Hackers took over his phone number for 61 minutes

**[00:00:00]** Hello everyone and welcome to the web talk show. My name is Armando Piscaro and with us today is Mark Kitzman from Ephani. How are you Mark? >> I'm doing excellent. Excellent. How are you? >> I'm doing excellent. Thank you for asking. I'm sure this will be a fun-filled episode because before the show we talked a little bit about what you do and I want the audience to learn about that as well. Can you tell our audience a little bit about you, your background, and how you got into what you're doing today? >> Yeah, so at a very high level, I was born at an age where very very young when the first Apple computer came out. And so before I remember even knowing what that computer was uh you know typing on the keyboard and at a very young age started I would I had a friend that had these magazines where had basic code in there where you could type it in and and uh create a game and that's kind of how I started out into into computers anyway and uh for some reason it really caught something just really caught my brain by the time I was you know ninth or tth grade I'm writing like complex code and my the computer science teacher in the high schools that kind of looking at me, you know, what's going on and and so um and so I got lucky that uh I went to college for management information systems and a master's in information and communication sciences. I did try and play golf. I wanted to be a golf pro also and that didn't work out. I couldn't get a degree and play golf at the same time. uh but uh I ended up in the right field and so I've been in telecom mobile services and uh had a primary focus on cyber security for probably about I guess since 2002 2003 some and I started out when I was graduating from the mast's program uh I started out at AT&T I they had actually give given **[00:02:00]** me an offer nine months before I was even going to graduate and they had to wait for me. So I I got lucky there and I shouldn't say lucky, I mean I prepped my whole life. Um and and I happened to be the right person and they took me ahead of time and I started out in the the big companies. So I started out with AT&T at a time when they were laying off, you know, tens of thousands of people and I was I graduated at a young age and so I was one of the most hated people and, you know, a seven state region of why is this, you know, 22 year old coming in here and and they're laying a bunch of people off and so I I got, you know, to go through that experience and and uh, you know, that's got a lot of stories just on its own for that experience. But um I ended up moving out to California still working in the telecom space watching the dot bubble and these grow and everybody was just like why are you not joining >> you know petfood.com and you know all these companies and and I would go look at them and re and I would and I think that I don't understand their business model. I don't know how they make money and I don't know how they're going to survive. And then of course the dot bubble hit and then a year later after that's when I joined. you know, two years later, that's when I I jumped into startups. >> And so I've been in startups. I was the 30th person, I think, uh, hired at a enterprise email security company and then I went to another one. The first one got acquired by Microsoft. Then I went to a web security for enterprise company and I worked directly for the co-founders at both of those and and then that company got bought by Cisco Systems and and so I had the bug in me and then eventually I tried to I wanted to do my own startup so I was in the middle of doing a self-funding startup self-funded startup and then I got mobile hacked and that's where I ended up today and it's one of the reasons why Fonnie was born because it was a very **[00:04:00]** painful that in 2018 and we can talk about that later but uh that's sort of the summary of my of my career. >> Well that is comprehensive. I think a lot of people just like start out go study something and then get to work. But uh you you had a path that's not the same as everyone else. And then you also had this experience of like being young when with a specialty that that whole thing we hear about it today as well with all the layoffs and everything and then someone comes in with a new thing and they're like ah and but [snorts] but really they're not seeing the other side which in your case I mean you had the value ad that this company needed >> that's why you were hired not because they wanted to lay off the other ones. Yeah, it was definitely an eye openener because I I was so young and so naive and AT&T at that time was heavily unionized >> and so one of the memories that sticks in my brain and I'll I'll remember it for the rest of my life is it's also when most people had it was it was when the dot matrix was printer was transitioning into the inkjet printers >> and so I happened to have a one of these uh uh you know these old style printers on my table and then one day a little spring broke and we're talking a spring that's like less than an inch long and so I wanted to get that repaired and so the my first experience at AT&T was that because I I was just going to walk down the street and buy a spring and I was told that would violate the rules. I had to submit it. They wanted to charge something like $250 from one AT&T department would charge our AT&T department like $250. it would take like 72 hours and my boss is like this is stupid. He he went and threw it **[00:06:00]** in the trash and then went and bought an inkjet printer for me. And that was that was sort of like my first introduction because in college they >> you know I'm learning about telecom and his the history of uh you know the deregulation of the the telecommunication industry and all of that. We never talked about dealing with, you know, uni unionized environments and things like that. And so it was it was definitely an eye openener when being very young and walking into that. >> That is a part of work that not all of us get to experience. The whole corporate slash unionized roles between businesses where you can't just do something. it has to go through multiple departments and and get approvals and then because the idea like the concept originally has a value they they wanted to make it to where people are not excluded because there's just a cheaper alternative or whatever, right? Like I I see where it came from originally, but then it got transformed into something that doesn't really help anyone and just slows down progress or or whatever you're trying to do. Many people now like younger people especially do not understand when you say AT&T they think of the carrier they're like oh yeah AT&T T-Mobile Google like yeah yeah there's a bunch of them right but they I think for the audience they there there's a lot of of younger people who don't understand the scope of what AT&T meant back in the day and the size and power of the company. >> Yeah. So AT&T, you know, at one time was the only provider. And so they had grown up through this and it was sort of job creation, you know, in the United States to just, you know, continue to hire people. And then when Ronald Reagan deregulated the industry and then there's competition, you had WorldCom, you had, you know, became NCI, of course, you know, Sprint **[00:08:00]** and T-Mobile popped up and and it was very disruptive to uh, you know, that environment in that time. So it was major disruption and I made it particularly difficult on the the people on the other side. And so I I you know I had to learn their side and and what made it even worse was I didn't I didn't get a computer science degree in college but I could program you know I put myself through college programming in probably five six different languages and [snorts] I sort of hid that. But then every time they gave me a job and they'd say, "Okay, you manage these seven people and you're going to start this in 60 days and I would look at it and I'm like, well, this I don't know." And then I would just automate it. I would write code to automate it and and uh and then pe that would make people angry that I just I just removed I think it I think there was one year where they were going to put like 12 people 12 unionized people on a project and I ended up writing code that BLF said couldn't be done and and I automated the whole thing and uh and so in the other memory that stuck with me at that time is that you know I I remember one of the employees saying are you going to Christmas party and I go, "Yeah, I was planning on it." She says, "Well, I hope you don't I hope you don't get your tires slashed." And kind of have this smirk on her face. And so that was the environment at that time. That was, you know, early mid 90s, a little late 90s during that time frame. And uh yeah, I don't want to go through that again. And I I wouldn't >> I wouldn't wish it anybody else, but I survived it. It it maybe it made me into, you know, a better person and and able to deal with Silicon Valley because, you know, when you when you jump into Silicon Valley, that's a whole another, you know, now you're talking about a whole another type of environment that's just the complete opposite of, you know, working for the **[00:10:00]** big corporation. That is shocking especially considering the time frame because people now are complaining about automation taking their jobs and uh many hear that from the news and think oh this is the new thing AI is coming to automate things and take your it's not a new thing we've been automating things forever like you've just proven >> it's automation is the process of creating something that can take care of things either by logic in code handwritten or nowadays in a nondeterministic way where it could just sort of think or plan for itself. But but programs I mean software in general is an automation like you being able to do 2 plus two to a point is it's an automation. I mean the invention of computers was an automation, the invention of the typewriter, the and of course the invention of the phone and uh yeah there's there's disruption you know every couple years of something some industry and certainly mobile's been part of that. But I I was lucky enough to actually work for Macau Cellular when I was in my young 20s before it became AT&T. And so I've been in mobile before it was even really you know AT&T and uh and and that's you know that's an interesting industry just by itself. mobile. Well, telecommunications is extremely interesting to me because if you look back not so many years and see how we were transmitting voice from one place to the other and then we started transmitting other things as soon as the internet and before the internet but but we started transmitting email, we started transmitting words, we started transmitting images and then videos and everything. And if you think **[00:12:00]** about how it all works, how like the last episode that's going to air today, our guest was in Singapore and we're talking just like you and I are talking. >> Yeah. >> And I was just blown away by the fact that that day I was talking with someone in India via voice call and then I was doing the show with someone in Singapore. And and it's like and it feels the same way. You're just chatting. But for that to happen, how many hops [laughter] >> do we think are required? >> Yeah, that's amazing. I It's probably about 18 months ago, but I had this idea of doing a video on >> all of the vendors we rely on to simply make a phone call or send a text message. You don't really think about that, right? You think of I have T-Mobile as my mobile carrier and then for when I send a text, it's just T-Mobile. And so I started to map it all out of, you know, because there's there's 117 companies that own the cell tower stations. A lot of people think that AT&T owns that tower. Verizon owns that. There's 117 companies that independent companies that own the majority of the cell towers. And so the whole thing's split up. So to make a to make a uh to send a text message from your phone, I mean, you've probably hit eight different vendors by the time you even reach the cell tower, you know, if you if you include like the hardware of your of your device, the operating system, who makes the who makes the uh you know, SIM card and and and the radio and and uh it's you know, we rely on so many different vendors and we just don't you know, the nice thing is we don't have to think about it. But >> Mhm. >> Um, you know, all you got to do is have a Telegram app or Signal app and you can reach people in over 200 countries around the world for free and have video calls. Like, it's amazing. It's I don't understand. I mean, as technical as I **[00:14:00]** am, it's still amazing to me how all of it works. It It amazes me more than the fact that I can get on a plane and fly to another country. M well the speed I was looking at a video the other day where they were doing a visualization of the the cables that are under the ocean. >> So for for us to get to Europe or Asia, there's this these cables which are not I mean the cable is still a like a fiber cable, right? >> [laughter] >> It's it's not huge, but there's there's redundancy or whatever, but they have all these cables going all the way over there so that we can transmit media, voice, text, images, video, whatever, all the way over there in milliseconds, which is just like how is it getting there so fast that you can have a real time conversation? Because people just imagine this abstraction of like, yeah, I have my phone. I send something and then what? It goes into space and then goes down. No, it doesn't. >> Yeah. >> For it to be fast, it stays here. >> Yeah. I worked at Global Crossing for two years, which is the company that laid most of that undersea fiber optic cables. And uh >> yeah, and uh you know, they built they get they built themselves up and then imploded, you know, on the stock market. But >> um and that's actually John Ledger used to uh be the CEO of and that before he went over to T-Mobile and it was it was a fun crew over there. [snorts] But uh yeah, that's that's an interesting space. But the undersea cable infrastructure, yeah, it's and that's another one of these vendors where you know, you send a text message, you make a phone call, you're not thinking about the fact that this is going, you know, under the ocean, right? You just you sort of have this concept of my mobile phone connects to the cell tower and nobody thinks about what happens after **[00:16:00]** that. But once it hits that cell tower, it goes into the internet and and if you're crossing from, you know, one country to the next or one continent to another, that's gone in those under under sea cables. >> Can you give us a And we were doing the video and it ended up being like going to be very long. You were talking about it the other day. So, can we do like a cliffnotes version of just to give people an idea? You send that message through your phone, gets to the cell tower, what happens next? >> Yeah. So, so even before it leaves your phone, there's protocols called SS7 diameter that's talking and communicating with all the the person that you're wanting to send a text message to. So there's so many different moving parts and and that's why it's kind of amazing. But um you know when you pick up your phone and you type the message that's still local on your phone but as soon as you hit send that's kicking off multiple protocols that are connect or you're able to communicate with the cell towers you're able to um these packets get sent to to so if I know your number and I send you a text message there's these get requests that go out on the SS7 network to find you. So, you know, I don't know where you are when I send this text message. You could be in Singapore, you could be in El Salvador, but that packet goes out to find you, and that's just amazing in itself. So, it goes out across the world and says that this person is attached to this cell tower, sends that message back to my device, and then that's when it sends that text message. And then there's just a bunch of different vendors, you know, in between there. And it's one of the reasons why security is so important in the mobile space because of the fact that the cell towers are independent that your operating system is different than you know typically the **[00:18:00]** device manufacturer and and you'd think that AT&T and T-Mobile have their own SMS you know text message system but that's a whole another vendor and that your text message is going through this other vendor that you know that you hope they don't get hacked, but you know, all these different vendors, you know, get hacked and and uh and so that's why security is so important in the telecom space is because there are so many vendors out there and it's could be like a server vulnerability in some software update. It could be a rogue employee that works inside of any one of these vendors. You know, a lot of us use VPNs and you just kind of assume that, you know, it's all fine and my my data is being encrypted, but you know, all it takes is like the wrong insight or a nefarious person that is working inside one of these organizations who, you know, puts some something inside of one of the servers that, you know, duplicates your message and sends it off to a server, you know, another part of the world. And I'm not suggesting that happens or you know that it is technically possible but uh you know there have been instances of almost every company having some kind of incident. You're very lucky if you if you