[00:04.210 --> 00:06.750] Hey, how's it going, DEF CON? [00:07.430 --> 00:12.870] Super excited to get to talk to you guys about one of these things I'm passionate about, [00:12.870 --> 00:16.250] which just happens to be security and magic. [00:17.470 --> 00:21.690] Today, we're going to be going over Outposts, Forces, and Equivocates, [00:22.090 --> 00:23.930] a treatise on how magicians speak. [00:23.930 --> 00:27.130] I learned that word all by myself, too. I'm very proud of it. [00:28.050 --> 00:30.390] But let's go ahead and get started here. [00:31.690 --> 00:39.010] So, starting off, I'm hex 90, no-op, not 0x90, whatever you want to call me. [00:39.010 --> 00:43.650] I don't really care. I'm a magician. I'm also a full-time software engineer. [00:43.650 --> 00:47.650] I have a background in security, love to break things, [00:48.050 --> 00:52.950] and most importantly, I don't need more than my current 200 Twitter followers, [00:52.950 --> 00:57.250] so no need for any handles or anything. [00:57.250 --> 01:05.610] But overall, a fairly unremarkable person, and you don't need to worry about it. [01:05.890 --> 01:14.830] What this talk is, I want to cover three major tenets within magic, [01:14.830 --> 01:21.650] specifically how we handle choices and how we handle making people feel [01:21.650 --> 01:25.370] like they're making choices, but ultimately, it's either something [01:25.370 --> 01:28.950] in our favor or something that we want to happen. [01:29.990 --> 01:35.330] So, we're going to be covering forcing, multiple outs, and equivocates. [01:35.330 --> 01:40.310] The interesting thing about these three techniques is that they're all super similar, [01:40.310 --> 01:44.070] but they do have some small key differences that make them worth talking about [01:44.070 --> 01:46.630] as an individual concept. [01:47.910 --> 01:51.610] Going forward, what this talk is not going to be... [01:52.390 --> 01:59.610] I don't want to feel like I'm giving people permission to heckle performers. [01:59.830 --> 02:06.950] Performing is extremely difficult, and honestly, if you have an interest in magic, [02:06.950 --> 02:11.870] the time to do it is not during a performance or a show. [02:11.870 --> 02:16.450] Honestly, a lot of magicians are pretty down-to-earth people. [02:16.450 --> 02:21.910] They're just people who are just as nerdy as you or I, [02:21.910 --> 02:24.230] just kind of doing a thing that they love. [02:24.230 --> 02:27.650] So, if you have an interest, honestly, take a magician aside, [02:27.650 --> 02:30.770] say, hey, I think that's really cool, and I want to try it. [02:30.770 --> 02:34.870] And they'll more often than not give you some cool books or some tips [02:35.250 --> 02:36.790] on how to get into magic. [02:36.790 --> 02:40.970] And I think that's really awesome because we're a really open community, [02:40.970 --> 02:45.150] but please don't harass them because you know how to do some stuff now. [02:46.450 --> 02:52.310] Also, this talk isn't about any secretly documented human cheat codes [02:52.310 --> 02:54.970] to make people act in ways that they normally wouldn't. [02:54.970 --> 02:57.650] You're not going to get someone to act against their interests [02:57.650 --> 03:02.630] by saying some magic words or hit some crazy synapses [03:02.630 --> 03:06.190] that are going to make them all of a sudden forget who they are. [03:06.290 --> 03:11.650] This is all very real, well-published, at least in the magic world, [03:11.650 --> 03:14.570] techniques that present the illusion of choice [03:15.070 --> 03:17.950] while you remain completely in control. [03:18.450 --> 03:23.050] I also want to take a moment to address the fact that we have... [03:23.050 --> 03:25.610] I am not in control of the slideshow right now. [03:25.610 --> 03:27.670] So, I'll be saying, next slide. [03:27.670 --> 03:30.630] And I'm sorry, it's not the most beautiful thing in the world, [03:30.630 --> 03:32.230] but I don't have a clicky thing. [03:32.450 --> 03:33.910] So, I won't be able to do that. [03:33.910 --> 03:38.410] And also, quarantine has made it so this week has been [03:38.410 --> 03:42.150] the most human interaction I've had to deal with in like six months. [03:42.150 --> 03:46.990] So, I apologize if I sound less than human. [03:47.150 --> 03:51.170] But let's go ahead and hit the first term. [03:51.930 --> 03:54.270] So, forces. [03:54.910 --> 03:58.850] Essentially, a force is the appearance of different values to be chosen, [03:58.850 --> 04:02.410] but through subterfuge, the only option is a single choice. [04:02.630 --> 04:05.790] This is when other choices cannot be selected. [04:05.790 --> 04:11.090] This is... I have 52 cards, and I really, really need someone [04:11.090 --> 04:13.310] to pick a specific thing. [04:13.650 --> 04:18.790] It's when you have no option but the primary choice [04:18.790 --> 04:20.570] that you want them to select. [04:20.610 --> 04:21.950] Can we go to the next slide? [04:23.470 --> 04:26.210] A super over-the-heads term. [04:26.690 --> 04:29.990] And honestly, next time you have an opportunity to do a coin flip, [04:29.990 --> 04:34.790] go ahead and try to say this, but tails I win, heads you lose. [04:37.010 --> 04:44.610] Very quickly, if you read it, it's easy to see how obvious that is. [04:44.770 --> 04:46.790] But ultimately, this is a force. [04:46.790 --> 04:51.410] There's no other option but to have them pick a wrong choice here. [04:51.550 --> 04:56.810] And if you actually try this, and you have confidence in your language, [04:56.810 --> 05:00.190] you'd be surprised with how many times you can actually get away with this. [05:00.190 --> 05:04.530] It's pretty fun, especially if you need to settle any bets within a bar. [05:05.830 --> 05:10.590] The next slide, we have multiple outs. [05:10.870 --> 05:16.250] This is the appearance of free choice, but ultimately all the possibilities, [05:16.250 --> 05:20.290] all the possible decisions are accounted for and expected. [05:20.350 --> 05:22.870] This is used when you need a freedom of choice, [05:22.870 --> 05:27.210] and they need to actually feel like they have a free choice, [05:27.210 --> 05:30.430] like everything is fully free. [05:30.430 --> 05:35.390] And the reason why you want to do this is just sometimes [05:35.390 --> 05:39.050] when you're forcing someone to pick a specific thing, [05:39.050 --> 05:43.430] unless that force is perfect, and it's designed for the situation, [05:43.430 --> 05:46.550] you can start to pick up on it. [05:46.550 --> 05:49.830] You can kind of detect something in your brain goes off and says, [05:49.830 --> 05:53.010] I'm being told to do something that I might not want to do. [05:53.010 --> 05:55.490] And there's an instant fight response. [05:55.490 --> 05:58.990] But if the pressure is no longer on the decision, [05:58.990 --> 06:03.990] and it's on the response, then you can get a little more into this. [06:04.390 --> 06:09.810] And if we go to the next slide, Penn and Teller, a while ago, [06:09.810 --> 06:15.190] they had the perfect example of multiple outs. [06:15.350 --> 06:18.990] They had a special called Penn and Teller off the deep end. [06:19.210 --> 06:23.710] And to give you an idea of how long ago this was, [06:23.710 --> 06:28.370] Aaron Carter was also on this special, and he sang a song underwater [06:28.370 --> 06:31.790] while they did magic tricks with scuba diving, [06:31.790 --> 06:34.550] as well as a bunch of other stuff on the beach. [06:34.550 --> 06:39.850] But one of the effects that they did was they had 52 reveals, [06:39.850 --> 06:43.270] which is sewing a playing card into your jacket, [06:43.270 --> 06:46.750] hiding a giant card in a pot of plants, [06:46.750 --> 06:49.790] kids having them written on them in sunscreen. [06:49.790 --> 06:54.750] They had 52 different values that they could potentially reveal, [06:54.750 --> 06:58.030] and essentially they had someone selecting a completely random card [06:58.030 --> 07:01.750] and naming it, and then suddenly they knew where it was, [07:01.750 --> 07:04.290] or they knew how to reveal it. [07:04.290 --> 07:07.830] And it made it seem like this was the only option that could have happened, [07:07.830 --> 07:14.430] because who would really set up 52 possible answers for this? [07:14.430 --> 07:17.390] And I think what they did was a perfect example [07:17.390 --> 07:22.310] to show the idea of what a multiple out is. [07:22.590 --> 07:24.170] Next slide. [07:25.310 --> 07:26.410] Equivocate. [07:26.490 --> 07:29.710] Equivocate essentially just means double entendre. [07:29.710 --> 07:31.710] I think it sounds cooler. [07:32.230 --> 07:35.850] But ultimately, you're using open-ended questions and vague language [07:35.850 --> 07:38.850] to create ambiguity around choice or knowledge, [07:38.850 --> 07:41.270] and I'm seeing that there's a typo in this slide, [07:41.270 --> 07:43.990] and I'm kicking myself, but I love it. [07:44.710 --> 07:49.610] You also use it when you need to control the perception of information, [07:49.610 --> 07:53.410] even having different definitions between different people. [07:54.790 --> 07:58.190] In magic, this is called dual reality. [07:58.190 --> 08:01.110] This allows you to have the same sentence, [08:01.110 --> 08:04.270] based on the context that two people are coming from, [08:04.270 --> 08:05.790] view it differently. [08:05.790 --> 08:10.270] And I feel like the equivocate is probably one of the most powerful terms [08:10.270 --> 08:15.450] when it comes to controlling decisions coming from people, [08:15.450 --> 08:18.850] as well as it's the most applicable to social engineering. [08:19.730 --> 08:23.110] And it's actually one of the many reasons [08:23.110 --> 08:25.850] why magicians won't perform a