And before we go into off the hook, again, a reminder, once again, please consider becoming a financial supporter to this radio station by calling 212-209-2950.
January 8th marked 63 years of WBAI being part of the Pacifica Radio Network and giving you that you Pacifica perspective in the NYC area.
And beyond by going to WBAI.org.
We would like to continue with that, but it can only happen with help from listeners.
212-209-2950 or go to give to WBAI.org online.
Now stay tuned for off the hook coming up.
You have not entered a valid code. Please hang up and dial again. 078-T.
Thank you for listening to off the hook.
Telephone keeps ringing. So I ripped it off the wall.
I cut myself while shaving. Now I can't make a call.
It couldn't get much worse.
But if they could, they would.
Bum-diddly-bum for the best, expect the worst.
I hope that's understood.
Bum-diddly-bum.
Bum-diddly-bum.
And a very good evening to our program is off the hook.
Emmanuel Messina with you on this.
Delightful Wednesday evening.
And I'm joined tonight by Kyle.
Yeah, I'm over here.
And we have Rob T. Firefly.
Good evening.
And we have Alex over in Skype land.
Good evening.
And special guest rejoining us after a period of, I think, 14 years is Arseny.
Arseny, you there?
Hey.
How are you doing? Welcome back.
Last show you did with us was in 2008.
How did you find that out?
I looked it up.
Well, the Internet is a treasure trove of information.
And that was the last show that we saw you on.
Unless you called in or just dropped in casually.
But you've been living in a rather interesting place over the past decade or so.
You want to tell us anything about it?
Yeah, yeah.
I've been living in Russia.
I had to relocate recently.
But, yeah, I mean, it's kind of moved there after been living there for five years more or less.
I have a company that used to have operations in Russia.
So I spent a lot of time there.
And I work in we make mobile games.
So I'm still in tech.
But, I mean, like I guess listeners might be interested like what's going on there.
Yeah, we hear other things are happening over there as well.
Let me just say I'm so happy that you're out of there.
I was talking to you for a while.
You were still there.
I was very worried that things might get even more tense.
But it's good to have you back over here, at least for now.
Yes, I'm now in New Jersey, a really nice place.
But, yeah, I mean, you know, being there, I'm ethnically Russian.
So for me it's like, you know, a second home.
But, I mean, like, you know, this isn't a political show.
This is more about tech.
And I think like the two main things that are really different
and maybe something that I had to get used to being outside of Russia
is like the banking system there is really nice in terms, you know,
from a consumer point of view, you know, which is weird because, you know,
Russia is like ex-communist, you know, they don't have banks.
You know, you can send money just to phone numbers.
So everyone is very used to having the ability to do electronic funds transfer,
you know, for as little as, you know, pennies.
And then you get here and then what is it?
Zelle or whatever the other one is.
And then you have to write what the money is for?
What?
Yeah, I don't know if they check.
But it is something that's a little bit different over here.
It's very different.
But I guess what I'm getting at is it's kind of a mindset difference
where if you are thinking, hey, you know, I don't even need to carry cash around.
But I think the more interesting one, many more relevant one that, you know,
I can bring up is like this right to repair.
And it's like in the U.S. or, you know, in normal countries, Western Europe,
it's like this whole thing.
You buy something and you can't get original parts to fix it yourself.
And that's just so ridiculous.
And I can't believe that, you know, we have to talk about this.
And kind of in Russia, the mindset was always like if this is my thing,
you know, I shouldn't buy a new one.
I'll just fix it.
I'll fix the one that, you know, whatever isn't working.
And that goes, you know, outside of goes to clothing, cars, whatever.
But there was always, you know, we have a game company, a lot of employees,
and like we work on some sophisticated equipment.
And it's like I can just bring that to some guy and he'll fix, you know,
these drawing tablets that I don't know what parts are in them.
But he fixes, you know, they were fixed without original parts.
Maybe with original parts.
I don't know.
But it's like it's, again, it's a different approach to the problem.
It's like, well, like, you know, original parts, whatever.
And then it kind of like after around the time when I was off the hook, you know,
I was into the maker space scene and stuff.
And, like, there's no hack spaces and make spaces in Russia because, like,
everyone has one in their house basically.
It's like a given.
And that's kind of like that's a different point of view.
I thought that was very interesting and I'm looking forward to when things get
back to normal so I can spend some more time there.
