[Music]
hey sir I have a question for you have
you ever noticed that if you tell
someone oh it’s easy to trick people
then they’re like oh yeah you know those
people but if you say well it’s easy to
trick you you’re a person and they’re
like whoa whoa whoa whoa I don’t know
about that and why is that why does it
feel so uncomfortable to think about
yourself being tricked
you can probably feel it right now I bet
have talked about it and you’re probably
thinking oh boy what’s this strange boy
you’re gonna do and fair enough
I’m here to try and show you that it’s
easier to trick you then you might think
it is because right now you probably
don’t think there’s easy to trick you
like at all but ask yourself again in
like eight minutes but what do I know
about tricking people well there’s two
parts here’s the first part when I was a
kid I got particularly into learning
magic tricks because I was curious and a
while I was learning magic tricks I
noticed this thing which was it like I
was just learning magic tricks from a
book and I was just following
instructions and had a trick people and
it was working like the first time it
worked
I was like whoa whoa no way that works
every time I must to go lucky but then
it just kept working and I was like you
know I would follow the instructions and
someone would get tricked and they would
love it and I was like really you can
just follow instructions and how to
trick people and it works that’s amazing
how is nobody taken over the world with
this yet
but then it turns out that people try
and take over the world by tricking
people all the time because it’s not
just magic that uses tricking people as
I got older ended up studying computer
security or hacking as the cool kids
call it and while I was learning about
hacking I saw that hackers were using
tricks as well
they were tricking people as well
because hackers those resourceful
scoundrels had figured out that
sometimes the easiest way to get what
they want isn’t to like do some really
complicated fast typing upload yourself
to the matrix technical thing it’s just
to trick somebody into giving you what
you want so like hackers we’ll just call
someone on the phone and talk to them or
send them an email and just trick
somebody into giving away their secrets
or into doing some sort of evil thing
and when I learned about this I was like
wow that’s amazing how has nobody taken
over the world with this yet so
sometimes people ask me how did you
first get into hacking how’d you first
get into security and well I was a
teenager and I was on a family holiday
and we were at this hotel when we got
there I like tried to connect to the
Wi-Fi there but I didn’t know like which
one to connect to and I was like oh mom
and dad I like which which Wi-Fi do I
use how do I connect to it and they were
like oh no none of them like we didn’t
have Wi-Fi at this hotel and I was like
but that’s alright like that’s okay but
you know all these Wi-Fi networks were
still just there and it made me maybe
wonder if there was some way that I
could get on to them anyway
and so that prompted quite a lot of
research and really devastated that
family holiday so
sorry mom and dad so that’s how I first
got into hacking and as I learned more
and more about it I kept seeing that
hackers wheezing tricks to get what they
want and that’s what this talk is about
showing you that it’s easier to trick
you than you might think it is using
magic and hacking as two examples so
which one you want to see first which
one you think we should do magic hacking
which one do you what no it’s it’s a
free rehearsed talk you can’t do that
you can’t just like I don’t know I can’t
whatever so I very conveniently have
this cup here which is exactly what I
need to show you the point and you might
be thinking I also have this ball here
and you might be thinking of the game
with the three cups and the ball and the
ball goes under the cup and you mix the
cups around and you have to find where
the ball goes
this is exactly like that but with one
cup and one ball so it’s not as good it
was gonna be in one of two places it’s
either going to be under the cup like
this or it’s gonna be in my pocket so
let’s do a practice round where do you
think the ball is right now so some
people were saying it’s in my pocket
those people have a way too much faith
in me no it’s right here it’s a practice
round it’s cold it’s cold lowering you
into a false sense of security
okay so let’s try again what do you
think the ball is right now you might be
thinking in my pocket right and you’ll
be right to kiss her because the copy
under the cup right well actually no
actually it can’t be under the cup but
don’t feel don’t feel bad if you miss
that one because this red ball is not
where this trick is about like at all
because to illustrate the idea that it’s
easy to trick you when you’re not paying
attention
while you weren’t looking I put this
lime under the cup did you say it do you
see it oh yeah so that’s how they get
you and just to really like send that
point home I’ve gone to just a really
illustrate like the point of it’s easy
to trick you in your not paying
attention I’ve gone to the trouble of
doing it a second time so I hope that
helps you so
so the trick to this is there is no
trick I really did just do it when you
weren’t paying attention because people
would do this all the time right people
do this not just in magic in all kinds
of tricks they like deliberately draw
attention to something just to draw your
attention away from somewhere else where
they don’t want you to look like this
banana and like you know that’s still
that’s just one example of people
drawing your attention away because you
know it’s easy to trick you in some way
you’re not paying attention but here’s
another example here’s one that you can
actually feel so right now all of you in
this room and not aware of a sensation
and you’re not gonna be aware of it
until I say what it is ready right now
you’re not aware of the sensation of
your feet touching your shoes or your