trick twice, [08:25.850 --> 08:27.710] very similar to multiple outs. [08:27.730 --> 08:30.350] Everyone's heard one of the rules of magic is [08:30.350 --> 08:32.270] you never perform a trick twice, [08:33.230 --> 08:36.190] and equivocates and multiple outs are a part of that. [08:36.190 --> 08:39.990] If you do the same effect, but you have to go a different direction, [08:39.990 --> 08:41.990] and someone's seeing it twice in a row, [08:41.990 --> 08:45.730] they're going to easily be able to pick up that there's two different paths [08:45.730 --> 08:47.790] that they possibly could have gone down. [08:47.790 --> 08:50.170] And it kind of does damage to the effect. [08:50.170 --> 08:53.070] As well as if you view magic like a joke, [08:53.070 --> 08:54.890] you wouldn't say the same joke twice in a row [08:54.890 --> 08:57.250] because everyone knows what the punchline is going to be, [08:57.250 --> 09:01.010] and it becomes substantially less special. [09:01.170 --> 09:04.730] But the example for equivocate, if we go to the next slide, [09:04.730 --> 09:08.790] is are you right-handed or left-handed? [09:08.790 --> 09:10.950] And if they respond left, then you say, [09:10.950 --> 09:12.850] great, I need this hand to be loose, [09:12.850 --> 09:14.510] so let's use your non-dominant hand [09:14.510 --> 09:17.350] because we want them to be using their right hand. [09:18.390 --> 09:20.450] But alternatively, if they would have said right, [09:20.450 --> 09:22.510] and you go to the next slide, [09:22.510 --> 09:24.670] are you right-handed or left-handed? [09:24.670 --> 09:27.510] And they say right, then you say, [09:27.510 --> 09:29.950] great, I need this hand to be strong, [09:29.950 --> 09:33.410] so let's go ahead and use your dominant hand. [09:33.850 --> 09:35.690] And if you notice here, [09:35.690 --> 09:37.550] if you saw these questions side-by-side [09:37.550 --> 09:39.130] and they're answered the same way, [09:39.130 --> 09:41.010] that would ruin this effect. [09:41.010 --> 09:43.270] But because of the vague language [09:43.270 --> 09:47.150] and the lack of intent being posed in the question, [09:47.150 --> 09:51.830] you can't actually tell what the reasoning is for the question, [09:51.830 --> 09:55.910] and so the answer doesn't seem so alien, [09:55.910 --> 10:00.230] but it is a little bit when you set them side-by-side. [10:00.450 --> 10:02.430] Let's go ahead and go to the next section. [10:04.130 --> 10:07.030] So how do these terms work? [10:07.030 --> 10:11.650] How come people don't instantly call a bull on a lot of this? [10:12.510 --> 10:15.910] And ultimately, it's not voodoo. [10:15.910 --> 10:18.010] There's no real magic here. [10:18.010 --> 10:21.250] You're simply taking advantage of people's laziness. [10:21.390 --> 10:23.030] There's a book actually called [10:23.030 --> 10:25.690] The Paradox of Choice, Why More is Less, [10:25.690 --> 10:27.890] and that was written by Barry Schwartz. [10:27.890 --> 10:31.870] And in it, he talks about the decision-making process that people have. [10:31.870 --> 10:33.690] And it's primarily about consumerism, [10:33.690 --> 10:35.910] but also in the book, it shows that [10:36.770 --> 10:41.330] people are less happy with their choices when there are too many, [10:41.330 --> 10:44.870] and often they'll take a lot longer to make a simple choice. [10:44.870 --> 10:49.330] So people much prefer to choose from three flavors of candy versus 50, [10:49.330 --> 10:52.950] because if they pick from 50, they're always going to be semi-disappointed. [10:53.990 --> 10:56.970] And the perfect example of this is [10:56.970 --> 11:01.050] anyone that's had to coordinate, especially now with Zoom calls, [11:01.050 --> 11:03.870] coordinate a time with multiple people. [11:04.290 --> 11:06.810] Anytime you ask, hey, what time works for everyone? [11:06.810 --> 11:09.070] Because you want to be a decent human being, [11:09.070 --> 11:11.750] and you want to accommodate everyone, [11:11.750 --> 11:15.130] it's going to result in a conversational gridlock. [11:15.390 --> 11:17.090] And this is because you have [11:18.830 --> 11:21.690] an infinite amount of times that could be selected. [11:21.690 --> 11:22.950] I can't imagine people are like, [11:22.950 --> 11:27.750] oh, yes, I want to meet at 12 p.m. and 16 picoseconds. [11:27.750 --> 11:29.950] But in theory, you could. [11:30.770 --> 11:33.290] And instead, if you say, hey, [11:33.290 --> 11:37.270] should we meet at 10 a.m. or 6 p.m. instead of what time works for everyone? [11:38.130 --> 11:41.050] More often than not, you're going to get an answer much quicker. [11:41.050 --> 11:43.610] Everyone's going to be able to come to a decision quicker. [11:43.610 --> 11:46.670] They won't always be exactly the times that you requested, [11:46.670 --> 11:48.050] but people will come. [11:48.530 --> 11:51.890] They will coalesce into a single time a lot faster [11:51.890 --> 11:54.750] because they're able to take that information [11:54.750 --> 11:59.670] and they pose it as a question to themselves as how does this apply to me? [11:59.670 --> 12:03.890] And how can I fit into this instead of also trying to account [12:03.890 --> 12:05.870] for all these external factors? [12:05.870 --> 12:07.890] And by limiting choices, [12:07.890 --> 12:12.150] you make people feel more confident in their choices [12:12.670 --> 12:18.150] instead of making it this open-ended world. [12:18.310 --> 12:22.610] And another issue with using equivocate [12:22.610 --> 12:25.150] or using multiple outs or even forces [12:25.150 --> 12:30.090] is that some of these methods can leave a trail of word crumbs [12:30.090 --> 12:34.630] that you can easily backtrack to figure out that there was manipulation. [12:34.670 --> 12:41.110] So if you were to rewatch a Zoom call where an equivocate was used, [12:41.110 --> 12:46.050] you could potentially figure out how vague that language is after the fact. [12:46.050 --> 12:51.490] Sometimes in the moment, you won't necessarily see that happening, [12:51.490 --> 12:56.370] but after the fact, you might be able to backtrack on it. [12:56.590 --> 13:00.330] But in that moment, you also want to avoid people being able to find [13:00.330 --> 13:04.670] and pick up on those word crumbs and backtrack on that conversation. [13:04.850 --> 13:10.210] And the way magicians get around this is we create little memory snapshots. [13:10.310 --> 13:13.290] So let's say we had to do a deck switch [13:13.290 --> 13:16.610] and do all these other crazy things. [13:16.690 --> 13:20.590] Instead of highlighting that moment of the deck switch, [13:20.590 --> 13:24.370] we're going to try to mentally have the picture that your mind takes, [13:24.370 --> 13:27.370] the thing that you remember, be much different. [13:27.490 --> 13:29.850] That's also why people, magicians at least, [13:29.850 --> 13:32.390] they'll work on blocking out their props. [13:32.810 --> 13:37.130] So for example, we had a magician who came on and he did a Zoom show, [13:37.130 --> 13:41.390] and part of it is he has a card under a box, [13:41.390 --> 13:45.630] and he wants you to make sure that you see that card and you remember it, [13:45.630 --> 13:47.830] and you remember that it didn't move. [13:47.830 --> 13:53.430] And that's very important because when you go back in your inferring method, [13:53.430 --> 13:57.930] you don't want to have your audience get distracted on that. [13:58.010 --> 14:02.750] And the way we do this is we reiterate on stories that we wanted to happen, [14:02.750 --> 14:06.910] not necessarily what exactly happened, but what we want to happen. [14:07.370 --> 14:10.530] And then we also let the manipulations fade into the background. [14:10.530 --> 14:12.890] We stop drawing attention to them. [14:13.570 --> 14:16.890] If I'm doing an effect where I need to choose someone's right hand or left hand, [14:16.890 --> 14:20.770] I'm not going to go back and say, and remember when I had you pick your hand? [14:20.850 --> 14:23.090] We're going to pretend like that never happened. [14:25.110 --> 14:29.850] And another misconception here is that misdirection is used, [14:29.850 --> 14:32.430] but it's not used in the way people think about it. [14:32.430 --> 14:35.870] A lot of people think misdirection is, hey, look over there, [14:35.870 --> 14:39.490] and then something sneaky happens over here. [14:39.490 --> 14:45.450] What actually happens with misdirection is you have something that you want to hide. [14:45.450 --> 14:48.010] You want this to be in the shadows, not in the light. [14:48.070 --> 14:53.570] So you make something interesting happen over here instead, and your focus comes here. [14:53.570 --> 14:57.990] And then this thing, it drops away into the background. [14:57.990 --> 15:02.530] And you can do this verbally. You can do it with props. You can do it with stage direction. [15:02.530 --> 15:06.610] If you've ever watched live theater before, even without magic, [15:06.610 --> 15:10.310] you'll notice when there's a monologue or something happens [15:10.310 --> 15:13.050] and they're bringing everyone to the front of the theater, [15:13.050 --> 15:16.790] things in the background start vanishing and they're pulling objects off of the stage. [15:16.790 --> 15:20.930] Maybe cast members are disappearing because they're changing out a set piece or something. [15:21.010 --> 15:23.710] But that's not because they're trying to misdirect you. [15:23.710 --> 15:25.390] They're not trying to fool you. [15:25.390 --> 15:29.850] They're simply encouraging you to keep your attention elsewhere, [15:29.850 --> 15:32.410] but they don't have to do it with a trick or like a, [15:32.410 --> 15:34.850] hey, look over here and ring a bunch of keys in your face. [15:34.850 --> 15:37.890] And