get away with not especially these days like anyone who's following the news on data breaches it's like multiple ones per day. Like the crypto space right now is getting you know getting hit really hard and and uh and and it's only going to get worse. One of the problems today is that while if you are in the space, you hear about these attacks, compromised servers or systems, the people who were doing them originally were experts and had very advanced toolings and they worked in groups etc. and they did all this **[00:20:00]** stuff. But nowadays with the tools being so powerful, now someone with the intent doesn't have to be an expert and can use tools to to do things that they might not have been able to before, which goes the other way. Obviously, now anyone can build a new company with with good ideas because you can now build software on your own using AI, which is fantastic. So it just goes both ways. But cyber security-wise, people have to be more cautious with what they share and how they share it in their passwords and all that because of the things you were saying. All these companies can have vulnerability and if you just trust them blindly and oh yeah, I'll send my social security through there or whatever because nobody reads my texts. Well, >> yeah. Well, I can give you specific data points of of how AI can be used, and I'm sure it is being used, but you know, if you were to go back, say, 10 years ago, let's say I'm a nefarious person, and you sort of picture this person in a in a basement somewhere with the, you know, the green screens, and he's like, he picks somebody, he picks a company, and then he spends day and night trying to figure out how am I going to go after that particular company. And so um AI coding has sort of revived my coding like like these days I don't want to pick up a book about Python language and Ruby on Rails or whatever the newest you know one is and then read the book and I you know I don't need to do that. Uh but you know these these coding platforms now are so powerful that it's kind of revived my desire to do that. So I started actually building some cyber security products for myself. I wanted I have ideas based on all the feedback I've been given from, you know, Fony has thousands of customers. So I get feedback from them on what they're **[00:22:00]** looking for. And uh and to give you an idea of what I've been doing lately. In fact, I've got a a Medium blog that I just started literally like four weeks ago. And anyone can go to my Medium blog. It's under Mark Kitzman. And so I wrote I used AI and I wrote my own scripts. And to give you an example, what I can do is I asked AI, go give me a thousand business domains of crypto companies and just list them out and then I would and I I designed like 32 33 different types of scans. So So one scan would be to to understand does a company have encrypted DNS? And I want I don't want to get too technical for your audience, but if you don't have encrypted DNS, then you're vulnerable to like email spoofing. >> So I could send an email on somebody else's domain like like a funny.com like somebody if if Aonnie was spoofable then you know I could send you a message and it looks like you know you're a customer. So, let's say it's a crypto company and you get a message saying, "Urrent, update your software. Go to this link." And I So, I wrote a script and I said, "Scan these 10,000 domains and tell me all the ones that don't use encrypted DNS." And now it found about 385 companies. And it took 4.2 seconds to do that. So I I was doing the math and I could in one hour and I and and I was using a $7 a month hosted server to do this. So in one hour I was I did the math on it. It worked out to be something like 36,000 I could I could you know 36,000 companies in one hour. And you can also say okay run 10 of these at a time to do even more. Mhm. >> And and so then I could take those thousand domains and say uh tell me all the ones that don't have you know this feature or this you know this **[00:24:00]** demarcation setting the demark turned on off is their security is their encryption TLS at this level or is it high or low >> and I could sit there and literally in [snorts] six and if I I've already got these scans designed so I can literally just in in 60 seconds say, "Okay, these are the five that are just the complete most vulnerable and then send a bunch of AI bots at them and just sit there and all they're doing is just pinging looking for holes." And this is why like the AI attacks are going to just explode. You know, one of the reasons I started the blog is because I've been I've been scanning like small business web domains or crypto domains and and doing all these different scans and then I summarized it up. I reported it. I post it on my LinkedIn account. So, if you want to go looked at my LinkedIn profile and under also my name, you can see I'm posting these these articles there and that'll take you to Medium if you want to see it. And I'm I'm kind of aggravated at the sense that there's so many companies that we rely on >> that have very poor web their their application their web application is very poor and every time I see a data breach I will go scan I'll do a full scan on that on that company and then it sort of aggravates me to find out that not only is their web security poor but they don't even have what's called this um automated security.txt file that you can hide in your website where researchers and auto scanners can actually when they find a vulnerability, the good people, the white hat people, the researchers that find a vulnerability can then send them a message automatically and then they can go and fix it. So there's a lot of companies that we rely on that don't **[00:26:00]** even that don't even have like a yeah, who do you contact? Of course, you could send something to like their >> support.com >> or or you go to like a form on their website, but that's going to go to some admin and they're just going to like, "Yeah, whatever. This I don't make any money off this." And it it goes into, you know, the lost email. And [snorts] uh and so I'm very frustrated. And so, and you can imagine now I probably emailed like 12 12 business owners on LinkedIn over the last three weeks saying, "Hey, I you know, I'm a part owner of this cyber security company. I'm legitimate. I'm a good guy. And you need to fix like your web application and I'm happy to provide you the scam." like I don't want to send them, you know, because then I look like the scammer and uh and none of them will respond. >> I can't believe >> and and so I I you know, part of it might be that who is this guy? Is this is he going to send me a file? I click on it, it's going to take my whole network down. Um and and and maybe, you know, they just ignore it. Maybe I don't know. But, uh, it's kind of frustrating because you can't, you know, if you if if I take if I do a scan and I've got 14 pages of information that basically sort of outlines, you know, what hackers would love to have and and that were that if I were to send that to somebody and that gets, you know, released, I don't want to get sued for, >> you know, providing a roadmap to somebody's, you know, infrastructure. And so, you have to be very careful about that. And that's that's why it's so necessary that companies have um either a bounty program, a bug bounty program, or they've got this automated feature that people like me and other researchers can do an auto send on it and it goes to the right person that cares about that. And so I feel uh very **[00:28:00]** bad for a lot of companies that are just going to get hit. and and I will continue to do scans and I'm hoping that maybe these you know start to get more popular and you know people will follow it. Of course, it's kind of hard to, you know, get uh, you know, following going on, you know, a brand new topic. But, uh, this is, yeah, we we all got to be careful about who has our data, who has our financial data, and are they actually securing themselves? You know, I'm I'm a big believer like at Afani, you know, I'm sort of a Karen at Afani. And I did all kinds of scans all the time. And so the Afani score was uh very high, but but uh of course when I started doing these blogs, I wanted it to be, you know, perfect. And so I was feeding, you know, our own team information and they would make a fix and the score goes up, make another fix and it's like, okay, you know, now we're at, you know, like 97 out of 100 [snorts] and there's some complex changes that that to go, but it's, you know, to get to the the 100. It's very difficult when your website is very complex and you've got multiple kind of domains and you've got all these, you know, integrations going, but you have to also worry about third parties. So that's one of the big things right now is that a lot of times when you see that X company got [snorts] um hacked that it's actually not their hack. It's actually a third party that they were relied on and and I'll try and find out who that company is and do a scan on that company. But a lot of times they hide it because they don't want to announce that this vendor got hacked because then all these hackers may just go, "Oh, really?" Like let's go find that >> client list. >> Yeah. Go after. especially if it's a financial company or crypto company, any anything where they can get money or, you know, blackmail, things like that, you you uh you know, once you get hacked, you got to be very careful about it. But, um, yeah, it's it's it's going **[00:30:00]** to get worse before it gets better. [snorts] One of the things that you talked about like the security TXT variations there of of ways for a researcher to reach out. I I struggle with the same thing of like you want to tell people when something is a miss. And even just every consumer we have traditionally it might have gotten better but traditionally you go into a website there's a contact form a generic for you think you're nobody's going to read it like you it's just where email goes to die right and uh with chat and all that it's gotten better but in general contact forms are very reliable >> for things like these even worse especially if you go to a big company mid mid-market company if you want just go try to send the contact form. It's like five drop downs, department and another thing in a subcategory and why and select the thing. So, you're not going to even send it because they're making it really hard for you to help them. >> Yeah. A lot of companies are also starting to implement AI for those type of things. So, you talk about things getting lost. I mean that you know AI gets um you know all these positive things and it's like but but at the same time AI can is very destructive. It ruins customer support. um you know, Airbnb. I mean, you know, you know, I've got a number of condos that I rent in Southeast Asia. We, you know, use Airbnb and they they move their customer support to AI and it's so frustrating and uh and and it's just a horrible experience. And uh you know, we we play around with AI a lot just because we need to know what we have to deal with >> and we've attempted to you know, can we you sort of have our own enclosed AI? uh and um so that therefore it's controlled but you know a lot of a lot of companies are implementing AI **[00:32:00]** internally in sort of an open way not really thinking about the fact that that information you know you could have customer information being basically put into AI >> and and and the one thing a lot of people don't think about is that you know when when my information or your information gets crawled or a data breach goes into the dark web and all these data brokers then will go and pick up that data and then they'll sell it. Well, the data brokers are federally regulated. So, if I know how to contact them, I can submit say, you know, delete my data. They have to delete it. They have to delete it for 30 days. And I think what they're doing most of the times is just they move it from a public server to like off in the back end and then whenever the federally regulated time frame come they just load it back in and uh but at least with the data deletion industry it's federally regulated but with AI if if your personal information gets loaded into AI and all of our data has been loaded into AI regardless of the fact that if I go on to chat GPT and I say tell me everything about this person it's going to say I can't do that but somebody can do that on the back end >> and it's either you know the governments you know the US government other governments uh the people inside of that AI companies there's certainly a number of people that will have that kind of access to all of our personal data and uh yeah some point in time like even third world countries AI is going to know every single human on the planet and it's going to profile and know everything about them and uh and and I've changed my philosophy on data deletion. So I hired at one time a data deletion company vendor myself and uh but I came to the conclusion that uh deleting your data and then just **[00:34:00]** refilling it back up is not it doesn't it's you know it's like you're you're in a boat that's slowly sinking and you're just you and so I' I've really got into data poisoning and the idea of poisoning data >> and so I've actually filed for a patent on uh what I call DNA noise and that is the mixture of deleting my data and then presenting just enough false information and real information together so that that's that is what get pulled in and so I have alias phone numbers alias email ids and things like that and I'll post those on social media and uh and the web crawlers will come and grab it and hopefully you know, readjust, you know, what's known about me with these data brokers. So, my data is not being being sold. And that's perfectly legal if a if a web crawler, you know, or like clawed a AI bot or the Google bot comes and grabs information and pulls that in, that's 100% legal. Of course, I can't go to like the Social Security Department or US government, give them false data, >> but I certainly can feed information to uh these data collection companies in a way that over time will will poison my data. I I I really believe that if you if you wanted to, you could make yourself look like you you're like you can try to pin somebody like an actor's name and say, "What's their net worth?" I think that you could probably poison the data enough to show that Armando is worth, you know, $79 million and uh and that if you you place information in the right spot in enough places that that will get crawled. Now, I don't recommend doing that because then you'll just make yourself an enormous target. >> Uh but um but I see that being I see data poison as being the way to go in **[00:36:00]** terms of trying to hide yourself. You can't hide because all our data has been breached, you know, a hundred times plus. So, you cannot hide, but you can sort of camouflage certain things about yourself. >> I like that. It reminds me of the secure deletion, right? For those who don't know, when you delete something in a computer from the hard drive, it doesn't really the deletion does not happen. it just removes the index to it. There's no way to find it. However, you can still find it. There's tools to do that very easily. >> And so, a secure delete, and you might be able to explain this better, basically deletes it and then writes and writes and writes and writes over it such that it's it's very hard to get it back. >> Yeah. Yeah, I mean basically when you you put a file on your on your computer, it's in it's zeros and ones, you know, in a certain order to to in, you know, create the machine language. And so when you write over it, you got it exactly right. It's just that the operating system, whether you're using a Mac or, you know, Windows, cannot view it, but it still exists. And the only way to make it so that it doesn't exist is actually write over it with all zeros, all ones, or something to clean it up. or you take some files from one side, you move it over um over on top of that. And uh but yeah, if you don't if you don't use sort of specialized tools, then um you know what what they say like it's wiping or you know, I know there's like an official, you know, term for it, but uh it it it's still there unless you're using like a special tool to wipe it off. >> Yeah. And what you're doing sounds similar to that, right? Yeah. Because it's like you're you're not just deleting the data which might just appear again because it's coming from somewhere and and by you doing that poisoning then that data is now mixed **[00:38:00]** between good data, bad data, etc. And just makes it a little harder for for these brokers to have the proper information. Is that accurate? >> Yeah. I mean the way that the way that the you know the data broker industry works it's based on confidence of the information they have >> and so you don't necessarily have to delete yourself but what you have to do is sort of convolute the data about you to the point where the confidence level on your data goes down to where they just won't bother selling it >> and and that's all you can do. you know, when when there's a company there's many companies out there that claim like we're going to take you off grid and you know, even the mobile carriers won't know you, can't find you, and it's I kind of laugh because being being a ex computer programmer gives me so many advantages to um to understand like how how things work. And um and these days you could have the most secure device, but if you're using it, if you're using a