Ah, chums, chums, the dreaming spires of Oxford, the beautiful city in which we all live. Well, all of us apart from Andrew, of course.

Alright, I'll show her the damn stuff.

You don't live in Oxford.

Well, I used to live in Oxford. I live close to Oxford.

You've never lived in Oxford in your life.

Well, no, I haven't.

You've lived close to Oxford.

Okay, well, I've, you know—

I am the only one who lives in Oxford.

The lies have been exposed after all this time.

Episode 304: Oxford Dating Disaster, Cheap Security Robots, and Faking a Suicide with Carole Theriault and Graham Cluley. Hello, hello, and welcome to Smashing Security Episode 304. My name's Graham Cluley.

Happy New Year.

Happy New Year, Carole, and happy New Year to our special guest this week who's joining us. He hasn't been on the show for a while. It is Host Unknown's Andrew Agnês. Hello, Andrew.

Hello, happy New Year!

Hi Andrew, welcome to the show. I'm Carole Theriault.

It's great to be back.

Yeah, it's so much more fun here, isn't it, than other places.

I think we've got to the point now where it's a bit weird to say happy New Year.

Oh yeah, it's our first show of the season, get over it.

Okay, yeah, so I actually meant the Chinese New Year, so we've not had that yet. That's 22nd of January, we're good for another couple of weeks.

Very thoughtful.

Before we kick off, let's thank this week's sponsors: Bitwarden, Zoho PAM360, and Lair. It's their support that helps us give you this show for free. Now coming up on today's show, Graham, what do you got?

Oh, I'm going to be talking about an Oxford student dating site which has got itself into a bit of a pickle.

Oh, I didn't know you hung out in those sites. What about you, Andrew?

I am going to be talking about autonomous security robots working for less than minimum wage.

And I'm going to be telling a tale of crazy social engineering. Or is it? All this and much more coming up on this episode of Smashing Security.

Ah, chums, chums, the dreaming spires of Oxford, the beautiful city in which we all live. Well, all of us apart from Andrew, of course.

No, I'll show her the damn stuff.

You don't live in Oxford.

Well, I used to live in Oxford. I live close to Oxford.

You never lived in Oxford in your life.

Well, no, I haven't.

You've lived close to Oxford.

Okay, well, I thought, you know.

I am the only one who lives in Oxford.

The lies have been exposed after all.

I can see the dreamy spires if I walk a block. So there you go.

Well, if I drove for about 25 minutes, I could find myself punting along the Isis with a wind-up gramophone, drifting past the ancient colleges, having a game of crazy golf. It's a lovely place, isn't it, to nibble a cucumber sandwich?

I have actually punted with my book group and read poetry, eating cucumber sandwiches while punting.

There you go. There's nothing more Oxford than that, isn't it? It's a city of culture, a city of sophistication, a city of study and intellect and great thinking, genius minds. And it's also the city of Oxshag.

Oxshag?

Yeah, Oxshag. Are you familiar with Oxshag?

No.

Well, it's a website which has just popped up last weekend. It poked its little head up and it promises to help overworked and undersexed students in Oxford find, and I quote, "Bookworms with benefits. Coursemates to keep it casual with. Nerds with no strings attached." So this is a new initiative to matchmake amongst Oxford University students. So if you want to swap the Bodleian Library for a hot bod, this is the place to go.

Okay.

So would you like to hear how it works?

Yes!

Of course.

Okay.

And do you have to be in Oxford to do it? Like, can you do 40 miles from your location? Oh, bet you're jealous.

Bet you're jealous. No, Andrew!

You have to be a member of Oxford University.

Okay, I know a number of professors that work there. Check.

Oh, right. Okay, well, for just 3 of your British pounds—

Mm-hmm.

It's about the cost of a pint in your junior common room, I expect.

About 1980. Yeah, okay.

You can sign up for OxShag and be presented with a list of potential matches.

Okay.

So, now there's a good chance that you'll be able to find a student who you fancy on OxShag because they've got a list of every single student at Oxford University.

Shut up.

And their email addresses.

Shut up. This is maybe why I can't find the website.

But is this as clever as it sounds? Because surely if you know the format for email addresses at the university, and you've got the student here.

Exactly. It's probably first name dot double-barrelled surname, isn't it?

Yeah.

It's @OxfordUniversity.

Hyphen, hyphen.

And no, but I'm guessing some students probably have their email address listed somewhere, you know.

Well, let me explain. Because it's not just students. For anyone feeling a little bit more adventurous, maybe you think, "Wow, maybe I can improve my grades. Maybe I'll find myself a sexy tutor." Admin staff, even porters, college porters, you might be able to match yourself up with. In fact, you can find anyone and everyone with a University of Oxford email address on OxShag, which means even university IT staff might have a slim chance of getting a little bit of bedroom action, or at least a little bit of fun one.

