Hello there everyone and welcome back to Redgate DB Ale, the podcast that's all about beer and database development. My name is Chris. And my name is not Chris. Bum, bum.
Bum. Actually yeah it is. I feel like we should have had some kind of sound effect there instead of just me. I'm happy with just you as the sound effect.
For example if I want to simulate the sound of someone being punched in the face. Yeah we'll save that one potentially for another episode. Or maybe five times this episode. So yeah as we said we are the bubbly and not so bubbly co-hosts of DBL.
And today we're going to be bringing lots of interesting news your way. So we're back to the original format of DBL. We've gotten Christmas out of the way and I'm sure Chris is very very happy about that. Are you happy about that?
Not really. I'm not happy about anything. Yeah I should have realised that. Okay so what we're going to be covering today is of course beer.
Beer? Which you have provided. I have provided but there was a limitation which will come on to us. We will indeed.
And then we're going to be talking all about security and specifically passwords. Yeah so this was an idea that you had Chris that I think actually took me by storm. It's something that I never really thought to do. But I think passwords is a really interesting thing.
A lot of people think that by having a five or a six character password with a couple of numbers in it that they are safe. Well hopefully not too many people think that. But generally yeah I think there's a lot of misinformation around what is a good password, what is a bad password. So that's what we're going to have a quick look at.
Yeah absolutely. So as is customary of course the best way to start off. Wait wait wait wait wait. Also still to come we've got the news.
Oh I hoped you wouldn't realise that I'd left that off the end there. No news is always on the agenda. Well certainly when you're around. Exactly.
Because I'm big news. You are big news. And yeah I guess that leaves us with a beer. It does indeed.
So moving swiftly on Chris can you tell us what beer we have today? Okay so I believe we've had a whole new calendar year pass. We have I remember New Year's Eve. Well I don't remember New Year's Eve as I was frequenting the establishments in my town.
There's a lot of traditions that come and go. Yeah. Some that stick for example New Year's resolutions. Yeah do you have a New Year's resolution Chris?
I have many New Year's resolutions. Oh well give us your top one. My top one. Well that kind of ties into what we're doing today which is about not drinking quite as much.
Or maybe not much at all. Maybe nothing in January. Whoa. Try January.
Chris you realise that this podcast is based on beer right? I do which struck me as a bit of a dilemma. I could either break the resolution. Which is perfectly reasonable.
Or I could just not tell people about the resolution and not tell people I told about the resolution about the beer. Ah so then mutually exclusive sets. Just lying. Unfortunately I don't think it is a fully mutually exclusive set.
So that was never really going to work. Or we could do an alcohol free beer. Well what a great idea. On that subject before we just quickly open these beers I'd like to encourage everyone out there listening to DBA that if you have a New Year's resolution that you'd like to share with us please do feel free to tweet us that's at redg underscore Chris.
Or? I don't know. Oh come on I'm some combination of an actor. As well Chris or something.
I think it's actor as well Chris but yeah you can tweet me if you want I wouldn't recommend it. So tweet me and we'll see if we can include some of your New Year's resolutions in our next podcast. If they can be database development related as well then even better. What kind of database related New Year's resolutions might you have?
I don't know maybe maybe your resolution is to index more or index better. OK. I think that's fair. Maybe not use sensitive data in your test environment.
That's also a really good New Year's resolution. Anyway I think we're going off track. Well absolutely. Point is at the moment we are not drinking alcohol.
Yes. So sad. We have got an alcohol free beer. Or actually if I'm honest a low alcohol beer.
It's legally alcohol free. Legally alcohol free. Which is maybe treading the line a little bit but I'm fine with that. Yes.
So what I found is infinite sessions pale. So this is an imitation session beer or an imitation. Yeah. Craft beer.
It's a fake. It's a fake. It's a fake. So you ready?
I am absolutely ready. Let's open this up. Who makes this? Who is it brewed by?
I don't actually know. brewed in London. I think infinite session limited. OK.