that's a very important thing when it comes to making that snapshot, [15:37.890 --> 15:41.970] because if you're really aggressive with that, you will fail. [15:41.970 --> 15:45.490] And that's how people can backtrack, whether it's in a magic trick [15:45.490 --> 15:49.970] or whether you're doing this in a social engineering setting. [15:50.150 --> 15:52.570] If you could go ahead and hit the next slide. [15:53.830 --> 15:59.250] Now let's get into actual applications of these three concepts. [15:59.690 --> 16:01.770] Magical applications of forces. [16:02.610 --> 16:05.210] Obviously, there's a card force. [16:05.210 --> 16:09.650] If I have, let's say, a duplicate of a card somewhere, [16:09.650 --> 16:11.810] and maybe it's in my pocket or something. [16:12.350 --> 16:14.770] And I want to do this really seamless effect [16:14.770 --> 16:18.790] where I have a card selected, and then it goes back in the deck, [16:18.790 --> 16:20.530] and then without bringing my hand near it, [16:20.530 --> 16:22.290] I can pull it out of my pocket. [16:22.290 --> 16:24.210] That's a very simple way. [16:24.210 --> 16:26.730] But there's many ways to force a card. [16:27.750 --> 16:30.690] The classic of all forces is exactly that. [16:30.690 --> 16:31.990] It's the classic force. [16:32.490 --> 16:37.310] And it's the idea of timing it in such a way that when they go, [16:37.310 --> 16:38.910] that they naturally select it. [16:38.910 --> 16:42.030] And this is something that takes decades of practice, [16:42.030 --> 16:44.810] and it's something that I continuously am working on. [16:44.810 --> 16:49.010] There's also methods of sleight of hand for forcing a card. [16:49.110 --> 16:53.370] And there are books and books and books written on this subject [16:53.910 --> 16:55.570] for actually learning this. [16:55.570 --> 16:57.290] And if you guys are interested, [16:57.290 --> 17:02.590] I'm happy to show a few methods later after the Q&A is going on. [17:03.070 --> 17:06.650] There's also a billet or an object force. [17:06.650 --> 17:10.150] So this is one that I think actually applies more to... [17:10.150 --> 17:12.050] that could be used better for social engineering [17:12.630 --> 17:14.850] or an offensive attack. [17:14.850 --> 17:18.530] But a billet is essentially a folded piece of paper [17:18.530 --> 17:21.890] that might have a piece of information on it. [17:21.890 --> 17:24.690] And commonly, if you need to force something, [17:24.690 --> 17:27.830] you might allow your audience to collect and write a bunch of things down [17:27.830 --> 17:29.090] to get put into a box. [17:29.090 --> 17:31.410] But maybe that whole box gets switched out, [17:31.410 --> 17:33.410] or maybe there's a special gimmick with the box [17:33.410 --> 17:35.990] that allows when you open it, [17:35.990 --> 17:40.730] you can go in and you're only going to pull out the ones that you want. [17:41.230 --> 17:43.530] And that's really important to take notice of [17:43.530 --> 17:46.710] because you can do this with pieces of paper, [17:46.710 --> 17:48.590] you can do it with small objects. [17:49.390 --> 17:53.310] And of course, the last one here is a pattern force. [17:53.490 --> 17:59.390] This was less about swapping out an object that you're providing [17:59.390 --> 18:03.330] and more about swapping out information [18:03.330 --> 18:06.510] that a spectator is providing for you. [18:06.510 --> 18:11.370] So let's say we have someone who mixes up a Rubik's Cube behind their back, [18:11.370 --> 18:13.770] they're unaware of what that information might be, [18:13.770 --> 18:16.710] and then they bring it forward to you without looking at it. [18:16.710 --> 18:20.270] And you're able to put something like a shell over it, [18:20.270 --> 18:23.750] or something that allows you to change the values in it [18:23.750 --> 18:27.290] to something that you want to get to a specific value. [18:27.290 --> 18:30.030] And essentially in real life, if you think about it, [18:30.030 --> 18:32.950] this would be like if someone was able to generate a random value [18:32.950 --> 18:35.450] that they weren't able to look at, and then they gave it to you [18:35.450 --> 18:37.890] and you said, ah, yes, your random value is three. [18:37.890 --> 18:39.170] Of course it is. [18:39.610 --> 18:42.470] And that could be very damaging. [18:42.590 --> 18:46.750] I can only imagine the type of nonsense that could happen with crypto on that. [18:46.810 --> 18:48.250] If we could go to the next slide. [18:49.710 --> 18:52.350] Some IRL applications of forces. [18:53.890 --> 18:56.650] So there's a bunch of different ideas [18:56.650 --> 18:58.710] and you can get as cheeky as you want. [18:59.130 --> 19:01.390] And I just came up with a few. [19:01.390 --> 19:03.590] These are, of course, theoretical. [19:03.590 --> 19:07.190] I'm coming from a magic perspective, but I also like to break things. [19:07.190 --> 19:11.910] So I haven't actually had an opportunity to do any red teaming myself, [19:11.910 --> 19:15.450] but I have done lots of security contracting [19:15.450 --> 19:19.990] with black box and white box penetration tests. [19:20.150 --> 19:23.910] And a lot of these concepts could easily apply [19:23.910 --> 19:26.910] and leak in to a social engineering concept [19:26.910 --> 19:28.870] because they do work so well in magic. [19:28.990 --> 19:33.110] But when you're comparing forces in magic to forces in real life, [19:34.630 --> 19:39.290] I realize that forces are best used for getting objects in people's hands, [19:39.290 --> 19:41.970] thinking that they have chosen them from a group, [19:41.970 --> 19:45.610] that this is the object that's in their best intention. [19:46.470 --> 19:48.830] Like imagine going to a used car lot [19:48.830 --> 19:53.170] and for some reason they want you to take this specific car. [19:53.170 --> 19:57.490] You're like, I want this model, and you have three of them, [19:57.490 --> 20:00.890] and they're all the same color, but why do you want me to have this one? [20:00.890 --> 20:03.310] And of course, that should throw some red flags, [20:03.310 --> 20:07.150] but there might be reasons for wanting to do that. [20:07.150 --> 20:10.090] It might be advantageous for them to get it off the lot for whatever reason. [20:10.090 --> 20:14.030] It might even be benign, but you never know. [20:14.150 --> 20:16.870] And some other applications of forces, [20:16.870 --> 20:22.690] for example, if you had a batch of benign USB sticks [20:22.690 --> 20:26.210] and then you had a batch of USB sticks that had, for example, [20:26.570 --> 20:28.650] a human interface device attack on it, [20:28.650 --> 20:31.750] something that's going to simulate a keyboard and open up the terminal [20:31.750 --> 20:34.610] and it's going to do lots of terrible stuff. [20:34.610 --> 20:36.450] I've written plenty of them. [20:37.070 --> 20:41.110] If you ever get into hit attacks, they're a lot of fun. [20:41.530 --> 20:45.030] But if you only want a specific person to get them, [20:45.030 --> 20:47.130] imagine if you're able to be a vendor at a party [20:47.130 --> 20:50.510] or you're able to pose as a vendor at a party, [20:50.510 --> 20:55.050] and everyone's getting their things and you could do some sort of grab bag switch, [20:55.050 --> 20:57.470] which is super common in Magic. [20:57.550 --> 21:01.390] They look very benign, but it basically makes it so [21:01.390 --> 21:03.730] certain people can choose from one compartment [21:03.730 --> 21:06.930] and another person can only choose from a specific compartment. [21:07.290 --> 21:13.550] And it's a great way to get people to select a specific object. [21:13.850 --> 21:16.270] Also, rigging a contest. [21:16.970 --> 21:19.690] If you think about something like the lottery, [21:19.690 --> 21:23.050] the whole lottery is based around making sure [21:23.050 --> 21:25.870] that you can't force the value [21:25.870 --> 21:29.410] of the ping pong ball. I don't know if they still do that. [21:29.410 --> 21:32.130] But if you're able to force that value [21:32.130 --> 21:34.730] or force the object of it, [21:34.730 --> 21:37.950] that's all game over, [21:37.950 --> 21:40.530] really. Another example is [21:40.530 --> 21:43.070] if you could easily, [21:43.690 --> 21:46.690] using a cross-site scripting exploit on a website, [21:46.690 --> 21:49.530] you could change all of the link values on a website [21:49.530 --> 21:52.730] and point it towards malicious software. [21:53.510 --> 21:55.890] And, of course, [21:55.890 --> 21:58.110] you can point it to a phishing website, [21:58.110 --> 22:01.910] you can point it to a piece of software, malware, whatever you want. [22:02.570 --> 22:04.450] But, of course, you're taking this [22:04.450 --> 22:07.930] environment of open choices. They think that they can go anywhere, [22:07.930 --> 22:10.390] but, of course, you're forcing them into a funnel. [22:10.390 --> 22:12.410] They're forcing them to a single choice. [22:12.410 --> 22:17.670] And then for a social engineering application, [22:17.670 --> 22:19.950] if you had, for example, [22:20.170 --> 22:22.390] a small directory of people, all with different [22:22.390 --> 22:24.850] phone numbers and names, and [22:25.630 --> 22:28.270] these are all your teammates, well, [22:28.270 --> 22:31.550] if you get caught in an attack or someone wants to verify your credentials, [22:31.550 --> 22:34.490] and instead of saying, here's my boss, go ahead [22:34.490 --> 22:37.590] and call him, you're like, here's my team, I don't have time to deal [22:37.590 --> 22:40.910] with this, because now you're putting weight on them. [22:40.910 --> 22:43.810] But you're like, I don't have time to deal with this. Go ahead and call one of them and [22:43.810 --> 22:47.010] they'll