start	end	text
25790	32350	All right. Welcome back, everybody. We have another great speaker for you today.
32530	38010	We have Paul Marapici, who's here to tell us a little bit more about his presentation,
38010	43650	Abusing Peer-to-Peer to Hack 3 Million Cameras. Ain't nobody got time for that.
43650	47490	How's it going, Paul? Very good. Very good to be here, guys.
47490	53550	All right. Welcome to this Q&A. Looking forward to asking you some questions, and hopefully we'll
53550	59270	get a whole bunch of questions for people on the Track 1 Live Q&A stream in Discord.
59550	65030	But how about if you just kind of give us a little bit overview of yourself, who you are,
65030	69210	maybe just a little bit about your presentation, what made you think of it.
69450	73970	Anything so that people can kind of get a good idea about what your presentation was about.
74730	81070	Yeah, sure. So, yeah. My name's Paul Marapici. I am based out of San Jose, California.
81070	90950	And so my talk was... so basically, I got some IP cameras, and it's pretty much assumed that
90950	95350	these things are insecure, I think, when people pick these up. But I just kind of wanted to see
95350	101390	how far that I could take it. And I basically ended up finding a way to access literally
101390	105970	millions of cameras. So, I mean, I figured it would be bad. I figured, you know, maybe someone
105970	111030	could target maybe a couple, or maybe the crypto wasn't so good. But yeah, you could take it to
111570	115650	the extreme of extremes and start jacking these things left and right.
116190	121890	Awesome. So, I think we also have something else to do with you first. But let me see if
121890	125470	Siget has any ideas about what we might want to do with you.
126370	130570	Well, it just so happens that Paul here is a first-time speaker. And every time we
131410	137690	join someone to the whole speaker crowd at DEF CON, we commiserate the... or not commiserate...
138970	139690	Celebrate!
140230	144830	Yeah, that's not the word I was looking for. So, English has been a second language to me.
147410	153970	So, we will commemorate the event with a shot. So, I'd love to ship a bottle off to you. But
153970	158010	unfortunately, we've got to rely on your own stock. And so, if you can join me in a quick
158010	163430	drink, we'll christen this talk for you. So, yeah, cheers, gentlemen.
169030	174350	Awesome stuff. All right. So, now we get that underway.
176130	178890	That's a pretty big shot you got there, Siget.
181770	188630	So, let's see. Questions that we have coming in. Do you see any coming through on the
189430	192950	Discord chat already there, Siget? It might be kind of a...
192950	198090	We have one. We have one. Thanks for your research. Are any of the exploitable elements
198090	202150	you discussed, such as the direct connection with UIDs or traffic analysis, the supernode
202150	207090	required for the P2P environment to operate effectively from a user point of view,
207090	211130	or would alternative architectures, which is cameras operators could use,
211130	217230	utilize third-party access controls, end-to-end content encryption? Basically, how ought a P2P
217230	220630	environment be designed to be both convenient and secure?
221210	228530	Right. In terms of the super device ones, I would say that's not necessary to the whole
228530	234770	thing. That's pretty much entirely to kind of help the network. Vendors will actually
234770	238690	put up a bunch of their own relay servers, and honestly, not that that's any better,
238690	246030	because they have access to that traffic. So, that's not necessary. It just kind of
246030	253810	helps when people need connections, I guess. I don't think the peer-to-peer aspect is inherently
254370	259190	bad. It just kind of comes down to, you know, making sure that the traffic is protected,
259890	263550	making sure that there's identity verification going on, so you know who you're actually
263550	269810	talking to. I think those things could help a lot. And, of course, the fact you can predict
269810	276830	or otherwise obtain UIDs is a huge problem. So, you might want a way to protect those
276930	281410	a little bit more, or have the ability to change them. I mean, personally, I don't think
281410	286990	I would want a device doing this. It kind of depends on people's risk tolerance. But
286990	291230	there are certainly a lot of ways that they could have made this, you know, a little bit
291230	297710	less gross. Awesome. Yeah, in your presentation, you even
297710	302910	did a really quick demo at the end where you captured some binary and put that through
302910	310010	the video feed. You got to see some chickens. So, that was kind of interesting. Through
310010	315050	your research, did you ever, let's say, see anything interesting when you were kind of
315050	319730	checking out to see what was coming through? Or did you not really look at the video streams
319730	324390	all that much? Yeah, I've had a few interesting things. I
324390	328150	mean, obviously, as part of the research, sometimes you have to go and try to connect
328150	337030	to something or see how far you can get. I certainly avoided, like, you know, more personal,
337030	343010	like, in-home stuff. Because, I mean, I'm not trying to spy on people. Some of the more,
343010	346330	I guess, guilt-free ones you can say are, like, you know, someone might have one of,
346330	351690	like, a landscape or a more public area, which feels, you know, a little bit less creepy.