Me too.
You know, I would like to get back in touch with people over there.
But, you know, there's a way to go.
But that's fascinating about right to repair.
I know, you know, when I went to Cuba, obviously,
you can't get parts there for different reasons.
And people fixed their cars using all kinds of material that was just lying
around.
And these are cars from the 50s and the 40s.
So they're able to do that.
With today's modern cars, of course,
that's pretty much been rendered impossible because if you don't have the
computer codes, you're up a creek.
But it's interesting to think about it along those terms.
Alex, Rob, did you have anything to add?
No?
Okay.
I do.
Well, you got to answer in less than ten seconds.
Kyle first and then Alex.
I was just wondering do older items tend to last or stay around longer as a
result of the repairing going on?
Yeah, yeah, yeah.
I think it's like you, I mean,
the striking thing was like people wouldn't replace things frequently.
And like, of course, you know, you want the new fancy TV,
but there's all these other things in your life that there'll be a guy who
fix it.
They even have sneaker or like shoe cleaning places.
And like, you know, if you're into sneaker culture,
it's nice to clean your sneakers.
But like there's a,
there's like a handful of sneaker cleaning places around where I'm living.
It's very interesting kind of different mindset that I,
that I think is just internationally welcomed.
Yeah.
That's a great spirit just to, you know,
keep waste out of keep the life cycle extending instead of creating more
waste in the, the, the life cycle of stuff.
Do they clean the sneakers while you wait or do you have to come back?
Well, no, you know, Russia's not perfect.
So I remember I get my sneakers in and came back,
they messed up the order and they're just like, Oh, here you go.
You don't have to pay.
Okay.
How'd they mess it up?
What'd they do?
He forgot.
I never paid.
Wow.
Cause it's so easy.
You like, you just send the, send the guy on his phone number.
I think.
Oh, wow.
That's an organized chaos.
Yeah.
Alex, go ahead.
I didn't expect to be talking about shoes tonight,
but I do see that how the lack of cobblers, especially in Manhattan,
I mean, there's,
they're almost non-existent could be some kind of cultural bellwether with
respect to the right to repair or,
or give you some kind of idea about cultures or rather the relevance of
repairing items and the significance of,
of how throw or just sort of disposable items are to a culture.
Because I'll tell you, I mean,
there used to be a cobbler right near my apartment in Manhattan and it's,
it's been gone for over 10 years now.
And I was very hard to find someplace that will fix a shoe or, you know,
mend your leather or something.
So I can see how that's just a different mentality.
But anyhow,
I think you and I might've been in touch like 10 years ago or something.
I haven't.
But where have you been in Russia?
Like, no.
So where, where exactly were you?
Yeah.
Yeah.
So I was,
I've been in St.
Petersburg and for folks unfamiliar.
So Russia has a couple of major cities,
but Moscow is very,
very big and St.
Petersburg is the second biggest.
And then there's some other countries,
some other cities,
I don't know.
But St.
Petersburg is very European looking.
It has a big Swedish background and it's,
it's perfect to have a creative or used to be perfect to have a creative
company.
It has a lot of artists,
a lot of universities for,
for art and tech as well.
Good spot.
I don't know how I know you,
Alex,
did I ever get in jail?
Did I ever go to prison?
You had to help me out.
I think you might've actually helped me out.
You might've helped me out with something like 10 years ago,
where I needed some connections in Russia for an investigation.
I'm almost positive.
It was you.
This is something,
but yeah,
St.
Petersburg is absolutely awesome.
All right,
let's put a stop to that right now,
because we don't know what you're saying.
I want to welcome Gila who has arrived courtesy of the New York city subway
system,
which I believe was,
was holding her for a while.
And just for her,
her edification,
we are joined tonight by arsony,
former cohost of off the hook from at least 14 years ago.
So welcome.
I guess this is the show where nobody talks.
Okay.
Well,
I have a story here,
which I thought was kind of interesting about,
about Twitter.
You might've heard about this.
There's a bit of a problem,
another problem with users having a lot of their data compromised.
Twitter put out an interesting notice today.
I don't know if you folks saw this,
but it was actually in the form of a tweet.
And that led you to a webpage that was entitled update about Twitter.
Incident alleged incident regarding Twitter user data being sold online.
I don't think it's alleged.
I think that is really happening.
