MB 3.1 KB 74 KB 49 KB 100 KB

Listener Feedback Q&A #22 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 34 MB 8.5 MB 2.1 KB 114 KB 65 KB 126 KB

PayPal Security Key Leo and I talk with Michael Vergara, PayPal's Director of Account Protections, to learn everything they can about the PayPal security key effort and its probable future. 25 MB 6.3 MB 2.1 KB 85 KB 49 KB 113 KB

Listener Mailbag #1 Leo and I open the Security Now mailbag to share and discuss the thoughts, comments, and observations of other Security Now listeners. 38 MB 9.4 MB 3.2 KB 119 KB 68 KB 129 KB

Are You Human? Leo and I explore the Internet's rapidly growing need to automatically differentiate human from non-human automated clients. We discuss the advantages and limitations of many past and current approaches to this problem while paying close attention to the most commonly used visual 'CAPTCHA' solutions. 40 MB 10 MB 4.8 KB 112 KB 67 KB 127 KB

Listener Feedback Q&A #21 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 31 MB 7.8 MB 2.1 KB 92 KB 57 KB 118 KB

Trusted Platform Module (TPM) Leo and I explain the virtues and misbegotten negative reputation of the entirely benign and extremely useful emergent crypto facility known as the "Trusted Platform Module." 25 MB 6.4 MB 2.1 KB 74 KB 43 KB 104 KB

Internet Identity Metasystems Leo and I discuss the user experience and operation of Microsoft's "CardSpace" technology which hopes to completely change the way users identify themselves on the Internet by doing away with traditional usernames and passwords. 24 MB 6 MB 2.1 KB 65 KB 37 KB 97 KB

Operation: Bot Roast Leo and I discuss the recent news of the FBI's announced crackdown and pursuit of 'bot-herders' who individually control networks of remote control DoS and Spam zombies numbering in the many tens of thousands. 22 MB 5.7 MB 2.1 KB 53 KB 34 KB 92 KB

Listener Feedback Q&A #20 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 36 MB 9.3 MB 2.1 KB 116 KB 69 KB 131 KB

OpenID Leo and I examine the open, platform agnostic, license free, OpenID secure Internet identity authentication system which is rapidly gaining traction within the Internet community. It may well be the "single sign-on" solution that will simplify and secure our use of the world wide web. 25 MB 6.3 MB 3.4 KB 63 KB 41 KB 101 KB

The Fourth Factor Having discussed the first three "factors" in multifactor authentication (something you know, something you have, something you are), Leo and I explore aspects of the power and problems with the fourth factor, "someone you know." 26 MB 6.6 MB 2.5 KB 63 KB 37 KB 98 KB

Microsoft Patent Wars Leo and I tackle the past, present and future of software patents. Our discussion of this non-security topic was triggered by Microsoft's recent declaration that since free and open source software (FOSS) was infringing at least 235 of their software patents, someone ought to be paying them. 35 MB 8.9 MB 2.1 KB 94 KB 57 KB 117 KB

Listener Feedback Q&A #19 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 30 MB 7.5 MB 2.1 KB 94 KB 55 KB 116 KB

Marc Maiffret   (pronounced "may-fray") Leo and I talk with Marc Maiffret, co-founder of eEye Digital Security of Aliso Viejo, California. eEye has perhaps done more forensic and vulnerability testing research to increase the remote security of Windows than any other group, including Microsoft. They continue to find and report an amazing number of Windows security vulnerabilities. 39 MB 9.9 MB 2.1 KB 105 KB 78 KB 134 KB

Multifactor Authentication Leo and I discuss the theory and practice of multifactor authentication which uses combinations of "something you know," "something you have," and "something you are" to provide stronger remote authentication than traditional, unreliable single-factor username and password authentication. 30 MB 7.5 MB 2.1 KB 89 KB 51 KB 112 KB

Even More Badly Broken WEP Leo and I review the operation of wireless network security and discuss in detail the operation of the latest attack on the increasingly insecure WEP encryption system. This new technique allows any WEP-protected WiFi network's secret cryptographic key to be discovered in less than 60 seconds. 22 MB 5.6 MB 2.6 KB 62 KB 36 KB 97 KB

Listener Feedback Q&A #18 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 27 MB 6.8 MB 2.1 KB 77 KB 50 KB 110 KB

SQL Injection Exploits Leo and I wrap up our three-part series on web-based code injection vulnerabilities and exploitation with a discussion web-based structured query language (SQL) database attacks. We explain why and how SQL injection vulnerabilities are creating an ongoing plague of vulnerabilities besetting modern 'Web 2.0' applications. 22 MB 5.6 MB 3.4 KB 58 KB 36 KB 96 KB

Cross-Site Scripting In this second installment of our three-part coverage of web-based remote code injection, Leo and I discuss cross-site scripting vulnerabilities and exploits. I quickly read through the 28 vulnerabilities discovered in popular software just during the previous month and discusses the nature of the threat and challenge facing authors of modern 'dynamic' web sites and services. 30 MB 7.5 MB 3.1 KB 81 KB 55 KB 116 KB