verify. Well, they're ultimately [22:47.010 --> 22:49.350] going to end up with the same person, but [22:49.910 --> 22:52.670] that illusion of choice, it makes it seem [22:52.670 --> 22:55.670] there's a legitimacy behind quantity. [22:56.490 --> 22:58.750] Because if I was a vendor, [22:58.750 --> 23:01.490] and it's the difference between going into [23:02.110 --> 23:04.930] a place and handing out a handful of [23:04.930 --> 23:07.730] flash drives from a baggie, and then [23:07.730 --> 23:10.430] having a box of 2,000 of them, [23:10.430 --> 23:13.610] one of them, you're going to go, okay, that guy's clearly handing out [23:13.610 --> 23:16.590] viruses, and another one, you're going to go, oh, maybe [23:17.490 --> 23:19.850] who's going to create 2,000 pieces of [23:19.850 --> 23:22.730] malicious hardware? I mean, I might. That sounds [23:22.730 --> 23:26.150] like a great attack, actually. Expensive, but it could be useful. [23:27.110 --> 23:29.150] If we could go ahead and get to the next slide. [23:30.830 --> 23:32.070] And the magic applications [23:32.070 --> 23:34.750] of multiple apps. There's a couple [23:35.670 --> 23:37.870] of... there's hundreds of tricks. [23:37.870 --> 23:40.530] There's thousands. You can find these in [23:40.530 --> 23:42.510] books everywhere, but [23:43.290 --> 23:46.690] I actually came up with a small little bar bet for this. [23:46.690 --> 23:49.490] And the idea is pretty simple. If you play a game of [23:49.490 --> 23:51.410] rock, paper, scissors, and [23:52.370 --> 23:55.410] the proposition is, I am going [23:55.410 --> 23:58.610] to win this game of rock, paper, scissors on the first round. [23:58.770 --> 24:02.050] And ultimately, whatever you do, you just pick rock. [24:02.050 --> 24:05.470] So if they go rock, paper, scissors, and this person picks rock, [24:05.470 --> 24:08.190] well, the idea is you can say, I told you I was going to win [24:08.190 --> 24:11.110] on the first round, and that's why I chose paper. And all you do is you have [24:11.230 --> 24:14.230] a piece of paper in your hand because they [24:14.230 --> 24:17.170] chose rock. Now, let's say they went ahead and they chose [24:17.170 --> 24:20.070] scissors. Of course, you win because it's rock. And if they went [24:20.070 --> 24:22.990] ahead and they chose paper to cover you, unfortunately, [24:22.990 --> 24:26.170] on your paper, you do have scissors. [24:26.170 --> 24:28.570] I don't know if that can make it out, but [24:30.050 --> 24:32.510] essentially, you understand the constraints [24:32.510 --> 24:35.710] of where you're in. They have three choices to [24:35.710 --> 24:38.710] pick from. And of course, it's a con, and you're more [24:38.710 --> 24:41.710] likely going to get punched than rewarded, [24:41.710 --> 24:44.590] but maybe you'll get a good laugh out of it. [24:45.370 --> 24:47.690] But the idea is that you see the constraints [24:47.690 --> 24:50.690] where they have three choices, and you're able [24:50.690 --> 24:54.210] to account to every single one of them and make it work in your favor, [24:54.210 --> 24:57.150] even if it is going to get you punched in the face. [24:57.810 --> 25:01.530] Another one, this is a classic effect. There's a [25:01.530 --> 25:05.070] queen's holdout. So if you were to have four queens, [25:05.070 --> 25:08.070] what you can do is you can get these [25:08.070 --> 25:11.690] sleeve garters. You can even do it with a rolled cuff. [25:11.690 --> 25:13.710] But essentially, you put these queens [25:13.710 --> 25:17.190] in your sleeve garter. They're pinned to your arm, and you spread [25:17.190 --> 25:20.050] them like so. And I'll put them in a specific [25:20.050 --> 25:23.090] order. It's called chased order. It's clubs, hearts, [25:23.090 --> 25:25.110] spades, and diamonds. And all you do is [25:25.110 --> 25:28.310] you have these on your sleeve, pinned, [25:28.310 --> 25:31.230] and in an effect, you can have a queen [25:31.230 --> 25:34.210] freely named and claim it's in your pocket. And [25:34.210 --> 25:37.770] when you open up your jacket, instead of reaching into the pocket, [25:37.770 --> 25:40.310] you reach into the sleeve, and [25:40.310 --> 25:43.030] you can feel the index and easily [25:43.030 --> 25:46.150] pull out whatever specific queen it is, [25:46.150 --> 25:49.370] deposit it in your pocket as you're opening up your body language a little more, [25:49.370 --> 25:51.690] revealing the queen. And of course, [25:51.690 --> 25:54.910] the first thing that's going to happen is people are going to say, [25:54.910 --> 25:57.790] there's more than one queen in there. So you can easily [25:57.790 --> 26:00.770] empty that pocket completely. Then they might imply that [26:00.770 --> 26:03.810] you have a queen in each pocket, and you're just going to change pockets, [26:03.810 --> 26:06.910] which you can also easily disprove. And this is a good example [26:06.910 --> 26:09.830] of an out, because they feel like [26:09.830 --> 26:13.430] everything is clean, everything's happening into a single location, [26:13.430 --> 26:15.350] but you've been able to determine [26:16.010 --> 26:17.790] that there are four choices. [26:17.790 --> 26:20.390] One of them has to end up here, [26:20.390 --> 26:23.550] and you know a way to account for all of them, [26:23.550 --> 26:27.130] whether it's through verbiage or it's through a physical manipulation, [26:27.130 --> 26:29.490] albeit this one is very simple. [26:30.490 --> 26:32.450] And then this is a classic, classic [26:32.450 --> 26:33.630] in Magic. [26:35.010 --> 26:38.090] You have them name any card, and you [26:38.090 --> 26:41.590] weren't ready for the one they named. Often, [26:41.590 --> 26:44.330] what I'll do is I will stack my deck, [26:44.330 --> 26:47.610] but not in all 52 kind of way. [26:47.610 --> 26:50.190] I will do something like a Queen of Hearts on top, [26:50.190 --> 26:53.750] and like a Jack of Spades on the bottom, and then maybe in my pocket [26:53.750 --> 26:55.490] I might have an Ace of Spades. [26:55.830 --> 26:59.630] And I just have a mental catalog of what cards [26:59.630 --> 27:02.010] get named the most. Usually [27:02.610 --> 27:05.870] one of those, sometimes like a King of Clubs might get thrown in there. [27:05.870 --> 27:07.570] And it depends on the person, really. [27:08.150 --> 27:10.770] But if I'm ready with that Queen of Hearts on top, and I have [27:10.770 --> 27:13.570] something that can blow someone's mind [27:13.570 --> 27:17.270] if I have them name a card that I know is on the top of the deck, [27:17.270 --> 27:19.950] then if they name it, great. If they name one of the other cards [27:19.950 --> 27:22.390] in a different position, I work with that. [27:22.430 --> 27:25.710] But if they don't name anything, it's not like [27:25.710 --> 27:29.250] there's this massive failure. You don't know what my intention was. [27:29.790 --> 27:31.750] If you went ahead and you [27:31.750 --> 27:34.270] named the Nine of Spades, then I just go ahead and go, [27:34.270 --> 27:38.150] okay, we'll use your free selected card. This is the one you were thinking about. [27:38.150 --> 27:41.110] Now let's work with this. There's no force [27:41.110 --> 27:44.710] in there. There's nothing that can make them go, oh, that was weird. [27:44.710 --> 27:47.190] It's just, I'm having you select a card. You don't know [27:47.190 --> 27:50.330] what's about to happen. And that's something that happens a lot in magic [27:50.330 --> 27:52.970] is this concept of don't run [27:52.970 --> 27:55.850] when no one is chasing you. And I feel like social [27:55.850 --> 27:59.270] engineering can really gather a lot [27:59.270 --> 28:00.010] from that because [28:02.690 --> 28:05.230] when you're nervous, when you are [28:05.230 --> 28:08.090] trying to make excuses for everything, when something doesn't work [28:08.090 --> 28:11.010] exactly how you want it, that's when things fall [28:11.010 --> 28:14.030] apart. People [28:14.030 --> 28:17.130] are weird. People are just inherently [28:17.130 --> 28:20.150] weird. And take advantage of [28:20.150 --> 28:23.250] that. So no one is a mind reader. No one can see [28:23.250 --> 28:26.070] exactly what you're about to do. Don't run [28:26.070 --> 28:29.150] when you're not being chased. Let's go ahead and get to [28:29.150 --> 28:31.970] the next section. This is the IRL application [28:31.970 --> 28:35.010] of multiple outs. Originally, [28:35.010 --> 28:38.110] I said this as a joke, but Batman is the master [28:38.110 --> 28:41.090] of multiple outs, even the Adam West one. [28:41.230 --> 28:44.030] And if you see here, he has both [28:44.030 --> 28:46.890] he's clearly being attacked by a shark [28:47.590 --> 28:50.150] but he's ready because he knows, he's like, I'm going to be [28:50.150 --> 28:52.890] attacked by a manta ray repellent, by manta rays, or I'm going to be [28:52.890 --> 28:56.110] attacked by a shark. And so he has repellents for both. [28:56.330 --> 28:59.390] And if both of those don't work, then he has fists. [28:59.390 --> 29:03.030] Batman is the king of multiple outs. [29:03.030 --> 29:05.530] He is always ready for different scenarios, whether [29:05.530 --> 29:08.410] it's Joker toxins, or maybe just [29:08.410 --> 29:12.050] throwing someone off a building. Who cares? He's Batman. [29:12.050 --> 29:14.570] But in actual real life, if we go to the [29:14.570 --> 29:17.250] next slide, the IRL [29:17.250 --> 29:20.530] applications of multiple outs, a really [29:20.530 --> 29:23.610] good example that I've used [29:23.610 --> 29:26.410] when I've done phishing attacks on [29:26.410 --> 29:27.930] on jobs is [29:29.010 --> 29:32.190] multi-layer phishing attacks. More often than not, a phishing [29:32.190 --> 29:35.350] attack is, here's my website, I want [29:35.350 --> 29:38.370] someone to go to it, and I want them to get tricked into going [29:38.370 --> 29:41.190] in, and I want them to try to [29:41.190 --> 29:44.730] type in their information, and I want them to send it to me, and I want to log it. [29:45.670 --> 29:46.450] No. [29:47.030 --> 29:49.710] Phishing attacks need to get way more sophisticated. [29:50.390 --> 29:53.050] And through multiple outs, you could easily [29:53.050 --> 29:56.190] do that. So if you think about it, [29:57.350 --> 29:59.270] you need to figure out what are all your [29:59.270 --> 30:02.970] constraints, and how can you have an outcome that serves you the best. [30:02.970 --> 30:05.310] So if you take phishing websites, for example, [30:05.310 --> 30:08.270] think about the outcomes. One, they [30:08.270 --> 30:10.830] leave immediately. Two, they type in their [30:11.250 --> 30:14.130] info, then they read the URL at the last second, [30:14.130 --> 30:17.250] and then they leave. Or three, they fall for it completely, [30:17.250 --> 30:18.850] and then they send you your information. [30:18.850 --> 30:21.370] All of those... [30:21.370 --> 30:24.670] the only one that wins is the very last case. [30:24.670 --> 30:27.610] But if you think about it, [30:27.610 --> 30:31.030] what if you actually, when they type in their info, [30:31.030 --> 30:33.870] you have a JavaScript keylogger that is taking note of [30:33.870 --> 30:35.990] everything they're sending, and it's sending it off to [30:37.070 --> 30:39.590] a command server. Every time. [30:39.590 --> 30:41.950] Anytime you make a phishing website, put a keylogger on it. [30:41.950 --> 30:45.530] Because I have gone onto websites plenty of times, [30:45.530 --> 30:48.150] I start typing my username and password, and then the [30:48.150 --> 30:51.770] oh shit moment hits, and then I read the URL, realize I'm fine, [30:51.770 --> 30:54.690] and then I keep going. But if there was a keylogger [30:54.690 --> 30:56.870] on that, I'd be fucked. [30:57.650 --> 31:00.210] That would not be okay. [31:00.510 --> 31:03.410] And then also, another way to serve yourself [31:03.630 --> 31:06.370] a little bit better, if someone leaves [31:06.370 --> 31:09.590] immediately, instead of letting them just [31:09.590 --> 31:12.310] leave immediately, why not attempt to have a [31:12.310 --> 31:14.530] JavaScript popup that uses [31:15.310 --> 31:18.430] some identifiable trademark language [31:18.430 --> 31:21.170] or a company name information from your [31:21.170 --> 31:24.270] target, and it says, hey, we just [31:24.270 --> 31:27.230] detected that this is a phishing website. [31:27.430 --> 31:30.230] Go ahead and fill in this form [31:30.230 --> 31:33.150] with your name or your email or your phone and your [31:33.150 --> 31:36.610] extension. Get privileged information. [31:37.370 --> 31:39.210] You might not get credentials, [31:39.210 --> 31:42.130] but privileged information is also gold. Not everyone [31:42.130 --> 31:45.130] has an easy-to-access company directory where you can [31:45.130 --> 31:48.190] start flexing around and getting stuff like this. You can even have [31:48.190 --> 31:51.110] when they try to leave a JavaScript popup that says, [31:51.110 --> 31:53.790] great job, this is an internal test from the company. [31:53.790 --> 31:57.050] You passed our security audit. Congratulations. Fill in this [31:57.050 --> 31:59.710] form so we can make sure that your manager knows. [32:00.410 --> 32:03.110] Boom. Taking advantage of that [32:03.110 --> 32:05.890] desire to build and feel good about themselves, [32:05.890 --> 32:08.650] you've given them more, and [32:08.650 --> 32:11.030] all of these options are way better than [32:11.610 --> 32:14.370] it either works or it doesn't. [32:14.650 --> 32:17.430] And then, of course, there's the option that they might be able to [32:17.430 --> 32:20.350] realize that there's a scam within the scam [32:20.890 --> 32:23.470] and you can go as many layers [32:23.470 --> 32:26.650] deep as you want with this. You can even follow up with an email [32:26.650 --> 32:29.630] afterwards and be like, hey, we noticed this, and try to contact them [32:29.630 --> 32:32.550] directly. But ultimately, those [32:32.550 --> 32:35.690] three layers are better than the original one. [32:36.030 --> 32:38.790] And an example of doing this in the physical world [32:38.790 --> 32:41.350] is think about [32:41.350 --> 32:44.750] crash key sets where you have keys for all of [32:44.750 --> 32:47.710] the entry boxes in Los Angeles [32:47.710 --> 32:50.590] or all of the elevator keys. [32:50.930 --> 32:53.470] There have been so many DEF CON talks. There are so many [32:53.470 --> 32:56.530] keys available. Everyone [32:56.530 --> 32:59.630] is aware of these. There's also the TSA [32:59.630 --> 33:02.510] key pack. Oh, bless the TSA. [33:02.510 --> 33:05.470] They have made this so easy. They took the constraint of [33:06.590 --> 33:08.750] everyone in an airport [33:08.750 --> 33:11.290] has to have a bag with a lock [33:11.290 --> 33:13.570] that fits this constraint. [33:14.770 --> 33:17.750] What type of outs do you need to have to make sure you can [33:17.750 --> 33:21.170] manage everything in this constraint? The TSA key pack. [33:21.230 --> 33:23.170] You get a copy of each one of those keys [33:23.170 --> 33:26.630] and suddenly you have an out for every single [33:26.630 --> 33:29.550] lock. And this works, of course, for [33:29.550 --> 33:32.790] other different systems. And [33:32.790 --> 33:35.690] you can just kind of view that exercise of [33:35.690 --> 33:38.270] think about challenges in a security scenario [33:38.790 --> 33:41.910] where you say, what are the constraints? How many choices [33:41.910 --> 33:44.470] are there? What are all the permutations of this? [33:44.750 --> 33:48.190] And how many can I realistically have a response to? [33:48.290 --> 33:51.090] And then how many can you do if you're being unrealistic? [33:51.190 --> 33:53.810] Maybe it takes having 400 different [33:53.810 --> 33:57.190] ISP uniforms in a van. Screw it. If it gets you in the [33:57.190 --> 34:00.310] building, it gets you in the building. Basically, [34:00.310 --> 34:02.850] any plan B attacks or additional layers [34:03.350 --> 34:05.630] in real life, that makes for a good [34:05.630 --> 34:08.630] multiple out. Can we get the next slide? [34:10.970 --> 34:11.450] So [34:12.210 --> 34:15.250] stage whispers. This is actually something that's used [34:15.250 --> 34:18.410] in both magic and also just on stage. [34:18.430 --> 34:21.150] Normally, a stage whisper on stage is just like [34:21.150 --> 34:24.250] you're communicating a direction that the audience isn't supposed to know [34:24.250 --> 34:26.770] about it. You can have full conversations on stage [34:27.170 --> 34:29.330] depending on the size of where you're at. [34:30.930 --> 34:33.290] But in magic, a stage whisper is [34:33.730 --> 34:35.870] you call up an audience member. [34:35.890 --> 34:38.770] You don't make a fanfare or anything. [34:38.770 --> 34:41.990] You bring them up. And while you're bringing them up, you look them in the eyes [34:42.390 --> 34:45.510] helping them up and you say, what is your name? But you don't say it loudly. [34:45.510 --> 34:47.950] You don't move your mouth a whole lot. You don't articulate. [34:47.950 --> 34:50.750] They say, I'm John. [34:50.970 --> 34:53.830] And you pull them up and you do a magic trick. [34:53.830 --> 34:55.990] You do whatever, maybe it's a mentalism piece. [34:56.230 --> 34:59.010] And you're doing your mentalism piece and then you say [34:59.950 --> 35:02.190] and your name is John. [35:02.190 --> 35:05.110] And everyone loses their mind when they nod because [35:05.730 --> 35:07.830] you've just figured out their name. [35:07.830 --> 35:10.710] And then you quickly have to hush them because [35:10.710 --> 35:14.110] you're like, no, this isn't where the magic begins. [35:14.110 --> 35:15.650] I'm more magical than this. [35:15.650 --> 35:19.730] And to John, it just looks like you're telling them, oh no, that wasn't actually magic. [35:19.730 --> 35:21.730] But this is an example of a dual reality. [35:21.730 --> 35:25.650] This is where the audience thinks one very specific thing [35:25.650 --> 35:28.090] and John is aware of a completely different thing. [35:28.090 --> 35:30.830] But the thing is, is that you don't want John [35:31.690 --> 35:33.350] to be in on it. [35:33.350 --> 35:36.990] You want him to be an unwilling participant. [35:36.990 --> 35:40.190] And you're doing this with an ambiguity of language. [35:40.190 --> 35:42.350] You're doing this with an ambiguity of knowledge. [35:42.590 --> 35:46.070] Another effect, and this is a classic thing, [35:46.070 --> 35:48.570] you have a box set aside. [35:48.570 --> 35:52.390] You have a watch, a knife, and a card. [35:52.410 --> 35:55.570] And on the card, it simply says, I have the card, [35:55.570 --> 35:58.510] you have the knife, the watch is in the box. [35:58.650 --> 35:59.950] It's very simple. [36:00.190 --> 36:04.030] And you place these objects. You let your audience member shuffle them around. [36:04.030 --> 36:06.650] Your person that you're doing this is great for one-on-one. [36:06.650 --> 36:10.670] And you say, put both hands on any two of these objects. [36:10.670 --> 36:12.570] The box is set aside. It's not part of this. [36:12.970 --> 36:14.630] And let's say they put their hands [36:15.410 --> 36:18.270] on the knife and the card. [36:20.230 --> 36:21.890] And you go ahead and you say, [36:21.890 --> 36:24.370] okay, hand one of those to me and you take one, [36:24.370 --> 36:27.110] leaving the watch on the table and you go ahead and just put it in the box. [36:27.230 --> 36:30.690] If they get the card, you say, read what