> If you want to shock your colleagues into action

Another way to shock your colleagues is making them point their browsers at https://myactivity.google.com

(and let them scroll down)

Part of the information shown there is likely to be part of what's in their phones.

When I've done something like this in the past, most of the responses I get are shrugs and, "I guess I'll change that password, do you have any tips on good passwords?"

A few people will go off with their lighthearted hyperbole "I'm moving to a cabin in the woods!" To which I respond, it's much easier to track a n=1 with a unique heat signature in the middle of nowhere - should someone be so inclined.

I make a habit of getting friends and family to do this. And, it’s sad to say, but even this doesn’t always elicit the sort of response one would think reasonable

Agreed. The typical response seems to be “what’s the worst that someone could do with that info?”

The NYTimes article attempts to answer that question but I’m not sure how successful it is. The gist seems to be that your data affects others, and you may case later about data that you don’t care about now. Nothing about identity theft, answers to secret questions, etc.

Some people I talk to already get it, that it’s hard to foresee the abuses, but for most people, if it doesn’t end with a hacker raiding their bank account then it’s not really a problem .

Another way would be to get that 50B location point data that some analysis was done on recently, and send them a list of all of the people that visited their home and all the homes the people in their home visited. Do that enough and you'll likely discover some clandestine activities.

It's a shame that most people will just add a number to their current password though.

After talking this through with many non technical people, I have become of the opinion the shame is ours. Why do we keep pushing this patently unsafe authentication mechanism? It should never have been allowed in the first place, but now with hardware keys readily available there really is no more excuse. I understand there is a first mover disadvantage to disallowing password-only auth, but that’s on us. Our collective timorous prevaricating is to blame for the misuse of passwords by end users. Because, unlike them, we do know better.

It's a shame that operating systems exist with no functioning system-wide API for authentication, let alone storing passwords.

That would change things.

Just look how Apple now inserts long random passwords in registration forms and immediately saved it. That's how users will use secure authentication. By helping them, not telling them to do better on their own.

Hardware keys get lost, what is the fix for that?

Backups. Either in backuping the data, or in enabling several tokens for the same service.

The problem is that the first one is frowned upon for good reasons (but maybe not as good as they seem), while nobody supports the second one. So, yes, currently depending on hardware keys is dangerous.

The same as real keys: you make a copy. If you don’t, you have to call someone to get it fixed, which is an expensive hassle. It’s an intuitive model that everyone already groks. No fragile user re-education necessary.

That doesn't seem right: https://support.yubico.com/support/solutions/articles/150000...

Hardware keys embedded under your skin. What could possibly go wrong with that?

Joking aside, hardware keys will absolutely get lost. Even car keys get lost around here on a fairly regular basis.

Fingerprints maybe?

Probably not: https://www.csoonline.com/article/3268837/busted-cops-use-fi...

and when the fingerprint database is stolen and shared with multiple adversarial parties? they now have your password and its gonna be hard to update / change yours.

This happened with the opm hack and a big one in India or Indonesia or something not too long ago I think.

go to some random video chat, and record the reactions when you offer full data on some plain nothing to hide person, then show that to those with nothing to hide

In my experience there is a realization that its not about hiding your data, its about hiding from a particular type of netizen that amplifies to an extreme

what is a shame is the mere existence of the password system, in a world where we have public key cryptography.

Hmmm … I wonder into what kind of action they'd most likely be shocked.

> So you took a private email address I gave you in confidentiality and handed it over to some hacker site which, without making any verification that you own that address, gave you a list of services I'd signed up for? Bob, YOU are now on my shit list. Your face IS punchable. You should get lost as soon as possible.

Maybe it would be better to tell them something along the lines of: "I just improved my internet security, and so can you! Check out these resources, plus some background information from trustworthy sources."

But which tools and reports should I recommend? In this context, "that talk I saw at Defcon" doesn't cut it. Recommending a site that endorses exactly one password management service also seems questionable; I'm concerned that if I tell colleagues to trust HIBP, I'm priming them to fall for anti-malware protection rackets.

How about the venerable NYT? They must have some great stuff. But then there's also content such as TFA, in which a graphics director and a writer from the opinion desk deliver bons mots such as: "None of us really has a choice to participate in tracking or not — the system just serves up location data, usually without us noticing. […] When we participate in this system, we're tacitly endorsing it." On a page that attempts to contact DoubleClick and Google Analytics. (Which I did notice, and, unlike the NYT, chose not to participate in.)

When someone asks for advice or I noticed them make a security boo-boo, I can teach them the bare minimum (basic stuff such as how to use unique credentials for every site and service). But when it comes to doing my part in spreading the word about being more proactive than the bare minimum … halp!

Edit: Credit where credit is due: I just finished reading TFA and discovered the section "What about The Times?", which has links to "This Article Is Spying on You" [0] and "How The Times Thinks About Privacy" [1].

[0] https://www.nytimes.com/2019/09/18/opinion/data-privacy-trac...

[1] https://www.nytimes.com/2019/04/10/opinion/sulzberger-new-yo...

Yeah, that’s the first step we take with PrivicyPal. Then data brokers, then Google/Facebook et al.

While there are others, Troy Hunt’s HIBP is a great resource, and we are indebted to his work there.

> Alice, YOUR physical address and family names are available in public information aggregation site ABC. Did your bank ask you what your mother's maiden name is "for security"? Did your HR set your password to YourLastName+StreetNumber?