Intro to Web Code Injection Leo and I begin a three-episode series to discuss and examine web-based remote code injection exploits. Commonly known as 'Cross-Site Scripting' and 'SQL Injection,' these exploits are growing in popularity and strength as hackers discover increasingly clever ways to exploit subtle defects in next-generation web-based applications. 26 MB 6.6 MB 2.4 KB 73 KB 47 KB 108 KB

Listener Feedback Q&A #17 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 30 MB 7.6 MB 2.1 KB 107 KB 63 KB 126 KB

UAC in Depth Leo and I wrap up our quest to get Windows Wi-Fi to 'Maintain Full Radio Silence' by adding one additional important tweak to Windows settings. Then we discuss the detailed security implications, now and in the future, of Vista's new and powerful user account control (UAC) system. 24 MB 6.1 MB 3.4 KB 81 KB 43 KB 101 KB

Cyber Warfare Leo and I discuss the interesting topic of state-sponsored Cyber Warfare. While born through the imagination of science fiction writers, the reality of international, inter-nation cyber combat is fiction no longer. 22 MB 5.5 MB 3.3 KB 61 KB 41 KB 101 KB

Hard Drive Unreliability Leo and I discuss the distressing results and implications of two recent very large population studies (more than 100,000 drives each) of hard drive field failures. Google and Carnegie Mellon University (CMU) both conducted and submitted studies for the recent 5th USENIX conference on File and Storage Technologies. 27 MB 6.6 MB 4.3 KB 86 KB 51 KB 110 KB

Listener Feedback Q&A #16 Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 36 MB 9.1 MB 2.7 KB 124 KB 75 KB 140 KB

Backtracking Spoofed Spam eMail Leo's 'TWiT.tv' and my 'GRC.com' domains are used by spambots which spoof their domains as the source of bogus eMail. This week they discuss the details of eMail "Received:" headers and explain how the examination of those headers can penetrate any spoofing to reveal the true originating IP of any spoofed spam eMail. 30 MB 7.5 MB 2.2 KB 87 KB 53 KB 113 KB

DEP in Depth With our new SecurAble freeware now launched, Leo and I discuss the full impact and importance of hardware DEP technology. I explain why I believe that hardware DEP is the single most important Internet-related security technology developed so far. 20 MB 5.0 MB 2.1 KB 53 KB 35 KB 95 KB

Microsoft on Vista DRM In episode #74 Peter Gutmann shared his concerns and fears about the system-wide consequences and impact of the digital rights management (DRM) Microsoft has built deeply into Vista. Microsoft's Vista Team responded with a comprehensive Blog posting which Leo and I read and examine this week. Here is the blog posting we used as our source: Windows Vista Content Protection - Twenty Questions (and Answers) 30 MB 7.5 MB 2.2 KB 100 KB 59 KB 120 KB

Listener Feedback Q&A #15 Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed. 30 MB 7.5 MB 2.1 KB 98 KB 59 KB 122 KB

Vista DRM Wrap-Up & Announcing “SecurAble” Following last week's guest appearance by Peter Gutmann, Leo and I wrap up the topic of Vista's new, deep, and pervasive Digital Rights Management (DRM) system. I also announce the completion and availability of GRC's latest freeware: “SecurAble.” Click this link for Securable's web page. 24 MB 6.1 MB 2.0 KB 81 KB 44 KB 106 KB

Peter Gutmann on Vista DRM Peter Gutmann, the author of the highly controversial white paper detailing the significant cost of Windows Vista's deeply-entrenched digital rights management (DRM) technology, joins Leo and me this week to discuss his paper and his findings. 24 MB 6.1 MB 2.3 KB 72 KB 50 KB 110 KB

Digital Rights Management (DRM) In preparation for next week's look at how and why Windows Vista has incorporated the most pervasive and invasive system for digital rights management ever created, AACS, Leo and I first take a step back to survey the history and evolution of media property rights and the technologies used to enforce them. 32 MB 8.0 MB 2.1 KB 79 KB 54 KB 113 KB

• Current Podcast Page
• Security Now 2023
• Security Now 2022
• Security Now 2021
• Security Now 2020
• Security Now 2019
• Security Now 2018
• Security Now 2017
• Security Now 2016
• Security Now 2015
• Security Now 2014
• Security Now 2013
• Security Now 2012
• Security Now 2011
• Security Now 2010
• Security Now 2009
• Security Now 2008
• Security Now 2007
• Security Now 2006
• Security Now 2005

You can receive an eMail reminder whenever this page is updated with a new Security Now! episode. Click the "Monitor Changes" button to have the highly-regarded "Change Detection" web site monitor this page and send you a note when it changes. Monitor this page for changes:  (it's private by ChangeDetection) Security Now!, SpinRite Testimonials, and other Feedback: Please use GRC's Visitor & Listener FEEDBACK Page where you may easily submit any feedback for Security Now, SpinRite testimonials, suggestions for future Security Now topics or questions & comments for future Listener Feedback episodes. Thank you! https://www.grc.com/feedback

Gibson Research Corporation is owned and operated by Steve Gibson.  The contents of this page are Copyright (c) 2024 Gibson Research Corporation. SpinRite, ShieldsUP, NanoProbe, and any other indicated trademarks are registered trademarks of Gibson Research Corporation, Laguna Hills, CA, USA. GRC's web and customer privacy policy.