the card says. [36:30.690 --> 36:34.330] And then they read it out loud and all of the qualifications for it are true. [36:34.330 --> 36:37.830] If you end up with the card, you simply read it out loud. [36:37.830 --> 36:40.410] And all the qualifications are true because it's from your perspective. [36:40.610 --> 36:42.950] The only instance where it gets a little weird [36:42.950 --> 36:46.210] is if they put both of their hands on the watch [36:46.210 --> 36:49.490] and one of the other objects. But you say, [36:49.490 --> 36:51.850] okay, now go ahead and lift up one of your hands. [36:52.090 --> 36:54.850] And if they lift up the hand [36:55.910 --> 36:58.590] that's on the knife, you can go ahead [36:58.590 --> 37:01.250] and say, okay, we'll set these aside. [37:02.370 --> 37:04.950] And then the watch, I want you to put that in the box. [37:04.990 --> 37:07.370] If they lift their hand off of the watch, [37:07.370 --> 37:10.310] you say, okay, we'll discard the watch. And this gets back [37:10.310 --> 37:13.550] into the idea of you don't want to do the same trick twice [37:13.550 --> 37:16.910] because this is a perfect example of if someone watches this twice, [37:16.910 --> 37:19.130] it's instantly going to fall apart. But [37:19.890 --> 37:22.590] if you can present this well and you can present [37:22.590 --> 37:25.670] your equivocate well and your method for it and your language [37:25.670 --> 37:28.190] and your confidence in it and how much you believe [37:28.190 --> 37:31.390] what you say is happening is happening, it becomes [37:31.390 --> 37:34.270] the truth. It's no longer optional. It is [37:34.270 --> 37:36.690] the truth. And that's why magic [37:36.690 --> 37:39.970] magicians like Aaron Brown are so effective [37:39.970 --> 37:43.790] because when he speaks, it's the truth. [37:43.970 --> 37:46.270] And that's absolutely wonderful. [37:46.430 --> 37:48.850] And then another effect is called [37:48.850 --> 37:51.910] ashen hand. Earlier I did a slide [37:51.910 --> 37:55.190] where I asked if someone's right-handed or left-handed and it didn't [37:55.190 --> 37:58.250] matter. The reason for this is [37:58.250 --> 38:01.250] for an effect called ashen hand. What you do is you have [38:01.250 --> 38:04.230] someone put both of their hands out flat like this. And all you do [38:04.230 --> 38:07.130] is you grab their hand and you adjust them a little bit like this. You maybe [38:07.130 --> 38:10.550] move it lower or higher. You give some bullshit stage direction. [38:10.610 --> 38:12.870] And what you're doing is you're secretly [38:12.870 --> 38:15.710] depositing a little bit of ash on your finger onto [38:15.710 --> 38:19.650] their left hand. You can do it on their right. It doesn't really matter. [38:19.670 --> 38:22.630] But you're going to force one of those hands with an equivocate. [38:22.630 --> 38:25.530] And so let's say you put it on their right. [38:25.530 --> 38:28.490] So you smudge it on their right hand and their hands are like this. [38:28.490 --> 38:31.970] You've moved them. They now have a smudge. You are now completely hands-free. [38:31.970 --> 38:34.350] And then you say, are you right-handed or left-handed? [38:34.530 --> 38:37.670] And this is where that choice makes it seem like they have full [38:37.670 --> 38:40.750] control over the situation. They say, I'm left-handed. You say, [38:40.750 --> 38:43.450] okay, great. We want to use your weak hand. So we're going to use your [38:43.450 --> 38:46.130] right hand. And go ahead and drop your left hand. [38:46.530 --> 38:49.470] They leave it out. If they say, I'm right-handed. You say, [38:49.470 --> 38:52.430] okay, leave your right hand out and drop your left. [38:52.830 --> 38:56.670] You have them make a fist. And from here, [38:56.670 --> 38:58.530] all you have to do is take a little bit of ash [38:58.530 --> 39:01.730] and you sprinkle it on the back of their hands and rub it in until it [39:01.730 --> 39:04.310] vanishes. That's not the magic. [39:05.230 --> 39:07.410] But you can play that up. [39:07.410 --> 39:09.910] Whatever your character, whatever your writing is. [39:09.930 --> 39:13.150] But then you say that the ash has gone through their hand and has ended up [39:13.590 --> 39:16.730] inside of their palm and they open up and then they have ash [39:16.730 --> 39:19.910] inside of their hand. And the reason why this is magical is [39:19.910 --> 39:22.650] because you've been stepped away. [39:22.930 --> 39:25.970] Even if they remember the actual fact that they made a choice of which [39:25.970 --> 39:28.590] hand, it's couldn't... [39:28.590 --> 39:31.690] because it's not on both hands. It's only on the one. And you never [39:31.690 --> 39:34.870] touched them because you've made this memory [39:34.870 --> 39:37.810] of, hey, you're fucking up. I'm helping you here. [39:37.810 --> 39:40.810] They're going to wipe that. And that's a perfect [39:40.810 --> 39:43.790] example of taking that snapshot as well [39:43.790 --> 39:46.310] as using an equivocate and that vague intent [39:46.310 --> 39:48.950] on your question to make them [39:49.630 --> 39:51.850] follow instructions with you a little bit better. [39:52.210 --> 39:54.110] If we can go ahead to the next slide. [39:55.290 --> 39:57.630] Real life applications of equivocate. [39:59.810 --> 40:00.930] Honestly, [40:00.930 --> 40:03.930] equivocates are best for inferred information. [40:03.930 --> 40:06.950] On a job, let's say you notice on Facebook the big boss [40:06.950 --> 40:10.150] had a barbecue. You're doing some big [40:10.150 --> 40:13.150] red team thing. And you want everyone to... [40:13.710 --> 40:16.190] you've done a bunch of research. You know the guy that runs the building [40:16.190 --> 40:19.170] or whatever. His name is Bob. And you can now [40:19.170 --> 40:22.090] weaponize the fact that he had a barbecue that weekend because [40:23.090 --> 40:25.290] while you're building rapport with one of [40:25.290 --> 40:27.750] your targets, you can say, hey, were you at Bob's barbecue? [40:27.890 --> 40:31.090] And they have two realistic responses. They can either say yes or they can [40:31.090 --> 40:34.210] say no. And by leveraging this, because of this vague [40:34.210 --> 40:37.210] intent, this vague language, you can make it seem like you're either [40:37.210 --> 40:40.310] invited but didn't go, which makes that person [40:40.310 --> 40:43.130] your equal instantly because you're now... they were invited [40:43.130 --> 40:46.070] to the barbecue. So were you. And if they [40:46.070 --> 40:49.150] didn't know about it or they didn't go, you can now be their [40:49.150 --> 40:52.130] superior. You are now the person that's friends with the big boss [40:52.130 --> 40:54.710] and they aren't. And suddenly [40:54.710 --> 40:58.150] this relationship dynamic, one, you've inserted [40:58.150 --> 41:00.990] yourself close to someone that they're [41:00.990 --> 41:03.610] supposed to respect and be under. But also [41:03.610 --> 41:06.690] you have given yourself a history. [41:06.710 --> 41:09.510] You have a background story just from one single piece of [41:09.510 --> 41:11.590] information and a vague question. [41:12.930 --> 41:15.270] And more often than not, though, in magic [41:15.270 --> 41:18.610] you leverage your social position to get away with [41:18.610 --> 41:21.930] equivocates. It allows you to get away with things that might not make sense. [41:21.930 --> 41:24.570] But when it comes to influencing people's choices in real [41:24.570 --> 41:28.170] life using equivocate, people say no and they'll walk away. [41:28.930 --> 41:30.930] You can't make realistic situations [41:31.950 --> 41:34.690] by forcing people to choose things with equivocates. [41:34.690 --> 41:37.910] It's very weird. But you can get away with it, [41:37.910 --> 41:40.590] but you have to be a bit of a jerk and you have to write it [41:40.590 --> 41:43.390] off as a misunderstanding later and you have to act quickly. [41:44.490 --> 41:46.070] An example of doing this with [41:46.070 --> 41:49.370] an ambiguous intent is, I don't know how many people know [41:49.370 --> 41:52.250] about the trick of asking when your partner says, hey, I'm [41:52.250 --> 41:55.270] hungry, you say, and instead of saying, okay, where do you want [41:55.270 --> 41:58.470] to go eat? You say, I already know where I want to take you, but you have to guess. [41:58.890 --> 42:01.790] And then they do. And instead of being like, oh, [42:01.790 --> 42:04.370] you're right, you just take them there because you use this [42:04.370 --> 42:06.850] ambiguous intent. They don't know [42:06.850 --> 42:10.350] any of the information that you know, but it's basically [42:10.350 --> 42:13.370] just a big lie to get them to give you more information. [42:13.770 --> 42:15.990] And sometimes people don't even know it themselves. [42:17.590 --> 42:19.490] And another way [42:19.490 --> 42:22.930] I've noticed equivocate in real life is in dark patterns. [42:23.010 --> 42:25.410] A lot of them, if you're not familiar with what a dark pattern is [42:25.410 --> 42:27.690] on the Internet, is when a UI [42:28.350 --> 42:31.310] is creating language [42:31.310 --> 42:34.010] or is creating a UI experience [42:35.750 --> 42:37.490] around sometimes preventing you [42:37.490 --> 42:40.430] from doing something or trying to mitigate [42:40.430 --> 42:43.730] the amount of people doing a specific action. [42:43.730 --> 42:46.270] Like, I don't know if you've ever tried to cancel an Amazon account, [42:46.270 --> 42:49.570] but there's like 16 menus to go through. And it's ridiculous. [42:49.570 --> 42:52.310] And that's the dark pattern. And a quick dark pattern here [42:52.310 --> 42:55.290] is do not uncheck this box [42:55.290 --> 42:58.390] if you wish