Why You Should Turn On Two Factor Authentication

Поделиться
HTML-код
  • Опубликовано: 2 авг 2020
  • The short answer is: "because it'll make things more secure". The long answer involves Ronald Reagan. • MORE BASICS: • The Basics
    Written with Sean Elliott / seanmelliott • Camera by Tomek • Graphics by William Marler wmad.co.uk
    Filmed at the Centre for Computing History, Cambridge: www.computinghistory.org.uk/
    Their current fundraiser: www.justgiving.com/campaign/c...
    Image of Dr Corbató courtesy MIT CSAIL, used with permission.
    🟥 MORE FROM TOM: www.tomscott.com/
    (you can find contact details and social links there too)
    📰 WEEKLY NEWSLETTER with good stuff from the rest of the internet: www.tomscott.com/newsletter/
    ❓ LATERAL, free weekly podcast: lateralcast.com/ / lateralcast
    ➕ TOM SCOTT PLUS: / tomscottplus
    👥 THE TECHNICAL DIFFICULTIES: / techdif

Комментарии • 2,9 тыс.

  • @TomScottGo
    @TomScottGo  3 года назад +6422

    It's good to be back in the actual Centre for Computing History! They're still closed to the public right now for obvious reasons, but have a look in the description for a link to them and their fundraiser to help them get through the closure!

    • @silvertube11
      @silvertube11 3 года назад +89

      Time traveler

    • @Whatsthetimemrfox
      @Whatsthetimemrfox 3 года назад +6

      Big chonk

    • @cr4zeelee145
      @cr4zeelee145 3 года назад +38

      "4 days ago"

    • @HR-in1dm
      @HR-in1dm 3 года назад +19

      Why does this say 4 days ago if it just came out 🤔

    • @hj9076
      @hj9076 3 года назад +39

      If u unlist the video , then u can leave a comment for later

  • @sarahlicity
    @sarahlicity 3 года назад +12625

    "You can't change your fingerprints… I tried… once…"
    That good old Tom Scott Deep Lore there.

    • @pystalcrepsi
      @pystalcrepsi 3 года назад +1226

      Is that a reference to the pineapple thing from years ago?

    • @dannywhite648
      @dannywhite648 3 года назад +487

      it's on the monitor in the background

    • @1121494
      @1121494 3 года назад +69

      Pineapple, I guess.

    • @pystalcrepsi
      @pystalcrepsi 3 года назад +193

      @@dannywhite648 Oh, you're right! I didn't even notice that. Good catch.

    • @ashitmehta5000
      @ashitmehta5000 3 года назад +48

      Only the OGs know

  • @tomato3456
    @tomato3456 3 года назад +4780

    "What I learned was 'keep your mouth shut'" - Tom Scott, telling a secret to his 2.9 million subscribers

    • @theophrastusbombastus8019
      @theophrastusbombastus8019 3 года назад +302

      And the lesson I learned was not 'don't do it', it was 'snitches get stitches' - Tom Scott, on the run from the Police, circa 2021

    • @floydhebert3684
      @floydhebert3684 3 года назад +12

      And it’ll probably be seen by more than 2.9 Million people

    • @saccaed
      @saccaed 3 года назад +19

      That is the actual secret. Know when to keep your mouth shut.

    • @hotaru8309
      @hotaru8309 3 года назад +12

      @@theophrastusbombastus8019 If it's "snitches get stitches" that is learned, it's probably not the police that he's running from.
      Also, I'm picturing him running clutching his stomach running out that scenario.

    • @woodfur00
      @woodfur00 3 года назад +2

      @@hotaru8309 Have you been paying attention to the news lately?

  • @Pr3st0ne
    @Pr3st0ne 2 года назад +1494

    "Signatures can be forged" is an understatement. 99% of people who require a signature for anything have actually no idea what your signature looks like, and it's practically a formality.

    • @Dazlidorne
      @Dazlidorne 2 года назад +262

      Another bad thing about signatures is that yours changes over time. If they actually used them to verify identity, you could be denied even if it were you. I worried about this when I voted by mail in the last election. The signature on file with the election officials is from high school. My signature has changed drastically since then.

    • @sprazz8668
      @sprazz8668 2 года назад +203

      I can't even forge my own signature

    • @YingwuUsagiri
      @YingwuUsagiri 2 года назад +17

      Signatures and initials have moreso become a thing for those that are relevant, like when accepting a package from a delivery guy. If any of my neighbours go onto their app in case the delivery guy was too lazy to put in a card saying hey, it's dumped at this address they can see my NS with a squiggly line and know it's at my house.

    • @Pr3st0ne
      @Pr3st0ne 2 года назад +35

      @@YingwuUsagiri that's a ridiculously specific edge case and I wouldn't be able to tell you the signature/initials of half my neighbors

    • @roofogato
      @roofogato 2 года назад +5

      JOKES ON YOU MY SIGNATURE IS A LIL DOOFLE I MADE

  • @floridag8rfan
    @floridag8rfan 3 года назад +2421

    "No way to check that the President wasn't ... being coerced."
    I always assumed that there was not only a "correct" code on the Biscuit, but that there was also a coercion code, basically telling the recipient that "this source is compromised, disregard further signals from this source."

    • @YoutubeAdministrator
      @YoutubeAdministrator 3 года назад +792

      We had this at a safe in a store I worked. If you typed in a pin containing double zero it would open the safe but also send an alarm to the security company + the Police.