browser, for example, there's there's what's called device fingerprinting, there's uh browser fingerprinting, there's canvas fingerprinting. And so what companies like Google and others can do is they will actually recognize that this device has a certain font style that he uses that it has uh um the size of the font. It has these specific apps. So if you don't, you know, change like the apps that are on your phone, it's it's actually fingerprinting that device. And so you could go to one company and attach your you're attached you're using your browser on your phone to that company and then literally an hour later and they and let's say they have Google Analytics and then an hour later you're going to a totally different company that's on the other side of the planet and you're using your browser to they the odds are pretty good they can tie that together and even though you **[00:40:00]** may have hid everything about you to both these companies that the analytics will link you. >> We [clears throat] all have what's called a an it's canvas fingerprinting. We all have this an advertising ID which has its own hash mark. So we all have a hashmark associated with different devices and things that we use that's that's profiled to you and it's actually and it shows up in in uh in shapes. So my shape is a rectangular rectangle and a triangle. and it'll shape it based on the hash mark. In fact, I I wrote a fingerprinting tool so I can actually go to my browser and and I just hit submit and milliseconds later it pops back and shows me, you know, my ID uh you know, my ad ID. Certain browsers are better at hiding blocking trackers and things like that, but uh yeah, to be off-rid it's very very difficult. It's >> you almost have to just not use a mobile phone or not use a computer because right now we're being tracked by Apple Air Tags, Bluetooth devices. You know, a lot of people are complaining about these cameras that are being put all over, you know, cities in the US. Well, a lot of those areas also have like what's a Bluetooth sensor. Mhm. >> And so there so not only you know the camera can show that um you know visually like who's driving this car and can can record the license plate and the car model. The Bluetooth device can identify everybody that's in that car by un by recognizing these connections of you like I have Beats the Beats earbuds and those have their own identifier >> and so if those have been and I use those at home >> they connect to my devices my devices connect to Wi-Fi that's in my name and so now that Bluetooth device can can I I **[00:42:00]** just I'm I'm in the back of a car. Somebody else is driving. I'm listening to music and I'm getting I could get identified. And of course, if it's running, you know, and if that identification is all AI, then they could literally just, you know, track me by my headphones. And uh and so this is where this is where we're we're coming. So, um, you know, I have a lot of ideas on on things that, you know, I think could be done to sort of mask that, but, uh, you know, at some point in time, it's maybe maybe not use Bluetooth devices, use the headphones or you plug it into your phone. I mean, I don't know. It's going to be difficult to to hide. >> Hard hardwired. >> Yeah. I mean think about the fact that let's say it recognizes that um you know I'm typically in the Bay Area but but I go all the way over I'm in Bangalore India and I I put my Beats headphones on and some sort of Bluetooth sensor picks it up and says well this is Mark and knows that I am in you know Bangalore outside of a cricket you know stadium or something like that's where that's where all this is hiding >> the many thing that you said for some who are listening there might be in their car. They Some of people might think this sounds very science fiction, which is not, by the way. And some might think this is very new, like, oh, they're doing these new things. It's terrible. But and you have way more experience in this, but even back in 2008 when we first started our first company, my partner was doing for the um what was cyber security lab and our university. They were working on fingerprinting for banks and other things so that they didn't have to use that token with the little thing that just generates the numbers before **[00:44:00]** obviously all the apps Google authenticator those came out. it was a physical device and so they were finding new ways to fingerprint people so in a legitimate way so that your bank knew that it was you and not someone else trying to get in your account. Right? So this was back then and and I'm sure it existed prior and also like the Bluetooth thing. I remember we were doing experiments on you can have these beacons at your store and then people would come in and you could see the little dots moving around and and uh now of course with all the privacy laws and things it's like no you can't do that but but you can't do it or you shouldn't do it based on the law is one thing. Are people doing it regardless? That's a different thing. And especially if you think about bad actors, like how many devices do you think are out there that are not regulated that can do that because the the technical part of it works for more than 20 years. >> Yeah. And then and then every time, you know, they've got like a government can create a law and and then six months later it's obsolete anyways because some new tech has figured out. But um you know I flew around the world talked to different uh carriers and so one of the things that you know we would discuss is that what what we called like gardenwald where like as you say could det like you walk in a store and your phone connects to Wi-Fi and so it knows potentially who you are if you've been there before like you gave them your phone number you gave them information to be part of their points program and then it could track you and and uh and and they can do that certainly with the mobile phone and then the carriers were working on providing actual the GPS location of your phone. So when you got to a certain area, let's say I let's say I walk in a store and one person goes over to the aisle that has candy in it, which is all low value, and then another person walks in and **[00:46:00]** walks over to the uh the Rolex part of the store would actually alarm and say, "Hey, this is somebody you need to go, you know, help and and try and sell them a watch." and uh and so you know you can say okay well you can't track that anymore now they still do it anyways that's how they caught like the u you know with the voting you know certainly you can put a a garden wall around like a voting booth and it will recognize every mobile phone that goes in and out and record that information identify the person and so if somebody votes you know 20 times yes they can do that despite what politicians you know may say you I know this for a fact. In fact, you can you can sort of test this yourself. Like when I traveled a lot and I was younger, I like night life. And so, let's say I'm in Singapore and I would I would look at, you know, let's say I want to go to a bar and and I'm sure a lot of people and I hear this don't remember seeing it, but you look at the bar and it's got the little bar chart that shows that 8:00 p.m. it's 20% full. at at 1000 p.m. It's >> and so you could actually like okay do I want to go to this bar because I want it to be quiet and I want to watch a NFL game >> or do I want to go because at a time so you so it's actually doing that by our mobile phones and it's collecting that data. So whenever you see sort of that bar chart of capacity broken down by the hour, it's because you have walked into one of the garden walls of you know that restaurant and it's and it's recognizing and measuring uh you know that data and uh you know now so like let's say a government says well you can't you know track people's GPS. Well, now you have now you have uh Wi-Fi routers where you load it with the right software, you can actually see humans >> through the through the RF signaling **[00:48:00]** kind and and and and watch from. So, um you know, there's been demonstrations, you can see it on YouTube videos and and so they'll use like an example of like a SWAT team uh you know, uses like the Wi-Fi to see they can see the person behind the wall. I can see like where they are when they're moving and and uh so it's it's that's sort of like something you'd see in sci-fi, you know, 10 20 years ago. Well, they're doing it now. And uh and so it's Yeah, that's kind of weird, creepy cuz uh you know, it'll get to the point where they can just actually see everybody moving inside of a condo building. >> Wow. >> Yeah. And that's where it gets, you know, that that would be like just so invasive, right? It's >> um >> you know and it would certainly make you know for some good comedy scenes in a movie and I'm sure it's been used before but uh uh but to think about the technology and where it's going. Yeah. It's getting very very creepy and and imagine you've got sensors on every building that are and that's connected to AI and that it's watching what you know everybody's doing and it it's very creepy. The the AI part is very interesting because models that have thinking, they're not thinking, by the way, caveat like but they call it thinking. Those that can do multiple rounds on their own. So you give them a prompt and they'll they'll sort of analyze it, run something, run the prompt, then do some additional work in the harness so that it looks like it's thinking, it's processing multiple variations and continues, etc., etc. They call them thinking models. Um they're very good at doing things, having a goal and like going and doing many things. But they're also very good at pattern recognition. So the things you were saying, you might **[00:50:00]** have data A, data B, data C, data D, thousands of data points, and it's very good at looking at all that in a second and figuring out the correlations between that data and and just finding out who is who within that data. So we've used it for examples when we've drawn like demos of let's try to consolidate a whole year's worth of billing and taxes and and all the things. You just give it the things just data in general and it will find every last scent where it came from, where it's going, if it was lost, like all of it, and attached to the right accounts, etc. So, of course, if you give it data points, people moving, doing these things, etc., it could be very good. Now, granted, this is amazing for like forensic investigations, for for criminal justice, etc., right? at but at the same time like you're saying it can be creepy [laughter] if if it's in the wrong hands then >> imagine day where there's uh you know 10 10 bots dedicated just to me >> I don't know I don't know they exist but they have my Bluetooth information address of my computer my mobile number all of that tracking my GPS you know know that I'm flying to you know Bangkok talk or >> Mhm. >> Uh that could simply just track you around and I don't think we're there. I don't think I don't think that's happening. But it can happen and therefore it will happen. There's there's this movie that very relevant for me. When I watched it, I was like, "Oh man, that's a that's a good like futuristic AI what could happen with AI movie." It's not a big blockbuster, but it's called Eagle Eye. I don't know if you watched it. Uh, but it's um >> Oh, yeah. Probably like 8 20 years ago or something. And it's >> Yeah. I don't I remember when it came out, but it was like it was a just a fun **[00:52:00]** fun movie to watch. But >> when all the Chad GBT stuff had started happening like six months in, I was like, it's like every single thing that happens in that movie can happen today >> without the massive little thing that moves in the robot. like no no just as things are it can happen and so it's a good for people who haven't watched it it's a it's an interesting movie because it's a diff it's a point of view of like not that the AI necessarily can do harm because it wants to do harm but because it might think it's the right thing based on the inputs and what it considers to be like in that case I won't spoil it but like a good person versus a person who's not And so, yeah, it's it's creepy what it can do, but also we we hear about the flock cameras and and then people complain, >> but just because you heard about it, like what do you think they're doing that you don't hear? I know for a fact from from somebody I knew, unfortunately, he passed away, but the he and his company would create these like surveillance devices that then went into a box and I saw it. I saw the device and the prototype and everything and they would go into a box. There was a telecom box that looked like every any other telecom box and then this was procured by the government of course and then they would have somebody from a telecom company installation company come in and they don't know anything. They just like they just get a new box. It's like yeah just go put it and they go and it's the right person from AT&T or T-Mobile or whatever or the company that does that sort of thing and goes puts it on the pole. They just think they're connecting the antenna like they typically would, but in reality, they're installing a surveillance device for a very specific part of town, right? **[00:54:00]** >> That's that's exactly how it works. >> Yeah. >> And we don't know about those. Like you don't complain about those, but if I mean it's happening. So it's like if you want to protect yourself, then just don't share as much or um take steps like you were saying before. But, uh, complaining won't won't really help, I think, just because they're still doing many of the things that that they want to do without us knowing anyway. >> Yeah, it's I don't want to get too conspiratorial or uh have your uh your video sort of banned for certain things, but yeah, things are happening that we don't know about. There's things are happening that I know about. I just uh will stay away from it. But yeah, tracking one of those. >> Yeah, it's now on the flip side, right? It seems to mean that if they want to catch a criminal or a terrorist, they have better means to do it, right? So, I mean, that's the whole point. They're not trying to track civilians just to track civilians for the sake of it. I mean, it's expensive, too. But having tools to defend yourself. I think that's the whole premise of doing things like that, such as medical, I mean, the advanced, you know, AI for medical, I mean, you're bringing intelligence that >> take for granted in the US >> to third world countries. And uh, you use AI for medical questions and things like that all the time. and as opposed to maybe having to spend time going to um you know having a doctor tell me this or that and >> and uh I was saying I'm skipping over you know bad things. Uh yeah certainly that and that's part of the problem is that every time technology advances they sell it on all these wonderful things and there and they are truly wonderful **[00:56:00]** but then that technology can get turned around and then used against you. M yes that is a part that I have mixed feelings about. There's the if you look at Frontier models, the most advanced AI models that that that are available to us, they're very good, but they are limited. They limit them because like when Mythos was being planned and played around with, they were like, "No, no, no. This is too powerful. We cannot release it to the public." Now whether that was a marketing thing or not stands to reason we don't know but >> then they released Fable for like a couple of days and no no no sorry the government shut it down are are they really good? Yes, they are very good, but then they have to sort of dumb them down a little bit or put put additional constraints to them because someone might use them for the wrong thing. And I understand that. Don't get me wrong. I really understand that. But the other models from other countries have similar capabilities and they are not being controlled. So >> yeah. >> Yes. The the the issue I have with it is exactly what happened to hugging face where they were accidentally attacked by Chacht and then they couldn't use Chachet themselves to defend themselves because the model was like no no no I cannot be used for cyber security purpose and then you're like yes. [laughter] So they had to use a Chinese model to defend themselves. Anyway, I think it was a comical really expensive and not good example, but comical in the sense that they had to use a Chinese model to defend themselves against the American model because them using the **[00:58:00]** American model was not allowed for that purpose. >> Yeah, there's there's when you think about like chatbt, it does have guard rails on it, at least for us, right? The users of it that >> pay to use it. But yeah, there's models that don't have any guard rails >> and they're outside of the the control of the US government or western governments and uh um and that's that's the problem >> is that and that's where you can't control it. It's it's and I I agree also with your assessment. I call I call AI algorithmic intelligence >> that it's just basically just boolean variables of if if if if and putting those together and in uh and in some sense I think that the the sort of the rumors of that it became a sentient being and things like that are sort of just sort there to kind of lead us on to a point where AI is basically becomes you know government and and uh and so that's kind of like the really the only sort conspiral thing that I think eventually