to be contacted via about product updates, [42:58.390 --> 43:01.390] upgraded special offers, and pricing. It doesn't make sense. [43:01.750 --> 43:04.850] It's confusing. It's vague. It's ambiguous. [43:05.130 --> 43:07.350] And it's how they're preventing you from doing [43:07.350 --> 43:11.050] an action, which is unsubscribing, which is something that they don't want you to do. [43:11.850 --> 43:13.390] And actually, even in our game, [43:14.010 --> 43:16.690] which if you haven't had a chance to check out the Rogues Village game, [43:16.690 --> 43:19.170] go for it. It's beautiful, lots of fun. [43:19.170 --> 43:22.510] But we have an Equivoque Easter egg hidden there. [43:22.550 --> 43:25.370] You're asked what one of your strengths are. [43:25.590 --> 43:27.990] And regardless of what you respond with, [43:27.990 --> 43:31.150] we're always going to give you the same item because we're either going to [43:31.150 --> 43:34.430] bolster your weaknesses or we're going to enhance [43:34.430 --> 43:37.430] your strength. And it doesn't matter, but it's an Equivoque, [43:37.430 --> 43:40.470] but you feel like you have a free choice, but both [43:40.470 --> 43:42.690] paths lead to the same road. And [43:43.150 --> 43:46.370] once again, it comes down to those constraints. You're figuring [43:46.370 --> 43:49.370] out what paths you have available to you and how can you merge them [43:49.370 --> 43:52.470] in a direction that you want. And let's [43:52.470 --> 43:54.990] go ahead and get to the takeaways. [43:57.370 --> 43:58.330] Forces are [43:58.330 --> 44:02.170] direct decisions that the target has zero control in. [44:02.530 --> 44:04.290] This is good for direct attacks that [44:04.290 --> 44:07.710] introduce a specific object. For example, [44:07.710 --> 44:10.450] if you're using a switch bag for getting in a piece of hardware [44:10.990 --> 44:13.810] or maybe forcing a value on [44:13.810 --> 44:16.970] something like a contest or a lottery, multiple [44:16.970 --> 44:19.890] outs are fully free selections that you [44:19.890 --> 44:22.890] cannot control. You can't control the amount of [44:22.890 --> 44:26.030] constraints. You can accept them, but you can be prepared [44:26.030 --> 44:29.030] for them. And this is good for having responses for a narrow [44:29.030 --> 44:31.810] selection of answers. For example, [44:32.610 --> 44:34.670] a deck of cards is a 52 question [44:36.070 --> 44:37.670] object. And [44:37.670 --> 44:41.030] once you can figure out how to mitigate those 52 [44:41.030 --> 44:43.770] questions, it becomes a lot easier to deal with. And [44:43.770 --> 44:47.430] equivocates, they're for creating ambiguity around definitions, [44:47.430 --> 44:50.190] allowing your will to be imposed on a target. [44:51.390 --> 44:53.250] Equivocates aren't perfect, [44:53.250 --> 44:55.850] but it allows you to enhance [44:55.850 --> 44:59.310] your percentages. And it's great [44:59.310 --> 45:02.030] for warping decisions or creating [45:02.030 --> 45:04.910] inferred knowledge. And the next slide, [45:04.910 --> 45:08.010] this is the defensive takeaways. I think this is something that [45:08.770 --> 45:10.130] everyone can actually [45:11.650 --> 45:14.170] gather something from, whether you're in security, whether [45:14.170 --> 45:17.130] you're in magic, or you're just a plain Joe. [45:17.290 --> 45:19.710] Because scams exist everywhere. [45:20.270 --> 45:23.350] But also, please don't ever do this to magicians. I beg [45:23.350 --> 45:26.090] of you. If I have someone do this to me and I'm doing a magic trick and it turns [45:26.090 --> 45:28.530] out they saw this talk, I'm going to be very sad. [45:28.830 --> 45:32.010] But forces, if you feel like you didn't have a free choice, [45:32.690 --> 45:35.010] attempt to make another one where you can [45:35.010 --> 45:38.070] change the rules of the selection. Be prepared for an [45:38.070 --> 45:40.750] out. Always be ready to [45:40.750 --> 45:43.910] try to change your choice. If you're at that car lot and they say, [45:43.910 --> 45:47.110] here's the green Subaru. And you can say, let me look at another [45:47.110 --> 45:50.010] green Subaru. And if they're really antsy about that, [45:50.870 --> 45:52.910] maybe just leave. You're [45:52.910 --> 45:55.770] an adult. Go buy a car somewhere else. [45:56.870 --> 45:59.030] Multiple outs. Go through the [45:59.030 --> 46:01.790] scenarios. What were your actual choices here? [46:01.790 --> 46:04.730] Because maybe you're actually in a force. Maybe you're [46:04.730 --> 46:07.930] in an equivocate. But go through your scenarios [46:07.930 --> 46:11.190] and see if it's possible to prepare for each of them. [46:11.190 --> 46:14.690] And if that intent on that preparation could be negative to you. [46:15.090 --> 46:16.810] And like I said, [46:16.810 --> 46:19.570] try to change your mind. Try to change the rules. [46:19.570 --> 46:22.850] If you can change the rules or you can change your mind, you have a lot more [46:22.850 --> 46:25.390] freedom. But also, [46:25.390 --> 46:28.770] chances that you can never be 100% sure. So always [46:28.770 --> 46:32.130] be able to stand your ground and redact. [46:32.410 --> 46:35.610] In equivocates, when you're given vague decisions, [46:35.610 --> 46:37.830] verify the intent of the question and what [46:37.830 --> 46:40.470] responses will be used for. [46:40.910 --> 46:43.810] So if you get a weird question and it [46:43.810 --> 46:47.810] seems very open-ended and weird and it's not from someone you trust, [46:48.410 --> 46:49.790] clarify what they want to use [46:49.790 --> 46:53.010] the answer for. You don't have to answer questions. [46:53.010 --> 46:55.730] You don't have to answer someone you've never met [46:55.730 --> 46:58.250] who's asking you in an elevator if you went to Bob's BBQ. [46:58.250 --> 47:01.610] You can say, what does it matter to you, guy? I don't know you. [47:01.850 --> 47:04.010] That's my purse. Get away from here. [47:04.370 --> 47:07.470] Always validate. And that's pretty much it. [47:07.470 --> 47:10.730] If you can validate, if you can change your mind, if you can change [47:10.730 --> 47:12.050] the rules or [47:13.350 --> 47:15.850] what gives you your selection of answers, [47:15.850 --> 47:19.270] you'll be safe. Or safer, as it were. [47:19.530 --> 47:22.550] And I think that's pretty much it. Yeah, I think I'm ready [47:22.550 --> 47:24.930] for my Q&A, Jay. [47:26.970 --> 47:28.810] So first up, [47:29.590 --> 47:31.570] 0x90, in your experience, [47:31.570 --> 47:34.290] what is the percentage of time that somebody uses [47:34.290 --> 47:38.850] some of the defense mechanisms you discussed? [47:39.910 --> 47:40.450] Yeah, [47:40.450 --> 47:45.250] when it comes to doing this in a magic scenario, [47:45.250 --> 47:46.490] it really [47:46.490 --> 47:50.410] depends on how you're approaching. [47:50.410 --> 47:53.650] I've noticed that if you treat anything that you're doing [47:53.650 --> 47:56.770] in magic like a puzzle, people will shut down [47:56.770 --> 47:59.250] and they will inherently get defensive [47:59.250 --> 48:02.290] and they will not want to interact. Where if you haven't [48:02.290 --> 48:05.630] selected a card, they'll wait until the very end because they don't trust you [48:05.630 --> 48:07.970] and it's because you haven't built up rapport. [48:08.610 --> 48:11.090] So it's a case-by-case scenario. [48:11.090 --> 48:13.330] It happens on an individual basis. [48:14.370 --> 48:16.910] The longer I've been doing magic, though, [48:16.910 --> 48:18.350] the less it has happened. [48:20.190 --> 48:22.930] It's gotten to the point for me... I remember when I first started [48:22.930 --> 48:26.070] almost 10 years ago, when I would be doing a trick [48:26.070 --> 48:27.510] and then someone would say, [48:27.510 --> 48:30.670] let me see those cards. And I'd be like, oh, no. [48:30.670 --> 48:32.610] And I would shut down and get all clammy. [48:32.810 --> 48:35.610] And all of a sudden, there goes all the magic. [48:35.790 --> 48:39.930] But now, I could have something that I'm preparing [48:39.930 --> 48:44.530] for hours ahead of time and I have every single card exactly where I need it. [48:44.530 --> 48:47.810] If someone says, whatever, magic boy, let me see that deck, [48:47.810 --> 48:50.750] I want to shuffle it, and it's not a show where I can tell them to go [48:50.750 --> 48:53.930] screw themselves, I'm going to hand them the deck and say, [48:53.930 --> 48:57.030] okay, shuffle it, and I will change my entire set [48:57.030 --> 49:00.230] just to preserve that magic. [49:01.690 --> 49:02.790] But basically, [49:02.790 --> 49:05.870] short answer, as you get better, the longer you do it, [49:05.870 --> 49:08.310] it happens less and less. It was at a point where it was maybe [49:08.870 --> 49:11.050] 1 out of 10 people, and now [49:11.050 --> 49:13.910] maybe if I'm performing a lot, it might happen [49:13.910 --> 49:17.010] once a month. But it really depends on [49:17.010 --> 49:19.870] how able you're to disarm your people [49:19.870 --> 49:23.330] and how much you can connect with them. Because if you're [49:23.330 --> 49:26.130] their friend before you start doing magic, they're not going to be [49:26.230 --> 49:27.290] a jerk to their friend. [49:28.430 --> 49:32.330] Someone asked the question, are you right-handed or left-handed? [49:33.290 --> 49:35.290] I am right-handed. [49:35.290 --> 49:37.370] I don't know exactly how [49:37.370 --> 49:40.550] the screen stuff is set up, so it might appear [49:40.550 --> 49:43.390] that this is my left hand, but I am right-handed. [49:44.410 --> 49:45.890] And we have a question [49:45.890 --> 49:49.310] for you, another one. What kind of ash is it [49:49.310 --> 49:52.170] that you're talking