    • @ahreuwu
      @ahreuwu 3 года назад +477

      @@RUclipsAdministrator we told you not to tell anyone!

    • @inanjarif1388
      @inanjarif1388 3 года назад +204

      @@ahreuwu *laughs in robbery*

    • @pirobot668beta
      @pirobot668beta 3 года назад +130

      ANGRC series crypto-radios (1970's tech) had a similar thing; lots of operator sequences could lead to auto-destruct!
      Any one of a dozen combinations of control settings will release the magic smoke from all the transistors.
      Hell, using the damn thing while driving on a bumpy road could start auto-destruct!
      The paranoia around these things being compromised was intense!
      OK, memory being what it is, it likely wasn't AN/GRC that I was thinking about...

    • @YoutubeAdministrator
      @YoutubeAdministrator 3 года назад +24

      @@pirobot668beta sounds very cool. Wonder how much equipment we have of these killswitches in today.

  • @TheFarCobra
    @TheFarCobra 3 года назад +5904

    That truly is all we ever learn as children: Not “don’t do it” just “don’t get caught”

    • @magentamovie6520
      @magentamovie6520 3 года назад +43

      Exactly!

    • @precumming
      @precumming 3 года назад +292

      Or at least have a very good excuse for innocently doing wrong ready

    • @cauchyschwarz3295
      @cauchyschwarz3295 3 года назад +194

      I think that is the lesson that punishment entails. If you make someone suffer for doing something deemed wrong they just learn not to be caught.

    • @ayhamshaheed7740
      @ayhamshaheed7740 3 года назад +9

      I don’t quite get what you mean. We’re taught not to do ‘bad’ things are we not?

    • @pony_OwO
      @pony_OwO 3 года назад +101

      @@ayhamshaheed7740 It's what we are told but not what we learn.

  • @JonathanKayne
    @JonathanKayne 3 года назад +2706

    The great thing about computers: they do exactly what you say.
    The terrible thing about computers: they do EXACTLY what you say.

    • @billionai4871
      @billionai4871 3 года назад +262

      Computers are the second dumbest thing that computer scientist have to deal with on a daily basis

    • @asianxhispanic
      @asianxhispanic 3 года назад +1

      😳

    • @imveryangryitsnotbutter
      @imveryangryitsnotbutter 3 года назад +36

      @Bounze You had to explain the joke.

    • @deliriousjason8133
      @deliriousjason8133 3 года назад +58

      It's like a douchebag genie who takes your words too literally.

    • @mirjanbouma
      @mirjanbouma 3 года назад +17

      @Bounze the number one being the users was implied. You kind of killed the joke by explaining the punchline.

  • @ELVIStheDotA
    @ELVIStheDotA 3 года назад +1642

    "So the moral of the story is to not do the bad thing?"
    "No. The moral is to not tell people you did the bad thing."

    • @arvaneret_329
      @arvaneret_329 3 года назад +34

      But what's actually moral is to avoid doing the bad thing altogether.

    • @thekingoffailure9967
      @thekingoffailure9967 3 года назад +73

      I thought of a bad thing i'd done that I had kept a secret and almost used it as an example here like a dumbass

    • @Rx7man
      @Rx7man 3 года назад +20

      @@arvaneret_329 but is just knowing a teacher's password a "bad thing"?

    • @user-cq7ec7zf3g
      @user-cq7ec7zf3g 3 года назад +5

      Dont do the bad thing and if you be bad and did it do not be worst and dont tell anybody

    • @animationspace8550
      @animationspace8550 2 года назад +17

      @@arvaneret_329 "It isn't illegal if you don't get caught" - A friend of mine from middle school

  • @theCodyReeder
    @theCodyReeder 3 года назад +4601

    Haha! I remember that pineapple video!

  • @dliessmgg
    @dliessmgg 3 года назад +3831

    "computers can only do what you say, they can't do what you mean"
    i wish my parents would finally learn this

    • @soldier3079
      @soldier3079 3 года назад +21

      When i was watching the video (the last minutes) i scrolled to the comments and when i was reading it was synced with the video itself

    • @stargate525
      @stargate525 3 года назад +35

      @Squant Because parents (instead of grandparents) are now of the generation who learned that computers can't do what you mean. And now they're frustrated because the computers are BAD at guessing what they mean because we're used to being much more explicit than the average.

    • @bartonseagrave9605
      @bartonseagrave9605 3 года назад +5

      Didn't grandparents invent computers?

    • @stargate525
      @stargate525 3 года назад +58

      @@bartonseagrave9605 Their generation did. But that's like saying Werner Von Braun's generation built rockets, ergo everyone of that generation is a rocket scientist.

    • @Abcdefghijklmnopqrstuvwxyz1024
      @Abcdefghijklmnopqrstuvwxyz1024 Год назад

      Parents can't do either

  • @svleda9145
    @svleda9145 3 года назад +5174

    I swear Tom Scott is just that dude who can make you smile with a random fact any time

  • @gschaftla
    @gschaftla 3 года назад +288

    "Computers can only do what you say, they can't do what you mean" is probably my favorite quote now.

    • @zwenkwiel816
      @zwenkwiel816 2 года назад +16

      Damn computers just need to learn to listen better. I threaten mine with violence whenever it doesn't do what I want. Doesn't seem to accomplish much but it does make me feel better...

    • @sadthomas5067
      @sadthomas5067 2 года назад +5

      @@zwenkwiel816 Yes Mr.President, we found him do we launch the missile?