Brilliant. Well let's see what happens though. We've both got our own bot latemars. I've got a red gate one of course.
I've got one I carry with me every day. Oh OK. Even better. Here we go.
Oh that was too bad. Right. Here we go. Even better.
It's pretty. It does look like it. It's got a good bubble to it. It looks kind of lagerish don't you think?
Yeah. Yeah it does. And it has formed ahead. Oh my goodness.
That is fruity. Very fruity. It smells like an American. Oh there's an Indian pale ale.
Left in the bottle. That would just get that. OK so you can taste I think that it's alcohol free. It's a lot lighter on the top.
That is a very delicate way of putting it isn't it. You can definitely, yeah, it's not got the same hit. Like we're always expecting some kind of hype. I've got to have my beer.
Yeah. The head is good though. The head is very good. Yeah that's impressive.
It smells right. It tastes right. I think it's like the finishes a little bit different. Yeah it's definitely not after taste.
When you're actually taking a sip it's like oh I'm drinking a pale ale and then suddenly it's oh I'm not drinking a pale ale. Yeah. Yeah. It's not taste very hoppy though which is interesting.
Brewed by rabbits. That's the trick. Oh dear. Sorry.
Right so Chris we've got our beer. We don't. It is now time to talk passwords. Let's talk passwords.
Let's talk about passwords. That's the word speed. No. Let's just leave that hang on.
Can we edit that out? Nope. That's in the final cut now. Oh dear.
So Chris let's laugh. What is your password? So my password is I love red gate one two three. I couldn't believe that.
Okay so to everyone listening it is not I love red gate one two three. Hunter two. Hunter two. Yeah always loved Hunter two.
I mean that's an interesting one. But I was thinking before we start I mean let's talk about oh sorry little aside for the Terry Pratchett readers. Swordfish. Yep.
Swordfish always a good password choice. I'm not going to text behind that but as good as any. I'll leave it. Fair enough.
So let's let's just quickly cover what a password is. Okay I think everyone out there knows what a password is certainly anyone who's listening to us on iTunes or Spotify. You've probably signed in using a password. Yeah for those of you who haven't used a password a password is a string of characters.
For example Hunter two or Swordfish or Chris's mum's birthday. We all use one of those three things to secure away our personal information and things we want to keep private. Yeah exactly. So there are three kind of main ways that we can store passwords.
You know we need to actually store the passwords for our users so that they're able to authenticate themselves. Obviously when they log into a website or an application something that requires that they get access to their own personal informational area as it were. Makes sense. Now there are three particular ways of storing these passwords.
So the first is right to your down in your notebook. Right to get that in my notebook. So now the first is of course the worst which is plain text. We can store plain text passwords so that when someone logs in with the password Swordfish it checks and says right here I have a password in my database.
So if the user has entered this password do they match are they both Swordfish? So this is bad I assume because someone can just read all the passwords. Yes that's the main one. Of course if we have a data breach as well then it means that obviously we lose plain text passwords and you would think that most businesses would be above storing plain text passwords.
But in fact we have seen certain behaviours and certain times when we've had a data breach we've been prompted by the website have I been pwned we'll get to that in a minute. But it said such and such business has had a breach and what we've lost is emails and plain text passwords. So it still happens today absolutely it's a practice that still happens but I think we can all agree that it probably shouldn't. So the second way of storing passwords is of course encryption.
So actually encrypting our set of data such that we can't unlock it without the encryption key. So for example swapping the first two characters would be a very basic form of encryption instead of Swordfish you've got Swordfish. I knew that would take them. Instead of Hunter 2 you've got Hunter 2.
Can we stop now please that's tickled me. So yeah effectively now this is still not infallible. What we mean here is that if you manage to steal a copy of someone's database and it just so happens that they also have the encryption key stored there or if we're able to steal the encryption key as part of the data that we steal then obviously it's still not going to be secure because it's effectively like putting a lock and then leaving the key next to the lock. So yeah it's protected and in case of someone just taking the encrypted information it's useless to them and obviously there are lots of encryption standards like AES and DES and we can encrypt that using 256 bit keys and 128 or 512.