socks and now you can suddenly feel this
feeling in your feet they can feel
before and similarly you’re also not
aware of the sensation of your clothes
touching a torso except now that I’ve
said it you suddenly are aware of that
sensation but now that I’m talking about
your clothes touching your torso you’ve
forgotten about the sensation of your
feet touching your socks or shoes but
now that I’m talking about your feel
again you’ve forgotten about your torso
because do you see do you see where I’m
going with this
so by bouncing your attention around
like this somebody can make you pay
attention to one place which makes you
not pay attention to another place which
makes it easier to trick there and
that’s called misdirection in magic
language another place misdirection is
used is in hacking and one example you
might have heard of is called fishing
fishing with like a pH and I want to
tell you about a time that I use fishing
recently I asked a friend of mine who
were gonna call Diana for permission to
try and hack her permission to try and
act like a whole life and she said yes
controversial but ok and so it’s a long
story and this is just a small part of
it but at one point I had to try and get
Diana’s email password because I wanted
to log into her email and I tried this
really complicated technical way of
doing it and it didn’t work because of
reasons and so because I didn’t work I
was like well it’s just too hard I’m
just I’m just gonna do it the easy way
and so the way I ended up getting down
his email password was with this email
and so it says it’s from somebody called
Kathleen it’s not that’s fake it’s for
me and it says like hey Diana I’m like a
recruiter and somebody’s listed you as a
reference and can you please tell us
like did you work with this person when
did you work with them were they’re good
to work with blah blah blah
I please tell us about this person who
said that they worked with you and then
if the resume say you can you know learn
more about them and so the reason I sent
her this email has nothing to do with
like recruiting or her employment or
anything like that all I wanted to do
was to click on that click here link
because when you cook it goes to this
screen which is a login screen for
hotmail Walker staying out of hotmail
account and some of you may have noticed
that this is not the website for hotmail
that’s not that’s not what the login
screen for up mail is because this is
not the real hotmail login screen this
is a fake one that I made and all it
does is it steals whatever you type it
to the password box and sends it to me
and so I sent this to her and it worked
obviously a way to totally wait right
like she typed in a password great easy
and like you might be thinking like oh
man this Diana person must be such a
bozo for falling for this but Danah is
far from the first person to fall for
this kind of thing and far from the last
she fell just wasn’t paying attention to
the like website name being wrong
because you’re thinking about who is
this person that says they know me
because I didn’t really say in the email
anyway who the person is if you might
have been curious about who it was and
forgotten to look at the email to look
at the yoruba and so since this happens
all the time since it was it was this
easy to trick my friend you might also
be thinking well isn’t this the kind of
thing that like banks and big companies
would have to worry about like no
employees and the answer is yes I do
have to worry about this kind of thing
but the way that they deal with that I
think is interesting so professional
security teams are like tanks or other
big companies they just assume that
their employees are going to get tricked
in ways similar to this they just assume
it’s gonna happen and the reason they
assume it is years of experience they
like see if somebody get tricked just
like Diana and they send them to like
special training where they try and
learn how not to get tricked
then they get tricked again anyway
because you can’t actually can’t
actually train yourself ahead of getting
tricked 100% and so the security teams
just accept the people can get tricked
because they’ve been able to see that as
true experimental II so what can we do
about this is it all over
should we just give up no I don’t think
so I mean you can try and not get
tricked
right for in my example you could try
and like you know remember to always
look at the URL bar make sure it’s
the right website but you know the
hacker is specifically trying to make
you not do that so it’s about how much
you try versus how much do they try if
you really want 100% guaranteed way to
not have any of your like online stuff
like tricked out of you you could not
use a computer like the best I have for
you and then it’s really embarrassing
when someone’s like hey what’s your
email and you’re like oh sorry I’m
trying not to get tricked like that’s
not that’s not that’s not gonna work
what you can do is the same thing as a
professional security teams do you can
accept that it’s gonna happen and how
you prepare for it and what you do after
you get tricked that’s was actually
important because you know everybody
makes mistakes especially when
somebody’s trying to force you to make a
mistake and it’s okay to make mistakes
because well only human so I hope you’ve
learned something about yourself today
or at least learned that lines are in
season and now that you’ve challenged
this assumption of I can’t be tricked
doesn’t it make you wonder nothing to
make you curious about well what other
assumptions am I making oh one more
thing you might remember earlier in this
talk I was like talking about the Wi-Fi
and the hotel thing and I was like you
know oh I just said it devastated the
family holiday I didn’t really say seem
happy wondering like what actually
happened you know in the hotel like did
actually did anything get hacked like
was there any hacking involved by what
actually happened what actually happened
there thank you very much
[Applause]
[Music] you
