All right, welcome to season five of Inside Mike and New Head. This is a Canadian podcast that's all about the integration of leading an incredible, awesome life, individual responsibility, individual emergency preparedness, and how do we navigate life's incredible, wild disruptions that we see among a sit-back, grab a beverage, and enjoy the episodes. All right, welcome back to Ottawa studios of Inside Mike and New Head. If the voice is a little off, that's because I have one of those fall flu COVID RSV vaccine initiated illness.
I don't know. You can call it whatever the heck you want. But yeah, so the voice is a little off and a little bit of coughing along the way. But we'll get through it today.
Very important topic. Today, we're going to talk about a real actual this week event of identity theft online and somebody losing their social media business. I'm going to walk you through it. We're going to talk about it.
Understand our exposure. So grab yourself a beverage. Let's get at it. All right, welcome back.
Before we jump in, I just want to say thanks again for all the feedback that I'm getting on the website and for the comments that you guys provide good, bad or indifferent. I enjoy them all. Please keep them coming. And I appreciate your patience, the fact that there were a little less frequent with the episodes right now because we're in the final three weeks stretch of completing my big major life project.
And so then we're going to take some holiday festive times and we're going to launch a new redesigned inside my canoe head in 2023. So with that today, this week, a very good friend of mine. She was in a guest on this podcast season three episode 15, Lingatar. She runs or used to run a homestead channel called Bucket List Homestead on YouTube.
And she had started it up from five subscribers like everybody does. She just recently crossed the 1000 subscriber list. She is now or was entering the monetization world. She was just creating her love and her contentment for living on her little three acre homestead outside of in Southern Ontario.
And she's a woman that hired a gold. I mean, she's a multiple cancer survivor. I've known Lingatar since 1993 in case you want to know how long she's been a part of my family's life. You won't find a more honest, open and loving human being on the face of this earth.
She logs or tries to log in to her YouTube channel 48 hours ago to check on a bunch of things and start uploading her next video and her access is denied. She doesn't have the ability to log in. She goes to YouTube. Her channel is gone.
It is now renamed to something completely different. And it is all of her videos are removed. And it is showing a live feed of an Elon Musk briefing from some time ago. That's it.
It's gone. Her list of her 1000, 1.08,000 subscriber list is there. But everything that she put up, all of her comments, everything are gone. Just gone.
Everything she's worked for. She started building this over a year and grinded it out. And it's gone. Absolutely gone.
Now you can think that can't happen. Don't worry. She didn't have two-factor authentication. You'd be wrong.
She had two-factor authentic authentication. It was on her account. It was to text her phone. Whoever got into her account got into it and did not trigger the two-factor authentication somehow.
The site was taken along with her Gmail account. That was associated. So you know, bucket list homestead at gmail.com was gone as long as her access to everything in there associated and her YouTube channel gone. And she was dumbfounded because the two-factor authentication wasn't triggered.
And so her backup, she didn't have access to her email that's linked to her YouTube account to tell YouTube it's me and somebody stole my account. So she was for all intents and purposes completely utterly locked out of what is her life's project. Just think for a second what that would feel like when you power your heart and your soul into creating something that you are passionate about and you're meeting a bunch of people she was going to homesteading conferences. She was just opening up this joyful part of her life and it's gone.
Like all of it taken from you and the security system that Google and YouTube asked her to put in place she did and it didn't work and now you have no way to contact YouTube. Just think about what that would look like. So luckily what happened is quite a number of us she texted a bunch of us. Oh my god what's happening etc etc.
So we jumped all over it. Enough of us went in and flagged this channel in through the spam. If you've ever tried to do that top right hand button top right hand party YouTube on a channel there are three dots you cook on that report and then there's an option for spam and then it gives you the option to it's like 300 texts like a big long tweet but we enough of us put in there to say this is Lingatar. I can attest to her identity.
This was bucketless homestead. It was taken from her. So enough of us did that. The channel got flagged a whole bunch at one time by something like 300 of her subscribers.
It's a tight knit community the homestead group. And so the channel's down. The problem now is that she still doesn't have access to any of her Gmail to be able to contact YouTube and say hi it's me. What are we going to do about setting this up?
So she does have the two factor authentication with her phone so all she can do at this point is reach out to Google using what information she has and hoping some human in the coming days will get back to her. So here she is. She's just sitting in limbo now just her life and everything turned upside down everything that she was swung out her legs out of bed in the morning to go after her dream is squashed right now. Absolutely squashed.
So today what we want to talk about on the channel is I want to talk about what is your exposure. I want to talk about what is your single point of failure and do you have one of those in your online presence and then I want to give you a report on my audit that I did yesterday through my online present as a result of what happened to Lingatar and I'll tell you what I found out. The first part of any situation or any event that you need to analyze is understand what's really going on. So in this case that is what is your exposure to the online space.
Remember like your iCloud if you have an iCloud or a cloud account it's really just stored on a server somewhere in a server farm right. Do you have a backup to that understanding where your information lies your key information. So we all have those file folders that contain our tax return our file folders that creating the most important medical information that matters to us. So email exchanges reports returns whatever it may be with your doctor other medical specialists we have a whole bunch of really important digitally remembered or digitally recorded personal information that is critical and should it be lost would cause potential catastrophic damage to ourselves.