They say we take our responsibility to protect your privacy very seriously
in response to recent media reports of Twitter users,
data being sold online.
We conducted a thorough investigation and there was no evidence that data
recently being sold was obtained by exploiting a vulnerability of Twitter
systems.
And then as a,
a section right after that called what happened,
I'm going to read you the very beginning of that.
As we previously informed users in August,
2022 in January of 2022,
we received a report through our bug bounty program of a vulnerability in
Twitter's systems.
As a result of the vulnerability,
if someone submitted an email address or phone number to Twitter systems,
Twitter systems would tell the person what Twitter account they submitted
email addresses or phone number was associated with.
If any,
this bug resulted from an update to our code in June of 2021.
When we learned about this,
we immediately investigated and fixed it.
I go back to the statement they made today saying that there is no evidence
that any of this was obtained by exploiting a vulnerability of Twitter
systems.
And in the very next paragraph,
they say this happened through a vulnerability in Twitter's systems.
What am I missing here?
They're contradicting each other in their own press statement.
And anyone have any thoughts on this?
Yeah,
it just,
it just seems like they're not quite sure what's going on.
And that seems consistent with what we know about the state of their
workforce at the moment where they've still,
I don't,
I don't think they've come back from when they laid off a bunch of their
staff kind of haphazardly and in ways that are engendering all sorts of
responses and possible legal action against Twitter.
So,
yeah,
we don't know who's there to check on these things or maintain these things.
And it's,
it's all a bit of a mystery and it seems it's a mystery even to them.
But this is simple proofreading.
It's just,
it's simply looking at what you're saying and then looking at what you're
saying in the next paragraph and seeing if you're saying the opposite in that
second paragraph.
Now I don't have the number in front of me,
but it was in the hundreds of millions,
I believe of users that had their private information
compromised and currently being sold somewhere.
Is that,
does that seem about right?
Does anybody have the,
the actual number?
I don't have the number in front of me,
but just to put out there,
you can check to see if you're in this latest data set of leaked data by
going to have I been poned.com.
That's have I been P W N E D.com.
And put in your email address that you use with your Twitter account and
you'll see what happens.
I think the vast majority of the people that I've asked who use Twitter,
including myself,
including Gila,
who's just arrived.
We,
we all,
we all are in that data set.
I'm saying over 400 million instances of of user data being compromised,
supposedly.
So just check that I'm in it.
I'm also in some weird Russian database.
I'm sure you're in a lot of weird databases.
Twitter,
200 million,
2023.
Yeah.
Wow.
That's a lot.
That's a big deal.
And you know,
the thing is though,
it's,
it's,
it's,
you know,
social media.
I wouldn't really give information on there that I wouldn't expect to be
compromised.
At some point.
The thing that worries me,
a lot of people rely on Twitter for private communications.
I've,
I've had activists,
you know,
openly communicate through DM on Twitter,
and it just doesn't seem safe.
And this is the kind of thing that can easily be compromised.
And,
and you could have all sorts of information you don't want to get out
revealed.
I'll also add to that.
And I think,
you know,
one of the things that we talked about time and time again on this show is
that Twitter is a social media platform,
but it has been used for,
you know,
everything from the dissemination of legitimate news to interactions
between nuclear powers.
You know,
I mean,
you have negotiations and talks happening between world powers on Twitter.
And so a lot of these politicians and a lot of people who may be in the
diplomatic services also rely on Twitter for private communications.
And I've seen in,
in my research and many investigations,
I've seen really,
really sophisticated targeting of Twitter accounts for,
for breaches and compromise because people want to get into those DMS.
So,
you know,
this makes it easier.
And,
and on the other hand,
we also get so desensitized to all of these data breaches and the large
numbers that we see associated with them.
But we forget that for every one of these breaches,
there's already a preexisting massive amount of data that has been
exfiltrated,
excuse me,
from other companies.
And when you combine all of these data sets together,
you can begin to piece and weave together a mosaic about somebody's life,
perhaps,
if that's what you're looking for.
And all of this breach data,
all of this exfiltrated data,
once you combine it,
you add it to,
I mean,
I don't want to use too many buzzwords,
but you know,
now we're,
we're in this age of artificial intelligence and machine learning and data
mining is becoming easier and easier and easier.
So,
you know,
once you,
once you have all of this data out there,
you know,
you can never put it back.
