Cy K

Head of security @ Google (reCAPTCHA/Safe Browsing) by day. Early stage/public markets investor by night. Security serious. Crypto curious.

[Pierre Elias, MD @PierreEliasMD]

Today I gave a talk to 75 people seated around the single largest table I've ever seen. It weighs 4,500 lbs and I can confidently say I've sailed on boats smaller than it. Thanks to @PeterFleischut and @DanielJBarchi for the opportunity to share our work!

[Cy K @cykho]

Crypto Guardians Episode 4 is out with Fintech + Open Source expert Dustin Kirkland

Dustin is an open source and fintech expert with experience at #GoldmanSachs, #Apex, #Canonical, #Google, #IBM, and #RedHat. We discuss his experiences with crypto as a user as well as a financial professional. Dustin outlines the parallels between crypto #opensource, and the traditional finance markets. Throughout the conversation we're able to draw from the historical examples to predict where #DeFi is going and how to keep your coins safe.

https://t.co/aYzTOifhr2

https://t.co/QRC6AfWuMw

https://t.co/O658g9IXIH

[Cy K @cykho]

Superbly insightful. Interviewing - especially at senior levels is about story telling. Interviewers will not ask you pass/fail questions (ie algo questions). They will provide open ended opportunities to story tell. It's your job to tell your story in a way that aligns with the job you want.

https://t.co/FkHRwSEjQ3

#job #opportunities #storytelling #interviewing

[Cy K @cykho]

In case folks are wondering why #SMS is moving behind a paywall at #facebook and #twitter it comes down to cost. Every #SMS costs around .2-.5 cents. Adversaries will abuse this cost with fake accounts. Putting this feature behind a paywall limits the cost of abuse due to this exploit. If you're an #ATO professional considering this try putting #recaptcha in front of the SMS 2FA on your site. It can significantly reduce the amount of abuse and enable you to continue offering SMS 2FA to your users.

https://t.co/fiuq0SNPgi

[Cy K @cykho]

Episode 3 of Crypto Guardians featuring @OurielOhayon of @ZenGo is now up on #YouTube, #iTunes, and #Spotify.

=Ouriel walks us through the security measures that ZenGo has implemented to find the balance between #MPC powered #security and #usability for the next generation for #Web3 users.

iTunes: https://t.co/AzQV2ZUAbj
YouTube: https://t.co/RtBE05vCEE
Spotify: https://t.co/IMkuZBPOpy

[Cy K @cykho]

@rmhrisk Udacity has always been a favorite of mine!

[Cy K @cykho]

This is the challenge of @recaptcha or any #bot #detection. We're starting to see convergence of AI and human behavior.

[Naval @naval]

If you think the AI is sentient, you just failed the Turing Test from the other side.

[Cy K @cykho]

@anton_chuvakin 20% yes is much higher than I expected...

[Cy K @cykho]

Couple hard learned #zerotrust #security lessons in this case:

1 - Start with the assumption your system is compromised. Any sufficiently large set of #infrastructure will have vulnerabilities. It's all about prevention/detection. Not building a big moat around your castle.

2 - Most #phishing/ #malware is distributed by #hacked sites. Don't assume any site is #safe simply because it's known or previously #trusted. Use best in class controls like Enhanced Safe Browsing (https://t.co/iVb93MdXO4) to stay safe wherever you are.

https://t.co/im912Dfrvh

#staysafe

[Cy K @cykho]

This is a very articulate post about some of the challenges #google faces in the upcoming years. The author and I both worked at #microsoft and #google in similar eras. His commentary resonated strongly with me. I don't see it as well defined as he did, but I certainly can see the signs:

"(1) no mission, (2) no urgency, (3) delusions of exceptionalism, (4) mismanagement."

"Google has a few strengths that Microsoft didn’t have as it tried to recover — it isn’t a culture of ego and fiefdoms, the environment values introspection, the stated core values of the company are rock solid, and there is still immense respect for Google in the external world. "

https://t.co/TqOCIajdSM

#environment #culture #respect

[Naval @naval]

What feels like play to you, but looks like work to others?

[Cy K @cykho]

new form of #Phishing. #attackers send 0 value transaction from an address that looks similar to past transactions of a #wallet hoping to trick the recipient into sending funds in the future to the wrong address.

https://t.co/V41RFW2ghy

Kudos to #coinbase for the analysis. #security #web3

[Cy K @cykho]

How every #infosec professional feels about #phishing and #socialengineering

[Cy K @cykho]

A quick example from #SF - two similar sized/located #properties. 4.5k in rent may be less in annual expenses than buying the 1.2M property.

4.5k #rent https://t.co/xMQNuuZwmw

1.2M sale https://t.co/GmLpA1u9qv

[Cy K @cykho]

https://t.co/ZaLMIvHmqN

The ultimate sign of overpriced #housing and a #housingbubble. I've walked through the economics with many friends - more often than not it makes #fiscal sense to rent until the #housingcrash comes.

[Cy K @cykho]

A simple way to think about this is ownership costs are in the 5% range (mortgage interest + taxes + maintenance). So, if you want to live in a $1m house (or condo in the bay area) you could pay $50k in rent for a similar place. All with no commitment, closing costs, or #risk.

[Cy K @cykho]

#phishing strikes again at #reddit. This is an all too common story. Kudos for the responsible disclosure and guidance to users to implement #2FA. I've seen #hacks like this often go unreported. The only way to get #safer is through #transparency.

https://t.co/C1XTQhH45M

[Cy K @cykho]

Some great #security tips for #SaferInternetDay. Keep #phishing #accounttakeovers and #malware away! https://t.co/Q34nBhlQVW