WEBVTT 00:04.210 --> 00:06.750 Hey, how's it going, DEF CON? 00:07.430 --> 00:16.250 Super excited to get to talk to you guys about one of these things I'm passionate about, which just happens to be security and magic. 00:17.470 --> 00:23.930 Today, we're going to be going over Outposts, Forces, and Equivocates, a treatise on how magicians speak. 00:23.930 --> 00:25.790 I learned that word all by myself, too. 00:25.790 --> 00:27.130 I'm very proud of it. 00:28.050 --> 00:30.390 But let's go ahead and get started here. 00:31.690 --> 00:39.010 So, starting off, I'm hex 90, no-op, not 0x90, whatever you want to call me. 00:39.010 --> 00:40.230 I don't really care. 00:40.230 --> 00:41.570 I'm a magician. 00:41.630 --> 00:43.650 I'm also a full-time software engineer. 00:43.650 --> 00:57.250 I have a background in security, love to break things, and most importantly, I don't need more than my current 200 Twitter followers, so no need for any handles or anything. 00:57.250 --> 01:05.610 But overall, a fairly unremarkable person, and you don't need to worry about it. 01:05.890 --> 01:28.950 What this talk is, I want to cover three major tenets within magic, specifically how we handle choices and how we handle making people feel like they're making choices, but ultimately, it's either something in our favor or something that we want to happen. 01:29.990 --> 01:35.330 So, we're going to be covering forcing, multiple outs, and equivocates. 01:35.330 --> 01:46.630 The interesting thing about these three techniques is that they're all super similar, but they do have some small key differences that make them worth talking about as an individual concept. 01:47.910 --> 01:51.610 Going forward, what this talk is not going to be... 01:52.390 --> 01:59.610 I don't want to feel like I'm giving people permission to heckle performers. 01:59.830 --> 02:11.870 Performing is extremely difficult, and honestly, if you have an interest in magic, the time to do it is not during a performance or a show. 02:11.870 --> 02:16.450 Honestly, a lot of magicians are pretty down-to-earth people. 02:16.450 --> 02:24.230 They're just people who are just as nerdy as you or I, just kind of doing a thing that they love. 02:24.230 --> 02:30.770 So, if you have an interest, honestly, take a magician aside, say, hey, I think that's really cool, and I want to try it. 02:30.770 --> 02:36.790 And they'll more often than not give you some cool books or some tips on how to get into magic. 02:36.790 --> 02:45.150 And I think that's really awesome because we're a really open community, but please don't harass them because you know how to do some stuff now. 02:46.450 --> 02:54.970 Also, this talk isn't about any secretly documented human cheat codes to make people act in ways that they normally wouldn't. 02:54.970 --> 03:06.190 You're not going to get someone to act against their interests by saying some magic words or hit some crazy synapses that are going to make them all of a sudden forget who they are. 03:06.290 --> 03:17.950 This is all very real, well-published, at least in the magic world, techniques that present the illusion of choice while you remain completely in control. 03:18.450 --> 03:23.050 I also want to take a moment to address the fact that we have... 03:23.050 --> 03:25.610 I am not in control of the slideshow right now. 03:25.610 --> 03:27.670 So, I'll be saying, next slide. 03:27.670 --> 03:32.230 And I'm sorry, it's not the most beautiful thing in the world, but I don't have a clicky thing. 03:32.450 --> 03:33.910 So, I won't be able to do that. 03:33.910 --> 03:42.150 And also, quarantine has made it so this week has been the most human interaction I've had to deal with in like six months. 03:42.150 --> 03:46.990 So, I apologize if I sound less than human. 03:47.150 --> 03:51.170 But let's go ahead and hit the first term. 03:51.930 --> 03:54.270 So, forces. 03:54.910 --> 04:02.410 Essentially, a force is the appearance of different values to be chosen, but through subterfuge, the only option is a single choice. 04:02.630 --> 04:05.790 This is when other choices cannot be selected. 04:05.790 --> 04:13.310 This is... I have 52 cards, and I really, really need someone to pick a specific thing. 04:13.650 --> 04:20.570 It's when you have no option but the primary choice that you want them to select. 04:20.610 --> 04:21.950 Can we go to the next slide? 04:23.470 --> 04:26.210 A super over-the-heads term. 04:26.690 --> 04:34.790 And honestly, next time you have an opportunity to do a coin flip, go ahead and try to say this, but tails I win, heads you lose. 04:37.010 --> 04:44.610 Very quickly, if you read it, it's easy to see how obvious that is. 04:44.770 --> 04:46.790 But ultimately, this is a force. 04:46.790 --> 04:51.410 There's no other option but to have them pick a wrong choice here. 04:51.550 --> 05:00.190 And if you actually try this, and you have confidence in your language, you'd be surprised with how many times you can actually get away with this. 05:00.190 --> 05:04.530 It's pretty fun, especially if you need to settle any bets within a bar. 05:05.830 --> 05:10.590 The next slide, we have multiple outs. 05:10.870 --> 05:20.290 This is the appearance of free choice, but ultimately all the possibilities, all the possible decisions are accounted for and expected. 05:20.350 --> 05:30.430 This is used when you need a freedom of choice, and they need to actually feel like they have a free choice, like everything is fully free. 05:30.430 --> 05:46.550 And the reason why you want to do this is just sometimes when you're forcing someone to pick a specific thing, unless that force is perfect, and it's designed for the situation, you can start to pick up on it. 05:46.550 --> 05:53.010 You can kind of detect something in your brain goes off and says, I'm being told to do something that I might not want to do. 05:53.010 --> 05:55.490 And there's an instant fight response. 05:55.490 --> 06:03.990 But if the pressure is no longer on the decision, and it's on the response, then you can get a little more into this. 06:04.390 --> 06:15.190 And if we go to the next slide, Penn and Teller, a while ago, they had the perfect example of multiple outs. 06:15.350 --> 06:18.990 They had a special called Penn and Teller off the deep end. 06:19.210 --> 06:34.550 And to give you an idea of how long ago this was, Aaron Carter was also on this special, and he sang a song underwater while they did magic tricks with scuba diving, as well as a bunch of other stuff on the beach. 06:34.550 --> 06:49.790 But one of the effects that they did was they had 52 reveals, which is sewing a playing card into your jacket, hiding a giant card in a pot of plants, kids having them written on them in sunscreen. 06:49.790 --> 07:04.290 They had 52 different values that they could potentially reveal, and essentially they had someone selecting a completely random card and naming it, and then suddenly they knew where it was, or they knew how to reveal it. 07:04.290 --> 07:14.430 And it made it seem like this was the only option that could have happened, because who would really set up 52 possible answers for this? 07:14.430 --> 07:22.310 And I think what they did was a perfect example to show the idea of what a multiple out is. 07:22.590 --> 07:24.170 Next slide. 07:25.310 --> 07:26.410 Equivocate. 07:26.490 --> 07:29.710 Equivocate essentially just means double entendre. 07:29.710 --> 07:31.710 I think it sounds cooler. 07:32.230 --> 07:43.990 But ultimately, you're using open-ended questions and vague language to create ambiguity around choice or knowledge, and I'm seeing that there's a typo in this slide, and I'm kicking myself, but I love it. 07:44.710 --> 07:53.410 You also use it when you need to control the perception of information, even having different definitions between different people. 07:54.790 --> 07:58.190 In magic, this is called dual reality. 07:58.190 --> 08:05.790 This allows you to have the same sentence, based on the context that two people are coming from, view it differently. 08:05.790 --> 08:18.850 And I feel like the equivocate is probably one of the most powerful terms when it comes to controlling decisions coming from people, as well as it's the most applicable to social engineering. 