hey sir I have a question for you have
you ever noticed that if you tell
someone oh it’s easy to trick people
then they’re like oh yeah you know those
people but if you say well it’s easy to
trick you you’re a person and they’re
like whoa whoa whoa whoa I don’t know
about that and why is that why does it
feel so uncomfortable to think about
yourself being tricked
you can probably feel it right now I bet
have talked about it and you’re probably
thinking oh boy what’s this strange boy
you’re gonna do and fair enough
I’m here to try and show you that it’s
easier to trick you then you might think
it is because right now you probably
don’t think there’s easy to trick you
like at all but ask yourself again in
like eight minutes but what do I know
about tricking people well there’s two
parts here’s the first part when I was a
kid I got particularly into learning
magic tricks because I was curious and a
while I was learning magic tricks I
noticed this thing which was it like I
was just learning magic tricks from a
book and I was just following
instructions and had a trick people and
it was working like the first time it
worked
I was like whoa whoa no way that works
every time I must to go lucky but then
it just kept working and I was like you
know I would follow the instructions and
someone would get tricked and they would
love it and I was like really you can
just follow instructions and how to
trick people and it works that’s amazing
how is nobody taken over the world with
this yet
but then it turns out that people try
and take over the world by tricking
people all the time because it’s not
just magic that uses tricking people as
I got older ended up studying computer
security or hacking as the cool kids
call it and while I was learning about
hacking I saw that hackers were using
tricks as well
they were tricking people as well
because hackers those resourceful
scoundrels had figured out that
sometimes the easiest way to get what
they want isn’t to like do some really
complicated fast typing upload yourself
to the matrix technical thing it’s just
to trick somebody into giving you what
you want so like hackers we’ll just call
someone on the phone and talk to them or
send them an email and just trick
somebody into giving away their secrets
or into doing some sort of evil thing
and when I learned about this I was like
wow that’s amazing how has nobody taken
over the world with this yet so
sometimes people ask me how did you
first get into hacking how’d you first
get into security and well I was a
teenager and I was on a family holiday
and we were at this hotel when we got
there I like tried to connect to the
Wi-Fi there but I didn’t know like which
one to connect to and I was like oh mom
and dad I like which which Wi-Fi do I
use how do I connect to it and they were
like oh no none of them like we didn’t
have Wi-Fi at this hotel and I was like
but that’s alright like that’s okay but
you know all these Wi-Fi networks were
still just there and it made me maybe
wonder if there was some way that I
could get on to them anyway
and so that prompted quite a lot of
research and really devastated that
family holiday so
sorry mom and dad so that’s how I first
got into hacking and as I learned more
and more about it I kept seeing that
hackers wheezing tricks to get what they
want and that’s what this talk is about
showing you that it’s easier to trick
you than you might think it is using
magic and hacking as two examples so
which one you want to see first which
one you think we should do magic hacking
which one do you what no it’s it’s a
free rehearsed talk you can’t do that
you can’t just like I don’t know I can’t
whatever so I very conveniently have
this cup here which is exactly what I
need to show you the point and you might
be thinking I also have this ball here
and you might be thinking of the game
with the three cups and the ball and the
ball goes under the cup and you mix the
cups around and you have to find where
the ball goes
this is exactly like that but with one
cup and one ball so it’s not as good it
was gonna be in one of two places it’s
either going to be under the cup like
this or it’s gonna be in my pocket so
let’s do a practice round where do you
think the ball is right now so some
people were saying it’s in my pocket
those people have a way too much faith
in me no it’s right here it’s a practice
round it’s cold it’s cold lowering you
into a false sense of security
okay so let’s try again what do you
think the ball is right now you might be
thinking in my pocket right and you’ll
be right to kiss her because the copy
under the cup right well actually no
actually it can’t be under the cup but
don’t feel don’t feel bad if you miss
that one because this red ball is not
where this trick is about like at all
because to illustrate the idea that it’s
easy to trick you when you’re not paying
attention
while you weren’t looking I put this
lime under the cup did you say it do you
see it oh yeah so that’s how they get
you and just to really like send that
point home I’ve gone to just a really
illustrate like the point of it’s easy
to trick you in your not paying
attention I’ve gone to the trouble of
doing it a second time so I hope that
helps you so
so the trick to this is there is no
trick I really did just do it when you
weren’t paying attention because people
would do this all the time right people
do this not just in magic in all kinds
of tricks they like deliberately draw
attention to something just to draw your
attention away from somewhere else where
they don’t want you to look like this
banana and like you know that’s still
that’s just one example of people
drawing your attention away because you
know it’s easy to trick you in some way
you’re not paying attention but here’s
another example here’s one that you can
actually feel so right now all of you in
this room and not aware of a sensation
and you’re not gonna be aware of it
until I say what it is ready right now
you’re not aware of the sensation of
your feet touching your shoes or your