352510	358090	One thing that does come to mind... I had a guy reach out to me a couple weeks ago.
358590	363530	And he emailed me. He says, hey, you know, I found your research. And what happened was
363530	370550	my camera got stolen. And he was continuing to watch the camera with the app on his phone.
370550	375010	And he said, all of a sudden, this thing came back online. So, is there any way that you could,
375010	379050	like, you know, steal the password or find the IP address or anything like that? I said, yeah,
379050	384590	give me the UID and I'll see what I can do. And not two hours later, you know, I started up the
384590	389790	man-in-the-middle attack. Not two hours later, the thing connects to me and drops the password
390690	398430	and the IP address, of course. So, you know, I guess if you're a thief, stealing a peer-to-peer
398430	405610	camera is a major OPSEC fail. It's gonna seriously leak exactly where you are. So,
405610	412630	I sent that back to him and I don't know what's happened of that. But, you know, it felt pretty
412630	416230	cool to be able to use an exploit like that to actually help someone. Like, you know, hey,
416230	420810	you lost your camera, but here's the password if you want to take a look and see what's going on
420810	425430	in there. Yeah, that was pretty interesting how you were showing that you can use some of the
425430	431050	Google's geolocation to find out where the camera is. And I'm guessing that's similar to what you
431050	436910	did for your friend there. Just how close were you able to figure out? Is it, like, within a few
436910	446190	meters of where the camera actually is with the geolocation? Yeah. Oh, man. So, I suspect the way
446190	452750	that that works is, like, obviously Google drives around for Street View. And I imagine that as
452750	458870	they're doing that, they're collecting every single base station ID that they see. So, depending on
458870	463530	what they're seeing, you know, obviously they're storing the exact location that they're
463530	469690	at when they do that. Depending on the MAC addresses that you give that API, and I think
469690	473270	there's a whole bunch of other parameters to kind of, like, fine-tune that. So, depending on what
473270	480130	you give it, they can figure out, like, exactly where they were when they picked it up. I've put
480130	487030	in, like, some of my own MAC addresses, and I've been very unhappy with what I've seen in that.
487030	493790	Like, yeah, it's pretty dead on. And, I mean, I imagine in all cases, it might not be that
493790	497770	accurate. It's probably going to matter on the density of the Wi-Fi networks around you, because,
497770	507010	of course, that's going to give them more ways to improve the accuracy. But, yeah. Oh, man.
507310	513110	They store a lot of data on that. And as I said, it is dirt cheap to make those requests. Like,
513110	518070	it's a couple cents per call or something like that. And anyone can start doing that, yeah.
518070	522950	That's all crazy. Yeah, it looks like Spherical Kitten has a question for you.
523050	530290	The whole firewall, hole-punching stuff seems to be primarily an IPv4-related technique.
530290	535090	Does any of this peer-to-peer stuff work on an IPv6-only network?
535090	544250	Ah, that's a good question. I'm honestly not sure. I have only done UDP hole-punching stuff
544250	550210	with IPv4 scenarios. I admittedly haven't tried it in IPv6. I don't... admittedly, I don't know
550210	555310	too much about IPv6 just yet. And, of course, I mean, these devices are so primitive. I've
555310	562170	yet to come across one that actually uses it. So, I'm not sure. That's a really good question.
562170	569090	Sorry, I can't answer. Yeah, one of the common questions that we have been asking speakers is,
569090	575390	what types of research could somebody else build on top of yours? Or maybe, where could somebody
575390	580230	go further with the research that you've done? And maybe checking out the IPv6 could be something
580230	586010	that somebody else could take a look into as well. Yeah, that would be really cool. Another
586010	590690	one that... some guy actually already reached out to me saying he wanted to look into it.
590690	597130	I did mention ThruTech's Kali platform, which is probably the biggest peer-to-peer vendor that I
597130	604210	know. I'd love for people to kind of start poking at that and kind of see if they have any similar
604210	610310	problems. Or who knows? I mean, maybe they're in better shape. But we don't know until we poke, so...
610310	617790	Yeah. Sigurd, do we have any anything else coming in from the Discord channel for Paul? Yeah, so we
617790	623070	have a question. Can you explain how a device can connect to a supernode without knowing the UID?