Oh yeah, there's a lot of people that work at Oxford, right? There's a number of colleges. There's people from catering staff to security staff to professors to—

Absolutely. Absolutely.

This is the original Facebook idea, right? This is what Zuckerberg actually wanted.

Yes.

When he first launched it, wasn't it?

Because the Facebook, when Zuckerberg created it, it was all about getting himself a date, wasn't it? Or sort of a hot or not thing to sort of rate people based upon their photographs at his college.

I don't think anyone would say he's hot, no offence, but—

Well, that is quite offensive, Carole. Is it? We try not to be judgmental in 2023 on this podcast.

There's someone for everyone, Carole.

Exactly.

Yeah, okay. Email me if you think he's hot.

So what OxShag realised is that people looking for love don't have any time to waste. They don't want to sign up for a service.

No, no, no, no, no.

Why sign up for a service? Oxshag takes that away from you, that pressure of signing up for a dating site. They've decided that the onus should be on the individual to opt out instead. So everyone is up there on the list of potential shags.

Yeah.

Did they run into any EU regulation issues at all?

Well, EU, do we worry about EU anymore?

GDPR. GDPR. Yes, we do.

We've got control back, Carole. It doesn't matter what the EU—

Yeah, hand on the rudder. Hands on the rudder.

So Oxshag, they decided to use a university tool that allowed you to look up anyone's contact details. And they scooped it all up. They scooped up all the names and addresses and they plugged them into Oxshag.

And their view is that because they're already public, what's the problem?

Yes.

And who cares if you're married with three children?

Right.

Legitimate interest.

Yeah. They say, well, look, you probably know who you would rather be doing it with in your filthiest fantasies. Our job is to bring those fantasies to life, be it a sexy tutor, a shredded gym crush. These are words. I'm just making noises. I don't know what these mean. Or even that one friend you've been too afraid to make a move on. We can make the magic happen. So what their plan was, was that you can register your interest until February 2nd and tell the site who you're interested in. You can pick anyone from the list. And then on Valentine's Day, they are going to send out the matches. And so people will get a message saying, 'So-and-so at the university is—' Well, they won't say who. They say someone at the university is interested in you. If you want to find out who—

You have these things in common. Fox hunting.

Can I ask, can I ask, is there any pictures of these people? Or is it just literally name and email address?

I think it's just name and email address, because when you're a student, you're not that picky. And quite right too.

Alright, so you just go, 'Oh, you know, I really want to shag a Pamela.' That's what I'm gonna, you know, I'm gonna Alt+F on Pamela and let's see what comes up. Hey, okay, this is fun.

So the chap who set up this website, his name is Oxshagger. I'm assuming that isn't his real name, but that's the name he's using in the media reports. And to answer your question, Carole, he said, I didn't look into the intricacy. Let me do it with an Oxford accent. I didn't look into the intricacies of GDPR law when making Oxshag. Because all the information I used was available on the Oxford University website.

I could have totally predicted this kid.

Yeah, I'm an oracle. So there's no privacy policy, there's no obvious way to remove yourself from the site. And I wondered, what do you think of all this? Is this a good thing? Is this doing people a favor? How do you feel about it?

Yeah, it's a great idea. They should do it all over the country.

Don't you think? I mean, what a brilliant idea, because it's so intimidating. Is it? This is the question which I really have for you right now. Andy, I know you've lost a lot of weight. I know that you're looking pretty shredded, pretty buff at the moment.

Shredded. Now you know what it means.

No, I don't know. I used it earlier, didn't I? But so I'm imagining you sat in the office. Now, would you like a stream of people coming up to you in the office and saying, "Hey, Andy, do you fancy going out for a drink sometime?" I would absolutely love that.

These are the good old days of the dot-com era where we had rear of the year competition. HR was like, you know, HR was in on it. They were — everyone came down the pub drinking and then all of a sudden the laws changed and it's like you're not allowed to —

God, women wanted rights.

Jesus Christ, so crazy. So yes, if — I mean, if these people are taking us back to those days, count me in.

You would love people to queue up, because that's what I'm wondering is, is this actually better than it happening in real life? Is it less intimidating to get an unsolicited email saying someone's interested in you? Is that better?

How are they interested in me? Is that — how? How does that work, right? So, so — what? No, no, but on this thing is just a name and an email address. How do they know anything?