    • @Dranok1
      @Dranok1 2 года назад +3

      Many years ago my department manager had a poster behind her desk:
      I hate this damned computer,
      I wish that they would sell it;
      It never does quite what I want,
      but only what I tell it.

    • @SquareoftheLightOnes
      @SquareoftheLightOnes 2 года назад

      It should be "computers will only do what you or the manufacturers say." The ones who built the operating system also get a say in what your computer can and can't do, and the manufacturers have precedence over the end user... unless you have an open source operating system like linux, but why would you torture yourself like that?

    • @bikeny
      @bikeny 2 года назад +1

      @@zwenkwiel816 I'm hoping your computer isn't named HAL, otherwise you're going to be having some real problems.

  • @player1_fanatic
    @player1_fanatic 3 года назад +89

    This reminds me of the trope from movies, where all security uses just "one-factor" authentification. Either as a guessable password, an item that gets stolen, or a body part that got "hacked" and used as a key.
    I guess so many movie plots would not work if basic 2-factor authentification was in play.

    • @billyweed835
      @billyweed835 2 года назад +14

      Well, that, or it'd just make the movie longer for nor real reason.

    • @doomse150
      @doomse150 9 месяцев назад +5

      I can think of quite a few movie scenes that had people both swipe a card/chip and also enter a pin, so two-factor very much was in play. It makes gaining illegal access harder but certainly not impossible. The one exception are usually biometrics, which are often considered safe on their own.

  • @rilikespie
    @rilikespie 3 года назад +603

    "You can't exactly change it. I tried once."
    Ah yes, the classic Tom Scott Pineapple Scrub™

  • @zincer2
    @zincer2 3 года назад +2670

    "Some kind of nerd who wanted to learn something for fun" is probably the same kind of person as 90% of Tom's subscribers

  • @acoolgoose1782
    @acoolgoose1782 3 года назад +335

    we are so lucky of having people like you in youtube

  • @cocknballtorturer6839
    @cocknballtorturer6839 3 года назад +279

    You know he's still mad about getting in trouble in high school...
    We all have that one thing we did super long time ago that doesn't matter anymore but you still wish you didn't do it

    • @vonkaiser6817
      @vonkaiser6817 3 года назад +14

      One thing! my bloody list is in the hundreds, and I haven’t even finished school

    • @Rx7man
      @Rx7man 3 года назад +10

      trust me, as you get older, you'll regret more things that you didn't do than those you did!

    • @emeraldday4755
      @emeraldday4755 2 года назад

      I don't have any such thing

    • @maknyc1539
      @maknyc1539 2 года назад

      cough

  • @sawyer-m
    @sawyer-m 3 года назад +1389

    You Can't change your fingerprints... I tried once
    Pineapple flashbacks

    • @dhpz
      @dhpz 3 года назад +123

      3:27 look at the computer

    • @Tessa_Gr
      @Tessa_Gr 3 года назад +7

      @@dhpz Was this the reason that video was in my recommended? I was confused that I got such an old video recommended.

    • @dhpz
      @dhpz 3 года назад +13

      @@Tessa_Gr nah probably because a lot of people search for it after watching this video

    • @billionai4871
      @billionai4871 3 года назад +7

      @@dhpz well spotted

    • @wollinger
      @wollinger 3 года назад

      Try harder

  • @koxukoshu
    @koxukoshu 3 года назад +1990

    "You can't exactly change it, I tried once"
    *Glasses-wearing, Pineapple-consuming, Long-haired war flashbacks*

  • @Jessie_Helms
    @Jessie_Helms 3 года назад +63

    “You can’t change it... I tried once.”
    Aye, I get that reference

  • @changein3d
    @changein3d 3 года назад +93

    No rapid cuts, straight forward monologue, no music and minimal, informative graphics, that's why I love Tom's videos so much.

  • @maxresdefault_
    @maxresdefault_ 3 года назад +1101

    “I tried once”
    And we all learned that Pineapples are no good at fingerprint removal becuse of it

    • @sepehrrz2101
      @sepehrrz2101 3 года назад +35

      Even watching that video hurts me. It's too much pain.

    • @angela.luntian
      @angela.luntian 3 года назад +12

      They'll heal back no matter how you skin it

    • @Avistew
      @Avistew 3 года назад +19

      I have a friend who has tons of allergies. One of his allergies causes his fingerprints to momentarily disappear. Sadly, it's not an allergy to pineapple.

    • @Kriae
      @Kriae 3 года назад +13

      I watched that video a couple of weeks ago, but for him it's a distant memory from last decade. Feels weird

    • @TackyHarmonica
      @TackyHarmonica 3 года назад +1

      Sepehr Rz same, I don’t know why I could feel it despite never having done anything like that

  • @ondank
    @ondank 3 года назад +1048

    Three things:
    1. Tom Scott is a genius story teller.
    2. Whoever edits Toms videos is brilliant at their job
    3. Tom Scott considers hacking fraudsters, scammers and MLMs on the same level, and like with many other things, Tom Scott is right.

    • @vigilantcosmicpenguin8721
      @vigilantcosmicpenguin8721 3 года назад +22

      Ah, the editor, William Marler. His work on Tom's videos is always great.

    • @mparagames
      @mparagames 3 года назад +11

      "3. Tom Scott considers hacking fraudsters, scammers and MLMs on the same level, and like with many other things, Tom Scott is right." - Indeed.