08:19.730 --> 08:27.710 And it's actually one of the many reasons why magicians won't perform a trick twice, very similar to multiple outs. 08:27.730 --> 08:36.190 Everyone's heard one of the rules of magic is you never perform a trick twice, and equivocates and multiple outs are a part of that. 08:36.190 --> 08:47.790 If you do the same effect, but you have to go a different direction, and someone's seeing it twice in a row, they're going to easily be able to pick up that there's two different paths that they possibly could have gone down. 08:47.790 --> 08:50.170 And it kind of does damage to the effect. 08:50.170 --> 09:01.010 As well as if you view magic like a joke, you wouldn't say the same joke twice in a row because everyone knows what the punchline is going to be, and it becomes substantially less special. 09:01.170 --> 09:08.790 But the example for equivocate, if we go to the next slide, is are you right-handed or left-handed? 09:08.790 --> 09:17.350 And if they respond left, then you say, great, I need this hand to be loose, so let's use your non-dominant hand because we want them to be using their right hand. 09:18.390 --> 09:24.670 But alternatively, if they would have said right, and you go to the next slide, are you right-handed or left-handed? 09:24.670 --> 09:33.410 And they say right, then you say, great, I need this hand to be strong, so let's go ahead and use your dominant hand. 09:33.850 --> 09:41.010 And if you notice here, if you saw these questions side-by-side and they're answered the same way, that would ruin this effect. 09:41.010 --> 10:00.230 But because of the vague language and the lack of intent being posed in the question, you can't actually tell what the reasoning is for the question, and so the answer doesn't seem so alien, but it is a little bit when you set them side-by-side. 10:00.450 --> 10:02.430 Let's go ahead and go to the next section. 10:04.130 --> 10:07.030 So how do these terms work? 10:07.030 --> 10:11.650 How come people don't instantly call a bull on a lot of this? 10:12.510 --> 10:15.910 And ultimately, it's not voodoo. 10:15.910 --> 10:18.010 There's no real magic here. 10:18.010 --> 10:21.250 You're simply taking advantage of people's laziness. 10:21.390 --> 10:27.890 There's a book actually called The Paradox of Choice, Why More is Less, and that was written by Barry Schwartz. 10:27.890 --> 10:31.870 And in it, he talks about the decision-making process that people have. 10:31.870 --> 10:44.870 And it's primarily about consumerism, but also in the book, it shows that people are less happy with their choices when there are too many, and often they'll take a lot longer to make a simple choice. 10:44.870 --> 10:52.950 So people much prefer to choose from three flavors of candy versus 50, because if they pick from 50, they're always going to be semi-disappointed. 10:53.990 --> 11:03.870 And the perfect example of this is anyone that's had to coordinate, especially now with Zoom calls, coordinate a time with multiple people. 11:04.290 --> 11:06.810 Anytime you ask, hey, what time works for everyone? 11:06.810 --> 11:15.130 Because you want to be a decent human being, and you want to accommodate everyone, it's going to result in a conversational gridlock. 11:15.390 --> 11:21.690 And this is because you have an infinite amount of times that could be selected. 11:21.690 --> 11:26.070 I can't imagine people are like, oh, yes, I want to meet at 12 p.m. 11:26.070 --> 11:27.750 and 16 picoseconds. 11:27.750 --> 11:29.950 But in theory, you could. 11:30.770 --> 11:34.490 And instead, if you say, hey, should we meet at 10 a.m. 11:34.490 --> 11:35.250 or 6 p.m. 11:35.250 --> 11:37.270 instead of what time works for everyone? 11:38.130 --> 11:41.050 More often than not, you're going to get an answer much quicker. 11:41.050 --> 11:43.610 Everyone's going to be able to come to a decision quicker. 11:43.610 --> 11:48.050 They won't always be exactly the times that you requested, but people will come. 11:48.530 --> 11:59.670 They will coalesce into a single time a lot faster because they're able to take that information and they pose it as a question to themselves as how does this apply to me? 11:59.670 --> 12:05.870 And how can I fit into this instead of also trying to account for all these external factors? 12:05.870 --> 12:18.150 And by limiting choices, you make people feel more confident in their choices instead of making it this open-ended world. 12:18.310 --> 12:34.630 And another issue with using equivocate or using multiple outs or even forces is that some of these methods can leave a trail of word crumbs that you can easily backtrack to figure out that there was manipulation. 12:34.670 --> 12:46.050 So if you were to rewatch a Zoom call where an equivocate was used, you could potentially figure out how vague that language is after the fact. 12:46.050 --> 12:56.370 Sometimes in the moment, you won't necessarily see that happening, but after the fact, you might be able to backtrack on it. 12:56.590 --> 13:04.670 But in that moment, you also want to avoid people being able to find and pick up on those word crumbs and backtrack on that conversation. 13:04.850 --> 13:10.210 And the way magicians get around this is we create little memory snapshots. 13:10.310 --> 13:16.610 So let's say we had to do a deck switch and do all these other crazy things. 13:16.690 --> 13:27.370 Instead of highlighting that moment of the deck switch, we're going to try to mentally have the picture that your mind takes, the thing that you remember, be much different. 13:27.490 --> 13:32.390 That's also why people, magicians at least, they'll work on blocking out their props. 13:32.810 --> 13:47.830 So for example, we had a magician who came on and he did a Zoom show, and part of it is he has a card under a box, and he wants you to make sure that you see that card and you remember it, and you remember that it didn't move. 13:47.830 --> 13:57.930 And that's very important because when you go back in your inferring method, you don't want to have your audience get distracted on that. 13:58.010 --> 14:06.910 And the way we do this is we reiterate on stories that we wanted to happen, not necessarily what exactly happened, but what we want to happen. 14:07.370 --> 14:10.530 And then we also let the manipulations fade into the background. 14:10.530 --> 14:12.890 We stop drawing attention to them. 14:13.570 --> 14:20.770 If I'm doing an effect where I need to choose someone's right hand or left hand, I'm not going to go back and say, and remember when I had you pick your hand? 14:20.850 --> 14:23.090 We're going to pretend like that never happened. 14:25.110 --> 14:32.430 And another misconception here is that misdirection is used, but it's not used in the way people think about it. 14:32.430 --> 14:39.490 A lot of people think misdirection is, hey, look over there, and then something sneaky happens over here. 14:39.490 --> 14:45.450 What actually happens with misdirection is you have something that you want to hide. 14:45.450 --> 14:48.010 You want this to be in the shadows, not in the light. 14:48.070 --> 14:53.570 So you make something interesting happen over here instead, and your focus comes here. 14:53.570 --> 14:57.990 And then this thing, it drops away into the background. 14:57.990 --> 14:59.730 And you can do this verbally. 14:59.730 --> 15:00.750 You can do it with props. 15:00.750 --> 15:02.530 You can do it with stage direction. 15:02.530 --> 15:16.790 If you've ever watched live theater before, even without magic, you'll notice when there's a monologue or something happens and they're bringing everyone to the front of the theater, things in the background start vanishing and they're pulling objects off of the stage. 15:16.790 --> 15:20.930 Maybe cast members are disappearing because they're changing out a set piece or something. 15:21.010 --> 15:23.710 But that's not because they're trying to misdirect you. 15:23.710 --> 15:25.390 They're not trying to fool you. 15:25.390 --> 15:34.850 They're simply encouraging you to keep your attention elsewhere, but they don't have to do it with a trick or like a, hey, look over here and ring a bunch of keys in your face. 15:34.850 --> 15:41.970 And that's a very important thing when it comes to making that snapshot, because if you're really aggressive with that, you will fail. 15:41.970 --> 15:49.970 And that's how people can backtrack, whether it's in a magic trick or whether you're doing this in a social engineering setting. 