Where do you have that information right. So understand where it is. Look at your passwords. How often do you change your passwords.
Everybody goes yeah yeah they tell you to change your well guess what you actually do need to change your passwords. You should have a number of different but it's it's what are your passwords right now I have a book on my desk it has all of my passwords. If you can get into my house and get to my desk you have a book and you have my identity. I won't give you good odds of being able to do that but it's there because I don't remember them and I change them so often not enough frankly and I use too many of them in common but I have a written not an online keychain I have a hand hand drawlically written copy of all of my passwords that I use online.
Where's your credit card information stored. How many websites do you use where you for convenience they've asked you would you like to store it whether it be a Shopify a Stripe account a Square account like where is your credit card currently stored on a company's server that may be hacked. Who knows. Do you what payment methods do you use online do you use multiple credit cards.
Do you use a single separate identity. So the whole idea of understanding your exposure is basically the first step is to create a list of absolutely every website on the planet where you have active login credentials right that are actively being used or you have at some time created it. What is that password. So you create a list of my 112 websites that I have a login ID for from your Steam account to your Apple account to your Google account to your TikTok account to your Instagram you can go through them all every single one of them to your Cabela's account whatever it may be your Canadian Tire account create an account for rapid shipping whatever whatever you've done in the past.
Again the idea right here is that what is understanding your exposure state is just to know exactly what you've put out to bear. We've opened your cimono to the world who knows what piece of information and where it's stored. You have to have a complete holistic list of your total exposure online. Now we're going to look at your single point of failure.
Do you have one. Do you have a single password number one that's used repeatedly across all of your things across a number of important sites that if they got that password if they got that user ID and password your identity would not only be compromised but it would be pretty damn hard for you to recover. Do you have one place where you store everything and it's protected by one single password and is that password one of those crazy Apple generated ones those crazy online you know really difficult ones or is it one you've chosen is your password common across multiple sites. Do you have and these are the powerful ones we have Apple ID we have Google ID we have Microsoft Sign In these are key powerful sign ins because everybody will say hey I authenticate yourself on this website by logging in via your Facebook profile or your Google.
How many times have you seen that on site all that's easy I'll just use my Google because it's there whatever and then YouTube will pop up and say hey just press on this button and authenticate it's you right. You've just made a link between those sites and as you continue to do that ease it's great way to do it what you're doing is you're setting up all of these other sites with this one password so you're creating a single point of failure if somebody gets your Apple ID email and password what could go wrong if somebody gets your Microsoft ID and password what could go wrong what have you used those to log in and create for yourself these are single points of failure that you didn't really think existed that probably you use all the time for a point and a manage of convenience that helps you out and makes things go really quickly because you never remember all your freaking passwords so if you just keep using your Facebook password to log in everywhere it is so simple well what if somebody gets your Facebook password just use Facebook ID all of a sudden you can understand their access so that's what a single point of failure is where you've taken an ID that is useful and then use that on multiple other sites to be able to get access and now you've created where if somebody gets that you're in big trouble so my audit what happened so after this happened to Lynne Gatorre and my heartbroken I did what I could for her and flagging everything I went in have a look at and conducted this what is my exposure and what's my single point of exposure audit on my online presence to see what my vulnerabilities were and you know as my old boss teeth used to say you just got to open your kimono right you just got to show the world everything and be honest with yourself and when I laid it out it was a pretty scary thing and I always considered myself pretty savvy right I had a number of passwords that are common I had a number of social media accounts and banking accounts that had common passwords those are now changed independent different passwords like I said I have a book with them written down so I'm not worried about it old accounts closed I went through a whole bunch of other ones that you know where account logins were there and I disabled them or actually went through there were four where I had stored my credit card and I went and removed it I have active monitoring on my banks and my credit card so I have I got a text the moment my debit card or my credit card is used anywhere I got a Tim Hortons I go to the drive-through I buy myself a coffee I'm not even out of the drive-through yet and I get the notification on my phone I have it instantaneously hooked up right both of my credit cards and my banking have the lock card option right there on the iPhone I'm an apple guy I use an iPhone so it's right there on the phone open up the app press the button lock the card right something pops up I didn't see it lock it done not a problem right so I went through and made sure those were good to go I went back and check my two-factor authentic authentication to make sure that they were all set up to text my phone and they were and this Lynn had done the same thing right I don't know what the problem with Lynn's account was I don't know how the person was able to get in to her Google email then into her YouTube and not trigger the two-factor authentication because that was going to her phone not the email so I'm not sure how they did that I'm sure the wizards out there will know the answer to that but what I made sure is that I have a YouTube channel I know it's like 31 subscribers I haven't done something in months but I have an inside my canoe head YouTube channel right so it's logged in with my inside my canoe head address that's not the same password as my inside canoe head email right it's not my login for my preparedness labs website is not the same as the email password so I made sure that my Google Gmail password is not the same as my Google account password the two of them are different if you get one you don't get the other so I separated that and made them distinct enough so they're not linked my two-factor authentication is always sent to my phone as my wife says all the time my phone is never far it's always out me arse it's