Alright well done you're so good with multiplication. But that's again it's not ideal. Now in practice one of the most common ways we see is of course the third way of storing passwords which is by hashing them. Okay so hashing as far as I'm ways where you basically encrypt something one way.
Yes exactly so effectively what happens is we take something like Swordfish a number of plaintext characters we then put them through a one way hashing algorithm and then we end up with a string of characters which is always the same length and they've been hashed in obviously there are lots of different hashing standards. Let's name one. How about MD5? Oh don't use MD5.
I think I broke MD5 in one of our first assignments at university was to write a Python program to crack an MD5 hash. So not very secure. Not very suspicious now yeah effectively. But the idea being that if we store the hashed value of the password in the database then we never actually have visibility of what the user's password is.
Okay yeah and that means that when they then come along to our website or application and they put their password in it is then hashed at that point and then communicated with us so that we can check the hash in our database against the hash the user has put in and if those hashes don't match because it's followed the same algorithm then don't let them in. So it's very hard to find what the original string of characters was the generates that hash. Exactly the prime difference between the encryption and the hashing is of course encryption is two way there's always a key but even if you have the algorithm even if you know exactly how to hash a string you can't get back to the original password without the original password itself. And then there's a mixture of stuff we can do with that as well right so come across the idea of salting.
Right so this is an interesting one so salting is obviously placing. Sorry it's an aside but I always love the word hash because it may just reminds me of like corned beef hash and then salting corned beef hashes. Oh dear and that's coming from Avagan. Yep anyway so effectively yes we can we can absolutely hash a string that's the more secure way of doing this because effectively we take a string of random characters append them to the plain text then hash it and then it's even more difficult to get back because then even if you've broken a hash or found a plain text password by getting it from some other vulnerability some other website then you're not guaranteed even if the password is the same to be able to break the hash at another location.
So common salt is the username and using name in not ideal because if you get using name and password somewhere. A fun little way to check to see if the website you're using uses that to salt is to have two different accounts with the same password but different usernames and if you enter the password in one window with one username and it comes to the same thing if you use like an auto complete to fill out the password and then modify the username but don't modify the password field fill it out and see if it lets you throw it on. That's interesting I didn't know that. So Chrome used to do this.
Yeah. Yeah so I'm not quite sure on the process behind the scenes but there's specific websites that I go to and I'd use the same password for different usernames. I can't use the name and the login would fail because I need to refill the password even like being auto filled. Okay.
Very interesting. Oh well very nice. Well of course there are still ways to crack hashes as we obviously said they're taking something like ND5 as a hash is not the most secure way of storing things. Obviously with improving technology improving processes then we can start to guess passwords and we can start to go through hashes and calculate them for various different combinations of passwords.
Now for a fairly modern mid range GPU I've kind of gone away and done as much research on this as is possible and I've got a bunch of different numbers but I've gone with the average of this. We can actually process around assuming that we're calculating SHA3 or SHA3 hashes. We can actually process nearly 300 million hashes per second. 300 million hashes per second.
300 million hashes per second. And that's just a brute force attack so we're not assuming that anything fancy is being done we're not using anything as a some kind of indicative input. We are. Exactly.
We're just going from AA, AA, AA, AA, AA, AA, AA, et cetera. So usually we're assuming that some kind of data breach has happened and you've got the hashed values of the password and you're trying to figure out what it is rather than logging through the application right? Yeah effectively. Yeah.
You know 300 million per second. This is why when you're writing an application in force a log in timeout so that people can't brute force through the application. Yeah exactly. Another way of doing this instead of just going for the brute force approach is of course using a dictionary or a rainbow table.
I like that name. Yeah so a rainbow table is effectively a list of inputs of common passwords. Things like Hunter 2, like Hunter 2, Chris's mum's birthday. Yeah swordfish.