15:50.150 --> 15:52.570 If you could go ahead and hit the next slide. 15:53.830 --> 15:59.250 Now let's get into actual applications of these three concepts. 15:59.690 --> 16:01.770 Magical applications of forces. 16:02.610 --> 16:05.210 Obviously, there's a card force. 16:05.210 --> 16:11.810 If I have, let's say, a duplicate of a card somewhere, and maybe it's in my pocket or something. 16:12.350 --> 16:22.290 And I want to do this really seamless effect where I have a card selected, and then it goes back in the deck, and then without bringing my hand near it, I can pull it out of my pocket. 16:22.290 --> 16:24.210 That's a very simple way. 16:24.210 --> 16:26.730 But there's many ways to force a card. 16:27.750 --> 16:30.690 The classic of all forces is exactly that. 16:30.690 --> 16:31.990 It's the classic force. 16:32.490 --> 16:38.910 And it's the idea of timing it in such a way that when they go, that they naturally select it. 16:38.910 --> 16:44.810 And this is something that takes decades of practice, and it's something that I continuously am working on. 16:44.810 --> 16:49.010 There's also methods of sleight of hand for forcing a card. 16:49.110 --> 16:55.570 And there are books and books and books written on this subject for actually learning this. 16:55.570 --> 17:02.590 And if you guys are interested, I'm happy to show a few methods later after the Q&A is going on. 17:03.070 --> 17:06.650 There's also a billet or an object force. 17:06.650 --> 17:10.150 So this is one that I think actually applies more to... 17:10.150 --> 17:14.850 that could be used better for social engineering or an offensive attack. 17:14.850 --> 17:21.890 But a billet is essentially a folded piece of paper that might have a piece of information on it. 17:21.890 --> 17:29.090 And commonly, if you need to force something, you might allow your audience to collect and write a bunch of things down to get put into a box. 17:29.090 --> 17:40.730 But maybe that whole box gets switched out, or maybe there's a special gimmick with the box that allows when you open it, you can go in and you're only going to pull out the ones that you want. 17:41.230 --> 17:48.590 And that's really important to take notice of because you can do this with pieces of paper, you can do it with small objects. 17:49.390 --> 17:53.310 And of course, the last one here is a pattern force. 17:53.490 --> 18:06.510 This was less about swapping out an object that you're providing and more about swapping out information that a spectator is providing for you. 18:06.510 --> 18:16.710 So let's say we have someone who mixes up a Rubik's Cube behind their back, they're unaware of what that information might be, and then they bring it forward to you without looking at it. 18:16.710 --> 18:27.290 And you're able to put something like a shell over it, or something that allows you to change the values in it to something that you want to get to a specific value. 18:27.290 --> 18:37.890 And essentially in real life, if you think about it, this would be like if someone was able to generate a random value that they weren't able to look at, and then they gave it to you and you said, ah, yes, your random value is three. 18:37.890 --> 18:39.170 Of course it is. 18:39.610 --> 18:42.470 And that could be very damaging. 18:42.590 --> 18:46.750 I can only imagine the type of nonsense that could happen with crypto on that. 18:46.810 --> 18:48.250 If we could go to the next slide. 18:49.710 --> 18:52.350 Some IRL applications of forces. 18:53.890 --> 18:58.710 So there's a bunch of different ideas and you can get as cheeky as you want. 18:59.130 --> 19:01.390 And I just came up with a few. 19:01.390 --> 19:03.590 These are, of course, theoretical. 19:03.590 --> 19:07.190 I'm coming from a magic perspective, but I also like to break things. 19:07.190 --> 19:19.990 So I haven't actually had an opportunity to do any red teaming myself, but I have done lots of security contracting with black box and white box penetration tests. 19:20.150 --> 19:28.870 And a lot of these concepts could easily apply and leak in to a social engineering concept because they do work so well in magic. 19:28.990 --> 19:45.610 But when you're comparing forces in magic to forces in real life, I realize that forces are best used for getting objects in people's hands, thinking that they have chosen them from a group, that this is the object that's in their best intention. 19:46.470 --> 19:53.170 Like imagine going to a used car lot and for some reason they want you to take this specific car. 19:53.170 --> 20:00.890 You're like, I want this model, and you have three of them, and they're all the same color, but why do you want me to have this one? 20:00.890 --> 20:07.150 And of course, that should throw some red flags, but there might be reasons for wanting to do that. 20:07.150 --> 20:10.090 It might be advantageous for them to get it off the lot for whatever reason. 20:10.090 --> 20:14.030 It might even be benign, but you never know. 20:14.150 --> 20:34.610 And some other applications of forces, for example, if you had a batch of benign USB sticks and then you had a batch of USB sticks that had, for example, a human interface device attack on it, something that's going to simulate a keyboard and open up the terminal and it's going to do lots of terrible stuff. 20:34.610 --> 20:36.450 I've written plenty of them. 20:37.070 --> 20:41.110 If you ever get into hit attacks, they're a lot of fun. 20:41.530 --> 20:57.470 But if you only want a specific person to get them, imagine if you're able to be a vendor at a party or you're able to pose as a vendor at a party, and everyone's getting their things and you could do some sort of grab bag switch, which is super common in Magic. 20:57.550 --> 21:06.930 They look very benign, but it basically makes it so certain people can choose from one compartment and another person can only choose from a specific compartment. 21:07.290 --> 21:13.550 And it's a great way to get people to select a specific object. 21:13.850 --> 21:16.270 Also, rigging a contest. 21:16.970 --> 21:27.830 If you think about something like the lottery, the whole lottery is based around making sure that you can't force the value of the ping pong ball. 21:27.830 --> 21:29.410 I don't know if they still do that. 21:29.410 --> 21:39.250 But if you're able to force that value or force the object of it, that's all game over, really. 21:39.330 --> 21:52.730 Another example is if you could easily, using a cross-site scripting exploit on a website, you could change all of the link values on a website and point it towards malicious software. 21:53.510 --> 22:01.910 And, of course, you can point it to a phishing website, you can point it to a piece of software, malware, whatever you want. 22:02.570 --> 22:05.970 But, of course, you're taking this environment of open choices. 22:05.970 --> 22:10.390 They think that they can go anywhere, but, of course, you're forcing them into a funnel. 22:10.390 --> 22:12.410 They're forcing them to a single choice. 22:12.410 --> 22:31.550 And then for a social engineering application, if you had, for example, a small directory of people, all with different phone numbers and names, and these are all your teammates, well, if you get caught in an attack or someone wants to verify your credentials, 22:31.550 --> 22:40.910 and instead of saying, here's my boss, go ahead and call him, you're like, here's my team, I don't have time to deal with this, because now you're putting weight on them. 22:40.910 --> 22:42.390 But you're like, I don't have time to deal with this. 22:42.390 --> 22:44.790 Go ahead and call one of them and they'll verify. 22:45.090 --> 22:55.670 Well, they're ultimately going to end up with the same person, but that illusion of choice, it makes it seem there's a legitimacy behind quantity. 22:56.490 --> 23:14.570 Because if I was a vendor, and it's the difference between going into a place and handing out a handful of flash drives from a baggie, and then having a box of 2,000 of them, one of them, you're going to go, okay, that guy's clearly handing out viruses, 23:14.570 --> 23:21.250 and another one, you're going to go, oh, maybe who's going to create 2,000 pieces of malicious hardware? 