Tom Eston

@agent0x0.bsky.social

3219 Followers 629 Following

Cybersecurity Aficionado, Privacy Advocate, Founder and Co-Host of the Shared Security Podcast @sharedsecurity.bsky.social Curator of @retrorelics.store Also: Sober 👍, Metalcore 🤘, Cats 🐈, Retro video games, mods, vintage consoles and repair.

A video clip of Jay Beale, a bald man with a goatee wearing a dark blue polo shirt and white wireless earbuds, speaking directly to camera against a black background. He animatedly recounts a social engineering story about sneaking into a building's second floor, finding an empty conference room, and claiming it as his "office" — then calling his colleague Tom to ask if they can go for sushi, only to be told: "No sushi until you get me some regulated damn data."
A black cats head popping up out of a cubby
Andrew Wilson, offensive AI researcher and CactusCon founder, discusses how artificial intelligence is transforming penetration testing, his PhD research on hacker cognition, Mexico's growing cybersecurity talent pipeline, and the future of offensive security in an AI-driven world.
Younger generations are increasingly ditching smartphones in favor of “dumbphones”—simpler devices with fewer apps, fewer distractions, and less tracking. But what happens when you step away from a device that now functions as your wallet, your memory, and your security key?
This episode explores the new privacy and security features in iOS 26.2's Airdrop, including the 10-minute time limit for the "everyone" setting and the introduction of one-time Airdrop codes, while providing recommendations for configuring settings to balance convenience with privacy protection.
Zillow push notification that says This is your headline. This is the body text
Default template text found in LinkedIn unsolicited messages
Screenshot of an email I received from Walmart showing DK Bananza on sale for $69 with the original price of $69.99.
A guy recording video at the Poppy show on a Nintendo DS
Mail spam from AARP that says “welcome to the 50s club”
An orange chunky cat sitting on a new Switch 2 box
Semester exam grade was an F. Students motivation is insufficient to achieve academic success.
Screenshot of a GBP IPS screen and shell on AliExpress going for $7,995.48
Pumpkin the cat laying on his owner. Who owns who though?
Picture of me and my Mom in 1995
New capacitors installed in a PS2 fat PSU. Old capacitors are on the right.
Capacitors on a PS2 fat PSU that need replaced for good preventive maintenance
The C009 capacitor on a PS2 fat PSU is almost always the issue with a PS2 fat that won’t power on
I think you could look at it from sort of a levels of risk point of view, right? I mean, as you said, if you happen to be in a high-risk demographic, right, where you think you're likely to be more scrutinized, then you would probably want to be very careful about what devices and what was on them. Um, from a, you know, non-risky point of view, you might look and say, if I have signal on my mobile phone, does that give them enough suspicion to say I do secret chats with people that I don't want people to know about?" "That's a really good point. It's kind of like somebody gets pulled over and the whole car smells like pot or alcohol." "Yeah." "They have a, yeah, they're like, 'Oh, somebody might be doing something illegal in this car.' It's very similar to having an app on your phone."
Picture of the Hakko FR-301 desoldering tool box
Tom Eston: "23andMe is exploring options such as, you know, putting themselves up for sale, restructuring, bankruptcy, all of those things, and it caused a lot of people to think about, well, wait a minute. I just gave my DNA to this company. They have all this very personal, probably the most personal information that you could give to a company, right?" Kevin Johnson: "Yeah." Tom Eston: "Talking about DNA, right? So it'd behoove you to delete this information as soon as possible." Kevin Johnson: "Can you?" Tom Eston: "And that's, that's the big question. But yeah, yeah, can you?" Kevin Johnson: "I wanna be very clear. I only pretend to be a lawyer on Twitter. Is data an asset? I think it, it's a simple answer, yes, right? I don't think anybody would argue that data is not an asset. My understanding of bankruptcy laws is when you enter chapter 11, you are not allowed to destroy or modify in any significant way an asset. They don't talk about the immediacy of that deletion."