It's very,
very difficult for an individual then to reclaim control over these types of
data sets or have an additional measure of control over,
you know,
what he deems to be the private details of their life.
You have all these,
this legislation that comes coming out,
you know,
in California of the California Consumer Protection Act,
all these different state laws that are designed to protect the privacy of
individuals,
but there's no reining this back in once the data is out there.
It's a,
it's a problem that's going to exist forever.
Very true.
And we're in control of how much data we put out there about ourselves.
We're in control about whether or not we give them actual phone numbers,
actual addresses,
actual political affiliations.
You can lie.
It's okay.
You can lie on social media.
You can lie to strangers.
It's,
it's,
um,
we don't have to make our lives an open book.
And I,
I,
I fear so many people have done that just assuming that they can extend the
same level of trust to the entire world that they do to their own close circle
of friends.
The world doesn't work that way.
Yes,
Rob.
But even in terms of that,
though,
like this breach,
uh,
it seems it consists of,
uh,
excuse me.
It consists of the public information you put out there on your social media
by choice.
The one main piece of information that's non-public that can be attached to
that with this latest breach is your email address.
It's the email address you use with your Twitter account.
And that's not normally published online by Twitter.
So,
uh,
those,
those people who don't want their email addresses out there want to be left
alone.
Um,
they're the ones that are going to be hit by this latest breach.
Well,
let's think of a way to defend ourselves against that in the future.
Can we have,
uh,
perhaps a system that forwards email,
uh,
to a different address.
You give,
uh,
Twitter,
um,
a,
a,
a dispensable address that forwards to where you really are.
And that way you can reply,
uh,
or you can,
you can,
um,
enter the code that they send you and they don't actually have your real
email address.
Does that,
does that seem something,
um,
that we could,
um,
feasibly do?
That,
that's something I do in fact.
Uh,
but,
um,
my,
identity theft at that point.
So, it is possible for you to have very secure passwords
if you just engage in a few tricks,
like say, use the first letter of a sentence
that is rather long, but you remember it word for word,
and every first letter is a part of the password.
And you can basically change the case,
you can be lowercase at the beginning or at the end.
You can do things that only you would remember,
and you can apply this for many passwords
without having to write things down
or worry about not remembering it.
They're little tricks, all sorts of little tricks.
It doesn't involve giving everything away
to some trusted entity that turns out to make a big mistake
and bring you down with them.
Folks, any thoughts on this?
Yeah, any time you add another entity
between you and your stuff, that's another point of failure.
That's just very basic security concepts right there.
So, yeah, if there's something else you depend on
and something else you have to give your information to,
that's something else that can go wrong.
I just want to mainly to remind myself,
because I catch myself, the temptation to reuse.
Don't reuse passwords.
Don't use it in any other place
than the one place where you use it.
Just don't.
I know it's tempting, I've been there too,
and you think, oh, I'll never really use this system,
I'm just testing this out, I'll use the one I always use.
Don't do it.
Make a different one.
If that's not a system someone has access to,
okay, maybe you write it on something
just because it's temporary and you're testing something.
But then throw the tape away when you're done,
if you tape something to it.
But don't reuse it, just always use different ones.
Here's my trick, and I'm going to reveal
actual passwords I use, and I feel secure doing this
because I'm not telling you what I'm using them for.
But I use a password, and this is kind of clever,
the password is password, because it's a password
and no one would ever think
that I actually use the word password.
P-A-S-S-W-O-R-D, you know, regular,
but then for the next system I use,
I replace the A with an at sign,
so it's P, at sign, S-S-W-O-R-D.
And basically I just go down the keyboard
for every single system I use,
and I have different passwords.
All different passwords for, what?
You're looking at me disapprovingly, Kyle,
is that not a good system?
I would put the caveat, don't do derivations,
you know, variations on the theme of a password.
Like, if you use a phrase like, I hate typing passwords,
don't use, I kinda hate typing passwords necessarily
for, you know, a system, a related system,
or something adjacent, or, you know,
that someone would say, hmm, maybe it's the same one
as this, or maybe it's, you know, some variation,
or they're using, you know, rainbow tables,
and it comes up, I don't know.
But you should try to keep them either very unintelligible
or a phrase that's never used,
or a combination of a lot of weird stuff and phrases.
Whatever you can do, just do what's comfortable for you,
and keep it different.