23:21.390 --> 23:22.350 I mean, I might. 23:22.350 --> 23:24.190 That sounds like a great attack, actually. 23:24.430 --> 23:26.150 Expensive, but it could be useful. 23:27.110 --> 23:29.150 If we could go ahead and get to the next slide. 23:30.830 --> 23:33.310 And the magic applications of multiple apps. 23:34.030 --> 23:37.870 There's a couple of... there's hundreds of tricks. 23:37.870 --> 23:39.250 There's thousands. 23:39.250 --> 23:46.690 You can find these in books everywhere, but I actually came up with a small little bar bet for this. 23:46.690 --> 23:48.270 And the idea is pretty simple. 23:48.470 --> 23:58.610 If you play a game of rock, paper, scissors, and the proposition is, I am going to win this game of rock, paper, scissors on the first round. 23:58.770 --> 24:02.050 And ultimately, whatever you do, you just pick rock. 24:02.050 --> 24:10.250 So if they go rock, paper, scissors, and this person picks rock, well, the idea is you can say, I told you I was going to win on the first round, and that's why I chose paper. 24:10.250 --> 24:15.070 And all you do is you have a piece of paper in your hand because they chose rock. 24:15.410 --> 24:17.830 Now, let's say they went ahead and they chose scissors. 24:17.830 --> 24:19.590 Of course, you win because it's rock. 24:19.590 --> 24:26.170 And if they went ahead and they chose paper to cover you, unfortunately, on your paper, you do have scissors. 24:26.170 --> 24:34.170 I don't know if that can make it out, but essentially, you understand the constraints of where you're in. 24:34.170 --> 24:36.630 They have three choices to pick from. 24:36.650 --> 24:44.590 And of course, it's a con, and you're more likely going to get punched than rewarded, but maybe you'll get a good laugh out of it. 24:45.370 --> 24:57.150 But the idea is that you see the constraints where they have three choices, and you're able to account to every single one of them and make it work in your favor, even if it is going to get you punched in the face. 24:57.810 --> 25:00.290 Another one, this is a classic effect. 25:00.290 --> 25:02.370 There's a queen's holdout. 25:02.510 --> 25:08.550 So if you were to have four queens, what you can do is you can get these sleeve garters . 25:08.610 --> 25:10.490 You can even do it with a rolled cuff. 25:10.490 --> 25:14.170 But essentially, you put these queens in your sleeve garter. 25:14.170 --> 25:17.670 They're pinned to your arm, and you spread them like so . 25:17.910 --> 25:19.990 And I'll put them in a specific order. 25:19.990 --> 25:21.170 It's called chased order. 25:21.170 --> 25:23.830 It's clubs, hearts, spades, and diamonds. 25:24.150 --> 25:33.870 And all you do is you have these on your sleeve, pinned, and in an effect, you can have a queen freely named and claim it's in your pocket. 25:33.930 --> 25:49.370 And when you open up your jacket, instead of reaching into the pocket, you reach into the sleeve, and you can feel the index and easily pull out whatever specific queen it is, deposit it in your pocket as you're opening up your body language a little more, 25:49.370 --> 25:51.070 revealing the queen. 25:51.070 --> 25:57.010 And of course, the first thing that's going to happen is people are going to say, there's more than one queen in there. 25:57.050 --> 25:59.550 So you can easily empty that pocket completely. 25:59.630 --> 26:05.890 Then they might imply that you have a queen in each pocket, and you're just going to change pockets, which you can also easily disprove. 26:05.890 --> 26:17.790 And this is a good example of an out, because they feel like everything is clean, everything's happening into a single location, but you've been able to determine that there are four choices. 26:17.790 --> 26:29.490 One of them has to end up here, and you know a way to account for all of them, whether it's through verbiage or it's through a physical manipulation, albeit this one is very simple. 26:30.490 --> 26:33.630 And then this is a classic, classic in Magic. 26:35.010 --> 26:40.310 You have them name any card, and you weren't ready for the one they named. 26:40.990 --> 26:47.610 Often, what I'll do is I will stack my deck, but not in all 52 kind of way. 26:47.610 --> 26:55.490 I will do something like a Queen of Hearts on top, and like a Jack of Spades on the bottom, and then maybe in my pocket I might have an Ace of Spades. 26:55.830 --> 27:01.070 And I just have a mental catalog of what cards get named the most. 27:01.610 --> 27:05.870 Usually one of those, sometimes like a King of Clubs might get thrown in there. 27:05.870 --> 27:07.570 And it depends on the person, really. 27:08.150 --> 27:18.830 But if I'm ready with that Queen of Hearts on top, and I have something that can blow someone's mind if I have them name a card that I know is on the top of the deck, then if they name it, great. 27:18.830 --> 27:22.390 If they name one of the other cards in a different position, I work with that. 27:22.430 --> 27:27.450 But if they don't name anything, it's not like there's this massive failure. 27:27.450 --> 27:29.250 You don't know what my intention was. 27:29.790 --> 27:36.690 If you went ahead and you named the Nine of Spades, then I just go ahead and go, okay, we'll use your free selected card. 27:36.690 --> 27:38.150 This is the one you were thinking about. 27:38.150 --> 27:39.630 Now let's work with this. 27:39.630 --> 27:41.470 There's no force in there. 27:41.470 --> 27:44.710 There's nothing that can make them go, oh, that was weird. 27:44.710 --> 27:46.830 It's just, I'm having you select a card. 27:46.830 --> 27:48.530 You don't know what's about to happen. 27:48.550 --> 27:54.970 And that's something that happens a lot in magic is this concept of don't run when no one is chasing you. 27:54.970 --> 28:11.810 And I feel like social engineering can really gather a lot from that because when you're nervous, when you are trying to make excuses for everything, when something doesn't work exactly how you want it, that's when things fall apart. 28:13.550 --> 28:15.730 People are weird. 28:16.010 --> 28:18.390 People are just inherently weird. 28:18.650 --> 28:20.750 And take advantage of that. 28:20.750 --> 28:22.490 So no one is a mind reader. 28:22.490 --> 28:25.030 No one can see exactly what you're about to do. 28:25.310 --> 28:27.470 Don't run when you're not being chased. 28:27.610 --> 28:30.250 Let's go ahead and get to the next section. 28:30.350 --> 28:33.090 This is the IRL application of multiple outs. 28:33.130 --> 28:41.090 Originally, I said this as a joke, but Batman is the master of multiple outs, even the Adam West one. 28:41.230 --> 28:54.130 And if you see here, he has both he's clearly being attacked by a shark but he's ready because he knows, he's like, I'm going to be attacked by a manta ray repellent, by manta rays, or I'm going to be attacked by a shark. 28:54.130 --> 28:56.110 And so he has repellents for both. 28:56.330 --> 28:59.390 And if both of those don't work, then he has fists. 28:59.390 --> 29:03.030 Batman is the king of multiple outs. 29:03.030 --> 29:09.730 He is always ready for different scenarios, whether it's Joker toxins, or maybe just throwing someone off a building. 29:09.730 --> 29:10.850 Who cares? 29:10.850 --> 29:12.050 He's Batman. 29:12.050 --> 29:30.810 But in actual real life, if we go to the next slide, the IRL applications of multiple outs, a really good example that I've used when I've done phishing attacks on on jobs is multi-layer phishing attacks. 29:30.810 --> 29:44.730 More often than not, a phishing attack is, here's my website, I want someone to go to it, and I want them to get tricked into going in, and I want them to try to type in their information, and I want them to send it to me, and I want to log it. 29:45.670 --> 29:46.450 No. 29:47.030 --> 29:49.710 Phishing attacks need to get way more sophisticated. 29:50.390 --> 29:53.890 And through multiple outs, you could easily do that. 29:54.090 --> 30:02.970 So if you think about it, you need to figure out what are all your constraints, and how can you have an outcome that serves you the best. 30:02.970 --> 30:06.750 So if you take phishing websites, for example, think about the outcomes. 