Shared Security Podcast

@sharedsecurity.bsky.social

221 Followers 11 Following

Honest, funny, and veteran takes on cybersecurity, privacy, and tech fails. Hosted by Tom Eston, Scott Wright, and Kevin Tackett. Real security talk from people who’ve lived it. https://sharedsecurity.net or wherever you like to listen to podcasts!

Surveillance pricing uses personal data and behavioral profiles to decide what price or discount you see, turning grocery loyalty programs, ad tech, and AI-driven targeting into a consumer privacy problem hiding inside everyday shopping.
Apple and Google are finally adding end-to-end encrypted RCS between iPhone and Android users, but Tom and Kevin explain why SMS, platform trust issues, and sensitive-message caution are not going away.
I think that they're capitalizing on the fact that people are using ChatGPT and these AI chatbots for all kinds of things — a lot of very personal things, a lot of sensitive things. We've talked about people having AI girlfriends and boyfriends. They're using it as a therapist. And now, you know, they're using it as a financial advisor. Like, I think everybody has to make that risk decision themselves — is this something that you are okay with?
This episode explores how tire pressure monitoring systems (TPMS) in modern cars can be exploited to track vehicle movements due to unencrypted wireless signals that broadcast unique identifiers and driving data.
Tom and Kevin discuss the privacy implications of Meta's Ray-Ban smart glasses, comparing them to traditional surveillance systems while exploring concerns about hidden recording capabilities, AI-powered facial recognition, and the normalization of everyday surveillance in public spaces.
TikTok has publicly confirmed it will not implement end-to-end encryption for direct messages, claiming it would make users less safe, while all other major social media platforms have moved toward stronger encryption, raising concerns about government access, data breaches, and user privacy.
Tom and Kevin explain why TikTok's viral 2026 privacy policy backlash is overblown, urging users to read policies and make informed decisions based on their own threat models rather than following the crowd.
This episode examines Ring's controversial AI-powered Search Party feature that sparked dystopian surveillance concerns during the Super Bowl, and explores a zero-click security vulnerability in Claude Desktop's AI assistant capabilities that highlights the risks of giving AI systems unfettered access to personal accounts.
This episode examines OpenClaw, an open-source AI agent platform promising convenience but plagued by serious security vulnerabilities and poorly coded implementations in viral platforms like MoltBook and MoltMatch.
This episode explores Amazon Ring's new AI-powered facial recognition feature called Familiar Faces, examining the privacy implications, legal concerns, and broader surveillance issues surrounding biometric data collection in smart home devices.
The Pennsylvania Supreme Court ruled that police can access Google search history without a traditional warrant, sparking concerns about digital privacy rights and the Fourth Amendment as hosts Tom and Kevin debate the troubling implications of reverse keyword searches and third-party data collection despite acknowledging the ruling helped catch a criminal.
This episode recaps 2025’s predictions, reviews top episodes and guest highlights, discusses trends in cybersecurity, AI, privacy legislation, and offers bold new predictions for 2026.
This episode explores the hidden privacy risks of tracking pixels in holiday marketing emails, highlights findings from Proton's latest report, and offers practical tips to protect your data and email security.
This episode explores the rise of AI-generated videos and deepfakes, how to spot them, their real-world risks, and practical steps individuals and organizations can take to protect themselves and verify what they see online.
In this episode of the Shared Security Podcast, Tom Eston reunites with Chris Clymer to discuss the evolving role of the CISO, the rise of fractional CISOs, and essential advice for aspiring security leaders.
In this episode, we discuss the changes and significance of the OWASP Top 10 for 2025, exploring new categories, industry impact, and the importance of community involvement in shaping application security standards.
This episode explores the recent AWS DNS outage, the importance of business continuity planning, cloud dependency, and failover strategies, all wrapped in humor and insightful discussion.
This episode explores the impact of Sora 2 and AI video generation on copyright, privacy, and the future of media, highlighting legal, ethical, and societal challenges.
This episode explores the rise of age verification laws in the US, their impact on privacy and cybersecurity, the risks of digital ID systems, and the challenges of balancing child protection with personal freedom and data security.
This episode explores the effectiveness and future of phishing simulations in 2025, discussing their pros, cons, and how security awareness training must evolve to better address real-world threats and user behavior.
In this episode, Tom Eston and Andy Murphy discuss practical strategies for situational awareness, family and personal safety, teaching kids to be alert, and the importance of digital and physical security in today’s world.
This episode revisits persistent cybersecurity challenges from 2020—including ransomware attacks on schools, election security threats, and ongoing privacy concerns—highlighting how these issues continue to impact us today.