All of these sorts of things. And we can get this information from existing data breaches as well. Okay. So one thing in particular that I found was of course.
So what you're saying here is that those various environments where passwords are stored as plaintext actually do produce some value to us because it gives us a data set of passwords. Yes but also why would we use that when we could use an even better list. Now a few years back there was a breach and we ended up with a rainbow table, a list of dictionary called the Rock U list. We will.
We will. So the rainbow table, specifically the Rock U list. Yes. The Rock U list effectively was 14 million real world unencrypted passwords.
Okay. Where does it come from? So I don't know where exactly it came from. I don't know which breach it was made available and effectively what we do is we take that Rock U list for instance of the 14 million passwords and they're common to use passwords.
There are duplicates in there where people are using the same passwords and all we do is just hash all 14 million of them and there we are. We're using something like I don't know, Dragon123 and boom, there we are. We have the hash and we can compare that and we can try and then break our way in and actually just calculating around 14 million hashes or variations there upon because that's what some very, very clever pieces of software can do and typically where users have gone. Oh no.
There's been a data breach and my password's been lost and my Dragon123 password is instead of Hunter 2, Hunter 3. Or when you're periodic six weeks, change your password policy comes into mind. And you just increment the number by one. Effectively what we can do is look for numbers and we can just increment them, add a few common characters.
We can look for things like zero being converted to O and vice versa, I being one. I thought I was a trend satter in this regard. Sadly not. But we can actually use this software to actually break real world passwords using this input.
Hopefully no one will figure out my replacement of the A symbol with an at symbol. Oh no, never. I would never dream of doing something like that. Yeah, so you thought so.
Well, it's actually interesting because I did again a little bit of research around this and I actually found out how Dropbox do their password protection. Or at least how they did. I'm not sure if they still do it this way, but it seems fairly cool. Effectively what happens is we give our passwords a Dropbox.
Then what they do is they do a simple hash of that password. Then they run it through a B-crypt algorithm. A B-crypt algorithm? Yes, so like a B-crypt but a B-crypt.
A B-crypt is a type of algorithm that can be used effectively for hashing. What you do is you give it a high count. Now the problem with these sorts of algorithms is that they are computationally heavy. They require going round and round and hashing and obviously doing its fancy thing.
And the higher the count the more secure we're going to make it. So that requires a salt and a cost. So we take the hash password, we hash it again with a salt and a cost over and over and over again. And then the resulting hash is encrypted with AES, 256.
And then it's stored separately from the main database. Nice. Super secure. It's mega secure but still very computationally heavy.
So it actually requires a lot of processing time to do this. It makes sense. But again as computers get faster, this still gets less secure so you just have to increase that cost, that count threshold. Now something I was thinking might be kind of fun before you tell us on how people can effectively put in place really good passwords is I was thinking we should play a little game.
Oh I like games. What's the game? We are going to be playing Kakasson. Cool.
No not really. But that's a great game for anyone listening. Now I was thinking we could play, stop looking at my list. I was thinking.
That's a weird thing. I was thinking for a change that we could play Guess the Week password list. So I actually have the top 20 weakest passwords here in my notebook that I've taken from 2018 data. And we're going to see how many you can guess.
Not 2019 data. No. So that's our date. Again passwords.
So I'm sure some of these parts, well a lot of these passwords have been common since the 90s. No, all my passwords end with 2019 now. Wait, hang on. Right.
Okay. So I'll tell you what, we'll give you five minutes to guess all of these passwords. If you get it in under that, then great. If not, then poor you.
This is just an easy way to float or increase the size of the recording. No, I just think it would be a five minutes is probably an appropriate amount of time. There are some easy ones on there. There's also a few kind of not so easy ones.
So we'll see how many you can guess. So you can do a countdown clock for five minutes. What me personally, you have four minutes remaining. I was thinking more like from the show countdown.