30:07.350 --> 30:09.250 One, they leave immediately. 30:09.450 --> 30:15.130 Two, they type in their info, then they read the URL at the last second, and then they leave. 30:15.190 --> 30:18.850 Or three, they fall for it completely, and then they send you your information. 30:18.850 --> 30:21.370 All of those... 30:21.370 --> 30:24.670 the only one that wins is the very last case. 30:24.670 --> 30:38.110 But if you think about it, what if you actually, when they type in their info, you have a JavaScript keylogger that is taking note of everything they're sending, and it's sending it off to a command server. 30:38.510 --> 30:39.590 Every time. 30:39.590 --> 30:41.950 Anytime you make a phishing website, put a keylogger on it. 30:41.950 --> 30:53.130 Because I have gone onto websites plenty of times, I start typing my username and password, and then the oh shit moment hits, and then I read the URL, realize I'm fine, and then I keep going. 30:53.470 --> 30:56.870 But if there was a keylogger on that, I'd be fucked. 30:57.650 --> 31:00.210 That would not be okay. 31:00.510 --> 31:21.810 And then also, another way to serve yourself a little bit better, if someone leaves immediately, instead of letting them just leave immediately, why not attempt to have a JavaScript popup that uses some identifiable trademark language or a company name information from your target, 31:21.810 --> 31:27.230 and it says, hey, we just detected that this is a phishing website. 31:27.430 --> 31:34.190 Go ahead and fill in this form with your name or your email or your phone and your extension. 31:34.190 --> 31:36.610 Get privileged information. 31:37.370 --> 31:41.590 You might not get credentials, but privileged information is also gold. 31:41.590 --> 31:47.230 Not everyone has an easy-to-access company directory where you can start flexing around and getting stuff like this. 31:47.230 --> 31:53.790 You can even have when they try to leave a JavaScript popup that says, great job, this is an internal test from the company. 31:53.790 --> 31:55.770 You passed our security audit. 31:55.770 --> 31:56.650 Congratulations. 31:56.650 --> 31:59.710 Fill in this form so we can make sure that your manager knows. 32:00.410 --> 32:01.110 Boom. 32:01.110 --> 32:14.370 Taking advantage of that desire to build and feel good about themselves, you've given them more, and all of these options are way better than it either works or it doesn't. 32:14.650 --> 32:24.910 And then, of course, there's the option that they might be able to realize that there's a scam within the scam and you can go as many layers deep as you want with this. 32:24.910 --> 32:30.470 You can even follow up with an email afterwards and be like, hey, we noticed this, and try to contact them directly. 32:30.750 --> 32:35.690 But ultimately, those three layers are better than the original one. 32:36.030 --> 32:50.590 And an example of doing this in the physical world is think about crash key sets where you have keys for all of the entry boxes in Los Angeles or all of the elevator keys. 32:50.930 --> 32:52.810 There have been so many DEF CON talks. 32:52.810 --> 32:54.690 There are so many keys available. 32:56.110 --> 32:58.630 Everyone is aware of these. 32:58.630 --> 33:00.530 There's also the TSA key pack. 33:00.530 --> 33:02.510 Oh, bless the TSA. 33:02.510 --> 33:03.970 They have made this so easy. 33:03.970 --> 33:13.570 They took the constraint of everyone in an airport has to have a bag with a lock that fits this constraint. 33:14.770 --> 33:19.670 What type of outs do you need to have to make sure you can manage everything in this constraint? 33:19.670 --> 33:21.170 The TSA key pack. 33:21.230 --> 33:27.270 You get a copy of each one of those keys and suddenly you have an out for every single lock. 33:27.470 --> 33:31.870 And this works, of course, for other different systems. 33:32.610 --> 33:41.130 And you can just kind of view that exercise of think about challenges in a security scenario where you say, what are the constraints? 33:41.130 --> 33:42.250 How many choices are there? 33:42.250 --> 33:44.470 What are all the permutations of this? 33:44.750 --> 33:48.190 And how many can I realistically have a response to? 33:48.290 --> 33:51.090 And then how many can you do if you're being unrealistic? 33:51.190 --> 33:55.850 Maybe it takes having 400 different ISP uniforms in a van. 33:56.050 --> 33:56.550 Screw it. 33:56.550 --> 33:58.790 If it gets you in the building, it gets you in the building. 33:59.610 --> 34:07.290 Basically, any plan B attacks or additional layers in real life, that makes for a good multiple out. 34:07.430 --> 34:08.630 Can we get the next slide? 34:10.970 --> 34:13.290 So stage whispers. 34:13.290 --> 34:18.410 This is actually something that's used in both magic and also just on stage. 34:18.430 --> 34:24.650 Normally, a stage whisper on stage is just like you're communicating a direction that the audience isn't supposed to know about it. 34:24.650 --> 34:29.330 You can have full conversations on stage depending on the size of where you're at. 34:30.930 --> 34:35.870 But in magic, a stage whisper is you call up an audience member. 34:35.890 --> 34:38.770 You don't make a fanfare or anything. 34:38.770 --> 34:40.090 You bring them up. 34:40.090 --> 34:44.430 And while you're bringing them up, you look them in the eyes helping them up and you say, what is your name? 34:44.430 --> 34:45.510 But you don't say it loudly. 34:45.510 --> 34:46.830 You don't move your mouth a whole lot. 34:46.830 --> 34:47.950 You don't articulate. 34:47.950 --> 34:50.750 They say, I'm John. 34:50.970 --> 34:53.830 And you pull them up and you do a magic trick. 34:53.830 --> 34:55.990 You do whatever, maybe it's a mentalism piece. 34:56.230 --> 35:02.190 And you're doing your mentalism piece and then you say and your name is John. 35:02.190 --> 35:07.830 And everyone loses their mind when they nod because you've just figured out their name. 35:07.830 --> 35:14.110 And then you quickly have to hush them because you're like, no, this isn't where the magic begins. 35:14.110 --> 35:15.650 I'm more magical than this. 35:15.650 --> 35:19.730 And to John, it just looks like you're telling them, oh no, that wasn't actually magic. 35:19.730 --> 35:21.730 But this is an example of a dual reality. 35:21.730 --> 35:28.090 This is where the audience thinks one very specific thing and John is aware of a completely different thing. 35:28.090 --> 35:33.350 But the thing is, is that you don't want John to be in on it. 35:33.350 --> 35:36.990 You want him to be an unwilling participant. 35:36.990 --> 35:40.190 And you're doing this with an ambiguity of language. 35:40.190 --> 35:42.350 You're doing this with an ambiguity of knowledge. 35:42.590 --> 35:48.570 Another effect, and this is a classic thing, you have a box set aside. 35:48.570 --> 35:52.390 You have a watch, a knife, and a card. 35:52.410 --> 35:58.510 And on the card, it simply says, I have the card, you have the knife, the watch is in the box. 35:58.650 --> 35:59.950 It's very simple. 36:00.190 --> 36:01.990 And you place these objects. 36:01.990 --> 36:04.030 You let your audience member shuffle them around. 36:04.030 --> 36:06.650 Your person that you're doing this is great for one-on-one. 36:06.650 --> 36:10.670 And you say, put both hands on any two of these objects. 36:10.670 --> 36:11.450 The box is set aside. 36:11.450 --> 36:12.570 It's not part of this. 36:12.970 --> 36:18.270 And let's say they put their hands on the knife and the card. 36:20.230 --> 36:27.110 And you go ahead and you say, okay, hand one of those to me and you take one, leaving the watch on the table and you go ahead and just put it in the box. 36:27.230 --> 36:30.690 If they get the card, you say, read what the card says. 36:30.690 --> 36:34.330 And then they read it out loud and all of the qualifications for it are true. 36:34.330 --> 36:37.830 If you end up with the card, you simply read it out loud. 36:37.830 --> 36:40.410 And all the qualifications are true because it's from your perspective. 36:40.610 --> 36:48.010 The only instance where it gets a little weird is if they put both of their hands on the watch and one of the other objects. 