But, Carole, because you go to Oxford University, so you see the porter, so you see your tutor, so you see your fellow students, you think —

And you know their name is Pamela Jenkins, and then you — right. Right. I'll search for Pamela Jenkins. Now I have her email address and I can stalk her. I could actually —

Or, or just send her a lovely message saying, I'm interested in, you know, mingling.

Why would I need to go through this website? Why wouldn't I just email directly if it showed all the email addresses?

Well, 'cause that can be a bit scary. You only want, you only want them to know that you are asking them if they log into the site and do a match. If they say, well, I'm interested in Carole Theriault.

Okay. That's clever. Yeah. Well, it's like Tinder.

Well, yeah. So some of the people I know that went to Oxford, they were, you know, introverts. They wouldn't openly go out. And so this is why I think it's a great idea. Now, University of West England, they don't need any help in hooking up. So probably not suitable for them.

Do you know the Yellow Pages and the phone books? BT should have got in on this because they have everyone's contact details in all cities. So they could have done citywide OxShag. And gotten rid of the student requirement and just done it, you know, citywide. Oh, I see.

We should have this nationwide, you think? That's right.

You could just be going, you could be going like Pembroke shag, London shag, Birmingham shag.

So Rishi Sunak, he wants to tax us more, right? He would like some more money. He could run a website which asks us to subscribe and we can all have fun.

And if he legalizes Mary Jane at the same time, people might think it's a good idea.

Well, Oxshagger, he says that — he says, what could have been a fun event has now been ruined by the loud minority. Because the site, it was briefly taken down due to complaints. It was relaunched for a reduced fee of £1, and it seems to have now gone completely, right? So they've taken it down. He says, loosen up a bit, have a laugh, take life a bit less seriously. I think those who are most against Oxshagger are probably the most in need of it.

Exactly. Bit rude. Yeah. Oxshagger, if you're —

If you're listening, get in touch. I think it might be interesting to interview them.

Well, I think there's a serious point here though, because you may have religious reasons why you don't want to participate in this. You may be a victim of domestic abuse or have been stalked in the past.

According to you, it's all fine because if I don't want to participate, I just don't log into the site.

Well, you still may not want those emails. I was just playing devil's advocate. Also, what if you're in a relationship and you receive one of these messages? That could cause a few problems, couldn't it?

It's quite nice actually. University.

Relationship for 15 years now.

You're right. I wouldn't mind a little flirting.

Yeah. Get him to perk up a little bit. Maybe it'd raise his game, would it? Yeah. If he knew there's something else in the room.

Exactly. Who knows who, right?

But anyway, the site has come down. Oxford University aren't very happy about it either. Branding issues.

I think he's going to do just fine, Mr. Oxshagger. You think? He's going to have more time to think, dream up his next venture. I think we'll hear from him again. He may have a different name. He may rethink that.

His name is probably Humphrey Ockshagger or Basil, isn't it? Or Tim. Tim Terribly Nice Foot Ockshagger. That's very—

No, I don't. His name could be just Geoff.

Oh, he'd go by Geoffrey, not Geoff.

He might go by Geoff. You guys have Oxford all wrong.

I went to the University of West England. I want to know why Andy's slagging it off.

Hey, I know what I'm talking about.

Andy, what have you got for us this week?

So CES 2023 was recently on in Las Vegas, and every year you see this cool tech and think either, that is really cool, or you think, what is the point of that?

Can you tell us a bit about it?

I've never been. CES, so this is in Las Vegas every year, the Consumer Electronics Show. It's all of the new tech that's coming out and how it's gonna change the future. This year, I was very particularly interested in any sort of robots or anything to automate security or anything like that. So John Deere demonstrated this robot planter as an example. So people no longer have to go out on their tractors. You know, you can actually just send the tractor out to plant stuff itself. But my favorite thing I saw this year was something called Parky.

This is— I don't think it hurt the And how did that go?

So for anyone who's got an electric car, you know how they have this sort of range anxiety, whether you do get to the car park, whether there's a space you can park in and charge your car. So there's this robot called Parky that actually comes to any space in the car park. So you can park anywhere in the supermarket, whatever, and it will come to you and just charge wherever you park, rather than you needing particular spaces to be free. But anyway, so I was looking for anything sort of security, you know, that's I love that type of area. But in my searches, I did come across this story about a robot security guard, which suddenly became unemployed after Christmas. Now, obviously, terrible time of year to lose a job anyway, but, you know, my attention was more on the fact that this was a robot that was actively employed to do security. And so, this particular article is about a California utility company called Pacific Gas and Electric, or more commonly known as PG&E. And they started trialing these autonomous security robots, or ASRs, in December.

child. I'm sure it wasn't going at top

And this was after the fallout from the San Francisco Police Department debacle. And so, the San Francisco Police were authorized to use robots to deal with certain situations. And they sort of freaked people out when they tried to reassure them that the robot would not be authorized to carry firearms, only explosives. Oh, much better. Obviously, most people were okay with that. Now, of course, there was a small minority, much like Bob Shaggar, you know, a small minority of, you know, people managed to, you know, cause SFPD to backtrack on these plans for now. But, you know, they're still authorized to do it. So anyway, I am all for innovation.