Doo, doo, doo, doo. Doo, doo, doo. Yeah, but for five minutes. No.
Right. Let's go. Let's go. Right.
So give me your first password guess. 123456. Yes. 1234567.
Yes. 12345678. Yes. The same, but we're nine at the end.
Yes. Was zero at the end? No. Ten.
No. Same, but ending in five. 12345. No.
ABCDE. A, B, C, D, E. F. No.
Some string of the first letter of the alphabet. Erm, I'll give you that one. We've got A, B, C, 1, 2, 3. Er, yeah, that makes sense.
Hunter 2. Hunter 2 is not present on the list. Your mum's birthday. It is also not present on the list.
Swordfish. Not on the list. Chris is a massive winner. No.
Let's see, what else? Computer? No. Six A's in a row?
Erm, no. But you're warm with that. Alright, is one of them going to be six or seven or eight of a certain character over and over again? Not character.
Letter. Letter. Not letter. Sorry.
Number. Yes. Which number? Alright, I'll give you this one.
So, six ones and six sixes are both on the list. Where's the six sixes would be one? Six, six, six, six, six. Yeah, this is easy to remember.
Er, try to think about my historic past ones now. Oh, there is one on here that I didn't give you. Six, five, four, three, two, one. Yeah, I'll put that one down.
No. No. No. Microsoft.
No. Telephone. You're not very good at this, are you? No.
I won't be a very good hacker. It'll take me a long time. Go on the most obvious one. What is your most obvious choice for your password?
Password. Password. Right. Right.
The second one is admin or administrator. Admin is on the list. It is number 16. Some kind of combination of password, password 1.
Nope. Surprisingly not. There is one, two, three, one, two, three. I'll give you that one as well because we've already covered numbers really.
Think about something that the team that we work with thoroughly love. Champagne. What team are you working with? Cuddles.
No. Dollars? Think about it in a kind of sporting sense. Winning.
No. Like a literal sport. Football. Really?
Yes. Football is in the top 20. That shouldn't surprise me too much. There is also another password that comes from just running a handle on the keyboard.
Quety? Quety is on there. A zerty? No.
Quety is a zerty. That would be a great password. My next password would be Quety as a zerty. Awful password.
Come on. Let's say one more to go. One more to go. Well, actually, there is not one more to go.
But you've got one more to go, two more to go in the top 10. Something we all love, but English people don't get enough of. Cuddles. There is still not on the list.
Mmm. Mmm. Mmm. I'm sure this makes for thrilling listening.
You might have added some of this. Hair cuts. No. All right.
Oh, God. And also, I'm going to take the rest of the password. Hey. Princess.
Mmm. Welcome. Right. And monkey.
Monkey. Monkey. Interesting. Yeah, I wasn't expecting that one at all.
Now, I think we can all agree those are pretty bad passwords. Yes. But can you tell us what makes a good password? How are we supposed to help these people protect their passwords?
So, I have some friends who are working security and security center. Wow. I do. I do.
I do. I'm going to look up a guy called Troy Hunt, who you're going to talk about in a bit, for being the owner of a specific website. But he has a great blog about passwords and general password tips. So one of the big mistakes he says people make, especially if you're in the IT team, is to set password policies that generally don't make sense.
So for example, specifying that people have to use special characters, but still only six characters long, or for having to reset their password every six weeks, one of the previous companies I worked out was every six weeks. Wow. All it means is that you cycle your passwords because who really creates a brand new password every single week? Yeah, that's not something I would have the time or energy or will to do.
So generally, those kind of things should be avoided. What is better than using special character enforcement and putting time limits in is ensuring that people are just generally making long passwords, that makes sense. We want to avoid making passwords that are easy to remember by machines, but hard to remember for humans. Instead, we want passwords that are easy to remember for humans and hard for machines.
So the best thing is to take a simple short sentence and use that as your password instead. Okay. So for example, cats out on the mat. Okay.