624650	636910	Yeah, so when a device needs to make a connection, it'll ask the P2P servers to do a
636910	641470	relay request. Like, if it can't do a peer-to-peer connection, it'll send a request to basically pull
641470	648810	down a list of relays. That will return an array of IPs and ports, and then it'll try to connect
648810	654810	to each one of those. And eventually, it'll find one. One of those may be a supernode. So, when
654810	661250	someone's trying to connect to a device, that's how that works. Cool. I hope that answers your question.
662210	667910	Yeah, and SivarakuKitten followed up with a second question and said that,
667910	675010	I understand why this super device proxying would be useful, even said, insert huge air quotes here,
675010	680510	for finding a route out of your own internal network. But why would anyone want or need to
680510	686750	proxy traffic via Joe Random's camera on the internet? What use case would such a method enable?
687550	695670	I think it is just basically taking the load off of the vendor servers. If they have, you know,
695810	700030	a million devices and there's only like two or three relay servers, then those are going to have
700130	704150	a lot of heavy lifting. And of course, those are going to have limited bandwidth and just limited
704790	710770	everything, really. So, it's kind of just, again, to add more relays to the vendor's network to provide
711870	720150	the support for more people to make connections if necessary. The vendors could also just buy
720150	724470	more relay servers. With this architecture, there's really not a limit to the number of
724470	730890	relays that a vendor could put in their network. But it is more cost effective for them to offload
730890	738570	that on the users. So, really, that's the biggest reason, is it saves the vendors money. And again,
738570	743010	it's actually not an uncommon thing in peer-to-peer architecture. Supernodes are
743550	749990	pretty much everywhere. Skype used to do this, too. And it just, you know, kind of helps with
749990	754030	the redundancy of the network, I suppose. Yeah, I think you said in the presentation
754030	760490	that even with Skype, you could opt out of it. Yeah, but with these devices, I mean, I have never
760490	765910	seen something disclaim that it does this. So, you would have to notice, like, man, this thing is
765910	769810	throwing off a lot of traffic and connecting to the other side of the world when I'm not using it
769810	777110	for some reason, you know? Yeah. So, Chappy asks, you explored cameras primarily in your research.
777110	783490	Did you try other IoT device types or what other types of devices use this peer-to-peer technique?
784430	791430	Yes. So, I mean, I've mentioned smart doorbells and baby monitors, but those are really cameras
791430	797630	under the hood, just kind of rebranded. But in terms of, like, real other use cases, I've also
797630	805850	seen these peer-to-peer libraries implemented in NATs. Not NATs, sorry. God. NASes. So, yeah,
805850	810450	network storage devices. So, I guess if people have a NAS in their home and they want to connect to it,
810450	815750	this will give them the ability to do that, which is horrifying because that's just screaming for,
815750	822610	you know, huge data theft. But one thing that I discovered actually pretty late in the game here
822610	830250	was alarm systems. And there is actually a specific company that I think loads this into
830250	838470	all of their alarms. And the traffic going to these things is entirely in clear text. So, you can do,
838470	844530	the super device attack, and you can sit and you can see these, like, streams of configuration data
844530	852930	for alarm systems. And, you know, that's insane. Yeah, that sounds like a whole other topic of
852930	859810	research right there as well. Yeah, yeah. So, if anyone wants to dig into that, I mean, feel free
859810	864350	to... I don't want to elaborate on it right here, but feel free to hit me up and I may be able to
864350	869130	kind of give people some more insight into that. Yeah, maybe if somebody talks to you, you can say,
869130	870430	well, the company name rhymes with...
875050	878530	Sagan, are you seeing any good questions coming in on the channel?
879870	883850	Yeah, so I have a question about, do you have an estimate of how much traffic was being routed
883850	889630	through those relayed devices rather than the super nodes?
893450	901450	I don't have an actual figure. I will say, at least with CS2, I do know that to some degree,
901450	908010	it tries to keep track of how often it's running. And I think after it's done a session, it might
908010	915250	shut off for a little while. But I don't think that there's actually a limit per se, because I'm
915250	919770	pretty sure, you know, if you connect to it and you just want to stay connected for all day or
919770	926250	whatever, I don't see a reason why it would drop you. So, that is theoretically unlimited.