36:48.010 --> 36:51.850 But you say, okay, now go ahead and lift up one of your hands. 36:52.090 --> 37:01.250 And if they lift up the hand that's on the knife, you can go ahead and say, okay, we'll set these aside. 37:02.370 --> 37:04.950 And then the watch, I want you to put that in the box. 37:04.990 --> 37:09.310 If they lift their hand off of the watch, you say, okay, we'll discard the watch. 37:09.330 --> 37:18.650 And this gets back into the idea of you don't want to do the same trick twice because this is a perfect example of if someone watches this twice, it's instantly going to fall apart. 37:18.730 --> 37:32.330 But if you can present this well and you can present your equivocate well and your method for it and your language and your confidence in it and how much you believe what you say is happening is happening, it becomes the truth. 37:32.330 --> 37:33.810 It's no longer optional. 37:33.810 --> 37:34.950 It is the truth. 37:34.950 --> 37:43.790 And that's why magic magicians like Aaron Brown are so effective because when he speaks, it's the truth. 37:43.970 --> 37:46.270 And that's absolutely wonderful. 37:46.430 --> 37:50.410 And then another effect is called ashen hand. 37:50.550 --> 37:55.650 Earlier I did a slide where I asked if someone's right-handed or left-handed and it didn't matter. 37:55.830 --> 38:00.150 The reason for this is for an effect called ashen hand. 38:00.230 --> 38:03.590 What you do is you have someone put both of their hands out flat like this. 38:03.590 --> 38:06.910 And all you do is you grab their hand and you adjust them a little bit like this. 38:06.910 --> 38:08.450 You maybe move it lower or higher. 38:08.450 --> 38:10.550 You give some bullshit stage direction. 38:10.610 --> 38:17.510 And what you're doing is you're secretly depositing a little bit of ash on your finger onto their left hand. 38:17.510 --> 38:18.430 You can do it on their right. 38:18.430 --> 38:19.650 It doesn't really matter. 38:19.670 --> 38:22.630 But you're going to force one of those hands with an equivocate. 38:22.630 --> 38:25.530 And so let's say you put it on their right. 38:25.530 --> 38:28.490 So you smudge it on their right hand and their hands are like this. 38:28.490 --> 38:29.290 You've moved them. 38:29.290 --> 38:30.330 They now have a smudge. 38:30.330 --> 38:31.970 You are now completely hands-free. 38:31.970 --> 38:34.350 And then you say, are you right-handed or left-handed? 38:34.530 --> 38:39.130 And this is where that choice makes it seem like they have full control over the situation. 38:39.190 --> 38:40.370 They say, I'm left-handed. 38:40.370 --> 38:41.210 You say, okay, great. 38:41.210 --> 38:42.770 We want to use your weak hand. 38:42.770 --> 38:44.390 So we're going to use your right hand. 38:44.470 --> 38:46.130 And go ahead and drop your left hand. 38:46.530 --> 38:47.170 They leave it out. 38:47.170 --> 38:49.170 If they say, I'm right-handed. 38:49.170 --> 38:52.430 You say, okay, leave your right hand out and drop your left. 38:52.830 --> 38:54.370 You have them make a fist. 38:55.190 --> 39:02.450 And from here, all you have to do is take a little bit of ash and you sprinkle it on the back of their hands and rub it in until it vanishes. 39:03.070 --> 39:04.310 That's not the magic. 39:05.230 --> 39:07.410 But you can play that up. 39:07.410 --> 39:09.910 Whatever your character, whatever your writing is. 39:09.930 --> 39:18.290 But then you say that the ash has gone through their hand and has ended up inside of their palm and they open up and then they have ash inside of their hand. 39:18.310 --> 39:22.650 And the reason why this is magical is because you've been stepped away. 39:22.930 --> 39:28.590 Even if they remember the actual fact that they made a choice of which hand, it's couldn't... 39:28.590 --> 39:29.870 because it's not on both hands. 39:29.870 --> 39:31.050 It's only on the one. 39:31.050 --> 39:36.650 And you never touched them because you've made this memory of, hey, you're fucking up. 39:36.650 --> 39:37.810 I'm helping you here. 39:37.810 --> 39:39.290 They're going to wipe that. 39:39.690 --> 39:51.850 And that's a perfect example of taking that snapshot as well as using an equivocate and that vague intent on your question to make them follow instructions with you a little bit better. 39:52.210 --> 39:54.110 If we can go ahead to the next slide. 39:55.290 --> 39:57.630 Real life applications of equivocate. 39:59.810 --> 40:03.930 Honestly, equivocates are best for inferred information. 40:03.930 --> 40:08.470 On a job, let's say you notice on Facebook the big boss had a barbecue. 40:08.470 --> 40:11.250 You're doing some big red team thing. 40:11.390 --> 40:13.150 And you want everyone to... 40:13.710 --> 40:14.850 you've done a bunch of research. 40:14.850 --> 40:16.970 You know the guy that runs the building or whatever. 40:17.070 --> 40:18.030 His name is Bob. 40:18.410 --> 40:27.750 And you can now weaponize the fact that he had a barbecue that weekend because while you're building rapport with one of your targets, you can say, hey, were you at Bob's barbecue? 40:27.890 --> 40:29.810 And they have two realistic responses. 40:29.810 --> 40:31.990 They can either say yes or they can say no. 40:32.150 --> 40:43.710 And by leveraging this, because of this vague intent, this vague language, you can make it seem like you're either invited but didn't go, which makes that person your equal instantly because you're now... they were invited to the barbecue. 40:43.710 --> 40:44.750 So were you. 40:44.850 --> 40:49.810 And if they didn't know about it or they didn't go, you can now be their superior. 40:49.810 --> 40:53.870 You are now the person that's friends with the big boss and they aren't. 40:54.150 --> 41:02.990 And suddenly this relationship dynamic, one, you've inserted yourself close to someone that they're supposed to respect and be under. 41:02.990 --> 41:06.690 But also you have given yourself a history. 41:06.710 --> 41:11.590 You have a background story just from one single piece of information and a vague question. 41:12.930 --> 41:19.650 And more often than not, though, in magic you leverage your social position to get away with equivocates. 41:19.650 --> 41:21.930 It allows you to get away with things that might not make sense. 41:21.930 --> 41:28.170 But when it comes to influencing people's choices in real life using equivocate, people say no and they'll walk away. 41:28.930 --> 41:34.690 You can't make realistic situations by forcing people to choose things with equivocates. 41:34.690 --> 41:35.870 It's very weird. 41:36.070 --> 41:43.390 But you can get away with it, but you have to be a bit of a jerk and you have to write it off as a misunderstanding later and you have to act quickly. 41:44.490 --> 41:55.670 An example of doing this with an ambiguous intent is, I don't know how many people know about the trick of asking when your partner says, hey, I'm hungry, you say, and instead of saying, okay, where do you want to go eat? 41:55.670 --> 41:58.470 You say, I already know where I want to take you, but you have to guess. 41:58.890 --> 42:00.350 And then they do. 42:00.350 --> 42:05.590 And instead of being like, oh, you're right, you just take them there because you use this ambiguous intent. 42:05.590 --> 42:13.370 They don't know any of the information that you know, but it's basically just a big lie to get them to give you more information. 42:13.770 --> 42:15.990 And sometimes people don't even know it themselves. 42:17.590 --> 42:22.930 And another way I've noticed equivocate in real life is in dark patterns. 42:23.010 --> 42:43.730 A lot of them, if you're not familiar with what a dark pattern is on the Internet, is when a UI is creating language or is creating a UI experience around sometimes preventing you from doing something or trying to mitigate the amount of people doing a specific action. 42:43.730 --> 42:48.370 Like, I don't know if you've ever tried to cancel an Amazon account, but there's like 16 menus to go through. 42:48.370 --> 42:49.570 And it's ridiculous. 42:49.570 --> 42:51.150 And that's the dark pattern. 42:51.150 --> 43:00.270 And a quick dark pattern here is do not uncheck this box if you wish to be contacted via about product updates, upgraded special offers, and pricing. 