Take away the spaces. Yeah. And suddenly you've got a long string that you can remember very, very easily, but it's not so easy to break down. Yeah.
Because you've got a lot of possible variation. Yeah. Other tips in general involve using a password manager, whatever possible. So for example, Chris uses the password Hunter 2 everywhere.
It's true. Instead, he should use Hunter 2 in some places, use his mum's birthday in other places and sort of fish in other places. Yeah. Nearly unique passwords everywhere.
But the reality is that is quite hard. So password manager helps that. Yes. But you do still have to have a master password.
So make your master password something long and complex. So for example, I really love Chris's mum. Make that I really do love my mum. Exactly.
It would fit really well. Use that as your long master password and then use the password manager to generate more secure passwords, like 25 characters long, complete gibberish for all your unique different sites. So if one gets breached, you're still completely secure. The other thing that's often recommended is to use a authentication system.
OK. So two facts or two facts are authentication. For example, if you just get a text message, getting a text message isn't perfect because phone numbers can be spoofed. So it still can be breached.
But it's better than just using a password. Yeah, because you would need to not only steal someone's phone or spoof someone's number, but you would need also to have their password. Yeah. The next best is to then put in a software authenticator application.
So for example, like Google provide, that allow you to authenticate separately with a generated code. And the best possible is a hard version of that. So for example, a key that's placed in to a USB drive. How is he?
Or a hard line authenticator, a pretty good one. But software authenticators generally pretty decently. And yeah, that is Troy's tips for making a good password. Well, you've really touched on someone, I should say there, who is incredibly important in this general realm is he not a name that most people are familiar with.
And that's because Troy runs the website. Sorry, I thought you were talking about me. No, no. And that is because Troy runs the website, have I been pwned.com.
That's P-W-N-E-D. He says grimacing as if that is the lingo he uses every night while killing teenagers on Fortnite. Oh, God. I'm so glad you completed that sentence the way you did.
Side note, 21 who wonders, I don't play Fortnite. But I can't floss. He plays PUBG. I don't know what that is.
Don't pretend. But effectively, have I been pwned.com is a great place to go when you want to check if your details have been lost in a particular breach, something that people have been made aware of and Troy maintains this himself through the goodness of his heart. And effectively, this is where we go to say, okay, have I been involved in any of these breaches? Which websites have lost my data and need to change the password that I use for that website and then the same password where it appears for other websites just in case it's been lost and found in one of these rainbow lists?
Yeah. So I found that my data was on there. Oh, really? Yeah.
So I had to do some major password changing and put it into a federal authentication. That's a great result. I can't remember specifically which breach it was, but yeah, great website to check out. Absolutely.
And you can also set up alerts as well. Effectively, what you do is you put your email address in and what happens is every time there is a breach, this database of people who want to know if their details have been breached or not, that then gets checked against the breach and then you are alerted and it says your details have been lost in a new data breach, which you can then go and investigate and change the relevant associated passwords. Makes sense. Absolutely.
Go do it. Yes. Go and change all of your passwords, make them insanely long and if possible, use two-factor authentication and a password manager. So that's how we can set up a good password system.
How we can make good passwords ourselves and how we can find out if someone has breached us. Absolutely. And if you're using the password 123123 or password or admin, just don't, please. But Chris's mum, Hunter 2 and of course Swordfish, all good.
Yes, those are all fine. Excellent. So Chris, now is the time that I know you have been waiting for, largely because the news largely depends on you this week. So I feel like I've been talking everyone's ear off.
I think I'm always in the news for one reason or another. Not in a good way. Always in a good way. Oh, okay, fair enough.
Well, give us your rundown then. In fact, if you want to, feel free to introduce the segment as you see fit. Welcome to the news. I'm sorry, can you just maybe make that a bit quieter?
Stop. Stop. Hey, you asked for it. Okay, so we have some very interesting news stories to report on that have occurred since the last time we did this thing.
