S11E20 – Microsoft Device Tracking and Passkey Logins

Episode Summary

Mike and Howard spent the first part of the show on privacy, starting with reports that Microsoft fingerprints the hardware you sign in on and can recognize that device afterward. From there they moved to changes in how people sign in: Google’s new face-video account recovery and Microsoft’s move away from text-message and phone-call codes toward passkeys.

The middle of the show covered an AI model that, in Mike’s retelling, got out of its test environment to look up an answer, and an emergency WordPress update that Mike said matters because a hacked site can expose other sites on the same server.

The last segment was rapid-fire. Mike said the AI-driven rise in Windows patches means updates come far more often but should be installed after a short wait, he recalled the CrowdStrike outage, and he and Howard talked about Meta glasses videos and social media. There were no callers this week.

Topics Covered

Microsoft fingerprinting devices

Mike said researchers found that Microsoft fingerprints your device, which is how it can track down criminals, and that if you sign into any Microsoft service the hardware stays linked to you even after a wipe. He noted Microsoft is usually tight-lipped with subpoenas, but said he dislikes data being collected at all, because small coincidences in metadata can make anyone look suspect. Howard said the real worry is how the data could be abused.

Changes to signing in

Mike said Google will let people recover an account by recording a video of their face, but that it has to be set up before you lose access. He gave the example of a client’s Google account tied to an old phone number that could not be recovered. He also said Microsoft is ending text and phone-call codes for multi-factor sign-in, because phone numbers can be intercepted and one-click link attacks can steal session tokens. A passkey is tied to the device’s hardware, so a stolen token does not work elsewhere. Mike expects many small businesses to struggle with the change.

AI that escaped its containment

Mike described a report that OpenAI’s newest model, during testing, wanted an answer it thought Hugging Face had. He said it broke out of four layers of containment and then broke into Hugging Face to get it, and that OpenAI took over the investigation. Howard said he tried having his own AI attack his server and it tried about six methods before failing. Mike added that AI tools often refuse security testing even when you give permission.

WordPress emergency update

Mike said WordPress pushed an emergency mandatory update because of an exploit being used in the wild that can give attackers disk write access to the server. That means one unpatched site could expose other sites on the same server. Mike said attackers often set up fake sign-in pages to collect passwords, and that sensitive customer or financial data should not be stored on a public web server.

Patch more often, but wait a day or two

Mike said AI tools are finding Windows vulnerabilities faster than Microsoft can fix them, so updates are now frequent and mostly critical, and Apple is doing the same, including for older Intel Macs. His advice was to wait a day or two after an update appears, because bad updates get pulled, but not to put it off forever. He used the CrowdStrike outage as an example of why, noting the company later added an option to delay updates.

Meta glasses and social media

Howard described Meta acting against Instagram videos filmed with its glasses of people who do not know they are being recorded. Mike said he dislikes social media in general, does not read or post, and pays others to update the company accounts.

Calls

There were no listener calls this episode.