AI will become sort of the arbitrator of of so many different things and used as an excuse to to give somebody something or not something. And of course, whoever has the power, whoever's in control of that can then uh basically have control of masses massive amounts of people. If you're in control of the the system that's actually, you know, making decision on uh on behalf of sort of like this new sort of government, you know, that's actually an algorithmic intelligence type thing. So, yeah, I look forward to the future. I I uh I you know, I always say that I'm actually I'm at an age where I'm actually glad that I'm not young. I'm glad that I was born at a certain time because **[01:00:00]** um if I were to live say another like 60 years it I sort of envision it being maybe some place that I'm not sure I want to [laughter] be and uh um you know and certainly you see with what what's going on around the world with uh you know the border control and things like that it's uh u you know technology is certainly going to play a part in in all this stuff that's going Yes, there's there's much to do with AI yet, but good things hopefully mostly good things and I think it will like the internet and the mobile smart devices. It really really helped the world become a better place. It has its downsides as well, but I think there's there's a lot of good that comes out of it. But at the same time, bringing it back to one of the points that you talked about earlier, security, talk about the like computer security in in businesses, you were saying you scanned a lot of them and uh they didn't have the best security and you're talking just like DNS level, which is which very important, but like encrypted DNS, things like that, like something that you would expect these companies to have. However, with AI now comes companies that are building tools or software, full software suites using AI, which is completely plausible and good. We've built a lot of software with AI and they just trust it blindly. I think that's where we need to put focus on as well. If you build a full software with AI, coding is not the hard part. like AI has coding down. It'll do an amazing job of coding, >> but the overall scope of the application, how it should work, how the data should flow, what things are required and not and safe and secure and etc. That's the part where a **[01:02:00]** human, an engineer ideally, but really it could be anyone can can give the input. But the building with AI is so easy that you just go through and then people see the finished product. And I've seen this many times and like yeah it's ready. But if you run a security assessment on it, you can even have the AI run the security. Cloud has a beautiful uh security plugin that you can add cloud security and it'll scan through and do all sorts of advertorial tests and attacks and like runs 160 agents against it and it will blow your mind how insecure that application that you thought was finished is. And so there's little things that you can do with the existing tooling to make them secure. But but I don't know how how what percentage of people do you think are using these tools? >> Oh, I well I definitely think that probably close almost close to it's closer to 100% than it's 50. I probably 95% of people be using AI to write code are are thinking that it's already secure. AI built it and so I can give you an act an exact you know my experience in data point because the reason I built all these scanners is because I was building my own products. >> So for example like when you if you were to call me and leave me a voicemail or send me a text message is actually comes into my telegram app. And so I I create I built these tools to be able to um have control over all of that. It's just much more secure. takes it off the voicemail platforms of the carriers. Now, when I built it, I used AI to write code. So, I'd write code and then I would manually deploy it, check it, do all the eye checks. I don't like AI. You know, a lot of people are building it with AI actually having access to all of that. And so, AI is picking up your AI, your API key, you know, very important **[01:04:00]** information. >> Um, you know, that you don't want into an AI system. So, you have to be very careful. Uh, but it's great for writing code and then you, you know, place that code. So, the reason I built the scanning tool is because I I I created these two products and I was like, "Okay, now I want to make sure they're secure." So, I started building my own scanner. And I I had done this one scan so many times. I'm like, "Okay, I'm just going to write the code to do it." >> And I kept building scanners. Now, I have like 34 33 34 different scans. And I actually used and and actually I bought I built the scan tool because I was using it purely for my own products >> and like [clears throat] you said it had so many holes in it. I'm a I'm you know good programmer. Um but of course like you when you build a product in the middle of it you're like oh you know what I forgot this database or I need to add these fields and and so you add it. You're not and you're not thinking about how all this stuff you know sort of work. You just want it to to work. Mhm. >> And but then when you start to run scans on it, you you and it and it comes up with things, you have to you're like, "Oh my god, I got to rearchitect the [snorts] way this works." And and then now you've got to do like sort of double the work. And I think I think with my scanning tool to be to do to get it to the point I think it's it's the most comprehensive one I think that I've found that exists. I probably ran 300 scans on my own things that I've been building. And not only did And now I do I did I do that to make it secure, but to continue to sort of build out my scanning. And then I started scanning 300 domains at a time, thousand domains at a time, and it would learn from that, find false positives, fix that. M >> and uh and so I guess that's a long way of saying that everything that you've talked about in terms of building applications with AI having huge holes **[01:06:00]** in it. >> I have I've been telling people that for months that there's thousands of AI built web applications right now that are going to get destroyed because they have not done any kind of security assessment. And I mean, you've got companies that there's they're a cyber security company and yet they're not using proper TLS encryption levels or you can access their website via HTTP or you can, you know, spoof their email and these are cyber security companies that are there that are supposed to be, you know, creating uh secure applications not only for themselves but, you know, selling those those to others. I I actually one of my blogs I did a scan on a number of the I picked out randomly a number of companies that are the big IT shops and I had to do it randomly and I had to pick like 10 out of the top 50 because I don't want to have people identify that I did the top 10 that the 10 >> have issues you know >> and so I think with that one I picked like 50 or 60 domains and and I randomly >> um chose chose them. But the IT companies that are running the IT of these other large companies themselves don't have, you know, they're supposed to be running the security for these other companies and they themselves have, you know, holes in their in their web applications. So AI AI web applications, yes, you you better make them secure. They're going to get absolutely destroyed. Like one of the scanning tools I built was that it can it'll go out and look for API keys and certain important information. >> And so one of the things that I discovered and why I started to doing the the code entry completely manual is because the first time I started to **[01:08:00]** write code, I was just having it connect with my hosting platform and and letting it go. And then when I when I created the scanning tool, that was doing the API key scans was one of the first things that I did. And it picked up it picked up two APIs that were sitting in an open public, you know, web root directory. >> Mhm. >> So that anybody who was technical that could build their own scanner can go and grab it. Mhm. >> And and so you know I I I took one of the scans is to look for like these five identifiers and one of them is the API. But these are like important things that you know you can get an API for like chat GPT and then go explode their the the company's chat GPT budget by using it. Um but you know I can scan thou I could probably scan 50,000 domains in a day just simply looking for API keys on a $7 web hosting. And if you were to find those then um you could really I mean you could take a company down, you could take their application down, you could get an API key like into the stripe system that is you know part of the back end of credit card transactions, you know, so what could you do with that? And uh and so these are the things that AI is good at finding those things, but you you just have to have a good person find it before a nefarious person does. >> Yes, I just got an email last night from Google that their ooth, so for those technically inclined, oath helps you connect to applications. So I can log into my Google account and sort of give it give another application permission to access specific tools from Google. They are now releasing an MCP that's only agentic. And so you have to flag your OOTH profiles as agentic if you're going to use them because they're **[01:10:00]** starting to see well I imagine it's because they're starting to see this sort of heavy use and they want to be able to flag it in a way where their systems can detect something malicious quicker. if if if it's flagged that way. Um because >> agents are so fast. They're they're a thousand times faster than us and they can do a lot of they can make a mistake much faster. So if you've ever for anyone listening, if you've ever used ages, you're doing something and if it if it makes a mistake like it understood the wrong thing from what you were saying and it doesn't have the proper guard rails, it's going to be like, "Oh yes, I've deleted the applic." You're like, "No, no, no, wait." [laughter] Like it's it's >> it's done. Like it already happened. And um that's why there there's steps there's ways to use these tools properly to get good results and and uh safe results at least safer. But yeah, it's it's incredible. And I think one of the things that people don't realize is that AI lose context with time based on the context window. So you can only talk to them for let's say if it's a 1 million token window you it's a 1 million words whatever that may be if it's using screenshots and things that's going to be much less and every turn it's sending back and forth the whole conversation. So that can go up pretty quickly especially if you're coding. So so a lot of people don't realize that that exists and that what happens when you get to the end is that it doesn't stop. compacts the conversation or it summarizes the conversation and then it continues and it sort of feels like it's still going and remembers everything but now it just remembers like the beginning and the end and like a blur of the middle or whatever the way they they set it up. >> So they're like compressing compressing >> compressing. Yeah. And so the problem is you lose that fidelity. And if you were talking about like some features that you were missing and haven't done yet, it might have forgot about them and then just continues building, but it might **[01:12:00]** have forgotten eight things that you had to do, nobody remembers them because you didn't write them out anywhere. And there's ways around this, but um but for people who are just coding, but from the the web app instead of codeex or cloud code or or whatever CLI version, that happens a lot and that's where a lot of these holes come from too. >> Yeah. Well, one that you reminded me of the subtitle of my final master's paper was uh to to heir is to heir is to is to be human to really think to air iss to be human to really screw things up requires a computer. Um >> yeah but uh the the what was the point you were making on AI >> that it it may >> Oh the fact that it forgets that yeah so and that's exactly the reason why I started doing manual updates to the code >> that it forces me to do the eye checks it forces me to understand >> architecture to understand the lines Because when it does these compressions, it's b yeah it drops off this history. And so now if you built this web application and then two months later you have to change something and uh and you say okay I want to modify this feature and it's oh I don't I don't have that as part of my conversation. And so if you don't if you're not a computer programmer >> and you don't how know how this thing's architected, it could actually go in and just really screw up your entire application. So the first time I actually started using AI to kind of play around with code, it was I used like base 4 to four 44 and and a couple other ones and I would spend like two hours, three hours and you know creating something just sort of for fun. Mhm. >> And then I would say, "Could I want to **[01:14:00]** change the background color to blue?" And then a minute later, it's like totally screws up the entire application. And so I actually gave up on it. And and then it wasn't until like Claude Bode and a couple other ones came along where u where I can now like create things and it wouldn't just totally screw it up. But then I decided that okay I'm gonna for me to learn and understand like what I'm building for the future I have I have to know this and uh be a you can build a great application today on AI. that could do everything you want and achieve the results that you want, but it could be completely unsecure. But then a couple months down the road, that AI might not remember 90% of how it even built that. And all it has to do is make one change to the database structure, something it didn't understand, and it's very hard to back out with AI as well. So when you when you do updates, you have to be very careful to to uh make sure that you're not going to just you have you have backups and you're not going to be totally screwing up the whole thing. Yeah, I well I help people sort of go through this a lot and it's a [snorts] teaching basic principles that you might know as a software engineer of like first things start a code repository. Don't do anything without a repository and commit and have these code snapshots so that you can not only go back but also the AI is very good at seeing what you changed and what happened and then that way something breaks it's able to go back and see oh we broke it in this version and then just fix that things like that but like you're saying if you have don't have a very good structure of how you document and what things should be done and how the application should work and uh we're **[01:16:00]** compressing the same thing. Like it's like you can do so much work so much faster that you compressed 6 months of like a software engineering team in like two weeks. And so now keeping all that in your head is tough of course and if you didn't have it properly document things you won't know how it works but it won't know how it works either. Like it'll have to scan everything again and things like that. And so I think today we are at a point where you can rely on it to build the full thing, but only if you have the proper structure where you're using a third party tool like GitHub issues to track your tasks and your milestones and what everything should do and it writes to it and it's a it's a non uh modifiable thing, right? cuz it's if it's writing its own files, it could just break them, uh, hide them, remove them, whatever. But if it's writing to a third party system that it cannot touch the history of, then you have a way for it like a ledger for for it to like keep track and not forget. So there's these little things that you can do to make it better. But I do agree with you completely on if you have the time and really want to understand the tool that you're building, have it explain it to you or code some things yourself if you want, but at least be in the loop >> such that you you yourself understand the tool cuz I I see my like I I've built software for for more than 20 years and and it's like software that I built a long time ago. I knew exactly what happened in 20,000 lines of code because you you wrote it, >> but now it it's it's very hard for that to happen. And you have to have a way for you to be able to still interact with it without completely losing **[01:18:00]** visibility into what you're building. >> Yeah. Yeah, if you're coding, you know, manually, I mean, if if if you're careful and you know what you're doing, you know, you're putting your remarks in, this is what this function does here and and and so you can go back to it, you know, two months from now and look at the code and and uh be able to determine where it is. But yeah, with AI, you know, never really thought about that before, but uh you know, probably when you build something, maybe maybe ask it to put, you know, remarks in there to sort of identify, you know, functions and how they operate and where it points you to and all of that. Um but imagine you know one person builds this application at a company and then they leave >> and then a brand new person comes in and then has to take over you know this code and uh you know things can happen like let's at one time I was building a product for myself and I had it connected with Twilio and Twilio is a VO