about? Something special or just burnt paper? [49:52.170 --> 49:53.990] Do you make the ash yourself? [49:54.610 --> 49:58.450] Actually, this is a classic impromptu effect. [49:58.890 --> 50:01.870] You used to do it originally with a cigar ash. [50:01.990 --> 50:04.470] The reason why it was neat is because you could just [50:04.470 --> 50:08.030] quickly dip your thumb in an ash tray, [50:08.030 --> 50:10.830] which is disgusting if it's public, but you know, [50:10.830 --> 50:13.090] it's magic. We do disgusting stuff sometimes. [50:13.590 --> 50:16.890] And then you can just sit at a party with your thumb behind your hand [50:16.890 --> 50:19.090] as you're gesticulating and talking to people. [50:19.110 --> 50:22.690] And you can go ahead and do the effect that way. [50:22.710 --> 50:24.690] But basically, cigarette ash. [50:24.730 --> 50:27.810] You might potentially want to do this a different way. [50:28.170 --> 50:30.650] There are a couple of other effects that have [50:31.090 --> 50:34.190] taken this approach and they are published [50:34.190 --> 50:36.770] and they're still currently manufactured. So if you want to [50:36.770 --> 50:40.110] go ahead and DM me, I'll actually give you a link [50:40.110 --> 50:42.950] to the product. I don't make anything off of it. I just don't [50:42.950 --> 50:45.950] want to imply that it uses the same equivocate and stuff [50:45.950 --> 50:48.630] because I didn't make the effect itself. [50:48.670 --> 50:51.830] But it's very good and it's modern. You've probably seen it on [50:51.830 --> 50:53.370] AGT. It's great. [50:54.430 --> 50:57.730] We have one person [50:57.730 --> 51:00.110] that is claiming you as a Fed. [51:01.270 --> 51:03.770] Oh, who's claiming me as a Fed? [51:04.850 --> 51:07.070] What's their social security number? [51:08.910 --> 51:11.230] No, I'm not a Fed. [51:11.410 --> 51:13.030] I have way too much hair. [51:13.030 --> 51:16.070] I have so much hair, especially for being a Fed, [51:16.070 --> 51:19.390] that you can't actually tell that I'm wearing Bose headphones. [51:19.450 --> 51:21.930] Like the full ear cup. [51:23.130 --> 51:25.170] Feds don't have this much hair. [51:25.170 --> 51:27.570] But no, I'm not a Fed. [51:27.610 --> 51:31.930] I'm a software engineer. I've done some security contract stuff. [51:33.270 --> 51:33.750] Ultimately... [51:33.750 --> 51:36.930] If you want to find me on Twitter, DM me and I'll [51:36.930 --> 51:40.410] send you my page. And you can be very disappointed. [51:41.810 --> 51:43.110] That's beautiful. [51:43.230 --> 51:46.130] I'm going to wait for one more question [51:46.130 --> 51:47.510] that's coming in. [51:49.630 --> 51:52.050] I think we can probably just field that on the Discord. [51:52.050 --> 51:55.850] I'm going to give them 10 seconds to get a 10, 9, 8, 7, 6... [51:55.850 --> 51:56.930] I mean, Jade's typing. [51:56.930 --> 51:59.150] Oh, okay. Alright. [52:00.090 --> 52:01.830] Ooh, AngelRain's typing. [52:04.190 --> 52:07.090] Maybe if I just keep saying people are typing, I'll get more and more. [52:07.090 --> 52:09.730] Maybe they'll just start typing and never fill it. [52:10.570 --> 52:12.050] Alright, to what extent [52:12.710 --> 52:16.190] admitting a failure can be used as an out? [52:17.270 --> 52:19.370] So, I wouldn't ever consider [52:20.770 --> 52:23.750] a flat-out failure as an out. [52:24.170 --> 52:26.030] There have been times where I have [52:26.030 --> 52:28.090] set up for an effect [52:29.230 --> 52:31.570] and you're so far in it. [52:31.570 --> 52:34.170] It's like where you're at the table and you need to turn over the card [52:34.170 --> 52:36.890] and it has to be your thing. And there have been some times [52:38.170 --> 52:38.990] years ago [52:40.110 --> 52:43.110] where I've turned that card over and it's the wrong thing [52:43.110 --> 52:45.230] and there's just no way of getting back to it. [52:45.230 --> 52:48.450] And I say, ladies and gentlemen, this is theater. It's live. [52:48.450 --> 52:50.190] I am so sorry. [52:50.590 --> 52:52.370] This is a fuck up. [52:53.170 --> 52:56.270] And every magician this has happened to. [52:56.950 --> 52:59.630] But ideally, if you have [52:59.630 --> 53:01.230] even the smallest window [53:01.230 --> 53:03.790] or where you can be clever about something [53:05.550 --> 53:08.630] you rarely have to accept failure. [53:08.850 --> 53:11.730] If I'm doing something that is dramatic [53:11.730 --> 53:15.190] and there is a lot of intention and emotion [53:15.190 --> 53:17.950] behind a certain moment or meaning behind something [53:19.690 --> 53:21.010] artistically, I make the decision [53:21.010 --> 53:23.790] to take the fall and the full blame of it. [53:24.730 --> 53:26.970] Similar to singing a horrible note [53:26.970 --> 53:29.790] on stage and you just kind of go [53:29.790 --> 53:32.490] I'm sorry, but I have my artistic integrity [53:32.490 --> 53:35.730] and I'm not going to do jazz magic over this to try to recover. [53:38.770 --> 53:39.750] I think [53:39.750 --> 53:41.550] that might be it. [53:42.610 --> 53:44.650] But thank you 0x90. [53:44.730 --> 53:47.490] Oh wait, sorry, this will be the last one. [53:47.490 --> 53:50.230] And then we'll cut it after this so we can feel them in the Discord. [53:51.050 --> 53:54.730] But this is a good one to end with. Who inspires you the most? [53:55.390 --> 53:56.210] Jeez. [53:57.730 --> 54:00.930] This is a really, really good question. [54:01.450 --> 54:03.490] I have a couple of answers for this [54:03.490 --> 54:06.090] but just to keep this short [54:06.090 --> 54:09.050] I would have to say the late Ricky Jay [54:09.050 --> 54:10.910] and the late Johnny Thompson. [54:11.290 --> 54:15.530] Both different worlds, different styles of performing [54:16.630 --> 54:17.990] but reading [54:17.990 --> 54:21.350] Ricky's depth of knowledge [54:21.350 --> 54:22.450] and how much he [54:23.770 --> 54:26.150] is passionate about his craft [54:26.150 --> 54:29.770] and elevating it to the level of art is beautiful to me [54:29.770 --> 54:33.390] and Johnny Thompson being this [54:33.390 --> 54:36.670] encyclopedia of magic where he knows just about everything [54:36.670 --> 54:39.410] and he's very good and cares about things deeply [54:39.410 --> 54:44.090] but they approach it differently. [54:44.090 --> 54:46.010] Johnny Thompson is about making sure people are [54:46.010 --> 54:47.610] entertained and doing it well [54:47.610 --> 54:49.430] and Ricky Jay is about the [54:51.870 --> 54:53.630] total experience of theater [54:54.190 --> 54:57.970] and he sees this theater that he alone sees in his head. [54:57.970 --> 55:00.790] It's just him. And he has this idea of what makes it perfect [55:00.790 --> 55:04.810] and he's very aggressive about it and I love it. [55:07.050 --> 55:09.290] Sorry, I lied to you. Last one. [55:10.410 --> 55:13.370] But AOD wants you to speak to the idea [55:13.370 --> 55:16.030] that a magician can sneak out of a failure [55:16.030 --> 55:19.010] because the audience doesn't know [55:19.010 --> 55:20.730] exactly what's supposed to happen. [55:21.690 --> 55:23.090] Yeah, exactly. [55:24.630 --> 55:27.750] Don't run when no one's chasing you. [55:27.750 --> 55:31.610] If I pull out a card [55:31.610 --> 55:33.330] and it's like the reveal [55:33.330 --> 55:36.910] and I know it's not it. I figured it out. [55:36.910 --> 55:38.330] That is not it. [55:38.890 --> 55:41.670] You can attempt to backtrack. [55:43.670 --> 55:45.530] There are effects. [55:45.530 --> 55:47.590] There's a thing called an invisible deck. [55:47.590 --> 55:49.270] It's wonderful and it allows you [55:52.730 --> 55:54.850] to summon any card [55:55.910 --> 55:58.570] For example, if you ever screw up so badly [55:58.570 --> 56:02.230] that it's irredeemable, you can keep something like that on your person [56:02.230 --> 56:05.270] and just be like, well, actually I did this. [56:05.270 --> 56:07.590] And then you did this whole other effect. [56:07.590 --> 56:10.310] You can always move on to something else. [56:10.310 --> 56:13.830] No one knows that you're about to have the card come to the top of the deck [56:13.830 --> 56:17.010] 47 times in a row. Maybe on the 22nd one [56:17.010 --> 56:19.430] you screw it up [56:19.430 --> 56:22.190] and you can just move into something else. [56:22.190 --> 56:25.370] You can just make a joke about it and be like, I guess it died after 21 [56:25.370 --> 56:28.590] and move on. And it depends on your personality. [56:28.850 --> 56:32.050] And honestly, the calmer you are [56:32.050 --> 56:34.730] the more ready you are to accept [56:34.730 --> 56:37.730] something getting screwed up and just moving on with it [56:37.730 --> 56:40.470] people will never remember it. People seldom [56:40.470 --> 56:43.090] I have come off of [56:43.090 --> 56:46.970] so many performances where I screwed one thing up [56:46.970 --> 56:48.410] and I had to recover like that [56:48.410 --> 56:51.150] and it affects me to the point where [56:51.590 --> 56:53.050] I become so upset [56:53.050 --> 56:57.450] like I need hours by myself to think about [56:57.450 --> 56:59.330] how I'm such an idiot and I screwed something up [56:59.330 --> 57:03.370] and I've never had a single person ever point it out [57:03.370 --> 57:05.750] and even professional magicians [57:05.750 --> 57:07.990] I'm like, yeah, but I did this and I screwed this thing up [57:07.990 --> 57:11.170] and they're like, oh, I thought you were just going into this effect that way. [57:11.190 --> 57:15.250] I had no clue. No one cares. No one's chasing you. [57:16.490 --> 57:17.650] Awesome. [57:17.770 --> 57:21.910] That will conclude our Q&A portion for this talk. [57:21.910 --> 57:24.230] Thank you, RX980, for everything. [57:24.410 --> 57:25.770] Yeah, thank you.