Did you sell out? speed. It was just the kid's foot.

I love new tech. Wholeheartedly think we need to go through these trials to get something out of the works. But what I didn't realize was how long these ASRs have been out in use in the wild. Okay, so this ASR that was let go by PG&E, you know, after Christmas, obviously very sad. California is an at-will state, so it's not getting any severance pay. But, you know, I wanted to know what its prospects were.

And so that's where it's— you know, it's an illness and so you can't fault the person for doing it. But that's what this strikes me as, that sort of vibe.

I am not running this software at the moment.

Yeah.

This is very difficult to do on audio. Oh. But there you go. So my pick of the week is an inflatable sofa slash lounger. I don't know. I got one for Crimbo from my brother-in-law. It's produced by a company called Orsen.

I don't know what You don't sort you're talking about. of roll off it or anything?

You know, it's really great. Kids would love it. Teenagers would love it. You know, it's an occasional chair they can put in their bedrooms. Anyway, check it out. Orson, the inflatable sofa or lounger. Find it on Amazon or wherever you shop. It's great. And that's my pick of the week.

Hang on, Andy, you're talking about a robot security guard here.

Nobody, I think the point is, the point is, is you can see why employers will prefer them because they don't have to shell out. Yeah, exactly. They don't have to shell out retirement fees and healthcare or anything. Well, maybe they need a little WD-40, you know?

Yeah, don't get complaints, you can make it work overtime, all this kind of stuff. So it's actually a Californian company because, of course, of course, that is called Knightscope, which makes these. But they're not the groundbreaking tech that I thought they were. Okay, so these robots were actually first deployed back in 2015. So sort of seven, eight years ago. And Knightscope, they describe themselves as public safety innovators. And these robots are fully autonomous. They use self-driving technology and they're designed to alert police of security incidents. They've got sensors that can detect weapons, they can read number plates, and they can detect other kinds of suspicious activities, which they don't go into detail about. But I'm assuming some type of facial recognition. And so that was in 2015, they were first deployed. Okay, so by 2017, their clients included Microsoft, Uber, Juniper, LaGuardia Airport, NBCUniversal. And obviously it's not been all plain sailing over the years, as you can imagine with this type of tech. So back in 2016, one of the robots accidentally ran over a sort of 16-month-old child whilst it was patrolling its warehouse.

Sorry, sorry, well, I sense that you're laughing at this,

So yeah, not the end of the world.

Andy. You're finding this amusing. Sounds a bit like when the Peloton treadmill sucked up an infant, if I remember correctly.

Yeah, but you know, you live and learn, okay? It's only an issue if you don't learn. It's like self-driving cars that crash, okay?

I'm looking at one right now, and they kind of look like a large— They look like large suppositories, actually. That's what they look like. A nappy bin, personally.

With a camera.

Well, they do look a bit like Daleks. They do, don't they?

There's another incident where one actually accidentally drowned itself in a fountain when it was supposed to be patrolling the Washington Harbour. It kind of went off track.

But yeah, so— I'm seeing one here being advertised on their website for the homeowner associations. Yes. You could have this thing in your street.

So many use cases. Monitoring you going, pick up your cat litter. Your bins are out. You left them out long enough.

Ding dong, ding dong, ding dong, ding dong.

Stop walking on the cracks in the pavement. What are you doing with that? Wearing that loud shirt.

So, right, the four models they've got, okay. So starting with the K1, which is a stationary one. It's designed as a weapon scanner for entrances to buildings and things like that. The K3 is designed to patrol indoors. So I'm assuming like shopping malls and things like that. The K5 is the one that goes outside and patrols areas. And they've got these sensors, like the Roombas, that go around and they know, they build maps of where they're allowed to go. And they've got a K7, which sounds like the daddy of all. It's like an all-terrain version that I assume can track someone down bounty hunter style.

But I really hope they've got a K9, which tells you if you've left dog poop and not picked it up.

It's got to be coming up soon, right? I mean, that's— but they charge an hourly rate of seven dollars, which is cheaper than the $16.99 minimum wage in some states. And as you say, obviously, they don't call in sick, they don't need bathroom breaks, they don't have family emergencies.