  • @vhetti999
    @vhetti999 3 года назад +14

    When you were talking about shoulder surfing passwords with your teacher, I did the exact same thing and got in trouble because guess what - I told my peers. Lesson well learnt and you literally spoke through me with that statement.

  • @courtneyelizabeth2588
    @courtneyelizabeth2588 3 года назад +39

    tom's mild almost unnoticeable humor makes me laugh more than those over the top humorous stories

  • @retroace6717
    @retroace6717 3 года назад +837

    Tom: * Talking about Nuclear Weapons *
    *The Basics*

  • @logank
    @logank 3 года назад +1312

    Not gonna lie, in high school, I learned a teacher’s password. It logged us into faster, less filtered, WiFi. So I logged myself and all my buddies in. Never got caught!

    • @kousikaraveti9296
      @kousikaraveti9296 3 года назад +77

      hope your teacher doesn' see this comment
      Thank you for the likes

    • @cedricorine3673
      @cedricorine3673 3 года назад +12

      How did you know? Might try it when quarantine is over

    • @sanuki3579
      @sanuki3579 3 года назад +29

      I guess sharing the fact that you and they are doing something naughty is a good idea in order to not get caught cuz no one would tell to the teachers, which what went bad for sharing immaturely in Tom's case.

    • @ReptilianLepton
      @ReptilianLepton 3 года назад +121

      You may have actually been caught by IT... but that doesn't mean they *cared.*

    • @James-un8io
      @James-un8io 3 года назад +11

      Now that its online classes I use a emulator and a VPN and log into the webex meeting and then I blast out music just for fun during classes while it seems like I already logged in and using a PC due to which they won't suspect that I did it

  • @kyleyoung1960
    @kyleyoung1960 3 года назад +4

    I really love how composed your videos are. It's clear that you put a lot of work and planning into the words that you say, and it works absolute wonders for your videos. Great work!

  • @emozley7667
    @emozley7667 3 года назад +10

    3:28 Look at the PC in the background! The subtle Easter eggs like this are amazing

  • @Adrian-jn9ov
    @Adrian-jn9ov 3 года назад +522

    3:27 Oh god the Pineapple flashbacks

    • @marysiamilach8460
      @marysiamilach8460 3 года назад +10

      I laughed waaaay too loud xDD

    • @aprilhdunmoyer
      @aprilhdunmoyer 3 года назад +1

      What video?

    • @SoloJona
      @SoloJona 3 года назад +7

      Watching that video made me feel his pain in my fingertips

    • @derpinator4912
      @derpinator4912 3 года назад

      what vid

    • @odyseya
      @odyseya 3 года назад +15

      The fact that it appears on the computer screen in the background makes it so much better

  • @matthijsmelissen2469
    @matthijsmelissen2469 3 года назад +1269

    "The code you type in can be short, because they only last one minute each"
    That's actually not true... In fact it's one of the most common misunderstandings I encounter as a security tester! The fact that a code only lasts one minute is not going to help you against an attacker that tries to guess a lot of codes. If the attacker keeps guessing random codes (and the codes are short), the attacker is expected to hit the correct code quickly, even if the correct code changes every minute.
    What does allow for short codes is the fact that we can block the user's account after a couple of wrong tries. Passwords cannot be short, because we cannot block the user after a couple of wrong passwords. (Some sites do, but it allows someone nasty to lock the user out of his account by deliberately entering wrong passwords, so not a good idea). Multi-factor codes can be short, because they come after the user has already his entered his password - so it's not possible for anyone but the user to deliberately enter wrong 2FA codes. With one exception: when someone else obtained the user's password, in which case it's probably good we block the user's account.

    • @zockertwins
      @zockertwins 3 года назад +40

      good comment

    • @Brittow
      @Brittow 3 года назад +64

      "so it's not possible for anyone but the user to deliberately enter wrong 2FA codes". Except when somehow the Authenticator and the phone times are somehow not syncronized so you keep trying with the right code but in the wrong time

    • @Dogelition
      @Dogelition 3 года назад +7

      Also, not that it really matters, but the codes usually only last half a minute.

    • @runarandersen878
      @runarandersen878 3 года назад

      Thanks

    • @FnordOok
      @FnordOok 3 года назад +42

      @@Dogelition Kinda sorta. There's usually a grace period involved where you could put in the previous or next interval's code, just in case the clocks are slightly out of sync.

  • @gvjpersonal
    @gvjpersonal 3 года назад +3

    This video is a masterclass in story-telling and public speaking. Tom started off with Reagan and a tense situation with a nuclear crisis, hooking the listener/viewer. Told them all about how multi factor authentication works and concluded by giving closure to the original story, while also articulating the big takeaways and caveats.

  • @skyyyfx
    @skyyyfx 3 года назад +4

    Just wanna give props for doing this in a freaking one-take. Amazing work.

  • @Ginjitzu
    @Ginjitzu 3 года назад +217

    "Computers can't stop you from asking for terrible things."
    Quit looking at my search history Tom.

    • @smartroadbiker
      @smartroadbiker 3 года назад +10

      Too late it's been leaked on the 'net, I'm reading it now! ooooo did you really buy those?! Cheeky! Hehe 😇🤣

    • @thetabs57
      @thetabs57 3 года назад +2

      @@smartroadbiker women humor

    • @bashthefash420
      @bashthefash420 3 года назад +15

      @@thetabs57 incel humour

  • @jaretanderson
    @jaretanderson 3 года назад +212

    What I learned from this video: Tom was up to all sorts of mischief as a teenager

    • @sumanthvs_
      @sumanthvs_ 3 года назад +14

      Watch the earliest videos on this channel! You'll be surprised

    • @recklessroges
      @recklessroges 3 года назад +13

      If a teenager isn't up to mischief, then they are doing it wrong. (Just as long as they don't go from mischief to crime.)

