Troy Hunt

That's actually how I, how I got off of it, and, uh, one of the first things I did was in, in 2021 around, there was a, uh, data breach that happened to the University of California system, uh, by, by a file transfer vendor, et cetera.

It exposed all the UC system's Social Security numbers, student information, et cetera, and I actually devised, uh, what, you know, is a, is a very simple algorithm, uh, to, to trawl that data, notify people that were affected, um, and I ended up co- collaborating with a well-known security researcher named Troy Hunt to actually notify people that were affected months before the official response.

And so tying it back to that Ben Franklin quote, being in that environment and seeing firsthand, um, how AI could, could help people's lives, I think that was really interesting, right? Because it was able to cut through the typical process, uh, typical months-long process of institutional bureaucracy of analyzing the data breach, doing all this stuff.

Uh, it wasn't necessarily the way that people would've done it at that time.

It definitely happens.

We did a story on Troy Hunt.

He's the Have I Been Pwned guy.

And he said, yeah, he was on a, you know, 16-hour flight or something and half to, half asleep, got a really convincing phishing email, clicked on it, gave him his MFA code.

Hi, I'm Troy Hunt.

Hello, this is Wally Me.

My name is Reid Purvis.

Dr. Corbato would eventually say to the Wall Street Journal in 2017 that passwords have become kind of a nightmare.

Troy Hunt has seen a lot of bad passwords.

In 2013, he created the service Have I Been Pwned to allow people to check whether their email has been exposed in a data breach.

And as the internet came along, we already had these well-established principles of, well, a password is memorable, something that you can type in.

Dr. Cranor says security is about balancing risk with potential cost and benefit, and the perception that this change could increase risk contributes to a hesitancy to update policies.

There's no perfect system, but if you're a security manager and you are appearing to be relaxing your requirements and then there's a breach, you're going to get the blame, even if that's not true.

Troy Hunt says it often comes down to a compliance officer with a checklist.

A lot of security guidance has evolved, particularly in the last about nine years since NIST put out their guidance.

Remember the story.

The Greeks spent ten years besieging the city of Troy, and nothing.

The walls were too high.

Then somebody had a brilliant idea, what today we would call a marketing campaign.

The Greeks pretend to sail away and leave a giant wooden horse on the beach as an offering to the gods and hide soldiers inside.

And the Trojans, thrilled, thinking, "What a thoughtful gift," do what? They roll it into the city with their own hands.

That night, soldiers climb out of the horse, open the gates, and Troy is history.

What a beautiful plan.

And so a big part of my message is, you know, there's two kinds of people, people that know they can be scammed, and people that don't know it but are gonna find out the hard way.

And a good example that I have in the book is that, uh, uh, Troy Hunt, who's one of the top, uh, cybersecurity professionals in the world, he created a tool called Have I Been Pwned? that helps people find out if they've had their data breach.

Uh, he's Australian, and he was traveling from London to Australia, and he had a terrible case of jet lag, and he was exhausted.

And he does what we all do.

He got phished.

And 16,000 emails of his follow- followers were stolen from him.

So if Troy Hunt can get scammed, and he's a cybersecurity professional, that means I can get scammed, Francis, you can get scammed, anybody can get scammed.

Nobody's unscammable.

Exactly.

And if Troy Hunt, who's one of the top cybersecurity experts in the world, if he could get pwned in a phishing scam, anyone can.

As long as you've got meatware between your ears and not circuits, you're scammable.

So one of the things I do in the book is I try to give celebrity stories to help everyday people understand that phishing attacks are not coming from somebody in a hoodie in their mother's basement chugging Red Bull.

Yes.

Kinda like the Have I Been Pwned service by Troy Hunt, where you can see if your informa- using your email address, you can see if your information is on the dark web.

Yeah.

If I, if and when I find this, I'll definitely let you know.