Front of a Daewoo CRT
I looked at this thread that was on Reddit and I thought it was interesting seeing how we all are changing the way that we think about privacy in this now new world of AI where everything has AI embedded into it now whether we like it or not these are things that are happening with every company every company is looking at this as a way to automate things to provide better customer service I think it's interesting to think about it from that perspective of how has our privacy changed when we're using these systems
Inside of a dirty N64 controller
New extreme green N64 shell
Dirty N64 console
Restored N64 with Legend of Zelda Ocarina of time showing on a CRT
A speaker named Dahvid Schloss discusses the difficulty executives face in understanding the importance of data breaches, specifically stating that 'a million records of PII means nothing to an executive.
Kevin Johnson humorously refers to Russia's actions as a "work from home invasion" of the United States, suggesting that Russia has effectively taken control without physically traveling. Tom Eston responds by reminiscing about how, as an '80s kid, he imagined a Russian invasion would be like the movie "Red Dawn," with parachute drops and taking over homes, highlighting the contrast with the present scenario.
PSP 1001 taken fully apart
A cat lying on his owner. The cat is either really relaxed or trying to kill its owner
The speaker, Kevin Johnson, explains why creating a backdoor for encryption specifically for the UK is impractical. He argues that implementing such a backdoor would compromise the security of all users globally, not just those in the UK. As a result, Apple disabled the encryption option for UK users and encouraged them to voice their concerns to their government officials to restore encryption capabilities.
This clip discusses the evolving tactics of cyber criminals. It highlights how modern threat actors may not necessarily rely on traditional malware. Instead, they could exploit cloud services, SaaS applications, and identity access to infiltrate systems. Infostealer malware on endpoints often facilitates these attacks. This can escalate to more severe threats such as ransomware, business email compromise, and supply chain threats, which are particularly concerning due to their wide-reaching impact.
This is something that the US government has tried to do: asking Apple to create a secret backdoor for government-only access into Apple devices. And I think this has really caused a big stir in the cybersecurity and privacy community because what this is going to do, and most likely will happen, is Apple will have to disable end-to-end encrypted iCloud backups just in the UK and not do it across the board. And that's not a good thing because it now opens up a lot of questions about Apple's overall security and the process around that, and it's just not a good thing.
Garbage in garbage out. If you put garbage in your resume, you're going to get no responses or you're going to get garbage jobs. On AI, there are tools on the flip side, on the recruiter side, that can scan a resume before it's even presented to a recruiter that says this is AI generated, especially if you've used AI to talk about something you did, and you really didn't do it. Sorry, plagiarism. Please don't do that. Your buddy will tell you that there's this really great template out there to use and just use this really great template and it'll get you a job. Please don't use a template because they will put graphics in it, and will put the spacing really differently. Keep it simple, stupid. You know, the KISS principle. Mainly because you do not know what the technology is on the recruiter's end that's going to read your resume, so whatever boldness or anything that you put in there, you don't know how it's going to be read by another computer.
Cohost Kevin Johnson discusses the differing legal requirements for providing phone passcodes versus biometric unlocking, expressing concerns about privacy and digital IDs
Video clip of the Shared Security Podcast discussing why it’s hard to not make mistakes in development and testing.
Short video about the younger generation not fearing data privacy risks from China
Short podcast clip discussing AI privacy policies
SEQURE HT140 2-IN-1 Hot Tweezers in the foreground. Gameboy Color in background
The allusive “Canada Goose”
There were some people saying that airplanes were going to fall out of the sky and the apocalypse would happen when all the computer systems shut down and the world would come to an end. There were some great movies and some bad movies. More bad. About what happened, you know, on New Year's Eve on 1999 to 2000. So there was a lot of hype, a lot of amplification of really bad things that were going to happen and honestly it was kind of a hysteria for a while. Was it felt kind of surreal, right? You know, coming up on it, everybody was talking about it, what's going to happen and then really nothing really happened. But it was mostly due to the fact that a lot of planning, people knew this for years ahead of time and started thinking about for our critical systems, we need to make sure that our next release of software does this properly, or in some cases they had to migrate systems, right? Like completely from one, you know, number system to another.