    • @Sir_Bucket
      @Sir_Bucket 3 года назад +2

      I think Tom was the "hum actually" type of teen, who hated everything concerning the big data

  • @popfizz55
    @popfizz55 3 года назад +60

    So THIS is why i was getting recommendations for how pineapple doesn’t clean your fingerprints, the youtube algorithm is a strange thing

  • @Dazlidorne
    @Dazlidorne 2 года назад +5

    I used to have a debit card from my bank that had a digital display on the front that generated a six or seven digit number each time you pressed a button on it and that verified the card when using it online. It was so cool! I used to push the button and tell friends that the seven digit number was my bank account balance.

  • @dabeamer42
    @dabeamer42 3 года назад +144

    "they can't do what you mean" (7:42). When I was a young programmer, I was complaining about a stupid bug (of my own creation) that I was chasing, and my boss said "Oh, you forgot to put in the DOWHATIMEAN instruction", with a silly smile.
    Someday, maybe...

  • @Blazer02LS
    @Blazer02LS 3 года назад +3

    We had a similar security token system in one of my former jobs. They initialized the token when you were hired and passed the background checks. Then the token started generating codes. In use you had to have your name, the tokens 8 digit code number at the moment you were logging in (changed every minute) plus your employee number and the secondary password you set up with the IT department after you were hired. The codes also only worked if there was a specific card installed in the PC and it was on the companies network.

  • @CaptainCiph3r
    @CaptainCiph3r 2 года назад

    Your seemingly off the wall or historical story lead ins are the reason I watch this channel

  • @mikebliss3153
    @mikebliss3153 3 года назад +293

    "You can't change your fingerprints. I tried once."
    *Nam flashbacks to a Tom Scott video from over ten years ago.*

    • @cagedtigersteve
      @cagedtigersteve 2 года назад +2

      If you are not human...you can change your fingerprint.

    • @sanderdrack
      @sanderdrack 2 года назад +7

      @@cagedtigersteve i see that you are not one of the brightest

  • @fp-vb5zq
    @fp-vb5zq 3 года назад +822

    In today's episode: Tom Scotts's Editor Flexing his skills fpr 5 minutes straight

  • @Lilith571
    @Lilith571 3 года назад +1

    Tom is seriously one of a kind! I love your videos Tom.

  • @seeteasea5497
    @seeteasea5497 3 года назад

    I genuinely can’t decide what series Tom puts out is my favourite? Is it The Basics, or Things You Might Not Know or is it Amazing Places? I honestly have no idea which I love the most!

  • @thenamelessdragon
    @thenamelessdragon 3 года назад +372

    the shoulder-surfing of passwords is a mood. when i was in high school there was a password for the sign in system which was ridiculously short and simple. cos i was late all the time, i was around sometimes when the device wasn’t set up and once i saw the password a teacher typed in to set it up. i actually never used the power for evil, just to not have to ask for help when one of the two systems was logged out, but the moral of the story is that schools usually have bad passwords (this one was literally 3 characters and those were the initials of the school).

    • @DevinDTV
      @DevinDTV 3 года назад +34

      Think about it this way: the teacher (or whoever else) has to remember the password. Therefore the password has to be really simple, because chances are that teacher (or other staff member) is braindead.

    • @mistythecat3050
      @mistythecat3050 3 года назад +40

      In my primary school the admin username and password was “j”

    • @AlmostUselessPenguin
      @AlmostUselessPenguin 3 года назад +19

      @@DevinDTV Hopefully future generations will be technologically literate enough to be able to remember at least 2-3 good passwords. Also would be good to normalise long passwords and password managers and leave behind pointless password requirements like numbers, special characters or capitals.

    • @hamiltonianpathondodecahed5236
      @hamiltonianpathondodecahed5236 3 года назад +7

      my school had the telephone number as the password♪┌|∵|┘♪

    • @eDoc2020
      @eDoc2020 3 года назад +5

      My school used the same password for most of the non-personal accounts in Active Directory. Naturally, this was the name of the school. Fortunately for security, the Administrator passwords were (comparatively) more secure.

  • @neelgokhale644
    @neelgokhale644 3 года назад +174

    Tom the picture of the phone at 4:30 was really smart
    The video went live at 4PM, so if you watched it when it came out you were at that point at 16:04, the exact time on the phone
    This is why I love your vids

    • @magentamovie6520
      @magentamovie6520 3 года назад +6

      For me it's 11am ;-;

    • @deefdragon
      @deefdragon 3 года назад +12

      I totally didn't catch that. While timezones make it not a thing for a lot of places, for the UK timezone, its freaking brilliant.

    • @Ironhide1125
      @Ironhide1125 3 года назад +12

      These easter eggs will forever be loved

    • @Multibe150
      @Multibe150 3 года назад +6

      It says 16:05 at 5:00 :0

    • @Bion479
      @Bion479 3 года назад +4

      It also is 16:05 at the 5 minuite mark and has today's date correct

  • @kitsujitsu
    @kitsujitsu 2 года назад +4

    Such a good video. Clear, well explained and easily understood. I'm going to do some coaching for friends and family on online security and I think I might make them watch this!