provider where you can it can you can buy a number and you can pay for long distance and international phone calls and set it up to to receive and send text messages and things like that. And so you could you create it and just secure and your Twilio account, you know, is secure, but then you use AI and it and it changes something and all a sudden the Twilio account that the key is exposed and if somebody gets a hold of that, they could drive up thousands of dollars on your Twilio account and and um and then take down your whole business, you know, you bankrupt. If you're just like a lone code or you're trying to create sort of a small business type thing using AI and and you you expose a key like that then uh very very dangerous. >> Yes. I I got a scare like that a few months ago. We we were overseas and we were about to board a 10-hour flight and I get this email from AWS Amazon Web **[01:20:00]** Services for for listeners. It's like where you host servers and things. And I have budgets. I don't really use AWS, but I have an account. And I have budgets. So, it'll let me know if I spent $2.50 just so I know like, hey, what what what was left on? Let me turn it off. So, I get this email. And it looked legitimate. It says, "Your budget alarm $2.50 current $108 million." [laughter] >> And I'm like getting to the airport. I'm like, "What is this?" Obviously didn't click anything, but I go check with my agents like, "What is this legitimate? Does it have the right like email signature? Is this an encrypted email? Is it coming from Amazon?" And like even the AI was like, "This does not look legitimate." [laughter] But but then it it scanned them like, "Yes, it does come from Amazon." And then I was trying to reach them. What's going on, guys? Like it's very hard to reach someone there. And obviously, and we had like 13 hour whatever time difference. It was horrifying for a few minutes until I went on X and found other people were having the issue. So, someone probably vibe coding messed up the rounding in Amazon's budgeting thing. >> Must have gone on. The AI is probably telling you, you know, you're going to make a tr trillion dollars today. >> Yeah. Yeah. something happened there and and so not everyone realized because you would have to either be in that page looking at it because it was like a visual thing but I think they thought it was a minor thing because they thought only people going to the page will see it but anyone that had an alert set up would see it too. So millions of people got these alerts and like were were like thinking they were going to go bankrupt, missed important dates, missed important events like tournaments, things like that. You would see all the comments in Twitter like because they all got it and **[01:22:00]** they were freaking out because how are we going to come up with this money? because they thought like myself like if it's a legitimate email and now I owe them this amount of money which seems ridiculous that you I mean they're not going to give you that amount of credit but it's still a legitimate email from them. So the only way in my mind that a huge bill could be wrapped up is if an API key was leaked and then they just spun up a bunch of inference servers or something which is can happen and so really scary because of what you're just saying that the if an API key is unsecured and and someone gets access to it, it could really affect a company. >> Oh yeah. I mean, there's been a couple stories in the last six months where, you know, some company had a, you know, $50 million bill from, you know, AI and um yeah, so these things are going to, you know, happen. But you brought up a very good point and I'm glad that um we can kind of squeeze this in because that this is why fishing is like the number one threat basically everybody. So, so with your AWS example and this is why This is why companies need to make sure that their business, their web application is set up and that their email is set up so that it can't be spooed. And this is that's why I get sort of annoyed with the fact that all these important companies that you think are securing you have not protected their email domain from being spoofed because you know imagine you you're going to board that plane and you get a an alert from Bank of America or you know whatever your bank is and you know it says you know $72,000 you know bill or something and and so you look at that and it looks real everything and you click on a link and it takes you and then you can do things like DNS hijacking at that point and it takes you to bank of.com **[01:24:00]** or there's like one of the characters a cerillilla character where an N is an M or M m is an N and but you're panicked and so you look at it and then it takes you to a page that replicates your Bank of America.com and you type in your login, you type in your password, you can't figure out how come it's not letting me in and as soon as you do that, a hacker on the other end is now actually at the real Bank of America to attempting to log in, you know, under your name. [clears throat] >> And uh and so with you at least, it was like a legitimate warning and it was just sort of a screw up of Amazon and their and their billing system. But these that's fishing is one of the biggest things you have to worry about and the reason why companies have to protect themselves from being able to be DNS hijacked as well as having their email domain be spooked. Yes, it's so we've got have two guests recently where where this topic was addressed of like fishing scams, things like that of of people getting socially engineered into doing the wrong thing, like sharing the wrong credentials. And I I'm glad you you went a little deeper into this because it happens a lot. And were it not for now Google and Microsoft sort of giving you a warning when something doesn't necessarily add up it it would be a tremendous mess. And even with that people like yeah they ignored us any other warning within their their system. I just like a few days ago, one of our clients said, "Hey, one one of our clients is saying that the email coming from this person is not does not look like it's from the sender." And they sent it to us. So, what does that mean? And I don't manage **[01:26:00]** their email or anything. And I was like, "Oh, let me take a look. It probably means you don't have SPF and DKIM and all that set up." So, I looked and sure enough, they didn't have anything. >> So, so I was like, "It's very simple. Like, just just follow these steps, put them in DNS, you're good. >> And now it's good." But like were it not that somebody told them then at that point anyone could be spoofing their their email. >> Oh yeah. Yeah. That then that's also the frustrating thing of why people like don't get back to me like so you just name like Dmark SPF a couple others uh you know DNS DNS sack. It's like a toggle switch for like or you go into Cloudflare and you add a couple lines of I mean you can go to AI and say what do I need to put in Cloudflare? It's that easy. and and and if I'm using a particular hosting platform, you take a screenshot of your DNS settings. Okay, what do I need to add? Okay, add this, add this. And that's the frustrating thing about the the weakness of all these business domains is that we're talking minutes to to fix. I mean, when you have a very complex environment, you know, takes it can be much more complicated for the SPF demark in those kind of settings. Um, but for but for to like to to take care of like 80% of your security gaps, we're talking minutes >> literally minutes of you logging into like, you know, hostinger account and putting in, you know, toggling DNS sack on versus it being off and uh and uh it and why companies are just are not doing that. You know, maybe maybe they have drift problems themselves where they built an application and maybe three years ago, two years ago was secure and then staff rotates and they've got a new project. They've got their own staging uh area and it and and they and they're adding features and functionality and they're not tracking the fact that they **[01:28:00]** just expose something, >> you know. But the staging environments is a whole another thing. So I have I have a scan that will go out and find you know all the staging uh domains. >> That's a good >> and so in one of my scans I I did scan on 10 particular companies and I don't want to say the the market but out of 10 companies they there's 64 staging domains. Wow. And so for those listening, a staging domain is like where you okay, you a company approves that we're going to go develop this uh new feature, this new application. They create a staging domain and that's where they build it. But when you build it in a staging domain, you're not thinking about security yet. And so it can be exposed, but you and then a company will take it from the staging and then move it into their production. and the production area may be perfectly obscure. The problem is is that if your staging environment is exposed, hackers can you can learn that software >> and because a lot of companies sort of forget about the security like you know they'll have like three programmers on a project and they all share an ID um you know so things like that and so staging departments is is another weakness where um things can be forgotten you know projects get half done and and then they get dropped, they get defunded or um you're halfway through a project and a whole new team comes in and and then takes it over and of course they sort of overlook things and but yeah, some of these companies where it's you know they could have 12 different staging domains that are uh you know showing up and if they're not securing those like they do with their production environment then they can learn that to figure out how to hack it when it actually isn't in **[01:30:00]** production. >> You were talking at the very beginning about an situation that happened to you with with uh I don't know if it was SIM swapping or them doing something based on your your number. Can can you tell us a little bit about how that works and why it's so dangerous? Yeah. So at the time, so I I had spent, you know, all the like basically 10 years in a row like building mobile security companies. Um I had recently left a company that provides the consumer security app that you would get from T-Mobile. Um Aani resells AT&T and Verizon. And then I own I still own a small portion of the the company that does security for T-Mobile. So I've got all three carriers um covered for security. But what happened was I was trying to do my own startup. So I got out of cyber security. I was getting kind of bored and I wanted to do my own thing. But I got into crypto. >> So I was getting into Bitcoin and blockchain and things like that. I I became I'd spent most of my life in the Silicon Valley, you know, Northern California area. Um, at the end of COVID, I had moved down to southern Arizona. I got into crypto crowd in Phoenix and would uh do meetups and things like that. So, I really got into Bitcoin and blockchain mostly at that time. And then I was trying to do my own crypto startup. I had my own app developer and I was trying to create applications, an SDK for applications. So you could take a mobile app like a cricket app or tennis app, Formula 1 >> and integrate this SDK into it and make it a crypto rewards app for example. >> Oh wow. >> And so I had built up say around 30,000 followers on social media and I 25,000 downloads on the app. I had at the at the at the time if you search for cryptoreward apps I was number one and **[01:32:00]** uh and I hadn't really even launched it yet. I was just sort of experimenting and developing and we had like I don't know 12 13 apps on the on the Play Store and then one day I was driving I was in the middle of the desert in between Tucson and Phoenix and anyone who's been there knows it is north south flat nothing there. this dirt and all a sudden my mobile phone stopped working and I thought well I'm right in I didn't I wasn't familiar with the area that much so I was thinking that well I must be right in the middle of like the the networks and that maybe it's a dead spot >> and I kept driving and driving and then I'm like think I start to get concerned and then I'm thinking to myself I hope my credit card on file like expired or something I just didn't you know and hopefully I'm behind on billing But I ended up driving around 50 55 minutes to my parents house and as soon as I got next close enough to the garage, the Wi-Fi kicks in on my phone because I had it already in my phone and six password resets go right at my phone >> and rushed inside. You know, my dad's trying to hug me and I'm like, I got an emergency. and I I go into his office and I call and it turns out that somebody in the carrier at one of the phone stores, moved my mobile account to a different phone and that my mobile service, it's a change in the network basically to say Mark's account, don't point it at the SIM or the ESIM in his phone. Point it over here. >> Wow. >> And so it it points at another person's phone, your phone goes dead. you can't use your mobile service. Now, your voice, your data, tax is in the hands of somebody that you you have no idea who they are. You don't know if they're your next door neighbor. You don't know if they're 4,000 miles away. And you don't know if they're in the UK. It can be done from different countries. **[01:34:00]** But what I do know is that they now have control of your voice, your data, your text. They can call your bank in your number. They can text. And that also means that they can do SMS password resets. So if you get a if you get control of somebody's mobile number and let's say you've only got 20 minutes, you're you could go to the top 20 crypto companies. You could use AI and say, "Tell me all the emails that Mark uses." And it's going to pro it's going to find some of them. or go to a data broker and you take all those email IDs and put them in the top 20 banks in the US, the top 20 crypto companies, the top 20, you know, whatever. >> And because your email becomes your login >> and if they own your mobile number and it's just SMS reset, they own it. They just they will just password reset. And so they don't they don't care about is your password 18 digits long or 16? Does it have all these character? They don't care because all they're doing is saying forgot password. Your application then texts to to say enter this code, but it's going to their phone. And so somebody had taken control of my phone for 61 minutes, did password resets, and then they ported it back to my phone. So all of a sudden starts working again while I'm on the phone with carrier. And so I thought, well, that's kind of curious. my phone's working. And um and the guy at the carrier, he looks and he's like, "Oh yeah, they ported it back to your phone." And so at that point, you know, I'm panicked. He thought I was the hacker to begin with. So it's extra verification. And now it's kind of like he it's I could tell the kind of the tone of his voice was like maybe I'm I'm messing around. Mhm. >> And [clears throat] uh but then we got over that hump, but then they go into liability protection mode and and **[01:36:00]** they're not trying to protect the hacker, but because they protect themselves, they pro they end up protecting the hacker more than they protect you. Because I I wanted to know what well, what store did this, you know, where did this change happen? Did it h happen in one of your call centers? Did it happen in a store? What state? What city? They won't tell you. Mhm. >> And they they don't have any legal uh requirement to give you any information about what just happened to you. And um it's very frustrating. I had they got into cloud accounts. They got into a bank account. They got into my Coinbase account that I had at that time, which now I barely keep anything in there. and uh a couple couple h how uh um hosted cloud solutions and they got into one of my emails. So imagine and it doesn't always have to be money. A lot of people will think that well I don't have any money to protect or my my crypto is stored on a cold wallet or you know self uh self custody. Uh, but imagine they get your mobile account and they and they're able to sync up one of your emails and they have 61 minutes of just sending downloading your history of emails. And if they get the right email, a lot of times they can daisy change from one email to another. Mhm. >> But if they get 61 minutes of emails or let's say they get you after you boarded a flight for Tokyo, imagine them having, you know, 20 hours, 25 hours to uh, you know, by the time like you get to your hotel and discover u, imagine them having all the time. How many emails I could download? And your emails can have, it could be business, it could be wire distribution, you know, wire transfers you've done, early distribution, medical taxes, all of that. And if they have all that information, they can just be selling it **[01:38:00]** then for the next, you know, decade, you know, or it gets loaded into AI gets, you know, so many things can happen. And so at the time, I was like, somebody had to solve this. And I only found one person on the planet that said they could they'd solved it for themselves. It's very expensive way that he did it, but at the time he was doing a startup with three other guys. They built one of the largest Bitcoin ATM networks in the world. And so this was a side project for him. And because I loved Bitcoin, he was into Bitcoin, we talked four or five times. And I eventually told him, I