43:00.270 --> 43:01.390 It doesn't make sense. 43:01.750 --> 43:02.790 It's confusing. 43:02.790 --> 43:03.470 It's vague. 43:03.490 --> 43:04.850 It's ambiguous. 43:05.130 --> 43:11.050 And it's how they're preventing you from doing an action, which is unsubscribing, which is something that they don't want you to do. 43:11.850 --> 43:17.370 And actually, even in our game, which if you haven't had a chance to check out the Rogues Village game, go for it. 43:17.370 --> 43:19.170 It's beautiful, lots of fun. 43:19.170 --> 43:22.510 But we have an Equivoque Easter egg hidden there. 43:22.550 --> 43:25.370 You're asked what one of your strengths are. 43:25.590 --> 43:35.290 And regardless of what you respond with, we're always going to give you the same item because we're either going to bolster your weaknesses or we're going to enhance your strength. 43:35.290 --> 43:42.410 And it doesn't matter, but it's an Equivoque, but you feel like you have a free choice, but both paths lead to the same road. 43:42.410 --> 43:45.890 And once again, it comes down to those constraints. 43:45.890 --> 43:51.130 You're figuring out what paths you have available to you and how can you merge them in a direction that you want. 43:52.110 --> 43:54.990 And let's go ahead and get to the takeaways. 43:57.370 --> 44:02.170 Forces are direct decisions that the target has zero control in. 44:02.530 --> 44:06.530 This is good for direct attacks that introduce a specific object. 44:06.530 --> 44:21.230 For example, if you're using a switch bag for getting in a piece of hardware or maybe forcing a value on something like a contest or a lottery, multiple outs are fully free selections that you cannot control. 44:21.250 --> 44:23.290 You can't control the amount of constraints. 44:23.290 --> 44:26.850 You can accept them, but you can be prepared for them. 44:26.850 --> 44:30.630 And this is good for having responses for a narrow selection of answers. 44:30.630 --> 44:37.150 For example, a deck of cards is a 52 question object. 44:37.650 --> 44:43.490 And once you can figure out how to mitigate those 52 questions, it becomes a lot easier to deal with. 44:43.630 --> 44:50.190 And equivocates, they're for creating ambiguity around definitions, allowing your will to be imposed on a target. 44:51.390 --> 44:58.390 Equivocates aren't perfect, but it allows you to enhance your percentages. 44:58.450 --> 45:03.610 And it's great for warping decisions or creating inferred knowledge. 45:03.790 --> 45:06.970 And the next slide, this is the defensive takeaways. 45:06.970 --> 45:17.130 I think this is something that everyone can actually gather something from, whether you're in security, whether you're in magic, or you're just a plain Joe. 45:17.290 --> 45:19.710 Because scams exist everywhere. 45:20.270 --> 45:22.870 But also, please don't ever do this to magicians. 45:22.870 --> 45:23.630 I beg of you. 45:23.630 --> 45:28.530 If I have someone do this to me and I'm doing a magic trick and it turns out they saw this talk, I'm going to be very sad. 45:28.830 --> 45:36.770 But forces, if you feel like you didn't have a free choice, attempt to make another one where you can change the rules of the selection. 45:37.030 --> 45:38.650 Be prepared for an out. 45:38.790 --> 45:42.090 Always be ready to try to change your choice. 45:42.090 --> 45:45.430 If you're at that car lot and they say, here's the green Subaru. 45:45.430 --> 45:48.030 And you can say, let me look at another green Subaru. 45:48.030 --> 45:52.190 And if they're really antsy about that, maybe just leave. 45:52.430 --> 45:53.710 You're an adult. 45:53.710 --> 45:55.770 Go buy a car somewhere else. 45:56.870 --> 45:58.290 Multiple outs. 45:58.330 --> 45:59.910 Go through the scenarios. 45:59.910 --> 46:01.790 What were your actual choices here? 46:01.790 --> 46:04.010 Because maybe you're actually in a force. 46:04.010 --> 46:05.930 Maybe you're in an equivocate. 46:06.030 --> 46:11.190 But go through your scenarios and see if it's possible to prepare for each of them. 46:11.190 --> 46:14.690 And if that intent on that preparation could be negative to you. 46:15.090 --> 46:17.910 And like I said, try to change your mind. 46:17.910 --> 46:19.570 Try to change the rules. 46:19.570 --> 46:23.690 If you can change the rules or you can change your mind, you have a lot more freedom. 46:24.030 --> 46:28.450 But also, chances that you can never be 100% sure. 46:28.450 --> 46:32.130 So always be able to stand your ground and redact. 46:32.410 --> 46:40.470 In equivocates, when you're given vague decisions, verify the intent of the question and what responses will be used for. 46:40.910 --> 46:50.890 So if you get a weird question and it seems very open-ended and weird and it's not from someone you trust, clarify what they want to use the answer for. 46:50.890 --> 46:53.010 You don't have to answer questions. 46:53.010 --> 46:58.250 You don't have to answer someone you've never met who's asking you in an elevator if you went to Bob's BBQ. 46:58.250 --> 47:00.130 You can say, what does it matter to you, guy? 47:00.130 --> 47:01.610 I don't know you. 47:01.850 --> 47:02.750 That's my purse. 47:02.750 --> 47:04.010 Get away from here. 47:04.370 --> 47:05.590 Always validate. 47:06.350 --> 47:07.470 And that's pretty much it. 47:07.470 --> 47:17.270 If you can validate, if you can change your mind, if you can change the rules or what gives you your selection of answers, you'll be safe. 47:17.270 --> 47:19.270 Or safer, as it were. 47:19.530 --> 47:21.650 And I think that's pretty much it. 47:21.650 --> 47:24.930 Yeah, I think I'm ready for my Q&A, Jay. 47:26.970 --> 47:38.850 So first up, 0x90, in your experience, what is the percentage of time that somebody uses some of the defense mechanisms you discussed? 47:39.910 --> 47:50.410 Yeah, when it comes to doing this in a magic scenario, it really depends on how you're approaching. 47:50.410 --> 48:01.450 I've noticed that if you treat anything that you're doing in magic like a puzzle, people will shut down and they will inherently get defensive and they will not want to interact. 48:01.470 --> 48:07.970 Where if you haven't selected a card, they'll wait until the very end because they don't trust you and it's because you haven't built up rapport. 48:08.610 --> 48:11.090 So it's a case-by-case scenario. 48:11.090 --> 48:13.330 It happens on an individual basis. 48:14.370 --> 48:18.350 The longer I've been doing magic, though, the less it has happened. 48:20.190 --> 48:29.930 It's gotten to the point for me... I remember when I first started almost 10 years ago, when I would be doing a trick and then someone would say, let me see those cards. 48:29.930 --> 48:30.670 And I'd be like, oh, no. 48:30.670 --> 48:32.610 And I would shut down and get all clammy. 48:32.810 --> 48:35.610 And all of a sudden, there goes all the magic. 48:35.790 --> 48:44.530 But now, I could have something that I'm preparing for hours ahead of time and I have every single card exactly where I need it. 48:44.530 --> 49:00.230 If someone says, whatever, magic boy, let me see that deck, I want to shuffle it, and it's not a show where I can tell them to go screw themselves, I'm going to hand them the deck and say, okay, shuffle it, and I will change my entire set just to preserve that magic. 49:01.690 --> 49:07.030 But basically, short answer, as you get better, the longer you do it, it happens less and less. 49:07.030 --> 49:15.310 It was at a point where it was maybe 1 out of 10 people, and now maybe if I'm performing a lot, it might happen once a month. 49:15.590 --> 49:21.630 But it really depends on how able you're to disarm your people and how much you can connect with them. 49:21.630 --> 49:27.290 Because if you're their friend before you start doing magic, they're not going to be a jerk to their friend. 49:28.430 --> 49:32.330 Someone asked the question, are you right-handed or left-handed? 49:33.290 --> 49:35.290 I am right-handed. 49:35.290 --> 49:43.390 I don't know exactly how the screen stuff is set up, so it might appear that this is my left hand, but I am right-handed. 49:44.410 --> 49:47.590 And we have a question for you, another one. 49:47.590 --> 49:50.290 What kind of ash is it that you're talking about? 