  • @manjubeli
    @manjubeli Год назад

    No retakes no weird transition, Tom did all this in 1 go. Mind blowing!

  • @Canadian_Ice
    @Canadian_Ice 3 года назад +449

    "i tried once"
    too many pineapples were harmed in the making of this channel

    • @aloysiuskurnia7643
      @aloysiuskurnia7643 3 года назад +4

      exactly one (1) Tom Scott was harmed in the making of this context

  • @violetmcneill4705
    @violetmcneill4705 3 года назад +340

    1:54 'password: CORblimey1926' a true British gentleman

  • @RipVanFish09
    @RipVanFish09 6 месяцев назад +1

    I love the detail of when you referenced the pineapple video, the computer on the desk showed a clip of said video. Nice touch!

  • @honeydew75
    @honeydew75 3 года назад

    Tom makes me smile so much with all these facts, love you dude

  • @a1oilsauce123
    @a1oilsauce123 3 года назад +481

    instructions unclear, now launching a nuke while guessing what 12yr old me's favorite drink was

    • @sonicruled
      @sonicruled 3 года назад +16

      I lost old accounts before because I forgot the password for my email, and I couldnt pass the "change my password" authentication.

    • @Lilac_Dreams
      @Lilac_Dreams 3 года назад

      @@sonicruled Same

    • @Humulator
      @Humulator 2 года назад

      @@Lilac_Dreams that heppened to me and now i dont even know the email to it because i made a new one

  • @m.streicher8286
    @m.streicher8286 3 года назад +186

    Gets done telling us exiting story about cold war era*
    "Don't worry, I'll talk about your stupid mundane phone now."

  • @boahneelassmal
    @boahneelassmal 3 года назад +4

    5:25 ah, yes the RSA key chain SecurID. Those were the times when you got the little token generator out of the pocket, saw it has 3 bars left, hastily put it in, only for it to expire the moment you hit enter.

  • @revessombres7837
    @revessombres7837 3 года назад +12

    3:28 "I tried once"
    remember that video where tom scott applied pineapples on his fingers...

  • @rafael5465
    @rafael5465 3 года назад +290

    Why am I slowing down the video to read the flashing password ?
    "MakesSense!"

    • @calebturner007
      @calebturner007 3 года назад +10

      I was going to, but a bit too lazy

    • @manueloribe9153
      @manueloribe9153 3 года назад +13

      Wait, isn’t the pass COrblimey1926?

    • @thisrandomdude_
      @thisrandomdude_ 3 года назад +4

      Can someone provide the timestamp?

    • @bigkusa2568
      @bigkusa2568 3 года назад +4

      @@thisrandomdude_ 2:03

    • @nousername1888
      @nousername1888 3 года назад +4

      I didn't need to slow it down to read that it wasn't that fast
      Maybe it's because I already know the password

  • @MacadeAllen
    @MacadeAllen 3 года назад +361

    "And if your fingerprint gets leaked ... you can't exactly change it. I tried that once."

    • @KrisMcCool
      @KrisMcCool 3 года назад +43

      The pineapple thing?

    • @emmakjr3276
      @emmakjr3276 3 года назад +12

      @@KrisMcCool yup

    • @Steamtostay
      @Steamtostay 3 года назад +18

      I worked at a retail store a while back and we had a fingerprint scanner as part of the sign in system. Didn't work all that well if our fingerprints got papercuts or similar during a shift...

    • @istiompaxindica9676
      @istiompaxindica9676 3 года назад +14

      @@Steamtostay yea, That's really inconvenient, isn't it. I always thought "oh fingerprints and face recognition, best security system" and I think it is, until you got cuts and bruises on those body parts

    • @Cameron-hz9wc
      @Cameron-hz9wc 3 года назад +9

      Heck it doesn't even need to have a cut or bruise. A small droplet of water or at the wrong angle breaks it.
      Lemme tell you, as someone who is nearsighted, face ID is great unless you're in bed without glasses on and the phone is two inches away. Face recognition is great; forehead recognition needs work. XD

  • @elisam.r.9960
    @elisam.r.9960 7 месяцев назад +1

    The bit about sci-fi writers brainstorming systems that know when a person normally is logged into a device has been investigated by corporate IT teams for several years. I feel like flexible work/work from home has actually added complexity to this potential solution.

  • @detectivejonesw
    @detectivejonesw 3 года назад +36

    "I told someone else that I'd done it."
    "The lesson I learnt was don't tell anyone."
    Been there my friend, been there

  • @alexanderking8336
    @alexanderking8336 3 года назад +48

    3:28 "I tried once". Tom, it's a good thing you remember that. Cause we certainly won't let you forget.

    • @JessmanChicken86
      @JessmanChicken86 Год назад +1

      The lemon trick! Didn't work. I remember.

    • @GabRioBlu
      @GabRioBlu 9 месяцев назад +3

      ​@@JessmanChicken86wasnt it pineapples?

  • @bunothebrains
    @bunothebrains 3 года назад +314

    Tom: "If a spy gets your fingerprint, you can't change it, I tried it once."
    Me: *long haired Tom pineapple flashbacks*

    • @meher.
      @meher. 3 года назад +4

      Finally! Someone else got it

    • @hoihoi12250
      @hoihoi12250 3 года назад +3

      LONG HAIRED??