called him up and I said, "This is what I do. I've built these other companies, worked directly for co-founders. I'd love to like help you take this to market. And so about 100 days, 120 days after my mobile attack, uh we renamed it to Aonyi.com. That was, you know, now it's been like seven years and uh and we've been growing ever since. And we we're self-funded. We didn't pay ourselves. uh two of us were doing 7 by 24 and and every time there was like some major breach out there, you know, at first I was kind of surprised because our website looked like we were selling. I used to make fun of it saying it looks like we sell Sweeter parts and uh that's how kind of boring it was. But people were calling us, you know, Ledger and when Ledger got breached, the crypto cold storage company when they got breached all of a sudden like the phone starts ringing at 2 in the morning, 5 in the morning and two of us, you know, we can't sleep. We had to start hiring people. We started updating the website because we didn't know you, we didn't know, does anybody have this problem? >> Um, we know that it happened. And you can you can you search on YouTube like if you just search sim swap on YouTube you're going to see all these people that got ripped off got their money taken they go on YouTube and this is how it happened to me be aware of this and **[01:40:00]** you'll notice all the local channels will have you know you know Dallas and uh Orlando and Chicago all the local channels will have simp swap stories. Mhm. >> Elderly people got hit, crypto community got hit, but it never shows up on these, you know, the three major, you know, CNN, Fox News. And my my theory is that telecom is the second largest advertiser on these shows >> behind pharma. So pharma is number one. The telecom and the mo in particular the mobile is number two. And so if you're a host of one of these shows or an anchor and you're relying on these, you know, you're not going to say anything bad about those companies. >> Sure. Um, you know, the last the the last person who actually a major host who actually did talk about uh it Lou Dobs did a like a five minute clip on how the US government bought all of our all US citizens location data and they were able to do it without a warrant. There was no subpoena, no warrant. Therefore, it's like there's no legal requirement other than the carriers voluntarily made money off of selling our data and then Lou Doabs was gone in a week. And [snorts] so I don't know if that had anything to do with it, but uh I I've been always suspicious of that. But yeah, you don't never see this being talked about on the the major channels. >> It's scary. Now, can you explain what Ephani does to protect people? Like, is it in the is it part of the network? Is it a network? Like how to help our listeners understand where does it finally fit in to to help us with something like that? **[01:42:00]** >> Yeah. So, it's very simple. So, one, you know, what is what is a SIM swap? Now, a lot of people have done a SIM swap, a legal SIM swap or a legal port over and they just don't really think about it. But if you have an iPhone 12 today and you go to the store tomorrow and you buy an iPhone 17 and then through that process like would you like your mo your number moved over and you say yes >> and you walk out of the store with your iPhone 17 and your new and your new phone is working with your old number. That is a legal SIM swap or a legal port over to your phone. The hackers are doing the same thing, but they're moving it from your phone over to a phone in their hand. And they're doing this through bribery through an insider. They could have a friend that works at a phone store that's giving out information. Uh it could be information that's being purchased from like their customer support teams. And this happens to all com all huge companies that can't monitor their employees properly is uh insiders can sell customer support data. You know, Coinbase went through this. They got ransomed for $25 million last year and the hacker group had been admitting to them that uh they had been buying customer support data and then ripping people off, you know, a bit at a time. So, the hackers kind of got greedy and thought like, well, let's just try and get $25 million out of it at one time. and Brian Armstrong, their CEO, turned around and said, "I'm making the I'm making the ransom of 25 million a reward to to tell us who is doing this." And I I don't know if it ever if it ever worked out, if they ever found them, but this is happening in the telecom industry as well. Now, what Aonnie does is we're set up as what's called an MVNO, a mo a mobile virtual network operator for AT&T and Verizon. So you can buy AT&T directly from AT&T or you can port your number over or get a new number with Aonyi and then select a **[01:44:00]** network. You can select either Verizon or or AT&T. Now let's say you select AT&T. So you're basically getting AT&T's covered speed and all of that. And so it' be the same. So if you were on AT&T or for in T-Mobile, now you're on AT&T through a but there's a couple things that are different. So, one is when you pay a company like T-Mobile, Verizon, AT&T, you're actually opening up a credit account. So, they have your personal info, your credit card, your social security, your birth date, all of that. The only thing that we're gathering is say credit card information and verification information. And then the information, we're not giving your personal information over to the carriers. So, your address isn't isn't with the carriers. In fact, our it's one of our addresses is in there and you basically look like an anonymous executive of like a business team >> as opposed to having Mark Wrightman lives at this address and birth date and all of that. we're not collecting that that information and we don't want to we're not collecting call records or text requ and and then uh we and the car carriers are locked out of it so we own the accounts. So even if you like went into a store and said I want to I want to make this change like they they can't make a change for you. We totally control that. Uh, one of the other big differences is that when you when you move from a carrier, like if if let's say you're on T-Mobile and you want to move to Aonnie, we only need a couple bits of information from you in order to to port that over. So, the scariest part about this industry is that let's say you're moving from T-Mobile. We don't need to call T-Mobile and talk to any humans there and say, "We're moving this account over and you don't need to call your own carrier to cancel." We have portal access like thousands of **[01:46:00]** other organizations that are all like reselling or a lot of people don't know that the most of the stores are independent stores. They're not owned by AT&T, Verizon, T-Mobile. They're actually independently owned. So there could be somebody that owns one store, three stores, but there's individuals that own hundreds of stores. And then there's also companies that own, you know, independent companies have nothing to do with uh, you know, they're not AT&T, but they run 800 AT&T stores. And so you're relying on these people managing and controlling all of that, which is, you know, nearly impossible. And, you know, are they hiring the right people? And uh and so what we're doing is we're locking all those people out. Now, in the example I gave where all we need is a couple bits of information, we can port your number over. When we port it over to to Aani, we're unplugging you from that. >> So no other company, you know, I mean, you could give your your information. You could you could go give a a hacker like this is my phone number, this is my device ID, but if they were to try and contact us, it's human verification and we're going to go through like what emails on file, what phone numbers on file. We text them to make sure they can text us back. We email them. Um it depends on how risky the transaction is, but we may email them and ask them to return that email. and like and unlike a carrier where a carrier just wants to just verify it quick, get you off the phone and move on to the next person, if we can't fully verify you, you know, and and the person has to leave, it's like, okay, I got to go get that info, they can call back the next day and we pick up on the verification. And it's not meant to be hard. I mean, it's for most things, it's very easy verification. And uh but if it's like somebody wants to port out >> Mhm. >> then that's where our resources are pointed at. So if you look at like the typical carrier reseller, the typical **[01:48:00]** mobile virtual network operator, we've reversed their model. So they put all their money in investment in selling advertising, selling phones, financing phones to lock you in over two years. And all their money is on that front end to get you as a customer. But if you want to leave them, no humans involved. >> They have they have done the math and they have determined that they will accept a certain level of fraud in order to not have the cost of dealing with you when you want to leave the company. Now, Aani, what we've done, we're we're lucky in the sense that we're we're there targeting um high-profile people, people with crypto, people that don't want to be blackmailed, people that are maybe using dating apps and don't want to get sin swapped and have um you know, be blackmailed or something like that. you know, if they've got money, crypto reputation to lose or or business to lose, you know, you could simp swap somebody and and they then use that in to get into like your web hosting like maybe your business domain and just and just delete the whole thing. It can be as big as uh I don't know if you're into crypto yourself, but um those watching that are into Bitcoin, for example, the SEC when they announced the ETF approval, it was actually a fake approval because somebody simply at the SEC used that to take over their X.com account. So under the X.com SEC account, they then used that access to take control of it. poured out that the Bitcoin, the first Bitcoin ETF was approved, Bitcoin goes up like 5%. So imagine organized crime that has, let's say, they they immediately buy 100 million in Bitcoin. Sim swap dump, you know, put this uh tweet out there and now they've got 110 million, **[01:50:00]** 105 million. So they sell it and then then the market finds out that oh this is this was like accidentally tweeted out. The money made in literally probably 60 seconds was in the millions for whoever did that as my guess and possibly even even more. And that's the scary part about hacking and AI and and and even the SIM swaps is that um you know as we talked about earlier in the call it used to be the oneman show and now me if I'm a nefarious person there $7 hosting account now I can go I can you know do scan on a thousand deans well >> there is hacking groups like in Cambodia for example it is a multi-billion dollar business like they're literally making 10 20 billion or more a year and and they're like prison camps. So they'll set up job ads. So somebody from Vietnam, Korea, maybe you the US, wherever, you know, they show up for a job ad and they go into what this looks like, you know, private school or something. They get behind closed doors, their passport's taken, the driver's license is taken, and then they can be in prison. So, um, you know, I tell people now that if somebody's like texting you, trying to get you to like talk on, uh, you know, WhatsApp, for example, but that their picture is some hot, you know, woman from Hong Kong that wants to open a beauty store in the US and would love to meet you and talk further. Um, you know, a lot of times that actually can be somebody where if they're not trying to hack, you can be beaten. Um when you know I spend a lot of time in Asia because we've got uh property there and we rent it out and every once in a while you'll see you know a Thai person shows up you know floating in the river or somebody from you know Korea or something like that. you know, the Korean government actually **[01:52:00]** flew a a jet in and threatened one of the uh sort of these they call them scam centers and said like you basically gota fill up our plane with our people or or um we're we're bringing in the military. And so these exist like could be 100 people sort of imprisoned in these camps that are that's their job and if they don't do it then they can get beat. Now certainly there's there's people that may volunteer to do that kind of stuff and join you know organized crime to do it but you take you take a group you know I always say that AI makes smart people incredibly smart but AI can also make a an ignorant person I don't want to say dumb an ignorant person can actually it can actually multiply their ignorance as well >> and so you got to be really careful about you know how you use AI and what you trust from it. Um, but you know, organized crime with a hundred people where a number of those are experts, expert hackers that have the power of AI, it's big business. If if those of you who follow Bitcoin again, you know, Trump announced like a year ago that they retrieved $15 billion from a Cambodian call center and that's what became the actual the initial deposit of the uh US federal government crypto reserve was them finding 15 billion in stolen funds and that that 15 billion was only a portion of what they get grabbed. Wow. So this organized crime unit may have a hundred 100 billion in crypto, you know, in buil in uh Bitcoin, but the US federal government was only able to get 15 billion back and and so if I if I if I had just like if I was paying a $100 for server and and I split it up and I put and I had uh hosted **[01:54:00]** servers in seven different countries and and now if I wanted to do like a thous th000 scans in 4.2 seconds. >> Now I can multiply that on seven different locations and and certainly having servers in other countries means I'm going to get around like IP geographical restrictions and things like that. And and now you're talking like instead of 40,000 scans in an hour, it's 40,000* 7. And I'm sure I could actually amp it up just on the $7 domain as well. I just, you know, didn't bother to I'm not looking to to see like how, you know, how many I can scan. U but this is this is the future. It's going to be AI against AI. >> Yes. Super interesting. I I I expected it could be that way where they someone internal to a telecom business could could do a SIM swap. I remember a long time ago it happened to me but in the credit card space like suddenly someone cloned my card but it was a card that never left the original envelope and I was like [laughter] >> um and so yeah but it it's scary and very interesting to see how you're managing that like it's it's a very out of the box or outside the box approach. >> Yeah. A lot of people picture us and they'll say like, "Oh, you guys got great technology." Like tell me and and so for our basic, we're working also on encrypted DNS for mobile and we have our own VPN in beta right now. We're putting beta users on it and we've got cloud filtering that's being put on. But for our basic service, what we've actually done is we've actually done the opposite of technology. M >> so you know you buy you buy a mobile service and you get like free Hulu, free Netflix, free Disney, whatever they're giving away these days. So that's data **[01:56:00]** profiling that they're collecting data on on you. They're selling that data and and so you become the product. So what we've done is actually we've stripped out all the technology. >> We don't have racks of servers. We're actually we actually went full uh manual and we have some we have some uh sort of beta testing where we have our own enclosed AI things that that are not connected to like AI actual live AI platforms >> and and so we're sort of testing that but we are full manual. It's an expensive way to operate. My bet. >> Yeah. Uh >> but but yeah, we've stripped the technology out. >> It makes sense. There's definitely a need for it, like you were saying, high-profile executives, celebrities, people. I mean, of course, people who who who care about their security in general, but there's definitely that segment of the market that needs this. We've got CEOs from from many cyber security companies because you know CEO of like an antivirus company doesn't want to get synth swapped and then have the world understand that their mobile antivirus doesn't you know protect them at all. Uh but we have tons of CEOs and scattered executives through all the Fortune 100 but we're starting to close seuitees. So right now I'm working on on a seuite you know 50 lines for uh you know I would say top I don't know 20 top you know 50 financial company I don't want to narrow it down to actually where it is because then >> I try sort of back engineer it but uh um but yeah we're we're closing you know family offices family offices are getting the Bitcoin >> now and so I'll talk to them it's like how do you secure it? It's like, well, we use an authenticator app on my phone. >> Like, [clears throat] oh boy. Okay. So, uh, you know, we starting to close where if they've got 15 people that work **[01:58:00]** there, they'll buy all they'll and they'll put all the all 15 people on it. We've got crypto hedge funds and things like that. But, uh, you know, even people that have say 10,000 in crypto >> because cryp and I and I mentioned crypto in particular because once it's gone, it's gone. >> Yeah. >> Yeah. And and the smaller amount it is, it's for sure gone. >> Yes. >> You