Picture of the front entrance of Jungle Jim’s International Market
R36S handheld on the left. Box it came in on the right.
Tom Eston: "I just don't see it happening so even with all this rhetoric and talk about China and you know China hacking telecoms, I just don't think it's going to happen. I think there'll be too much of a backlash from especially Americans that actually make money off of TikTok. I think that's the big sticking point for this. And the other prediction I have is that the election that has just taken place, it's not going to change anything around getting a federal privacy law this year. I believe that there will be no movement at all at the federal level in the United States on privacy. I hope I'm wrong, but I think I'm right." Kevin Johnson: "That's the same prediction we gave last year because that would be an effectual law and uh..." Tom Eston: "Right, but I just don't see our Congress even unifying on anything like that anytime in the near future."
A white mug with a picture of Kim Jong Un that says “Live, Laugh, Love”
When you get these messages that seem to be very, I guess, vague or unusual. A lot of people will reply saying, "Who is this?" or "Sorry, wrong number," right? But even doing that can give the attackers, if it is an attacker, enough information to say, "Hey! This message, this phone number is live," and I can try any other kind of pretext with it in the future, in the hopes of getting somebody to either click on a link or respond with information or take some action, right? I know a lot of us, everybody here on this podcast, and most of our listeners, I'm sure, have gotten messages like this. They go beyond just the typical scam pretext that you would see, but there's just this very open-ended, "Hi, who are you?" or "How are you? Is this the right number?" Like, you get all kinds of weird stuff.
Screenshot of YouTube’s new policy to allow third party companies train AI models using my channel’s content. Box is unchecked for obvious reasons.
New Noctua fan installed and tested before putting the case back together
Modified fan cable using the cut extension cable provided with the Noctua, then soldered to the original fan cable also cut.
PS2 fat about to be upgraded with a Noctua fan and 3D printed fan housing.
For years, we've been saying 'Use Signal, Use Signal, Use Signal,' and the government has said, 'Well, encryption is bad unless we use it.' And it's like, no it's not. But you know, that mass shooter—we could prove they were guilty if we just had access to their phone. I don't know, the video in the school of them shooting people is probably enough to prove they were guilty. But, hey, you do you. And now it's, 'Well, the Chinese have control of this, we should probably use encryption.' I feel like we've said that. As a matter of fact, it's funny to me that they're willing to let us use it against the Chinese, and they're not complaining about it for themselves until six months from now. When the next time they're trying to get into a phone, they want to push that Apple is evil because they encrypt things, or whatever.
Tanya Janca: "I talk about privacy a lot in the book. Privacy matters to me, and I have a lot of strong opinions on it. I feel like developers can push for better security and better privacy sometimes just by asking a question or saying, 'Do we really want to do that to our users? How would you feel if we did that to you?' And suddenly the conversation's different, right? So I'm hoping to see better privacy practices, obviously way better secure coding, and better and inventive uses of AI." Scott Wright: "That's really cool. I like that idea of more insightful questioning of the requirements to start with before you start coding at all." Tanya Janca: "Yes, yes, because that's just it. When we are silent, generally that is approval."
Xbox One disk drive with its laser removed
The video discusses the importance of genuinely protecting children on social media rather than pretending to do so. It mentions Australia's approach, likened to a 'social media TSA', and raises concerns about the benefits of social media for kids facing issues like depression and abuse. AI solutions are suggested but questioned, along with a mention of the unbanned status of AI girlfriends.
A cat (Rosie) sitting on Tom's chair right before recording next week's episode of the Shared Security Podcast
A picture of brown bread in a can
Silver GameCube DOL-101 with silver controller