When was the last time we did this thing? Oh, we did this. It was the last month, around about this time of the month. Yes, the night before deployment.
Yeah, that thing that you remember. Okay, so the first major news story is from Germany. Ask for a session? Yeah.
Chris knows German. You may have heard about a German hacker. How long? I don't know.
Have you been keeping track? I don't know. I'm very out of touch with the news, Chris. So if the Spice Girl is still popular?
Yes. I mean, yes. So if you are a German celebrity or a German politician, then you may have been hacked. The story that came out a few weeks ago, a German hacker effectively got hold of a lot of sensitive information from these German officials and all the way throughout Christmas as like a hackers advent calendar.
He was slowly releasing day by day more and more personal information about these individuals. Oh, so how much was lost in total? Was about a thousand individuals in total. And there was things like phone numbers, addresses, credit card details and private information, internal documents, emails.
Ooh, emails. Yeah, so not just emails, it addresses emails themselves. And for a huge swathe of public figures. So German rappers, I know you're big into the German hip hop scene.
You may have heard of some of the German politicians. So for example, Angela Merkel, I think it's pronounced. Yes. Fairly famous politician from Germany there had some of her information breached.
Wow. Also the German, I think it's the German Chancellor, the head of state. Do you remember the name of it? Chancellor and President.
Yeah, I know there's the two, I can't remember which one. Angela Merkel is there. Chancellor. Okay.
So the President also got his information hacked as well. Both heads of state. Wow. And what, why this is interesting and why I wanted to raise this.
One of this isn't the typical kind of data breach we usually see. It isn't strictly someone got access to a backend database and released all of the information. It's been particularly a particular pertinent to what we're discussing today. Because the hacker was caught, 10 out to be a 19 year old guy who effectively just tried a whole bunch of basic passwords for these people and got all of their personal information.
Oh, dear. By, yeah, brute forcing with very simple passwords. And it was the example passwords that you used. I actually think I saw, I love you come up.
No. Yeah. So kind of ridiculous. Sorry, 20 year old, 19 year old.
That makes all the difference. It does. Well, it kind of does. He's, he was given a three year sentence.
People think that's likely to be dropped down to young offenders. What, at 20? Apparently Jeremy is a post where that happens. Okay.
So I guess that's good. He has, well, at least there's an argument to be put there that he has been very cooperative and he has in a way done a little bit of a service to the German people in releasing information that, you know, once sensitive information is not information that's going to cripple the German government in a particular way. No, this is true, I suppose. It comes down to the differentiation that people make between, I think it's called white hats and black hats and where you've got someone who has done something, not with nefarious intent, someone who's done something to prove that they can do it.
And certainly there are a lot of people out there who are very, very good at cracking passwords who are employed by various governments as security consultants. There are people out there whose job it is on a day to day basis to crack passwords and actually try and make systems more safe, like penetration testers. Yep, absolutely. I think in this case it's a bit more of a grey hat situation.
A white hat probably would have gone straight to your authorities and said, here's the thing that I did rather than release it over to Twitter. And there was a little bit of a political edge to his actions as well. But still, I think the sentence will be commuted down from the four or three years. So yeah, that was a particularly relevant piece of news.
Well, nice. So I think we've got just about time for another piece of news. So I think you've done yourself this week, Chris. I've got two bits of news.
Oh, no. Second bit of news is actually an update on previous. Oh, OK, that doesn't count then. So let's do the update.
So the first of my updates, I've got two updates. Actually, no, just one update, one update and another separate thing. Mariette, Sheraton. Yes, we spoke about the breach.
Yep. And Chris lost all his personal information. Well, first and foremost, we have part one of the Mariette update in that the numbers have been revised somewhat. Previously, we were looking at 500 million.
That has been brought down to a mere 383 uniques. Only the population of Great Britain and the United States combined. Yeah. So yeah, it's not quite a lot, but five million unencrypted passport numbers, additional 20 million encrypted passport numbers, around 8.6 million payment cards.