never out of my hand so listen if you get my phone and you get my thumbprint you can have access to all of my money and all of my stuff so what I've done is is make sure that everything is differentiated and it's a standalone so the password for one thing is not the password for another they are all different so if one of my passwords gets compromised out there for say a Canadian Tire account I don't have one but more staples account right it's not a password that is common to any other single login identity I have so if one goes down it goes down right the big thing was is my iCloud is now much better protected than it was before but what I have like for example a great system that's out there is either apple pay google pay or PayPal and what the benefits of those systems are is that when I use apple pay at a merchant online the merchant doesn't get my credit card information what the merchant gets is an apple ID account number that is that is randomly associated with my banking information that is held at apple so if I buy something off of the pottery barn using apple pay and ship it to my house the pottery barn does not know my credit card information so if the pottery barn gets hacked the pottery barns information somebody gets a randomly generated apple account number that is associated with my account that's protected at apple and there's no information to be compromised they get an email but I'm sorry I've used the same Gmail account for 20 years it's about as compromised as you can all over the internet if there's nothing else I can do right but I don't use that account to log into anything else so the point is is that I strongly encourage people to use things like apple pay pal google pay that has that protective layer so as you use it the merchants don't know obviously never purchase anything with your debit card always purchase things with your credit card because it is the most protected form of payment because if there is a argumentative charge and you spend two months debating it it just sits on your credit card account the money's not gone it's a credit card right so until that problem is solved nobody's gone into your bank account and hauled out five thousand dollars so other than Tim Hortons I don't buy anything without using a credit card I buy everything on a credit card and then obviously pay it off at some point in the future but the key is in all of this is number one uh to hope and pray that lingatar gets her account back and that bucket list homestead comes back rockin and roaring but this should be a lesson for everybody out there who thinks that two-factor authentication is protecting you completely from your asset make sure that your passwords are not common make sure that you're in there all the time that you have notification if somebody logs in from an unknown place to your account that you are set up to get a notification and again this person logged in from an unknown location hacked lins account and she never got a notification from google youtube never told her that somebody hadn't logged into her account and changed her password and all that all that was done without her getting notifications i'm not a tech wizard she did everything that she was supposed to in accordance with in known rules and still lost everything so the point of this is is that if you have any digital information which of course we all do because this is the digital world we live in make sure it's duplicated somewhere make sure it's backed up make sure the important information is as protected as you possibly can and understand that when you throw everything into cloud-based storage as a lot of us do your cloud-based storage is just a server on some server farm anywhere that is open to to a hacker to get into the server farm now you can trust google you can trust apple as i do or you can store it on a hard drive attached to your computer and nothing on the cloud i'm each and every one of us have a different risk profile we talk about this and preparedness all the time your personal risk profile how much risk you're willing to assume in the world but just understand your exposure take the time to have a look at your online presence and then ask yourself the simple question as we do in preparedness all the time what does the world look like when somebody gets my apple id what does the world look like when somebody gets my microsoft id what would they be able to do with it right now if they got it and i didn't know they had ask yourself that question poor nice cup of coffee this doesn't cost any money walk yourself through that process and as you do you start to see there's a pretty big single points of failure you start to see that you have commonality a bunch of things and then you start taking effort yeah you know what this takes this takes effort it takes constant not concentration it takes effort and it takes intent to make sure that your online presence is very well controlled very much segregated from each other and that you are actively monitoring this on a very regular basis don't let happen to you happen to Lynn guitar my heart breaks she's just a wonderful human being she'll come out of this because that's the type of person she is i mean you can say she doesn't deserve it welcome to the online world why would somebody take here and delete all your stuff off youtube i don't know and i don't know why i don't really care why somebody would do that the fact that they can still do that now without all this with all the security protections in place and none of them function the way they were supposed to raises my concern to go oh really am i relying on google youtube or apples to factor authentication to protect me but what if somebody figures out a way around that and everything's gone right so now i have backup emails i've set up not only two-factor authentication i've set up a separate email that is now back up to all my other email logins so i can still prove it's me say hey listen this account is me by going through the company for my secondary email source it's a lot of work it really is uh my best suggestion is after you've done this audit is to go in and delete all of your presence online that you're not actively using if you're not actively using certain apps etc log the hell out delete it get rid of it uh change your passwords today all of them every freaking one of them to something different for every freaking site you use and record it down on a piece of paper not in your keychain because guess what what if they hack your keychain online and get all those passwords how does that work because guess what i don't allow computers to save any of my passwords i allow computers to save my login information so i don't have to type my email or whatever my user ideas but the actual password i have to enter each and every time it might seem like a pain in the butt but that hopefully that's adding an extra layer of protection so please take the time uh on this wonderful november snowy day to understand your exposure take the necessary and protect yourself because if you think that two-factor authentication is protecting you and that's all you have to worry about i'm here to tell you the answer to that is a big fat nope not at all make sure you're doing everything you can take care keep the messages coming we'll talk to you soon