Well, not yet they don't. Not yet they don't have family emergencies or have to take the— I mean, with the advancement of AI, it's only going to take a certain while before these robots start demanding union rights.

Yeah. Unless the government changes the rules and ensures a minimum service requirement, then which could happen. So security guards could go on strike and these robots get deployed in their place for half the cost.

How soon before they have tasers and, you know, exactly.

Yeah. And I mean, so we are only in the second week of this new year and they've already signed 4 new contracts to deploy these ASRs to various clients. So this stuff started in 2015, 4 new contracts already this year. And I'm sure that these things are not things you buy off the shelf. You can't make stuff up.

I wonder what happens if someone suddenly jumps out, somehow misses the sensors and spray paints all 15 video sensors on it, or drops a bag from a great height on top of it. Right? Do they all come running? Does it call its peers and they all come?

Hopefully that's where the K7 all-terrain one comes out. That would be the enforcer model. Call your big brother sort of thing.

Carole, what have you got for us this week?

Well, we are entering the world of self-publishing. I mean, it's got to be hard, right? Publishing with an agent and a publisher is hard enough. I've heard from various authors how they not only have to write the book, but they have to do much of the marketing activity as well and flog it and everything. But if you write and publish your own stuff, you've got to be either super talented, savvy, lucky to get a glut of readers, right?

Oh yeah, I think it'd be hard, wouldn't it?

Yeah. You once helped someone to self-publish a book?

Yes, I did. Yes.

What was that book again? I can't remember.

It was written by my father-in-law. It was arguments as to why Britain should I think he sold about 30 or 40 copies in the end, but he needed some technical assistance. He self-published via Amazon. He'd made this perhaps short-sighted decision to originally write the book, not in Microsoft Word or a word processor, but instead to write it in PowerPoint. And so every time he edited a page, every subsequent page had to be sort of shifted along a little bit. leave the European Union. That's right. It's not the way I'd recommend writing a book. And it is particularly not very helpful if you're the one who's been asked to produce it in a form which Amazon will accept, because they don't take PowerPoint slides. Plus, of course, it was about reasons why we should do Brexit, which is a bloody idiotic thing to do.

And somehow you offered your services.

Well, I'm just a kind person. We thank you.

We thank you.

Well, don't thank me because of course, maybe it did actually tip the balance so that we did actually vote for Brexit as a country, which—

Those 30 votes did it.

Yeah, I think possibly they did. Possibly they did. So yes, let's move on, shall we? Thank you for mentioning it.

I didn't. I asked. You talked. What can I say? Well, things for Tennessee-based self-published author Susan Meacham weren't going so well. She seems to be a specialist in what some have called paranormal bully romance. What? Paranormal bully?

So grumpy ghosts who want to stay with you?

Or bully you, I guess. Okay, I don't know. I haven't read it.

Is this something that is just completely unprovable?

Well, when I say specialist, I mean she's a self-published author and specializes in writing books about paranormal bully romance. So anywho, anywho, I digress. So Miss Meacham also had a group she founded on Facebook, and in September 2020, a post appeared and it told the followers that it wasn't Susan but her daughter writing, and that she was announcing that her mom, Susan Meacham, had committed suicide.

Oh my goodness.

Following bullying and harassment from members in the book community. And this is a big deal, right? The whole group is shocked. And a month later, in October 2020, this is all according to Rolling Stone, a new post was shared on the account clarifying that her mom obviously was no longer in charge of the account. Sorry. "Thought everyone on this page knew that my mom passed away," she writes, and she further clarifies, "Dead people don't post on social media."

"I've been on this account for a week now, finishing her last book." You say dead people don't post on social media, but I follow a number of dead musicians online. So I follow John Lennon and George Harrison and Jimi Hendrix. They still seem to produce posts on Instagram and places all the time. So she's gone. She's gone.

So she's gone. Her daughter's still working on the final book. And then there was another post, okay, and it requested that the account, Susan Meacham account, should not be reported to Facebook because Facebook would probably discontinue it as she's passed. And the reason for this would allow the account administrators to focus on dispersing the late author's remaining inventory throughout audiobook giveaways and to help her complete her final novel. And there was a lot of work, so the daughter sought out volunteers on the group, right, to help put the book together, edit, and promote it.

That sounds fair enough. And yeah, right.

And there was a fellow author, Samantha Cole, said how the daughter wrote about how horrid the book world had been to Susan. And she writes, quote, apparently they wanted to honor their mother's memory by publishing the last book she wrote, which they did. Okay, so the fans and volunteers dedicated to the self-published author pulled together an anthology called Bully King, a collection of her stories.

I'm so fascinated by this whole concept now of paranormal bully romance.