Gila.
Hi.
Welcome.
I'm sorry I was late.
I want to thank the MTA for that.
But, so I have a password tip that I got
from someone years ago,
who used one of their childhood phone numbers,
but replaced some of the numbers with the letters
that you'd find on the keypad.
And he said the only people who were gonna be able
to guess that password were his siblings,
and he was pretty okay with that.
But, so there you go, there's a tip.
Until the siblings go, you know, dark,
and wind up working against you, you know.
So true, so then don't tell your siblings
that you've done that.
But, the other thought that I had though,
going back to LastPass for a second,
thinking about identity theft,
and thinking about people who have LastPass accounts
that may still be active,
but don't have the ability to get in there
and change their stuff.
You know, not to bring everybody down,
but my late father had a LastPass account.
He had a lot of stuff in there.
And what's going to come from that is, I'm curious.
You know, we hadn't ever downloaded his Twitter stuff,
so his Twitter account is still active.
There are things that we deactivated after he passed away,
but there's stuff that we just didn't think about.
So I'm really curious how that,
like, I'm actually now terrified
of what could happen to that.
So sorry, that's where my mind went
when you started talking about LastPass.
Well, I mean, this is going to become
more and more of an issue with all of us
in the coming years,
and things that these companies
probably have never thought of.
Yeah, yeah, I've thought of this too.
I had, let's say, a relative or family friend
that had an email account that was compromised.
And I immediately thought of the other people
related to them, because they may have gotten past it.
Like, oh, it's, you know, no big deal.
I just made another account and they moved on.
But I think it's good, you know,
some of us maybe with a mind for it
can maybe help them understand that this actually,
you know, whatever information was in there
could still be used in some way.
It's not over just because you made a new account
and you've accepted that you lost access
or that someone gained access
to all of those correspondence.
You need to continue to be vigilant
for people exploiting what information was there.
And if it's, you know, correspondence with,
you know, whatever it is, bills or personal finance,
all that stuff, intimate, you know, letters,
regarding family wellbeing and so forth, you know,
all of that, it's very personal stuff
that people have in these webmail accounts.
And it's just good to remember, you know,
that you should try to remember what was lost
and how it might be used if it is in the future.
All right, well, speaking of things that seem obvious,
we have to learn hard mistakes anyway.
I don't know if everybody's been focused on this.
I don't know if we talked about it on the show,
but California has, for some reason,
decided it's a good idea to digitize license plates.
In fact, I'm looking at a Gizmodo story right now
where they basically describe it this way.
The past several years, California has been
on a weird mission to digitize its car tags.
Advocates claim this modernization effort
will offer a host of benefits to drivers,
really, including visual personalization
and easy in-app registration renewal,
because, yeah, that's really what we need.
But we all know, if you're gonna do something like that,
it's gonna get hacked.
It's going to get hacked, and it did.
It did.
There's a story that just came out.
Security researchers have hacked digital license plates.
Yeah, only a few months after the California legislature
passed a law to legalize these digital plates,
that is exactly what happened.
In a blog post published last week,
bug hunter Sam Curry noted that he and his friends
had recently managed to attain
full super-administrative access
to all of the user accounts
linked to the company called Reviver.
They're responsible for selling
California's modernized plates.
Reviver sells a thing called the R-Plate, or a SmartPlate.
Why isn't it called the S-Plate, then?
R-Plate, okay.
Basically, it's a battery-powered digital display
that gets affixed to a vehicle's rear
and then projects the car's information.
Battery-powered?
What happens when the battery runs out?
That seems so dumb.
How is this different from a license plate?
I'm looking at, it's literally a screen
that has a license plate.
What's wrong with license plates?
That's so simple.
I'm surprised they didn't make it machine-readable,
like just a barcode so no one can read plates.
So, the plate, and I'll get to barcodes in a second.
The plate allows users to share different graphics
and words on the plate,
because that's been always the complaint,
that you can't do that.
It also comes with an app that includes
car monitoring and safety features.
Safety features for a license plate?
I don't know what that's, that's code for something else.
The going rate for one of these things,
also available in Arizona and Michigan,
because why not, only 20 bucks a month.
Yeah, 20 bucks a month, so now you get to pay 120,
no wait, you get to pay, why can't I do math anymore?
Over $240 a year.
That's a lot.