    • @mohamedmusamustafa3324
      @mohamedmusamustafa3324 3 года назад +5

      do you mean: flashbacks of RUclips algorithm being weird and recommending it to you five times over the past year

    • @meher.
      @meher. 3 года назад +3

      @@mohamedmusamustafa3324 not really but that could've been a possibility

    • @albertjackinson
      @albertjackinson 3 года назад

      @Buno the brains Can you explain that? I'm a relatively new subscriber.

  • @m1n3craftPCtut0r1al
    @m1n3craftPCtut0r1al 3 года назад

    I actually watched the video of you attempting to remove your fingerprints. When you did the joke at the end with the stove you genuinely got me, so good on you Tom

  • @taro2520
    @taro2520 2 года назад +1

    this makes incredible sense and the way he phrases it really clears up all my questions. im still too lazy to turn on 2fa

  • @benjamingeorge8241
    @benjamingeorge8241 3 года назад +19

    "Computers can only do what you say. They can't do what you mean, and they can't stop you from asking for terrible things.
    But at least they can be reasonably sure that it's you asking."
    ~ Tom Scott

  • @jbed6
    @jbed6 3 года назад +181

    "You can't exactly change it. I tried once."
    >pineapples still don't remove fingerprints.

  • @obinga5685
    @obinga5685 10 месяцев назад

    This is a great video. Actually watching it as part of my curriculum at uni right now in Sweden. Thanks mr. Scott!

  • @felixhaagen3724
    @felixhaagen3724 3 года назад +1

    I subscribed like 2 days ago and i think your content is amazing. You teach people not only usefull but coll and interesting things. Love your videos and if you sometime in the future decide to start a patreon or membership i will absolutely join in. Keep up the incredible work!

  • @derpimusmaximus8815
    @derpimusmaximus8815 3 года назад +26

    2:51 According to my mum, the 11th commandment is "thou shalt not get caught".

    • @whybob1930
      @whybob1930 3 года назад +4

      it's only a crime if you get caught

    • @professionalyeeter
      @professionalyeeter 11 месяцев назад

      @@whybob1930 engineer gaming

  • @garishanth
    @garishanth 3 года назад +45

    and streaming service like spotify, tidal, netflix don't have these.
    no wonder many of it's users (including me) complain about stolen accounts despite using separate emails and unique passwords.

    • @bananya6020
      @bananya6020 3 года назад +2

      my guess is that someone probably combined someone else's password with your username and added a few numbers and got lucky then. probably some kid trying to get a free spotify account tbh

  • @Richs_reef
    @Richs_reef 3 года назад

    Love your videos Tom, keep up the great work!

  • @avalonhamakei
    @avalonhamakei 3 года назад +2

    Very concise. Will you ever do a short video explaining the difference between identification and authentication? Sadly many people seem to think they're the same thing

  • @Vujnovic634
    @Vujnovic634 3 года назад +114

    3:27
    "I've tried"
    That video is 10 years old🤣

  • @dindings
    @dindings 3 года назад +14

    1:48 I want to add something to the list of authentication"something you didn't know". Like "where are your keys". It's something you don't know, it's something you don't have and it is something you are: me, the clumsy guy from Brooklyn

  • @nabeelmalik8025
    @nabeelmalik8025 3 года назад +13

    3:27
    I had flashbacks I wish I didn’t. I thought I was done with that era.

    • @Kitulous
      @Kitulous 3 года назад

      p i n e a p p l e

  • @rafazafar82
    @rafazafar82 3 года назад +1

    Great work, as always! You should do an entire episode on "Keep your mouth shut," because I'd love to see data on conviction rates resulting from bragging.

  • @hoangtran4736
    @hoangtran4736 3 года назад +79

    "I tried once"
    *flashbacks to tom trying to get rid of his fingerprints using pineapple and sandpaper*

  • @ToddHowar.d
    @ToddHowar.d 3 года назад +418

    “You spend most of your day telling a robot that you’re not a robot. Think about that for two minutes and tell me you don’t wanna walk into the ocean.”

    • @Don-ps2um
      @Don-ps2um 3 года назад +35

      Tod when is Elder Scrolls 6 coming out

    • @captainmemez3219
      @captainmemez3219 3 года назад +15

      You dork go back to the chess club

    • @laurinneff4304
      @laurinneff4304 3 года назад +2

      @@Don-ps2um after all the Skyrim ports are done. Or never.

    • @adojck
      @adojck 3 года назад +3

      Umm, I don’t wanna walk into the ocean..?

    • @jasondashney
      @jasondashney 3 года назад +20

      I'm a scuba diver. Walking into the ocean is as good as it gets.

  • @nii_amart
    @nii_amart 3 года назад

    This guy is so intelligent. Discovered this channel a while ago but I've learnt so much from his videos.

  • @thriceandonce
    @thriceandonce 3 года назад

    Briefly having the monitor in the background "play" the pineapple video when you talked about falling to remove your fingerprints was a nice touch!

  • @patiodoorman
    @patiodoorman 3 года назад +66

    For anyone wondering, the password at 1:55 is "CORblimey1926"

    • @kndr2094
      @kndr2094 3 года назад +10

      Keep your mouth shut $

  • @jevanking4768
    @jevanking4768 3 года назад +6

    Kind of cool that the time on the phone is 16:05 and that’s roughly the time this was uploaded and playing

  • @Sympli
    @Sympli 3 года назад +1

    this has nothing to do with this video but; Tom, you are an amazing person. the views, the information, the subjects, the research. Just everything is always so... you. impossible not to like, easy to understand, just very uhhhm stable, might be the right word. Keep it up with all the interesting work you have been doing these past 12 years on youtube and thank you for giving us a peek inside your mind.