socks and now you can suddenly feel this
feeling in your feet they can feel
before and similarly you’re also not
aware of the sensation of your clothes
touching a torso except now that I’ve
said it you suddenly are aware of that
sensation but now that I’m talking about
your clothes touching your torso you’ve
forgotten about the sensation of your
feet touching your socks or shoes but
now that I’m talking about your feel
again you’ve forgotten about your torso
because do you see do you see where I’m
going with this
so by bouncing your attention around
like this somebody can make you pay
attention to one place which makes you
not pay attention to another place which
makes it easier to trick there and
that’s called misdirection in magic
language another place misdirection is
used is in hacking and one example you
might have heard of is called fishing
fishing with like a pH and I want to
tell you about a time that I use fishing
recently I asked a friend of mine who
were gonna call Diana for permission to
try and hack her permission to try and
act like a whole life and she said yes
controversial but ok and so it’s a long
story and this is just a small part of
it but at one point I had to try and get
Diana’s email password because I wanted
to log into her email and I tried this
really complicated technical way of
doing it and it didn’t work because of
reasons and so because I didn’t work I
was like well it’s just too hard I’m
just I’m just gonna do it the easy way
and so the way I ended up getting down
his email password was with this email
and so it says it’s from somebody called
Kathleen it’s not that’s fake it’s for
me and it says like hey Diana I’m like a
recruiter and somebody’s listed you as a
reference and can you please tell us
like did you work with this person when
did you work with them were they’re good
to work with blah blah blah
I please tell us about this person who
said that they worked with you and then
if the resume say you can you know learn
more about them and so the reason I sent
her this email has nothing to do with
like recruiting or her employment or
anything like that all I wanted to do
was to click on that click here link
because when you cook it goes to this
screen which is a login screen for
hotmail Walker staying out of hotmail
account and some of you may have noticed
that this is not the website for hotmail
that’s not that’s not what the login
screen for up mail is because this is
not the real hotmail login screen this
is a fake one that I made and all it
does is it steals whatever you type it
to the password box and sends it to me
and so I sent this to her and it worked
obviously a way to totally wait right
like she typed in a password great easy
and like you might be thinking like oh
man this Diana person must be such a
bozo for falling for this but Danah is
far from the first person to fall for
this kind of thing and far from the last
she fell just wasn’t paying attention to
the like website name being wrong
because you’re thinking about who is
this person that says they know me
because I didn’t really say in the email
anyway who the person is if you might
have been curious about who it was and
forgotten to look at the email to look
at the yoruba and so since this happens
all the time since it was it was this
easy to trick my friend you might also
be thinking well isn’t this the kind of
thing that like banks and big companies
would have to worry about like no
employees and the answer is yes I do
have to worry about this kind of thing
but the way that they deal with that I
think is interesting so professional
security teams are like tanks or other
big companies they just assume that
their employees are going to get tricked
in ways similar to this they just assume
it’s gonna happen and the reason they
assume it is years of experience they
like see if somebody get tricked just
like Diana and they send them to like
special training where they try and
learn how not to get tricked
then they get tricked again anyway
because you can’t actually can’t
actually train yourself ahead of getting
tricked 100% and so the security teams
just accept the people can get tricked
because they’ve been able to see that as
true experimental II so what can we do
about this is it all over
should we just give up no I don’t think
so I mean you can try and not get
tricked
right for in my example you could try
and like you know remember to always
look at the URL bar make sure it’s
the right website but you know the
hacker is specifically trying to make
you not do that so it’s about how much
you try versus how much do they try if
you really want 100% guaranteed way to
not have any of your like online stuff
like tricked out of you you could not
use a computer like the best I have for
you and then it’s really embarrassing
when someone’s like hey what’s your
email and you’re like oh sorry I’m
trying not to get tricked like that’s
not that’s not that’s not gonna work
what you can do is the same thing as a
professional security teams do you can
accept that it’s gonna happen and how
you prepare for it and what you do after
you get tricked that’s was actually
important because you know everybody
makes mistakes especially when
somebody’s trying to force you to make a
mistake and it’s okay to make mistakes
because well only human so I hope you’ve
learned something about yourself today
or at least learned that lines are in
season and now that you’ve challenged
this assumption of I can’t be tricked
doesn’t it make you wonder nothing to
make you curious about well what other
assumptions am I making oh one more
thing you might remember earlier in this
talk I was like talking about the Wi-Fi
and the hotel thing and I was like you
know oh I just said it devastated the
family holiday I didn’t really say seem
happy wondering like what actually
happened you know in the hotel like did
actually did anything get hacked like
was there any hacking involved by what
actually happened what actually happened
there thank you very much
[Applause]
[Music] you
Please follow and like us: