Light

Episode #834 Quiz

Life: Hanging by a PIN
Date: 2021-08-31 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

The episode explains that credit freezes, not optional locks, are the free, federally mandated way to deny credit bureau queries, including Innovis. It details T-Mobile’s unencrypted breach and SIM-swap risk from stolen PINs, Exchange ProxyToken auth bypass via SecurityToken cookies, Windows 11 compatibility confusion, and SSD bait-and-switch NAND downgrades.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific change did Steve say he made to his password manager after reconsidering the T-Mobile breach?

Question 1

According to the episode, what specific change did Steve say he made to his password manager after reconsidering the T-Mobile breach?

He removed SMS-based account recovery He disabled two-factor authentication on the vault He replaced his master password with a recovery PIN He switched all account recovery to email-only verification

Question 2: What was the key reason Steve gave for urging T-Mobile subscribers to change their account PINs immediately?

Question 2

What was the key reason Steve gave for urging T-Mobile subscribers to change their account PINs immediately?

The breach exposed the PIN as part of the subscriber data T-Mobile began requiring longer PINs after the breach The carrier had announced a forced PIN reset for all customers The PIN was only needed for device unlock, not account recovery

Question 3: What two flaws in Exchange Server combined to make the ProxyToken attack possible, according to the episode?

Question 3

What two flaws in Exchange Server combined to make the ProxyToken attack possible, according to the episode?

A DNS rebinding issue and an unpatched TLS library A non-empty SecurityToken cookie bypass and an exposed canary token A weak password policy and an unsigned PowerShell script A malformed SMTP header and a stale cached login page

Question 4: What distinction did Steve make between Tailscale's open-source components and its non-open-source components?

Question 4

What distinction did Steve make between Tailscale's open-source components and its non-open-source components?

Only the daemon is open source, while the client code is proprietary The client code and daemon are open source, but the GUI wrappers are not The repository is open source, but all binaries are built from closed code Only the Android client is open source, while all desktop clients are closed

Question 5: In Steve's explanation, what does the IMSI represent in the cellular identity stack?

Question 5

In Steve's explanation, what does the IMSI represent in the cellular identity stack?

The immutable identifier burned into the handset hardware The subscriber identity that can move between SIMs and devices The carrier's internal code for a phone's port-out freeze The unique identifier printed on the outside of the SIM card

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.