019 - A Conversation with Luke Mulks from Brave Software

In this episode we're joined by Tony Daly, Managing Director of Seiber, for a deep dive into open-source intelligence (OSINT). Tony discussess what separates professional intelligence work from “spicy Googling,” how seemingly insignificant pieces of public information can expose identities and locations, and why good methodology, verification, proportionality and ethics matter. The conversation also covers digital footprints, social-media privacy, professional OSINT tools, dark-web investigations, AI and search, facial recognition, AI governance, and routes into a career in OSINT.

In this episode, we continue with a closer look at what cybersecurity competence actually means, and why qualifications, compliance frameworks, and public reputation are poor substitutes for understanding how real attacks work. We explore the cryptography behind Proton Mail, public and private keys, fingerprints, and what you can do with PGP word lists. We’ll also discuss passkeys, account recovery, SIM swaps, ClickFix malware, infostealers, VPN blocking, and the residential proxies that allow malicious traffic to hide behind ordinary household IP addresses. In this week’s episode: Hackers, threat actors, security influencers, and the risks created by confident but inaccurate advice Kerckhoffs’s principle: designing security under the assumption that the enemy knows the system How public and private keys work, including Proton Mail encryption, digital signatures, fingerprints, and independent key verification Using the PsySecure Workbench and PGP word lists to make cryptographic fingerprints easier to exchange and verify The problem with passkeys, and why weak account recovery can undermine their security ClickFix attacks that imitate Cloudflare verification pages and trick users into running malicious terminal commands How infostealers target browser data, authenticated sessions, cookies, passwords, and other valuable information Why VPN traffic is increasingly blocked or challenged while attackers move toward residential proxies that resemble legitimate users You are the proxy: How cheap smart home devices, streaming boxes, thermostats, and cameras, can become hidden residential proxies The normalization of identity verification, digital ID checks, and other invasive systems Show Links: The Hidden Backdoors Inside Millions of Smart Devices (WSJ): https://www.youtube.com/watch?v=apEPPKYgLL0 keys.openpgp.org: keys.openpgp.org PsySecure Workbench: https://psysecure.com/workbench An Investigative Framework for Auditing the Security & Privacy of Mobile VPNs: https://www.ndss-symposium.org/wp-content/uploads/2026-s1573-paper.pdf Matrix Community Rooms: Matrix Community Space: https://matrix.to/#/#psysecure:matrix.org Individual Room Links: https://matrix.to/#/#lockdown-intro:matrix.org https://matrix.to/#/#lockdown-podcast:matrix.org https://matrix.to/#/#lockdown-general:matrix.org How to check public key fingerprint from the command line: gpg --show-keys --with-fingerprint public_key_file.asc ★ Support the show on Patreon ★

Season 2 of The Lockdown is here, with a renewed focus on the overlap between privacy, security, and open-source intelligence. In this episode, Ray explains why reconnaissance should be treated as the first line of defense, not as the attacker’s free move. This episode lays out a practical way to think like a CISO in both your personal life and inside an organization. The core idea is simple: Minimize What Can Be Known, understand what you are protecting, and close the gap between having security controls and actually being protected by them. Why privacy and security should be treated as two sides of the same coin Reconnaissance, OSINT, and how attackers build a picture from public information Thinking like a CISO: threat modeling, risk, residual risk, and compensating controls Practical privacy choices, including GrapheneOS, browsers, VPNs, prepaid SIMs, and data brokers The control confidence gap, including SIM swaps, help desk attacks, security questions, and deepfakes Real-world examples of reconnaissance-driven attacks, including MGM, Caesars, Marks & Spencer, and ransomware extortion The updated OSINT Defense and Security Framework, plus practical homework for individuals and organizations Show Links OSINT Defense & Security Framework PDF Weekday executive security briefing email Matrix Community Rooms: • Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org Individual Room Links: • https://matrix.to/#/#lockdown-intro:matrix.org • https://matrix.to/#/#lockdown-podcast:matrix.org • https://matrix.to/#/#lockdown-general:matrix.org Support the show on Patreon ★ https://www.patreon.com/TheLockdown

In this final episode of The Lockdown, I reflect on the journey of the podcast, and explaining why I’m redirecting my energy to other projects. I discuss the importance of practical privacy measures, measures over an ‘all-or-nothing’ approach, as well as sharing my thoughts on threat modeling, and address several listener questions about privacy tools and self-hosting. I also introduce a new concept from my recent blog post about the “space between” in cybersecurity, examining how compartmentalization of identities can serve as an early warning system against social engineering attacks. In this week’s episode: Why this is the final episode The all-or-nothing fallacy Airport facial recognition and the Clearview AI threat Threat modeling for different life situations The CIA triad and why 100% security doesn’t exist UK and Swiss digital ID systems and their privacy implications NPM breach case study and the psychology of social engineering Why organizations should compartmentalize communication channels Listener Q&A: MySudo virtual cards, self-hosting setup, and mobile hotspots The new Privacy Tools page on PsySecure.com Matrix Community Rooms Matrix Community Space - https://matrix.to/#/#psysecure:matrix.org Individual Room Links: https://matrix.to/#/#lockdown-intro:matrix.org https://matrix.to/#/#lockdown-podcast:matrix.org https://matrix.to/#/#lockdown-general:matrix.org Show Links: Privacy Tools Page - https://psysecure.com/privacytools/ PsySecure ODSF Framework - https://odsf.psysecure.com "The Space Between" Blog Post - https://psysecure.com/ma-the-space-between-breaches Swiss E-ID System Information - https://www.bk.admin.ch Cyber Kill Chain (Lockheed Martin) - https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html Robert Cialdini's Principles of Persuasion - https://www.influenceatwork.com Daniel Kahneman's Thinking, Fast and Slow - https://www.amazon.com/Thinking-Fast-Slow-Daniel-Kahneman/dp/0374533555 “Nothing in life is as important as you think it is when you are thinking about it.”- Daniel Kahneman, Thinking, Fast and Slow

In this episode, I share news from my recent trip to the UK, noticing how it seems to have reached the epic proportions of a Black Mirror episode; from the absurd TV licensing program to the new Digital ID Brit cards that will track your behavior. I also explore how the UK may be serving as a testing ground for new levels of behavioral surveillance that could eventually spread globally. I dive into California’s $900 “smart” license plates that track your every move, centralized government digital currencies, and my predictions for the next 20 years of Orwellian surveillance. Support the show on Patreon!