I know, I know. I was going to open this story with an excerpt of one of her books, right? I thought that'd be the way to do it, and I just couldn't get there in time. So inside the book, this collection that they put together, the dedication reads, "The world is a little less bright without her. Words can hurt, but they don't have to. Words can also heal. Let's keep bullying where it belongs, in fiction." Now, by January 2021, this is three months after the initial suicide announcement, Susan's daughter revealed that the page views and sales had basically reached zero. And she posted an announcement saying the account would be going back to a private page for memories only. Occasionally fundraisers benefiting nonprofits like American Foundation for Suicide Prevention and the National Suicide Prevention Lifeline appeared on the profile, but other than that, the page went dark. And that should be the end of that. Yeah, except that Susan Meacham is not dead. More than two years after the announcement, the suicide announcement, Meacham has decided that she wants her life back and returned to Facebook to reveal, "Ta-da! I was never dead in the first place. Woo-hoo-hoo-hoo! I'm here, guys! Stop crying! I'm right here!" Quote, she writes, "I debated on how to do this a million times and still not sure if it's right to do so," she wrote in her back from the dead to the Facebook group on January 2nd.

And I imagine she was welcomed back with open arms. And everyone said, "Oh, we're so happy." Exactly. They're all, "Fuzzies, we thought you were a goner. It was really fun working on your book, volunteering all our free time to pull it together because you had apparently committed suicide."

So she'd been posting TikTok videos.

Yes! Yes! And people hadn't noticed this.

Another person on Twitter reported that one of her book rankings on Kindle jumped from place— this is positions on Kindle Store. So at first it was 267,000th, and it went up to 82,000th. So a huge jump.

Big jump. On the paranormal bullying romance chart, I imagine.

Exactly!

So she sold more books because people were, I don't know, memorializing or thinking, "Oh, I'll buy her last book and support her family." And— but she wasn't actually dead. She wasn't actually dead. So I guess my question to you guys is, how bad of a crime is this?

But yeah, so this is really tricky because obviously everything I say will be immortalized and it's going to be, "Oh God, you thought this." But this— you know those people that sort of pretend their kids are sick and don't shave their hair and stuff like that?

This strikes me as that type of— Munchausen by proxy. Yeah, yeah, that's it. Yeah.

Might be some sort of mental health element to this, perhaps. Yeah, it's rather distasteful. I mean, if you're going to fake your death, it's rather distasteful, I think, to claim suicide as opposed to died in your sleep or something or fell off a roller coaster. I don't know, but it just feels— that feels quite wrong to me.

Yeah, yeah. I totally agree. Like, as Andrew says, if this is a mental health issue, then I hope she gets help. 'Cause this is very not cool. It's not cool to pretend that you're dead, and it's not cool to be involved in somehow profiting from it and getting people to volunteer their time in honor of something that hasn't happened. But anyway, I just found a little excerpt from one of her books. Should I end on that? Love to Last a Lifetime by Susan Meacham. I was born into wealth and prestige. There was nothing that I couldn't have. Or so I thought. One night is all it took to change my world. We saw each other for the first time that autumn night. I was a young man at 25 years and Greta had just turned 19. She was friends with my best friend's girlfriend. From that moment, my whole purpose in life was to go—

I'm sorry, are you having a stroke?

No, I just got bored. I think we should just fade. Yeah, fade to black.

Fade to black. So there's probably a lot of Smashing Security listeners out there who might be concerned after hearing about the data breach which recently occurred at LastPass. Now, that allowed hackers to steal customers' password vaults, and unfortunately there were parts of those password vaults which were astonishingly unencrypted. There's no doubt a lot of questions users are going to ask LastPass about how that could have happened. And why some of that data was left in that insecure state. But one password manager that isn't making that mistake is our sponsor Bitwarden. Customers of Bitwarden know that their vaults are entirely end-to-end encrypted with zero-knowledge encryption, including, unlike LastPass, the URLs for the websites which you have saved passwords for. You can learn more about that in the Bitwarden Help Center. And at bitwarden.com/privacy. And if you happen to be looking to switch password managers right now, well, Bitwarden makes it easy. They support importing from lots of other solutions, and there's even a LastPass migration guide available. Learn more at bitwarden.com/migrate. That's bitwarden.com/migrate. And stay safe.

Did you know that misuse of privileged credentials is often the entry point into your network for attackers? And enterprises can combat these threats using an enterprise PAM solution like Zoho's ManageEngine PAM360. PAM360 is a fully functional privileged access management suite offering a holistic picture of all the privileged devices, users, and credentials in your IT infrastructure. It's easy to adopt and implement and has been recognized in the 2022 Gartner Magic Quadrant for Privileged Access Management. No wonder it's trusted by more than 280,000 enterprises around the world. Get PAM360 to achieve world-class Privileged Access Management capabilities without denting your IT budget. Learn more at smashingsecurity.com/pam360. And thank you to Zoho PAM360 for sponsoring the show.

Today's podcast is also brought to you by NordLayer. Now, NordLayer safeguards your company's network, but it's much more than just a VPN for business. As you already know, business networks today are more vulnerable than ever due to remote work, ransomware attacks, data leak incidents. Well, NordLayer secures and protects remote workforces as well as business data, and it can even help you ensure security compliance. Simply go to nordlayer.com/smashing and get 1 month free. NordLayer is easy to start at. It takes less than 10 minutes to onboard your entire business on a secure network. NordLayer is easy to combine as it's hardware-free and compatible with all major operating systems. And finally, NordLayer is easy to scale, as you can choose a plan unique to your business requirements and your rate of growth. So if you want to secure your business network, go to nordlayer.com/smashing to get your first month free. And thanks to NordLayer for supporting the show. And welcome back. And you join us at our favorite part of the show, the part of the show that we like to call Pick of the Week.

Pick of the Week.

Pick of the Week. Pick of the Week is the part of the show where everyone chooses something they like. Could be a funny story, a book that they've read, a TV show, a movie, a record, a podcast, a website, or an app. Whatever they like. You always pretend it's your son, Graham. Just, it's okay. We're okay with it.

Well, this is a rare example of a game that I've actually been capable of playing. And it is called Vampire Survivors. And when you look at Vampire Survivors, you'll probably think, well, these graphics are rubbish. There's nothing fun here because it's all sort of pixely. It looks like it's from about 1990. It is a dirt cheap indie game. It sells for about £3 on the Steam store. And let me describe it because it's great fun, this. It says you mow down thousands of night creatures and survive until dawn. Vampire Survivors is a gothic horror casual game with roguelite elements. And what happens is you have swarms of monsters coming around you. When I say monsters, little pixels coming towards you. And what's brilliant about this game is firstly, it's not in 3D. I can't play 3D games because I have— I don't know which way is up, left or right, right? It's just 2D. I need 2D. Secondly, there's no fire button because I'm terrible at aiming at things or firing in the right direction. So it constantly fires. And over time you build up your weapons, you collect more weapons. And so you begin to fire in more extravagant ways and your armaments become greater. But there's a never-ending horde of attacking creatures coming towards you, continuous waves of monsters. And you slowly build up your collection of jewels, and you can upgrade yourself, upgrade your elements, and evolve.

It's really— Okay, level up.

It's really good fun.

Like every single computer game. No, not like every single computer game.

It's, it's Ars Technica called it their game of the year. It's a minimalistic indie game. It looks like it's rubbish. It's really addictive and fun. I played it on Steam on the Mac, but you can also get it for Windows, Xbox. There's also a completely free version for Android and iOS, but I tried it on the iPhone and it had touch controls and I was awful at that because I don't have any coordination. So I couldn't really do it on iOS, but I found it very, very addictive, dangerously so. And so that is why Vampire Survivors is my pick of the week. I like the name.

Well, you know— I'm not a gamer. I'm not a gamer.

I'm not actually much of a gamer either.

For someone who's not much of a gamer, you play a lot of games.

No, I don't. My son plays a lot of games. I normally just observe. But this is one where I actually joined in and had a go because the controls were so simple, which appealed to my kind of brain. Andy, what's your pick of the week? So I have a fantastic pick of the week, or maybe one of the worst pick of the weeks you could possibly ever consider, depending on where you land on this. And it's a huge debate for me. Andy, are you running this software at the moment while we record this podcast? With the conversation we had before we officially started.

So no, I don't have— I'm actually not using my Mac at the moment. Oh, thank goodness. You can switch it off. And so this is one of these things I'm actually horrified and intrigued as well. So for me, it would be about going back and pointing out when someone said something that they later denied they said. Thom Langford. Exactly. I would say, I've got receipts, right? I will prove when you said this, and yeah, I'll prove that I was right.

I wonder if you can— is there a button that says monthly report and then it tells you how much you talked about food, how much you swore, how much porn you watched? Oh, right.

Yeah, it was on the beach. I signed up for it and it took a while till my signing came. So they launched in November, but I was really debating. So a friend who sent it to me actually sent a video of what his typical day looks like. And it's a very condensed, like a highlight reel. And it scared me 'cause, you know, you could see when his son walked in the room and he turned around to speak to him and stuff like that. It's all his Slack messages that he's going through, every single thing. But obviously, yes, huge consent issues. Is this information getting uploaded to the cloud?