Encrypted? No. Oh, that wasn't encrypted. Oh.
Around 354,000 active. They think that was now spread over 200, what I call intrusion incidents. 200, yes. Wow.
So the same initial breach, points, but 200 intrusions. Now, yes, encrypted, but because of the reasons you discussed previously, we should maybe assume that it's kind of moot that those things were encrypted, because encryption keys almost suddenly were stolen as well. Yeah. So the ICO is currently leading the investigation in the EU, and this kind of comes into our second update here.
So there's the initial find that many are thinking could be as much as $915 million. I mean, the full whack. But the second update is that we are starting to see class action lawsuits come in. So it's actually been two.
Most of the first one is kind of minor, but the second one has currently got 176 plaintiffs. Of course, because it's a class action lawsuit, that number would climb to the entire $300 million spread across 50 different states. That was published or filed, I guess, on January 9th. Essentially the plaintiffs are arguing that Marriott did not adequately protect their information and failed to provide timely, accurate, and adequate notice once they did.
Sure. But for each user, that could be a filing of about $25. It doesn't sound like much, right? Until.
Until you times it by the number of affected. So that's around about $12.5 billion on top of the fines. Do we know what's the overall value of Marriott? The overall revenue of Marriott, I believe, is around about $20 million.
But bear in mind, the hotel industry is not going to have huge margins. Yeah. So yeah, that would be quite a substantial fine. Previous class action lawsuits around day's bridges.
This isn't, by any means, breaking new ground. So you may remember the Uber data breach. Yes. That ended up with $148 million.
Yeah. Class action lawsuit. Yahoo. $85 million.
So on top of the initial fines, on top of the initial stock price hit, and they've now potentially caught this class action lawsuit. Oops. Yeah. So big update.
Big news. Essentially, try not to be breached because it costs you a lot of money when it happens. And this is the thing. This is what we talk about on a daily basis.
We speak to some of our customers who are actually trying to do their due diligence. It's not necessarily that they are worried about GDPR or HIPAA or SOX or poppy or HIPAA or PIPA. It's not about California, California, Consumer Privacy Act. Shield.
The New York Shield. Yeah. But you've got all of these regulations that people have to abide by, but it's not necessarily we are doing this to be compliant with that regulation because we potentially have to be compliant with multiple regulations. So a good place to start is to borrow a phrase from the GDPR to protect everything by design and by default.
If we can make sure that we're doing our utmost to protect our users' information from the very get-go, then hopefully compliance with this sort of legislation that isn't just a checkbox like ISO 27001, for instance. It's very difficult to be compliant with this legislation. But if you do everything you can, then the chances of you being breached are lessened, but also if you do get breached, then you can at least prove that you were doing something and that someone made an extraordinary attempt to get around all of that security. Absolutely.
We have one final item in the news. Fabulous. Bit of festive cheer for you. Oh, I like festive cheer.
Yeah, so Christmas isn't quite over, but news is that we reckon cyber attacks went up around about 35% over the holiday period. Merry Christmas everyone. That comes from a report produced by the insured shop. Oh, great.
Yeah, so there you go. And that concludes the news. What do you want for Christmas? Credit card fraud.
What do you want for Christmas? Lots of new credit card numbers. Yes, so don't go spreading around credit card numbers and make sure you take appropriate protection, not only of your data with fancy super long passwords, but also other people's data as well. So, I think people know what date of the year Christmas month's birthday is.
The more secure my password is. Yes, and you may have noticed I haven't said that date at all, not that I use it in any passwords. 30th of February. Yes, the 30th of February.
But with that in mind, I think it's about time we brought DBL to its inevitable conclusion. And hopefully we'll see all of you listeners back roughly this time next month as well. Again, please do feel free to tweet us your new year's resolutions, your thoughts, your beer preferences will be back on the beer next month. And that's at Red G underscore Chris.
And that's at Kurzwell Chris. And this has been DBL. Happy New Year. Happy New Year.