Just to have a license plate.
Yeah, unfortunately, Reviver's pricey high-tech solution
also comes with some high-tech problems.
Curry and his friends investigated the Reviver app
and website, discovering a vulnerability
that allowed them to gain full administrative access
to all user accounts and vehicles
for all Reviver-connected vehicles.
So, not just hacking into one license plate,
hacking into all of them.
Now, what could they do with this access?
Among other things, they found they had the power
to track the GPS locations of every single registered user,
manipulate data on users' plates,
i.e. send a message to the cop behind you,
and even, oh my, the mind boggles,
even report specific vehicles as stolen,
because they have this thing.
If you look at the graphic of this article,
above the license plate number, it says stolen,
that's the name of the car dealership
that you bought the car at.
It's, I guess, the equivalent of mobile swatting.
You basically have all these cops to pull you over
because your car is advertising that it's stolen.
I can go on with all the things that they could do,
all the mayhem they could wreak, but it's stupidity.
Buying into something like this,
fixing a problem that isn't there.
Is anyone surprised that this happened?
I'm surprised it happened so quickly,
but I think we all knew it was coming.
Go ahead, Rob.
Not only is this fixing a problem that isn't there,
but it's causing so many more problems.
I mean, if you think about where the license plates
are in a vehicle, and you're driving around,
things are flying around on the ground, on the road.
Little bits of things are always getting flung at cars
and chipping paint and stuff,
and now you have an expensive electronic screen there
instead of a plate made of metal
that can take a few scratches.
This is amazing.
I'm looking at the picture of this thing on Gizmodo,
and yeah, it also seems like there are really no upsides
to this that do the job better
than a plain piece of metal license plate.
Yeah, this seems like California being a victim
of its own success with tech and innovation.
They just wanna keep on the cutting edge
to kind of validate their own importance,
even if it's a flop.
Okay, I think I figured out
why anyone would want this thing, though.
Yeah, tell us.
So, because I'm looking at someone tore it apart,
so it's an E-ing screen, so that's kind of cool.
But basically, the example here is like,
if you're in a parking garage,
you don't need to put the paper thing on your dashboard
because your license plate will say that it paid.
Wow, the time that would save in my life.
That's a no-brainer.
But if it has a GPS that knows where the car is,
like, that's wonky.
Yeah, because it's not just the car,
it's you, because you're in the car.
It's a tracking device that will always know where you are.
Yeah, like you're giving the Department of Motor Vehicles
their own kind of GPS tracker, like LoJack,
but it's basically for their purposes,
so your speed, anything GPS can tell you.
Arsene, I have to ask,
what is motor vehicles like in Russia?
It must be a different level.
Oh, well, listen, I just never had the opportunity
to buy a license, but my friends all went
through that process, and what else?
Oh, here's an interesting one.
You can be pulled over by a police officer in a taxi
and can be fully searched, and that's very scary.
You mean the passenger can get pulled over somehow?
Well, I mean, the taxi gets pulled over,
and you can be fully, you can be searched.
The passenger can be searched.
You know, great way to find guns and drugs,
but, like, I don't, what, you know,
there's no reasonable, there's no reason for that.
And that's off, that's spooky.
But, yeah, I mean, you know, seatbelts not required
in the cars, I think.
I've been in several cars that don't have
seatbelts in the front.
Wow, I mean, we used to do that.
Fell out of favor.
Maybe it's those same cars.
Yeah, I mean, there are people who say
that's an overreach of the government to require this,
but, yeah, that's an argument I don't wanna get into.
Rob, go ahead.
Yeah, just thinking about these digital license plates,
I mean, there are things that the plain license plates
have enough of a problem doing.
I don't know if you've seen the stories
that have been going around lately
about people taping things to their license plates,
like sticking a piece of plastic or a leaf or something
so their license plates can't get picked up
by the scanners at things like toll gates
so that they can get through without paying.
And that's kind of an epidemic in this city.
They can't stop people from doing that,
but they're going to instead introduce things like this
that you could do all sorts of other shenanigans with.
I mean, that would be fun.
Change your license plate to someone else's license plate
and they can pay all your tolls for you.
I just thought, as you said that,
what about everybody has the same license plates,
like Spartacus license plate?
Oh, wow, Spartacus, that's a great license plate.
Everybody is racking it up on one plate.