49:50.290 --> 49:52.170 Something special or just burnt paper? 49:52.170 --> 49:53.990 Do you make the ash yourself? 49:54.610 --> 49:58.450 Actually, this is a classic impromptu effect. 49:58.890 --> 50:01.870 You used to do it originally with a cigar ash. 50:01.990 --> 50:11.570 The reason why it was neat is because you could just quickly dip your thumb in an ash tray, which is disgusting if it's public, but you know, it's magic. 50:11.570 --> 50:13.090 We do disgusting stuff sometimes. 50:13.590 --> 50:19.090 And then you can just sit at a party with your thumb behind your hand as you're gesticulating and talking to people. 50:19.110 --> 50:22.690 And you can go ahead and do the effect that way. 50:22.710 --> 50:24.690 But basically, cigarette ash. 50:24.730 --> 50:27.810 You might potentially want to do this a different way. 50:28.170 --> 50:36.270 There are a couple of other effects that have taken this approach and they are published and they're still currently manufactured. 50:36.270 --> 50:41.150 So if you want to go ahead and DM me, I'll actually give you a link to the product. 50:41.230 --> 50:42.550 I don't make anything off of it. 50:42.550 --> 50:48.630 I just don't want to imply that it uses the same equivocate and stuff because I didn't make the effect itself. 50:48.670 --> 50:51.070 But it's very good and it's modern. 50:51.070 --> 50:52.530 You've probably seen it on AGT. 50:52.530 --> 50:53.370 It's great. 50:54.430 --> 51:00.110 We have one person that is claiming you as a Fed. 51:01.270 --> 51:03.770 Oh, who's claiming me as a Fed? 51:04.850 --> 51:07.070 What's their social security number? 51:08.910 --> 51:11.230 No, I'm not a Fed. 51:11.410 --> 51:13.030 I have way too much hair. 51:13.030 --> 51:19.390 I have so much hair, especially for being a Fed, that you can't actually tell that I'm wearing Bose headphones. 51:19.450 --> 51:21.930 Like the full ear cup. 51:23.130 --> 51:25.170 Feds don't have this much hair. 51:25.170 --> 51:27.570 But no, I'm not a Fed. 51:27.610 --> 51:29.510 I'm a software engineer. 51:29.510 --> 51:31.930 I've done some security contract stuff. 51:33.270 --> 51:33.750 Ultimately... 51:33.750 --> 51:38.470 If you want to find me on Twitter, DM me and I'll send you my page. 51:38.470 --> 51:40.410 And you can be very disappointed. 51:41.810 --> 51:43.110 That's beautiful. 51:43.230 --> 51:47.510 I'm going to wait for one more question that's coming in. 51:49.630 --> 51:52.050 I think we can probably just field that on the Discord. 51:52.050 --> 51:55.850 I'm going to give them 10 seconds to get a 10, 9, 8, 7, 6... 51:55.850 --> 51:56.930 I mean, Jade's typing. 51:56.930 --> 51:58.150 Oh, okay. 51:58.370 --> 51:59.150 Alright. 52:00.090 --> 52:01.830 Ooh, AngelRain's typing. 52:04.190 --> 52:07.090 Maybe if I just keep saying people are typing, I'll get more and more. 52:07.090 --> 52:09.730 Maybe they'll just start typing and never fill it. 52:10.570 --> 52:16.190 Alright, to what extent admitting a failure can be used as an out? 52:17.270 --> 52:23.750 So, I wouldn't ever consider a flat-out failure as an out. 52:24.170 --> 52:31.570 There have been times where I have set up for an effect and you're so far in it. 52:31.570 --> 52:35.590 It's like where you're at the table and you need to turn over the card and it has to be your thing. 52:35.690 --> 52:45.230 And there have been some times years ago where I've turned that card over and it's the wrong thing and there's just no way of getting back to it. 52:45.230 --> 52:47.630 And I say, ladies and gentlemen, this is theater. 52:47.630 --> 52:48.450 It's live. 52:48.450 --> 52:50.190 I am so sorry. 52:50.590 --> 52:52.370 This is a fuck up. 52:53.170 --> 52:56.270 And every magician this has happened to. 52:56.950 --> 53:08.630 But ideally, if you have even the smallest window or where you can be clever about something you rarely have to accept failure. 53:08.850 --> 53:23.790 If I'm doing something that is dramatic and there is a lot of intention and emotion behind a certain moment or meaning behind something artistically, I make the decision to take the fall and the full blame of it. 53:24.730 --> 53:35.730 Similar to singing a horrible note on stage and you just kind of go I'm sorry, but I have my artistic integrity and I'm not going to do jazz magic over this to try to recover. 53:38.770 --> 53:41.550 I think that might be it. 53:42.610 --> 53:44.650 But thank you 0x90. 53:44.730 --> 53:47.490 Oh wait, sorry, this will be the last one. 53:47.490 --> 53:50.230 And then we'll cut it after this so we can feel them in the Discord. 53:51.050 --> 53:53.150 But this is a good one to end with. 53:53.150 --> 53:54.730 Who inspires you the most? 53:55.390 --> 53:56.210 Jeez. 53:57.730 --> 54:00.930 This is a really, really good question. 54:01.450 --> 54:10.910 I have a couple of answers for this but just to keep this short I would have to say the late Ricky Jay and the late Johnny Thompson. 54:11.290 --> 54:44.090 Both different worlds, different styles of performing but reading Ricky's depth of knowledge and how much he is passionate about his craft and elevating it to the level of art is beautiful to me and Johnny Thompson being this encyclopedia of magic where he knows just about everything and he's very good and cares about things deeply but they approach it differently. 54:44.090 --> 54:57.970 Johnny Thompson is about making sure people are entertained and doing it well and Ricky Jay is about the total experience of theater and he sees this theater that he alone sees in his head. 54:57.970 --> 54:59.110 It's just him. 54:59.110 --> 55:04.810 And he has this idea of what makes it perfect and he's very aggressive about it and I love it. 55:07.050 --> 55:08.310 Sorry, I lied to you. 55:08.310 --> 55:09.290 Last one. 55:10.410 --> 55:20.730 But AOD wants you to speak to the idea that a magician can sneak out of a failure because the audience doesn't know exactly what's supposed to happen. 55:21.690 --> 55:23.090 Yeah, exactly. 55:24.630 --> 55:27.750 Don't run when no one's chasing you. 55:27.750 --> 55:35.470 If I pull out a card and it's like the reveal and I know it's not it. 55:35.470 --> 55:36.910 I figured it out. 55:36.910 --> 55:38.330 That is not it. 55:38.890 --> 55:41.670 You can attempt to backtrack. 55:43.670 --> 55:45.530 There are effects. 55:45.530 --> 55:47.590 There's a thing called an invisible deck. 55:47.590 --> 55:49.270 It's wonderful and it allows you 55:52.730 --> 56:05.270 to summon any card For example, if you ever screw up so badly that it's irredeemable, you can keep something like that on your person and just be like, well, actually I did this. 56:05.270 --> 56:07.590 And then you did this whole other effect. 56:07.590 --> 56:10.310 You can always move on to something else. 56:10.310 --> 56:15.390 No one knows that you're about to have the card come to the top of the deck 47 times in a row. 56:15.390 --> 56:22.190 Maybe on the 22nd one you screw it up and you can just move into something else. 56:22.190 --> 56:26.470 You can just make a joke about it and be like, I guess it died after 21 and move on. 56:26.470 --> 56:28.590 And it depends on your personality. 56:28.850 --> 56:39.650 And honestly, the calmer you are the more ready you are to accept something getting screwed up and just moving on with it people will never remember it. 56:39.650 --> 57:06.110 People seldom I have come off of so many performances where I screwed one thing up and I had to recover like that and it affects me to the point where I become so upset like I need hours by myself to think about how I'm such an idiot and I screwed something up and I've never had a single person ever point it out and even professional magicians I'm like, 57:06.110 --> 57:11.170 yeah, but I did this and I screwed this thing up and they're like, oh, I thought you were just going into this effect that way. 57:11.190 --> 57:12.510 I had no clue. 57:12.890 --> 57:13.830 No one cares. 57:13.830 --> 57:15.250 No one's chasing you. 57:16.490 --> 57:17.650 Awesome. 57:17.770 --> 57:21.910 That will conclude our Q&A portion for this talk. 57:21.910 --> 57:24.230 Thank you, RX980, for everything. 57:24.410 --> 57:25.770 Yeah, thank you.