S11E04 – Passwords, Two-Factor and Antivirus Advice

Episode Summary

Mike devoted most of this episode to how people’s accounts and data get stolen, and what ordinary people can do about it. He covered credential stuffing, why two-factor sign-in matters, why saved browser passwords are now a bad idea, and how long passphrases beat short complex passwords.

He also gave his view on antivirus: keep only one product, accept Windows Defender if you have Windows 11, and skip antivirus apps on phones. The second half turned to broader themes, including the Artemis moon mission, the loss of shared sources of truth online, Arizona Tech Week, and a caller’s point about checking facts in books versus websites.

Topics Covered

How accounts get stolen

Mike said the two big routes are people handing over information through phishing and credential stuffing, where attackers test breached passwords against many sites. He cited Microsoft reporting around 30 billion such attacks a month. He said to turn on multi-factor for every account, and that a surprise two-factor prompt means someone has your password, so change it right away. He said the code should not go to an email account, because someone who controls your email would get that code too.

Passwords and password managers

Mike said to stop saving passwords in the browser and to delete the ones already there, because malicious browser extensions can read them, and not to keep them in a spreadsheet. He recommended a password manager and named LastPass and 1Password as decent, suggesting people try one or two. He also described a memory system of category roots plus site-specific endings. He said every site should have a different password, since the biggest risk is another site being breached.

Long passphrases

Mike said length matters more than complexity. He said that adding characters multiplies the time needed to crack a password, and gave the example of three words, strong gorilla tables, which he said would take 1.3 billion years for a normal computer to crack.

Checking the dark web and choosing antivirus

Mike pointed to Have I Been Pwned as a free way to see if your information has leaked. He said ordinary antivirus catches little of what matters now, and that businesses use EDR, a smarter behavior-based tool. He warned that only one antivirus should be installed at a time, so an expired McAfee or Norton should be removed first. He called Windows 11’s built-in Defender “aggressively mediocre” but better than an expired paid product. He said VPNs and extras sold with consumer antivirus are largely a waste of money, and that antivirus on iPhone or Android is snake oil.

Truth, critical thinking and the internet

Mike spent a long stretch on how hard it is to find a trusted source of truth online and why critical thinking matters. He described the Dunning-Kruger effect and said that people who know little are often the most sure of themselves. He ended by saying the internet and cloud are more fragile than people assume, noting that Amazon has gone down for a day a few times in the past year.

Calls

• Rick said he had called the old show about 15 years ago. He is a book collector and history buff, and noted that casualty figures for wars differ across websites while a respected historian’s book feels more trustworthy. Mike played devil’s advocate, noting that later research can change the numbers. Rick agreed, citing Soviet archives opening after the Soviet Union fell. Rick also asked what happens to photos he deletes locally if the forum hosting them shuts down. Mike said they would be gone, and that the reverse also happens, where deleted items stay online.