Oh, it's one letter too much in New York.
You can only have eight characters.
Good idea, though, good idea.
I said I was gonna get to barcodes.
Actually, it's QR codes.
The city of Melbourne in Australia
has this system where they're fighting graffiti, okay?
And they're fighting graffiti
by putting up these QR codes everywhere.
And it says, scan to report graffiti and street waste.
And people are supposed to use their phones and scan,
and I guess it tells them the location of where they are
and they go out and they clean up the graffiti.
Well, it turns out somebody is replacing
all the QR codes with another QR code.
And those QR codes forward to a documentary
about hip hop culture on YouTube.
And that documentary explores graffiti
as part of hip hop culture, it's ingenious.
It really has saddened the Melbourne Lord Mayor, Sally Capp.
It couldn't just be a mayor, it'd have to be a Lord Mayor.
Okay, Sally Capp said it was not yet known
how many of the QR codes had been vandalized.
Is that the right word, vandalized,
or just simply replaced or modified or...
But they believed it was still small in number.
The hacking of the QR codes is so frustrating,
Lord Mayor said.
I think it gives people some insight
into what we're dealing with these vandals,
with taggers and with graffiti across our city.
The brilliance of this is though,
how do you know which QR code it is?
They look the same.
You have to actually scan it yourself
and probably is an advantage to the people on the other end
if you go to their site over and over again.
The city of Melbourne is investigating
how many of the QR codes have been affected
and is assessing whether an alternative
will be needed in the future.
Our team is replacing the QR codes
where we've become aware they've been patched over.
They really go into detail about this.
The Lord Mayor said the city of Melbourne
had initiated discussions with Victoria Police
and would draw on CCTV footage
to see how we can catch these culprits.
The QR codes have been instrumental
in helping us be more responsive to cleaning the city.
We've cleaned more than 150,000 square meters.
Okay, you know what, this goes several pages more.
How about this?
Lord Mayor, if I may say so,
why don't you just put up a sign with a phone number on it
or a website or something like that?
You know, why do you need the QR code?
Because you can't tell when the QR code has been replaced.
And the phone number at least,
well, I guess I could replace the phone number,
but I don't know.
People have been dealing with this for a long time.
It really shouldn't be this much of a challenge for you.
Yeah, I think graffiti has evolved.
It's not what it was in the 70s and 80s.
And she's, yeah, rightly saying,
yeah, this points out what we're dealing with.
We're dealing with people that are passionate
and they have more reason than ever
to be putting statements up
and getting their message out there.
There's a lot of enthusiasm for public art and murals
and tagging and stuff.
People have a lot of different reasons
to be spraying on stuff
and being subversive in that way
because so many other areas of life
seem to be ever more controlled
and less free in that way, in that form of expression.
And as the times change,
the tools and techniques,
graffiti artists have that,
they know what this technology is
and it just doesn't surprise me
that they would innovate in a kind of snarky way.
Go ahead, Alex.
This whole notion of replacing QR codes
as well as something that we have talked about,
I think a couple of times on the show
over the last couple of years.
QR codes essentially just serve you up a URL.
Anything that gives you a URL or a web address
shouldn't innately be trusted by any means,
but yet we've become so conditioned
to trusting QR codes throughout the pandemic.
If you remember, all the restaurants removed their menus
because we had this crazy notion that we know now
that the coronavirus could just spread very easily
through touching things.
And so menus were removed and QR codes
that would link to a menu were replaced
in nearly every single restaurant that you went in
from the middle of 2020 until today.
I mean, so many of these restaurants
still just have QR codes as opposed to printing menus.
It drives me absolutely nuts
because I hate using the QR codes.
But it's something I'd said years ago
is that I'm really surprised we don't hear
people replacing these QR codes
to link to some kind of phishing site
or basically push out malware to a particular phone.
I mean, it would be a really easy way to do this
because everybody trusts these QR codes.
I think it was the Super Bowl last year
where you even had a commercial.
It was a Coinbase commercial, I think, of a QR code
just bouncing around the television screen.
You know, and probably thousands of CISOs
and security practitioners around the world
are just smacking themselves in the head saying,
oh my God, you know, all this training
about not trusting URLs and QR codes
has just gone out the window
because all our employees probably just, you know,
raised their phones to the screen
trying to figure out what the hell
that commercial was about.