    • @Sympli
      @Sympli 3 года назад

      Correct, always so correct, that was the word I was looking for.

  • @ColouredPenguins
    @ColouredPenguins 3 года назад

    your videos are always super interesting, love it.

  • @devindykstra
    @devindykstra 3 года назад +21

    It blows my mind that Tom Scott can somehow do this all in a single take. Mad respect

  • @Insert.Oregano
    @Insert.Oregano 3 года назад +49

    Summary:
    Keep your accounts secure with more than passwords alone, because passwords aren't safe from Tom Scott

  • @FifaGian21
    @FifaGian21 3 года назад

    This guy’s delivery is so good.

  • @Fenriswaffle
    @Fenriswaffle 2 года назад

    Rewatching this video is so delightful because after understanding other technologies and their issues, in so many places that people are too concerned with MitM attacks or intercepted data or hacked phones/servers when so *so SO* many instances of theft or fraud were perpetrated under circumstances an automated system would be incapable of understanding weren't legitimate. Its a salient point in how we design security and how it fits in with society and its incentive structure and how...its not always compatible, and that no amount of patching or improvement will resolve a more fundamental shortcoming if its never acknowledged.

  • @savethewhales7256
    @savethewhales7256 3 года назад +25

    3:27 a Tom Scott classic
    Edit: Right after i saw the video RUclips recommended the Tom Scott Pineapple Video. Scary.

    • @meetaverma8372
      @meetaverma8372 3 года назад

      Same 🤔🤔

    • @dragoncurveenthusiast
      @dragoncurveenthusiast 3 года назад +2

      That's because many people went back to watching it after this video. So the algorithm knows it's a popular follow up.
      Scary? Maybe. But not mysterious.

    • @savethewhales7256
      @savethewhales7256 3 года назад

      @@dragoncurveenthusiast oh, I See.

  • @PurplProto
    @PurplProto 3 года назад +16

    Yes yes yes! Thank you for encouraging people to take security more serious!
    And doing what you do best, giving some history and explaining it well.
    Love your videos Tom 🙂

  • @REVI7970
    @REVI7970 2 года назад

    i have just started watching this channel, really enjoying the content! thanks mate :)

  • @diamondflaw
    @diamondflaw 3 года назад +4

    We use hardware tokens at my work. They're great, but you definitely need reasonably strict timeouts for inactivity. Too many people just don't think that much about walking away from a computer while it's still logged into their account.

  • @rancidmarshmallow4468
    @rancidmarshmallow4468 3 года назад +148

    [tom]: hey, did you know, if you put your password in chat it censors it? see: *********
    [me]: MakesSense!

    • @crispoman
      @crispoman 3 года назад +19

      hunter2 jokes incoming in 3...2...1...

    • @Dekkia_
      @Dekkia_ 3 года назад +10

      hunter2
      Did it work?

    • @mnikhk
      @mnikhk 3 года назад +4

      Yes remember that 🤣 type your password Facebook/whatever app you're using has a secret function that will censor it

    • @Addsomehappy
      @Addsomehappy 3 года назад +8

      OralCumshot

    • @somerival930
      @somerival930 3 года назад +22

      Lemme try!
      dQw4w9WgXcQ

  • @animewow311
    @animewow311 3 года назад +28

    3:50 is something that is kind of already being done, Tom. Some companies are starting to use ML algorithms to track your keyboard and mouse behavioral patterns to identify that it is you that is inputting them. They usually use proceed to use phone identification when you fail that test.

    • @walale12
      @walale12 Год назад

      Yes, I've had 3D secure authentication ask for an SMS code, and then ask me to type my email address with the way I typed it apparently being a form of identification

    • @zakattack5863
      @zakattack5863 Год назад +1

      That’s just recaptcha

  • @maharaja87
    @maharaja87 3 года назад

    Really fantastic videos Tom! Thanks so much!!

  • @AcridDragoon
    @AcridDragoon 2 года назад

    "The lesson I learned was not 'don't do it', it was 'keep your mouth shut'". Best advice ever. The more you brag the more likely you get caught

  • @garbagebag185
    @garbagebag185 3 года назад +9

    I just can’t stop noticing that Commodore PET

  • @Azeria
    @Azeria 3 года назад +93

    Now if only Spotify would actually add 2FA, five years after it was feature requested...

    • @gaborsophie3347
      @gaborsophie3347 3 года назад +4

      I always get the feeling Spotify ignores features that are requested by the community anyways. For example, why can I still not download one single song?

    • @Sam-zq4yx
      @Sam-zq4yx 3 года назад +16

      Gabor Sophie You can download a single song...

    • @FeLiNe418
      @FeLiNe418 3 года назад +1

      just use a facebook account for spotify.

    • @FeLiNe418
      @FeLiNe418 3 года назад +1

      @@gaborsophie3347 What's wrong with adding the song to a playlist?

    • @jewishautisticnerd3874
      @jewishautisticnerd3874 2 года назад

      Even if 2FA didn’t suck why would you want it for Spotify

  • @vladislavkaras491
    @vladislavkaras491 2 года назад

    Thanks for the video, Tom!
    It was informative!

  • @jameshanleyinvesting2296
    @jameshanleyinvesting2296 3 года назад

    You're a legend, mate. Brilliant story teller 👍 Cheers