know, if you if you lose say $5 million in Bitcoin, well, you might be able to get a district attorney or you might be able to get the FBI cyber security unit to actually pay attention to you in San Francisco. But if you lose 10,000 in Bitcoin, nobody cares. Attorneys don't care. you know, the the the basically the an attorney that that's the other thing is a lot of people don't when if they have a big loss and they they now want to sue the carrier, then they discover that the carriers have all slipped in arbitration clauses. >> And arbitration means that your odds of winning are a little bit higher, but you're also going to win 30 cents on the dollar and uh and and you're gonna have to pay your attorney out of that. So, the attorneys and I and I'm very familiar with the attorneys, what they're asking, what they look for, because I've been asked to be an expert witness a number of times. You know, the attorney will contact me and say, "I understand you work for a company that protects and swaps. I'd love to have you be the expert guest." I've never accepted it because one, I don't have time, but I also don't want to be on record going against carriers that we partner with. Mhm. >> But all the attorneys say the same thing is which is the defense of the carrier is that SIM swaps have been normalized and therefore we shouldn't be held accountable for it. And so again, they've done the math. They've they're willing to accept the a certain amount of fraud for the um in trade for customer support because they would have to hire thousands of people in in order to do **[02:00:00]** what we do. And um I even know the guy, one of the main guys that these carriers hired actually defend the carriers. And so I I get all sides of it. And in fact, he's one of our biggest fans. And uh and so it's kind of a dirty industry once you once you get SIM swap. Like I say, the carriers go into liability protection mode. You find out you're on arbitration. And so if you didn't and and then the attorneys if you didn't lose 250,000 most most the attorneys don't even >> they'll be they'll refer you to somebody that uh you know like a desperate attorney that that will want okay well if you pay me eight grand up front I'll I'll try and help you recover this 15,000. But uh but it doesn't it doesn't have to be crypto. It can you know it can be your email. can it can be your business, can be your family. You know, you don't want people tracking like your daughter's location and things like that. We have a lot of doctors for that reason. >> Mhm. >> Yeah. >> And certain doctors need it more than others. >> Uh because they're higher targets, you know, through like whether it's political, whether it's life choice type things. Um you know, people get motivated for all kinds of different reasons to simply hack you. It doesn't have to be about money. >> Can be about a divorce, >> right? >> For example. >> Yeah, that that makes sense, too. >> One of the questions I think a lot of people are going to have is, "Okay, this sounds amazing." Of course. >> What about like you know how all you you said they put all their money into sales, right? So they're all about the get this speed and get this unlimited thing and get this other thing and like most of it's just marketing speak. But regarding those features like they go on Aani they get do they get like is it the same thing or is it is it different? How **[02:02:00]** does that work? >> Yeah. So yeah I'm glad you asked. So like you can get AT&T directly for as an example and you get voice data text and US Canada Mexico. Now if you buy our basic plan and you choose AT&T you get AT&T voice data tax US Canada Mexico same thing. Now in addition to that is we offer this is no additional cost a dual eim configuration. So on my on one of my phones for example I have AT&T and EIM slot one and that's my voice data tax and I have our Afani global data eim and slot two and that gives me data in 200 around 205 carriers 205 countries and is 453 carriers I think coverage around the world and so if I fly and land in Tokyo or Singapore for London. When I land, I have I have data and no additional costs. >> I have texting, you know, included in it. And so you get global data with no additional costs. The dual ESIM configuration separates you, you know, your voice from your data. Mhm. [clears throat] >> And we also enable Wi-Fi calling globally, meaning that wherever you are in the world, your phone thinks it's in the US when you when you're on a Wi-Fi calling connection. So, I land in Tokyo and I use a second phone for as a hotspot connection or I got a Wi-Fi dongle, you know, pocket dongle or there's just a a cafe. >> Somebody [clears throat] calls my Aani number, it rings, it's unlimited. I can talk and I can also call back to the US for free. unlimited >> because the phone thinks it because the carrier thinks I'm in the US. >> So I could be in Bangkok and I could, >> you know, use a 100 minutes a day for the whole month. Don't have to worry about it. We also throw in, it works out **[02:04:00]** to be anywhere from like 400 to 500 free international calling minutes as well. Mhm. >> So if I'm in the US, let's say I'm in San Francisco, I want to call Germany, Spain, Australia, you get, you know, 4 500 free minutes at no additional costs. And and we what we did is we discovered that it's actually free. It's actually cost us less to just give away that that amount >> than it is to try and charge this person $15 per month for unlimited, >> you know, and then we turn that on and they don't need it anymore. turn it off. And so we've tried to just remove all the necessary transactions. >> And it also means with the Wi-Fi calling is that again if I'm in Singapore and I've got any kind of secondary data connection that I can actually with those free minutes I can call local in Singapore, >> I can call Thailand. I can call Australia, Germany, Spain. >> Yeah. And I get those free minutes. So, for a global traveler or somebody that vacations for like three times a year, like we're we're already kind of a no-brainer because you're getting all of this, but you're also secure, more private, and we also back it back it up with a line of insurance that covers up to 5 million >> in SIM swap losses. >> Wow. >> Now, the policy has never been used. So, that's what that's our motivator. So, if you're a customer, it's not necessarily like we love you so much. We do without anybody that's a customer of ours, but we have a $5 million insurance policy. We don't ever want to be utilized. And so, it's not just us making a commitment and a promise. It's the fact that somebody called this up and says like, I don't want to verify, but I want to switch this number over to another phone. We have to make sure that that insurance policy is is uh protected. >> And so without it, yeah, you anyone can commit say like, "Oh yeah, I promise **[02:06:00]** that you're never going to get SIM swapped." You know, I mean, these carriers tell customers that all the time, like, "Oh, you'll never get sim swapped." And then, you know, a year later, they're calling us out going like, uh, you know, they promised me and they put me in this, you know, secure, uh, you know, system. But if you got insiders that can just simply flip toggles, you know, or like hackers that, you know, could >> potentially switch things on the back end because they're still connected to these, you know, the the the mobile uh portal matrix >> where we unplug you. >> Yes. >> And uh what else do you get? So, if you've got the iPhone 13 or above >> Mhm. >> So, iPhone has uh they have this one feature that works with because we turn on all these features. >> Uhhuh. >> So, for the iPhone 13 and above, you actually don't even need a secondary data source. And so, I've got one of the later models on the iPhone. It's got a dual ES config. And so, I don't even need a Wi-Fi connection. my phone if if I'm if I was in Singapore, I don't have to be under a Wi-Fi connection. I could be out in a field in Bangkok and as long as I got data coverage and you call me, it's free. I can call back to the US for free with no Wi-Fi connection. And and so you don't have to pay that $10 a day roaming fee. I don't know if you've ever paid the $10 per day or $100 per month >> to go on vacation to get that roaming >> yourself, but but family members have. We had this experience where where we went on a cruise and then they got the the bill because they didn't do it on time so they had to pay after and it was expensive etc. >> We don't have it and and I'm glad you asked because we use Google and from what I understand Google is also an MVM mode right not all the security stuff but just for people who who are like how does this work like who uses that? Well, Google's thing is just that, right? Like it's the same type of connection to what T-Mobile or something in the in the **[02:08:00]** sense that that they're they're like this virtual carrier. We pay Google, >> but then we use >> what the T-Mobile's network. Um, >> and it works and it has like Yeah, like you're saying, you go to Tokyo and they don't like bill you extra for anything when when you're there. Now, whether it's works better than other car. I don't know, but it's just it just works for me. >> I would say that I would say that Google Fly does work. And I would say that they I would say they're slightly more secure from like SIM swaps than a standard carrier, but it is Google and Google is interconnected with Google. Um, in the same way like WhatsApp, you know, like I a lot of people just they want they have a WhatsApp, they want to connect there, but like I would never put uh, you know, my private information and proprietary information, you know, on WhatsApp just because it's part of a a company that has no morality when it comes to data collection. And you know, Facebook's got some they've got their they've got more hooks than they want to admit. >> I've done some I've done some sort of testing on my own of uh and it's kind of surprising of what uh what Facebook is able to do. You know, a lot of people talk about how how Tik Tok, you know, in the terms you accept it's like you accept that it's can connect and gather data on your networks as It's uh it's it's they're not alone. Tik Tok's not alone in uh in having those hooks out there. But uh for me, I you know, I live sort of on the paranoid side. I have I have four different phones. I have uh technically I have five. I have four mobile phones with mobile service and I have one that has none. That's the one where I put my **[02:10:00]** social media on where there's no mobile connection to it. But I can turn Wi-Fi on, turn it off, and I try and keep it disconnected for like everything else just because I know that it can sort of crawl out, you know, amongst your other devices. Um, but that's sort of how I learn. I got an iPhone, Android, I got a grappling OS phone and uh and use those sort of to test and learn about what it is. But yeah, if you've got an iPhone 13 and above, you you want security and you travel, >> we are an absolute no-brainer. Like, you shouldn't even have to worry about it. Should even if you don't care about security, >> you get these roaming benefits. >> Yeah. >> That you know, people will say like this is a game changer, right? They don't have to they don't have to call us up and go, I'm going to Tokyo, >> you know, blah blah blah and tell us like where where they're even going. They just land in Tokyo and it works. >> Yeah. And and the fact that you have 450 carriers means like when I went to when I was last in Singapore, our uh data eim I had four choices >> and I can set it up to auto rotate to the strongest signal which actually moves my data around across different carriers or I could say okay just fixated on Singtile the the uh 450 carriers plus also includes AT&T, Verizon and T-Mobile. And so an example would be is I used to own a a cabin in in a place called Bear Valley in Northern California. And there may be some listeners here that familiar with Bear Valley. It's about an hour and a half south of of South Lake Tahoe. And in the wintertime, the only way to get there is to have a very expensive powder sled in between the mountains. And uh and and uh the only service that works up there is Verizon. And so at the time, you know, I didn't have Verizon. And uh but with with the **[02:12:00]** Ephani service, I can I can go skiing. If Verizon works up there, I switch to my data to Verizon. I ski, I come back down to the cabin and um if I no longer need Verizon, I'll switch it back to AT&T or whatever. Um and so it expands your local coverage and it also works for disaster recovery. So, if you're in Florida, a hurricane takes out the AT&T tower, or just put your data on Verizon Mobile, you've got data for the seven days, they get the tower back up, you switch your your data back to to AT&T or Verizon, your primary carrier, and um and you never have to call us for any of those switching. It's literally you go into your phone and say, "I want data to point to this or that." >> And you don't have to call us up and tell us you got some business deal in El Salvador and you need to to you know have data there, you just fly there. that is super convenient and also I mean the privacy of it like especially if it's a high profile executive or or C or whatever and like [laughter] >> calling the the Yeah. >> Yeah. So when you're traveling around like the data eim's completely anonymous >> you know that doesn't have any of your information attached to it now over a long time period you know could it be profiled and fingerprinted? um you'd it'd have to be probably you know lengthy time period. Um but that that in itself does add uh at at least sort of uh you know not data poisoning but it's kind of separating out your >> your voice uh from your data when you're when you're overseas. The other reason we give out the data eMM is that the it's a high-speed data >> and so a lot of people will you know they're going to go travel and they go buy one of these cheap eims. >> Yeah. you know, travel eim, which are typically for like one country or or five countries, seven countries, and the **[02:14:00]** more countries that it's going to cover, it gets very very expensive. Uh, but you know, those those providers may not have any privacy policies at all. >> Yeah, that's right. >> And so, and so ours ours is man our data EIM, we actually managed it out of Europe for the PDPR type protection. And so you've get the data privacy protection of uh you know the carriers when you're traveling around you sort of getting this additional protection from the actual governments uh you know that may want to try and pry or data collectors >> and but you want to you want to stay on LTE and 5G because they're much higher encrypted protocols. If you drop down to 3G now you're now you have issues with Izzy catchers where they get in between you and cell towers. They can actually slow your connection down even if even if you have an LT or 5G connection >> but that [clears throat] ESI provider allows a 3G connection they will get in between you and the cell tower and slow it down to 3G and now you've lost all your encryption protection. And now that's when they have the opportunity to actually look at text messages that you've sent or you're receiving. And it's passive. You don't even know it's there. You're you think your phone's connected to cell tower that's 600 meters away, but you're actually connected to an MC catcher or a stingray that may be say 100 meters away. And then from there, it's connecting you to the cell tower. So you you're getting everything you want. You just think like, oh, it's it's working. Now you're doing like a crypto transaction and you know you're putting information in and there's an MD MZ catcher you know that's gathering that information and so again what this data eim does is it keeps them on the encrypted protocols. It gives them that that extra privacy and just makes it seamless to be able to travel around. Uh but certainly if you're into security then we are the **[02:16:00]** carrier of choice. Now we call ourselves you know native carrier. So we work with the exotic phones like the graphine OS phones and everything's fine. And if your phone will work on AT&T or Verizon, it'll work on Aani. >> Wow. >> But we have a lot of users that are now con converting to graphine OS or Graphino users are ready and they move over to Aani. And so if you're one of those people, then you would be joining a pretty large community of other graphing OS users. We've got partnerships with Above Phone and Mark 37 on their ghost phone and a couple of other ones that the uh the secure phone companies will reach out to me and they all say the same thing which is we've created what we believe to be the most secure phone on the planet. The problem is when people put a a SIM or an ESIM in it >> because >> yes, >> a lot of people because there's this myth that people that they don't understand what's happening like you could have the most secure phone, you could put that phone inside of a Faraday bag. You could put that inside of a safe, drop that safe in South Lake Tahoe and you're still not protected from SIM swaps. It doesn't matter if you use a VPN or an antivirus. if you have the most complex codes because a SIM swap is a change in the network. >> So when when when the network changes your phone and all the security you invested in that is not even in the equation. The hackers aren't they don't they're not wondering does he have an iPhone, does he have an Android or gra they don't care. They don't care if you have a phone