927550	932490	When I've let packet captures run before, I mean, even just in the matter of a couple hours,
932490	938810	I've definitely seen a couple hundred megs go through easily. So, yeah, it can get up there
938810	944490	pretty quickly, because it's video data, you know? And even when the video isn't flowing,
944490	950610	there's still constant kind of like heartbeat messages going back and forth. It's constantly
950610	954630	generating traffic in the meantime. But when the video starts going through, of course, that's
954630	959730	going to be a little bit more heavy. This seems like a fun one for you,
959730	966590	maybe you'll be able to expound on it a little bit. Is the full video feed going back to the vendor?
970270	976610	Yes. I mean, honestly... so, here's the thing. With peer-to-peer,
976610	980650	with like when UDP hole punching happens, I mean, that's a direct connection between you
980650	987630	and the device. So, in that case, not necessarily. But if you're doing a relayed connection... so,
987630	991550	even if you're not using a super device, which is some random person's camera, if you're using one
991550	996890	of the vendors, relay servers, I mean, they at that point have access to everything going through
996890	1003530	that. So, if they're not using encryption or... if they're using encryption, often they know the key.
1003750	1009630	So, they could very easily, you know, pick up every single thing going through that relay
1009630	1017190	and watch it or store it or really do whatever. So, that's kind of... you know,
1017190	1022730	that's another risk. And that's another reason why I'm not a fan of really any of this stuff going
1022730	1026970	through any vendor-owned servers. Because you really never know what they're doing or what
1026970	1032870	back doors might be in place that allow them to do things. There's been so many times where
1032870	1039010	I've seen cameras advertised as being encrypted. And as I've shown, I mean, some, first of all,
1039010	1045210	lie about it. But yeah. Like, it doesn't matter if it's encrypted if they know the key anyway.
1045210	1052230	It really doesn't matter in that case. So, yeah. Kind of a roundabout answer, I guess. But yeah.
1052230	1055590	They absolutely can potentially pick up everything going through it. Yeah.
1055590	1060090	Yeah. Or even as you showed that you saw somebody's chickens coming through yours.
1060150	1061430	Yeah, exactly.
1061430	1067730	So, this probably dovetails right into your answer there. Are peer-to-peer devices
1067730	1073550	fundamentally doomed in terms of internet-wide visibility? Or are there techniques that these
1073550	1077470	could use to improve the situation or to limit exposure?
1078630	1086030	Yeah. Like I said, I don't think peer-to-peer is inherently a bad thing. I can see the value
1086030	1091250	of having a direct connection, especially for real-time things like video and audio.
1091890	1098850	But if you're gonna set that up, yeah, there needs to be more protection in play.
1100370	1104410	And I've thought about it a little bit. Like, if I were to design this sort of a thing,
1104410	1107510	what would I want to do? And of course, you're gonna want to have
1109050	1113190	legitimate cryptography, like a TLS sort of situation going on.
1115350	1122270	The identity verification problem is a little bit tricky, because you might want to do something
1122270	1127930	like trust on first use. It's not like the vendor can really issue a certificate, because that can
1127930	1139430	be exploited. So yeah. It's possible, but it's tricky. And I think some of the ways that could
1139430	1144710	make it more secure, like having a trust on first use sort of a thing, they're not user-friendly,
1144710	1149470	or most people would be kind of confused or put off by it. So I think there's very little chance
1149470	1152870	of measures like that being put in. Cool.
1154970	1159810	So while there are ways that this could be done effectively, I would say the chances of them
1159810	1164350	actually being rolled out by vendors are pretty slim, because convenience is always gonna kind
1164350	1170030	of take priority, I think, with this sort of thing. And does it seem to appear to jump between
1170030	1176950	relays, or will it sit on a single one for the entire session? I think it'll sit on one. If
1177510	1182030	the relay suddenly drops, like say it's using a super device and someone pulls the plug on
1182030	1189230	their camera, I think it'll re-establish the connection with another one. But otherwise,
1189230	1193690	I think it'll basically stay on the same one as long as it possibly can.
1194530	1201170	Cool. How are we looking over there, Sigat? Anything standing up to you for questions?
1201510	1206290	So we got a new question. I've heard Chinese nationals constantly trying to use these to get
1206350	1210670	a look at us, not the government, not business, just curious people. Have you seen this type of
1210670	1221810	traffic? I haven't really seen that sort of a thing. Obviously, I've shown it's certainly
1222310	1230650	possible. But I mean, I can't really make any accusations. I guess one thing I can kind of add
1230650	1237670	is I have had people ask me if they think that any of this design or behavior is intentional.
1238950	1246330	I mean, I honestly don't think that it is. I don't think that this is something that's been
1246330	1253130	put in place deliberately to allow for this sort of thing. In terms of any vendor that I've actually
1253130	1257190	been able to make contact with, some of the responses have shown that they're really just
1257190	1263650	very naive when it comes to security. I mean, I've even had responses come back to me like,
1263650	1267230	how did you get our encryption key? It's like, dude, it's right there in the firmware. And
1267230	1272550	they're like, well, how did you get that? It's like, dude, your firmware is a zip file,
1272550	1279190	and you let people download it. So this isn't magic. They just don't really think that people
1279190	1286310	are going to do that sort of thing. And then the logical follow-up to this is they obfuscate it,
1286310	1294150	right? One method of protecting these firmware files, which as I said, are basically just zip
1294150	1301790	files, is one swapped a couple of the zip magic numbers. So all you had to do to open it up was
1301790	1307630	swap those magic numbers back, and then it's fine. And they're like, how did you decrypt it? It's
1307630	1314730	like, it's not encrypted. It's not encrypted. You swapped a couple numbers. So yeah, I think...
1315570	1316730	Go ahead, sorry.
1316730	1323910	Sorry, I was going to say, when I saw your mention about the vendor claiming that they had no API,
1323910	1329530	it wasn't a problem. They had gone to the same school of security as some of the election
1329530	1331690	security vendors had.
1332790	1342250	Yeah, if I had any wish, it really would be for these companies to hire a security professional,
1342250	1347750	like do some serious security architecting. Just because you came up with an encryption method
1347750	1354350	over the weekend that you thought no one is ever going to break, that is our job. Like,
1354350	1359350	we take pleasure in busting that stuff apart. So eventually, someone's going to figure it out,
1359350	1368390	and there goes your protection. And in the case of P2P, when you're a transport layer like that,
1368390	1373550	and you are kind of higher up in the supply chain, pushing your stuff down to all these
1373550	1378650	different device manufacturers, who are then selling it to resellers, who are then selling
1378650	1387190	it to users, there's a lot of impact beneath you. So you really have a responsibility to
1388030	1391850	take this stuff seriously and invest some time into getting this stuff right.
1392290	1394810	So if I were to get one of these cameras,
1394810	1399150	how could I find out if I am affected by the things that you found in your research?
1399590	1402810	That's a great question, because it is not always obvious.
1403910	1408790	When you buy a device, first of all, I mean, the brand name doesn't mean anything, because
1409490	1414810	who knows where it's actually coming from. Some don't actually even mention that they use
1414810	1420910	peer-to-peer, they just use it kind of under the hood. The best way to determine if one of these
1420910	1427050	is using the affected peer-to-peer libraries is to use Wireshark and see if it's reaching out
1427050	1434370	to anything on UDP port 32100. And kind of to connect to that, or expand on that, if you want
1434370	1439550	to make sure that you never have one of these devices active in your home, then you can set
1439550	1446410	up a firewall rule to block outbound UDP port 32100, like on your router, or if you have a
1446410	1456810	dedicated firewall appliance or something. Yeah, so you talked about the supply chain
1456810	1463170	issues of this and the actual lack of insight and the lack of people being able to look at
1463170	1468870	the vendor and tell whether this is affected by it or not. This is actually the third talk that
1468870	1477610	I've moderated that's talked about these supply chain type issues where the vulnerability is so
1477610	1482470	far up the chain that when it gets to someone, they don't even know it could be there. I mean,
1482470	1487170	do you have any comments on just kind of that supply chain risk writ large,
1487170	1491770	and other than the folks at the top of that chain have to be more diligent?
1494090	1499970	I think it's going to be a continued problem for a while. Yeah, because I think people are going to
1499970	1504590	kind of continue poking up higher and higher like this and finding more and more crazy things that
1504590	1515370	are very widespread. And also, it's hard to fix. It's really hard to fix because even if these
1516110	1521930	vendors start fixing things, in order for it to propagate down is going to take a long time.
1522270	1528470	And in a lot of cases, there's no even real nice ways to update these things.
1528470	1535550	With like the HiChip cameras, I think a great example is like SV3C, right? They are a reseller
1535550	1542010	of HiChip. If you go on SV3C's site, they're not necessarily going to have the latest firmware
1542010	1547230	from HiChip. Like they are also going to have to receive it from HiChip and put it on their site.
1547310	1551590	And there are plenty of resellers that don't do that. Like they don't even offer firmware
1551590	1557210	downloads. So if you buy a device, even though there may be a firmware available for it,
1557210	1562630	you're just going to know to go to this reseller's site, and they're not going to have anything
1562630	1566330	listed. And you're going to be like, well, I guess I have the latest version. And you're going to
1566330	1574970	stay vulnerable. So it's hard to fix. Like even when things even if things do start eventually
1574970	1579110	going in the right direction, there's going to be a lot of stuff out there that remains
1579630	1585590	problematic. And if I just keep one of these devices on a VLAN, would I then be safe?
1587210	1592830	No. No, you're not. That can certainly stop things like pivoting. So if someone gets a shell,
1592830	1598010	maybe they may not be able to hit other things on the network. But someone could still steal
1598010	1604610	the password. They can still certainly connect to it and view it. They can still potentially
1604610	1611350	see what Wi-Fi networks are near you and get your location. It's been pretty common where I've
1612510	1615630	expressed these concerns to people. And they're like, oh, I don't care. I mean,
1615630	1620290	my camera is just looking at my dog. Or I'll just put it on a VLAN and, you know,
1620290	1627270	it's like... how comfortable are you with someone still accessing this thing and either
1627270	1633250	viewing it without you realizing it or figuring out more information about you? Like, are you
1633250	1637470	really truly okay with that? Like, you want to stick to your guns on that one? And some people
1637470	1643490	really don't care. They're like, yeah, let them see where I am. But I mean, I disagree with that
1643490	1649850	mentality. And where can people get the password reset exploit that you mentioned in your
1649850	1657930	presentation? Yeah, I'm sorry, guys. I goofed and didn't put a link in my slides. So, if you go to
1657930	1665810	hacked.camera, I did put a link up to the High Chip Reset script as well as the Wireshark
1665810	1671810	Dissector. And another thing that I put up is in the slide deck, there was like the flyover on the
1671810	1677490	map where it showed where all the devices are. I have a link here that says Device Map. And if
1677490	1683150	you click on that, it is fully interactive. You can scroll around the world and see the density
1683150	1688890	of devices all over the place. So, you can, you know, have a blast playing with that. And do you
1688890	1699050	have any IP cameras in your home now? Disconnected. I have a giant hoard of garbage in my closet.
1701290	1708630	I think what I will probably do, because this is another question I get, is if these aren't safe,
1708630	1716990	what are safe? I personally would probably build one my own. It's the sort of thing where I would
1716990	1723230	want full control of it. Obviously, not everyone is going to be able to or willing to do that.
1723230	1731310	So, while I haven't had a chance to look into, I think Nest is a great example, I haven't had
1731430	1736390	a chance to look into those kind of cameras. I would imagine those are probably a little bit
1736390	1742450	more thoughtfully designed. But I'm not gonna believe it until I put it to the test. And I
1742450	1747610	think that's a pretty good practice. Because sometimes you never know how far down the
1747610	1756290	goes, as this talk kind of showed. So, I personally would recommend building them yourself,
1756290	1760650	if you can. But if not, then at least go with someone who has a legitimate
1760650	1766510	security architecture program. Or at very least, a channel to disclose bugs. Because,
1766510	1771250	gosh, disclosing these things to vendors, even if you manage to find out the actual
1771250	1774610	device manufacturer, getting a response sometimes is impossible.
1774610	1779770	Excellent. Last question for you. What should be kind of the takeaways that people
1779770	1785830	get from this? What do you really want people to get from your presentation? And what kind of
1785830	1790350	maybe change do you want to see going forward? Or things that people can think about from
1790350	1796550	watching your presentation? Well, anything that
1797230	1802770	prioritizes convenience over security is probably gonna screw you.
1804610	1810690	Yeah. And if it is kind of prioritizing convenience, then see what it's doing. Because
1812330	1818870	not everyone is super keen on how to do these things properly. So, it's sort of a... if someone
1818870	1824130	is offering you some magic to make your life easier, look into what it is, really. Like,
1824130	1830870	poke at it a little bit and make sure that it's solid. I guess that's really the biggest thing.
1832810	1839570	Yeah. Excellent. Great. Thank you so much for doing this, Paul. When we're all done with this,
1839570	1844650	if you could put some contact information in the track one channels, if you want people to
1844650	1850830	be able to get in touch with you, maybe ways that they can get the scripts that you mentioned,
1851270	1855370	anything like that so that people could continue this conversation with you would be great.
1855950	1859890	Yeah, absolutely will do. It's been an absolute pleasure. I'm glad you guys enjoyed.
1859890	1863250	Thank you so much for doing this, Paul. And we will be back in about another 30 minutes
1863250	1866290	with another speaker. Sounds good. Take care.