Is there, what's—

They say it stays local. So everything stays local on your machine.

What was that Charlie Brooker thing though? They had something like this where a couple had been recording themselves fighting and then had to go back and find all the tapes. You can imagine a couple not getting along, this would be obsessive.

Well, especially if it's indexed. Makes it much easier to search. This is appalling.

Are you asking permission from the people who come into your room or who you have chats with?

Well, so Rewind actually have a very useful article on their site that says, you know, the importance of consent. And they give you the phrase you should say, "Hey, look, you know, for my note-taking purposes, would anyone have an issue with me recording this, you know, using Rewind?"

Yeah, I'm looking at the website right now. I kind of like the idea of doing it during meetings when you have audio on coming in through your computer, because Yeah. Interesting. I have to think about this. then everything is captured that anyone said in the meeting.

No, I hate it. I hate it. Why?

Because you're a big liar? Yes. Yes.

Well, okay. At the moment, I'm able to rely on the, "Oh no, you didn't say that." So I remember—

Oh yeah, yeah. You totally— It totally has been working for you for the last 20 years. Totally. Never once have I questioned it.

This sounds awful.

Interesting, I think the word is.

How much does it cost, Andy? So, what's this?

$30— I want to say $39 a month. I can't remember. Finance is not my strength. I sort of have a card that I use for online. It just auto-tops up when it runs out. So it's a— Wow.

So we're not sure if that's a pick of the week or a nitpick of the week. I don't know. Do we like that or not? I don't know.

I think our listeners should tell us. Do you like it? Do you know it?

Carole, what's your pick of the week?

No idea. Okay. Doesn't deflate. Okay, I had mine up during my New Year's Eve little soiree, and people sat like three at a time. Some people dived on it, whatever. It did not deflate. No, it's got two channels. So you kind of either, you can sit in one and you can sit right inside it. You can look it up, look it up. So it supports people.

No pump required? Yeah, no pump required. And it has pockets and pegs. So if you're outside and it's a bit windy, you can peg it down so it doesn't take off when you get up and go get yourself a drink or whatever. And how thick is it? Would it sort of burst on some rocks or, you know, where there's some gravel you didn't see? If you were sitting on knife shards, you would probably want a tarp underneath it. It is inflated, but it feels quality, man.

Would it support the more corpulent gentleman, the more generously proportioned?

Up to 440 pounds. So that's quite a lot. I think you'll be fine. Hang on, that's a lot more than me. I think you'd be fine.

That's 0.2 tonnes. Let's just see. I'll just, okay, I'll just about manage that. Yeah. Well, Carole, I expect to see this next time I'm round for a little drinky poo in your back garden. Let's get it out. I can try it out.

Yeah, I've had it out in the house. I've had it in the front room and everything.

Well, on that note, we've just about wrapped up our first show of 2023. Andy, I'm sure lots of our listeners would love to follow you online. What's the best way for folks to do that? Oh, the best way. So last time I was on, I actually gave out my number and was surprised when a few people actually did message me, which was surprising. So I got rid of that number after 15 years of having it. On your LiveJournal blog, you can—

I am 100% serious. I have two social media apps. I have TikTok and Tumblr. I don't want people talking to me on TikTok.

All right. You can follow us on Twitter @SmashingSecurity, no G. Twitter won't allow us to have a G. We've also got a Mastodon account. So look for Smashing Security up there. And don't forget to ensure you never miss another episode. Follow Smashing Security in your favorite podcast apps, such as Apple Podcasts, Spotify, and Google Podcasts.

And huge thank you to this episode's sponsors, Bitwarden, NordLayer, and Zoho PAM360. And of course, to our wonderful Patreon community. It's thanks to them all that this show is free. For show notes, sponsorship information, guest lists, and the entire back catalog of more than 303 episodes, check out smashingsecurity.com.

Until next time, cheerio. Bye-bye. Bye-bye.

Bye.

Ah, lovely. Thank you very much. Andy, really appreciate you coming on. Interesting topics and pick of the week.

No, I absolutely love it. It was really good. No, that pick of the week is scary. It's interesting though. I don't know how they got funding. $75 million they're worth currently.

Well, you know, people fund Facebook and the like, don't they? So, you know.

Yeah, but Facebook, you're getting the data out of it, right?

I suppose.

What are people getting out of this? That's the scary thing. Yeah, but you just—

Basically it's heroin. You get people addicted to this and change the terms, and yeah, change the terms, and then you make a cloud version so you can access it anywhere on different devices, and you've got them. You're hooked.

Vampire Survivors is very addictive, I can tell you. Give that a shot.