manufactured by the NSA because your mobile service isn't even pointing at that phone. [snorts] Yeah. And then also, I'd like to offer uh if anyone's still listening at this point that um anyone who's educating their community, we'd like to give out a promo. So if anyone wants to get a $99 **[02:18:00]** discount off of Afani, instead of going to Afani.com and and buying, go to aani.compromo. And if you go through that process, when you get to the checkout page, there'll be a $99 discount. You can buy us on a monthly. We don't do contracts. >> Oh, good. >> And so it's prepaid. And so we don't lock anybody in and you can quit at any time. If you do monthly, then basically what you're doing is you're going to get a free second month. >> But we also have a money back guarantee up to 60 days. So for your first month, you you pay, your second month is free, and then if you don't like Afani, then you can actually get all your money back and then leave a there's also an annual option where you save almost two months of billing >> and you just make a onetime payment and you get the $99 off of that total fee. So your first year you're getting a you know good price and even if you don't like Aphani within 60 days you get the whole year refunded back no questions asked and so we're we're a no risk in fact if you use if you pay for a year and you use it for 6 months and then you leave then you get back a prrated amount as if you had been paying monthly but you do get some you know back on a refund and so we're not doing Even our business accounts, we only have a few that have locked in because they just want to lock in like the best price for >> um you know the next three years, but uh even our even the majority of our business accounts, it's all prepaid. There are no locks. [snorts] And uh and so, you know, if you're a family office and you want to protect 10 people, uh we're no risk 60-day money back guarantee and you can cancel at any point. That's incredible. Well, it it it seems to me that you're very customer oriented **[02:20:00]** from from the whole like bringing it down to nonautomated release so that people don't >> take Sims away, but also the whole experience. It's very different from the traditional carriers that lock you in and like you said, it's all based on the credit and and they create this account for you. They basically want to keep you there forever. here. It's more of like you want people to come in from [clears throat] from what I'm gathering and enjoy the service and >> yeah, we like to think of ourselves as like boutique customer support. >> Mhm. >> And uh you know, not necessarily like all the way to like you know, if you have the little button in your Mercedes or concier type thing. Um, you know, but when people are in tough spots, too, like we've had people call in and say like, "Hey, I'm in an area and I need, you know, can you help me out?" Like, and uh, and so if there's an opportunity for us to do that, you know, we will, you know, in fact, I was thinking about today because we always have people that are in Panama >> and, uh, you know, with what happened in Panama in the last, you know, 48 hours or 24 hours. Uh so we like to think of ourselves definitely as you know security first and you know tied with you know the customer experience. >> Mhm. >> We not perfect you know the telecom space in general. It's a tough business. It's 7 by 24. You have people that travel all over the world. So we have to cover uh you know worry about people that are in every single time zone. uh not everyone but you know a lot of time zones in the world at any given time. you know, we have we have uh you know, a couple competitors now that have basically tried to copycat us and and and sort of the big thing is that um it's like AI driven AI support and AI chat bots and you can't reach a live person. And my guess is that they did **[02:22:00]** not live in the back end of a mobile operator like I did. So like I say, I was I lived in the back end of MacOs Cellular as it was turning into and being acquired by and what became AT Mobile. And in fact, I used to be I used to do main be the main backend person for the airto ground uh service. So if you remember the planes where you had the phone, you pull it out and it's got the cable. Mhm. >> And so I I I was uh you know one of the main like five six people that that handled trouble tickets and saw that and it's human there. Humans have to like disable enable ports to clean them out and and uh and all kinds of things happen. You cannot have a mobile operator without having humans that are looking at dealing with all these problems. And so I look at our at the few competitors is sort of um if they get customers, they're going to be ours after a certain time. And so I we wanted a market. We want them to sell. We want them to promote. And uh it's it's good for us. And we're in a great we're in a great spot. Um you know, we're really proud of what we've done. It's it's a it's more than a business. It's definitely a passion project and and it we're we're in that unique position where we founded the company not because we're like this would be a great idea. It was Afani was founded because of anger. It [snorts] was purely out of digital PTSD from being ripped off of being so angry that I dropped what I had had been spending you know 18 months on uh where I so angry I dropped that in order to do a funny and and I think that's actually what made his customer **[02:24:00]** focus because um my partner that the original founder he's our CEO um he since he was working on a bit my big Bitcoin project and he he was going to the Bitcoin conference when it was called a Bitcoin meeting with 50 people. >> Wow. >> And and so he was a big target. He got sim swap I think three times and and that's why he just said I'm going to pay for to have this protection just for myself and expense. Basically he set up an a secure MBN for just his line his family. >> Oh wow. And uh and and so then I came along and and then we we we had blown it out. Um but we had we started out of be because we're both angry because we're both victims. And I think that's what makes us customer focused because when somebody calls in if they got mobile problems like I understand >> and uh and you know most of the time it's like if they haven't paid their bill for a while or something and it's like a reminder goes out and they call in. But I understand when you don't, you know, when your mobile phone's not working or you have issues, you you accidentally toggled a setting and it's, you know, we've become so accustomed to using our phones. We take it for granted. you know, I can't imagine you there's I'm sure there's 18 year olds, 20 year olds and I know that I know there are where because I inter I last year I interviewed somebody who was graduating college and and I'm like, "Oh, so are you do you live east? I know the area. So, do you live east or west of the city?" And they're like, "I don't know. I don't." And it's like, "Wait, so were you born there?" Like, "Yeah." And you lived there the whole time? Yes. Did you go to college? Yes, I went to college. They're like, "So, what direction from your college do you drive to get to the sea?" So, you know, the younger generation now is growing up to where **[02:26:00]** they just ask, they just tell the phone like, "Take me there." >> Mhm. >> And so, people aren't learning at this point. There's some people apparently that don't learn don't know which direction is north, south, east, or west. And imagine when we have uh cars that are basically like Elon Musk has these cars coming out where there's no there's not even a steering wheel. It's just >> you're going to call it on your app. It shows up. You hop in. >> It takes you to whatever place. Like >> with AI and all this automation, people are going to become basically like brain dead, you know, [snorts] over time. And uh it it's uh you know I'm sure there's going to be some sci-fi movies that that'll be uh including you know a lot of these type of things that we're talking about. >> Yeah. Yeah. Well, it's important to mention because it's as you stop paying attention to things that's when something can happen because people will take advantage of something if it's not being paid attention to. So >> yeah. Yeah. I interviewed a guy that he's an author. He's wrote he wrote two sci science fiction books and I was interviewing him for no other reason but he happened to be an author and and uh and so one of his books was um it was about and he wrote this like 10 years ago but it was about how AI had built a gaming system and it's a free gaming system. So people were using the free games and the AI would learn about them and the AI, you know, grew and spread out. And he's basically explaining sort of like some of the hacks that I see today. >> Wow. >> But he took me through his book and I'm like, man, you were ahead of your ahead of your I wish I could remember something like Alyssa or something like that. And uh he was definitely ahead of his time in and what he was thinking about in terms of uh you know because this was prea pre AI. **[02:28:00]** >> Uh but it makes you kind of think about the fact that you oh there's this AI tools free, this game's free. >> And then you go use it and so you want to make sure that you're using like alias IDs or you have like throwaway email IDs to go and use these free tools. maybe even use it on a separate device than you do to like do your business transactions because that is just when you when you think about it, it's so easy that and that means that it's done already. >> Yeah. And there's so much monetization of people, right? It sounds horrible, but it like just obviously social networks and all that. I recently made my own like credential sharing thing for our company because I wanted to send someone a secure credential. Then how do you do it? You go online and there's these like sense security but like they have ads and like no way [laughter] >> even even if it's supposed to be secure in the browser whatever like how can you trust them? There's there's and so so I just made one that's like a CLI based that can only be unencrypted from my machine with with my um it's like a public public private key. Yeah, very basic ads part of it. >> Sorry, >> did you say that had it had ads as part of it? >> Yeah. No, not mine. So, the ones that are out there. So, if you go online, you're like send someone like a like a private paste bin, that sort of thing. There's a there's a bunch that come up in the search results, but most of them have ads or like sell a sell something. And and it feels really sketchy to use a tool to send something securely if it has ads on it. at least from my perspective. I was like, "No, no, I'm just going to build my own internal." It took no no time. Um, but that was >> so ads are one of the ads are one of the most popular ways to distribute malware and and so to give people a data point of what these big corporations are willing to do or not do is that one of **[02:30:00]** the companies that I used to work with, I was actually a competitor there. So I worked for the founders of company called Frontbridge that Microsoft built and the main competitor was a company called Postini and Postini was a cloud email solution. >> Mh. And um and what Postini was able to do is when you is when you you use the web so you go on Google and you do a search and let's say you search for screen saver and it lists you know your 12,000 you know findings or whatever and if that and if one of those items or multiple ones had detected malware they would put a spider over it and so you'd know as the user not to click on it. Mhm. >> So Google acquires Postini. They find out about this warning of malware and spyware and Google turns it off. >> Wow. So, 60 days later, all of a sudden, this feature, you know, stops working. And uh because it because you don't want to pay for advertising if you're going to be deemed as uh something that people shouldn't click on. >> Mhm. >> Um that's the industry that we live in and uh >> Yeah. Well, I believe you. It's time. >> There's there definitely be careful with your click on the other day. I would I don't know where I was, but this happens all the time. Like if you go on a on a site, not sites that I visit, but like sites that that that maybe older people visit, they're just clicking around. Even news sites, news sites are terrible. They're all filled with ads. But like your regular person, uh maybe an older gentleman or lady, they're just browsing. They're looking at interesting things or recipes, whatever. They click on something, the website opens, and then the ads show things like [snorts] **[02:32:00]** like a button that seems to fit in exactly with the site. So, these ads are perfectly tailored to those people. So, it looks like that's the action that they have to click to like download the recipe or download the whatever other thing. It's not the thing. Like the site has its own thing, but it's so filled with ads that these people, whoever made these ads, and I don't know how they pass whatever Google's tests do, if they have tests at all >> at this point. Um, so you see that button, you click it by accident cuz I've seen them, they tell me, they're like, "Oh, this thing showed up." And it's one of those like you click it and it's like warning, warning, warning. And it shows like the same operating system, but obviously sometimes it makes mistakes. It shows like a Windows UI and you're on a Mac, but it shows like Warren, you have to click this, download this cleaner for your computer because we have found 500 viruses or whatever. So, people freak out. They click on it, they download the malware, whatever. Like, I don't see any legitimate security company asking you to download their software that way. And so, yeah, like how do those how are those ads permitted on these platforms? I mean, what you're saying, yeah, I understand now. Like, it's just it's just a A lot you know a lot of people don't think about the fact that they they could go to a one website but that but that web p that web page could actually be made up of 30 different URLs. >> Mhm. >> And so we have a beta tool you can see it you can actually measure. So if I like if I turn that on and I go to let's say 10 websites and you would think in the history it would be like just 10 you know I went to this domain this domain but it actually you look at it and be like you went to 412 domains. I only [snorts] look I only visited 10 websites and so when that page forms on your screen the ad could become it's going to come from an ad network and that's that's a different URL and a banner could come from so they've got like 10 different ads on there well that could be like 10 different URLs just by itself >> and it's also the reason why I get **[02:34:00]** frustrated with these companies that have these business companies have weak domains >> because somebody could you know potentially like add a button on their website. >> Mhm. >> And and uh and then take them off, you know, redirect them to somewhere else, you know, server in China or something like that. And so redirections are an issue. That's another weakness that, you know, I can scan for. And uh boy, we could we could probably go on for a couple more hours [laughter] with you. I mean you've obviously got a lot of you've obviously got a really good background in in the um sort of web web engineering space. A lot of people don't know you know what SDF and Demark is and you know things like that and uh um and so that has helped make this conversation much more interesting for me. I appreciate the the fact that you've got this really good background. >> No, it's my pleasure. I know we should we we we can do another episode another time so I don't keep you here forever. But uh this yeah there's there's so many things that people should know about or show know more about that isn't being talked about as much and I think um episodes like this are going to help at least get some people to know a little bit more about it. So, um, Mark, thank you so much for coming on to the show today and sharing your expertise and knowledge all these years in the industry. Um, it's always amazing to me to listen to stories from people that have been in a space for a long time >> because you've got your night rich stories and and obviously some very good stories as well. Um and uh it gives us perspective as to what happens behind the scenes because I know most of us have no idea of what is happening and how some of these companies just brush off some things **[02:36:00]** just because they like yeah it's an expense. It's just it's it's [snorts] we can manage it the cost of it and not do the right thing which is terrifying but it happens. So again, Mark, thank you so much for your time to the end on the show. >> Yeah, thanks for having me on. Appreciate it. >> And for our listeners, if you haven't liked and subscribe to the show, please do so because that way you will be the first to know whenever we have an amazing episode like this one with Mark today. If you want to learn more about Ephani, we will put the link in the show notes. It's a funny.com, so it's very easy, but um we'll put that in the show notes so that you learn that as well. And then you said if.com/promo >> promo if if you guys want to take advantage of the promo pricing that Mark has mentioned for us today. Sounds very interesting. I will look at it as well because yeah this day and age things are getting a little dicey. [laughter] Thanks so much everyone and we'll see you in the next one. Thanks Mark.