So QR codes can be dangerous.
They can be fun.
I've got a QR code morale patch, actually,
that Rick rolls anybody that would put it up to my jacket.
So there's all kinds of fun things you can do,
but they're really dangerous too.
I had a little Russian story.
So it sounds like the point of these QR codes
is if you want to report graffiti,
scan this code that gives you like a phone number,
and then you call and say, hey, there's a,
at this spot, there's whatever.
So very surprisingly, in St. Petersburg and in Moscow,
you can take pictures of violations.
For example, a garbage can is not cleaned.
And there's an app where you just submit the photo.
And by law, they have to respond
within five days or whatever.
And it really works.
And then, of course, the joke is that, you know,
if you want your garbage can cleaned faster
or if you want snow out, you know,
just write some politician's name on it,
you know, in graffiti and take a picture.
It'll get clean.
But surprisingly, it does work.
That is something.
Hey, folks, we're at the end of our hour,
but we are going to be going to YouTube
for overtime at 8 p.m.
Go to Channel 2600 on YouTube
or simply go to the URL at the top of the 2600.com webpage.
I wanted to spend a moment, though,
on what is a rather sad anniversary,
a very sad anniversary.
In fact, it's 10 years to the day
that we lost one of our brightest stars
in the hacker world, Aaron Schwartz.
I can't believe it's been 10 years.
He took his life after being targeted
by the federal government for the crime
of trying to make academic papers more accessible.
It's a crazy story,
a story that would take a long time to really go into,
and it has been documented quite well.
I just wanted to give the opportunity
to anybody who wanted to say anything about Aaron,
who was on off the hook once,
and was just such a pleasure to talk to,
somebody who had such ideas.
It just makes me realize that when you target somebody,
with all the weight of the legal system,
oftentimes you don't know what you're doing to an individual.
You don't know the pressure that that can create.
You don't know the harm that that can cause,
and I don't think those responsible
have ever been held to account
for the loss that they're responsible for.
Yes, Alex, go ahead.
I wanna say, at Hope this past summer,
we addressed the actual law that has been now,
the prosecutorial guidelines
for the Department of Justice
for the law that Aaron Swartz was charged under,
the CFAA, the Computer Fraud and Abuse Act,
have been revised now
to provide for an ethical hacking exemption.
And had that revision been in place
when Aaron had been,
or when charges were even sought,
or when a prosecutor was thinking
of bringing charges against Aaron,
they probably wouldn't have occurred.
He probably would never have been charged.
So you look at just how quickly times have changed here.
One of the things that always stuck with me
is that we had an FBI agent who was on the panel,
the whole panel that I put together,
and we were discussing this,
and we brought up the Aaron Swartz case.
This was not something that we ignored at Hope.
And his response, I thought, was really, really heartfelt,
because an FBI agent who investigates cybercrime said
he thought it was a tragedy that Aaron was charged,
and that it was a real tragedy
that we don't have his voice today,
because he was such a bright star
and such an incredible mind,
and that it would be wonderful to have his thoughts
on things like content moderation,
on these data breaches of a week,
and how technology can be used and abused in society.
So we've really come a long way.
It's sad what happened,
and I can't believe it's been 10 years.
And with that, we'll have to close the show for tonight.
You can write to us, oth at 2600.com,
or please join us on YouTube, Channel 2600,
and of course join us here on WBAI next week at 7 p.m.,
and please support WBAI.org.
Good night, everyone.
Will you please remember me? ♪
If we never, never meet again ♪
Will you please remember me? ♪
I'll always be your friend ♪
I wanna go, go back home ♪
I can't find my way ♪
I wanna go, go back home ♪
I guess I'll get lucky one day ♪
Once I had, I had a few good days ♪
Once I had, I had a few good days ♪
They're all behind me now ♪
Once I had, I had a few good days ♪
I guess I'll get by somehow ♪
I went down one old lonesome road ♪
Couldn't find my way back ♪
I went down one old lonesome road ♪
Wasn't nobody crying back there ♪
Will you please remember me? ♪
If we never, never meet again ♪
Will you please remember me? ♪
I'll always be your friend ♪
We have people and we have people that can make contributions.
Here on WBAI 99.5 FM, we want to have the Tower Fund strong and healthy so we're not worried about it.
212-209-2950 or you can go online at wbai.org and donate to the Tower Fund.