This episode explores the trade-off between convenience and privacy in our digital lives, highlighting how everyday tech choices impact personal data security and offering practical tips for protecting your privacy.
Podcast co-host Kevin Johnson discusses how the cybersecurity industry focuses on advanced topics like post-quantum encryption while still encountering basic web attacks that have existed for decades.
Two podcast hosts discuss whether bad code is always AI-generated, highlighting that not all poor code comes from AI and that human oversight is still essential. The conversation is casual, with both hosts appearing on screen, engaging in a thoughtful discussion about AI, coding, and software security.
This episode uncovers the tricks behind smishing scams, explains how to spot suspicious text messages, and shares practical tips to keep your phone and personal information safe.
This episode explores the fallout from a critical SharePoint zero-day vulnerability, examining how flawed patches, government agency breaches, and possible leaks from Microsoft’s MAPP program highlight ongoing challenges in cybersecurity and trust.
In this episode, the hosts discuss the controversial idea of allowing the elderly to write down their passwords, considering various perspectives on risk, technology adoption, and the evolving role of passkeys and AI for seniors.
In this episode, Tom Eston and Kevin Johnson discuss the groundbreaking advancements in autonomous penetration testing by cybersecurity startup XBOW and its implications for the future of offensive security.
The alt text for this clip could be: "A speaker named Katie discusses the importance of networking in advancing a career in cybersecurity. She emphasizes that building a network early on can have lasting value throughout one's career and urges listeners to make valuable connections to accelerate their career growth."
This episode discusses the Kids Online Safety Act (KOSA), highlighting its potential consequences for censorship, privacy, and free expression, and emphasizes the importance of parental involvement and responsible legislative action.
Are smart cities truly the future, or are we opening the door to unprecedented cybersecurity risks? This week, I explore the potential hazards with Scott Wright as we discuss real incidents, including hacked crosswalk signals and the importance of cybersecurity in city infrastructure. Tune in to understand the fine line between innovation and vulnerability.
The clip features Tom Eston and Kevin Johnson discussing the long-awaited implementation of Real ID in the US. They talk about what is needed to fly, the relevance of passports, the introduction of mobile IDs and apps like Google Wallet into the TSA's plans, and the broader implications for identity surveillance. The conversation includes playful banter about the frequent use of the word "real."
This episode discusses the growing issue of hidden cameras in private spaces, exploring personal experiences, legal implications, and tips for detection.
In this episode, we explore an incident where Anthropic’s AI, Claude, didn't just resist shutdown but allegedly blackmailed its engineers. Is this a glitch or the beginning of an AI uprising? Along with co-host Kevin Johnson, we reminisce about past episodes, discuss AI safety and ethics, and examine the implications of AI mimicking human behaviors like blackmail. Join us for an in-depth conversation on the future of AI and its potential risks.
Scott and Tom explain Mark Zuckerberg’s vision for AI friends
Audiogram with a clip of episode 2 of the Social Media Security Podcast from 2009
Let’s talk about “vibe coding” on the latest Shared Security Podcast
The discussion explores the potential impact if the US government ceased funding the CVE (Common Vulnerabilities and Exposures) program, which is considered vital for cybersecurity. It covers the origins of the CVE system, the challenges around standardizing vulnerabilities, and misconceptions about its role and effectiveness in the industry.
Dan Decloss enthusiastically announces the launch of PlexTrac for Continuous Threat Exposure Management (CTEM). He explains CTEM as a framework designed to manage and prioritize the remediation of security findings continuously. The goal is to bring all findings into a continuous workflow, automate processes, and provide essential context for risk prioritization, ensuring the most critical vulnerabilities are addressed first while tracking progress.
"I think you could look at it from sort of a levels of risk point of view, right? I mean, as you said, if you happen to be in a high-risk demographic, right, where you think you're likely to be more scrutinized, then you would probably want to be very careful about what devices and what was on them. Um, from a, you know, non-risky point of view, you might look and say, if I have signal on my mobile phone, does that give them enough suspicion to say I do secret chats with people that I don't want people to know about?" "That's a really good point. It's kind of like somebody gets pulled over and the whole car smells like pot or alcohol." "Yeah." "They have a, yeah, they're like, 'Oh, somebody might be doing something illegal in this car.' It's very similar to having an app on your phone."
Dan DeCloss CEO of PlexTrac speaks about vulnerability remediation workflows
The speaker critiques a take on security vulnerabilities, arguing that regardless of whether a teenager or a nation-state steals data, the outcome is bad. They discuss how the author of a piece seemed to highlight the poor state of security by pointing out that even teenagers can breach systems, possibly using the APT acronym for added attention. The speaker disagrees with this perspective, finding it to be a misguided approach.