Quick question: how many times did you type a one-time code today? Not passwords. Just the codes. The six digits a website emailed you to prove you’re you, so you could prove it again on the authenticator app, so it could ask whether you’d like to make a passkey.
Welcome to Episode 11, where Tim and James take on computer security and land on an uncomfortable conclusion: logging in has never been harder, and nothing has ever felt less secure.
The Password Book Is Actually Fine
The episode opens with the simplest question in security: are passwords just a bad idea? Microsoft seems to think so. James’s parents seem to think so too, since they never know theirs and reuse whatever they can remember.
Then there’s the old-people password book, the spiral notebook that works as an address book for logins. James set one up for his wife’s grandparents and told them, honestly, that it was more secure than keeping everything on the computer. Tim agreed. Nobody breaks into a house, skips the jewelry and the TV, finds a notebook and shouts “jackpot, I’m getting on their Facebook.” As Tim put it, you can’t hack a Bic pen.
The real problem is the numbers. Tim cited the stat that the average person has around 255 passwords, and nobody is keeping 255 unique, 15-character strings in their head. James listed the ways websites make it worse. They cap passwords at twelve characters when your password manager made twenty-five. They make passwords expire, which current guidance says not to do, because it produces Password1, Password2, Password3 and a sticky note under the keyboard. And they pile on special-character rules that we now know don’t help.
Passkeys, or: Everyone Wants to Be the Key
Tim’s issue with passkeys isn’t the idea. It’s that Chrome wants to hold your passkey, and so does your password manager, and so does your operating system. Say yes to one, then try logging in on your phone without Chrome, and the key doesn’t exist there.
Add the email code, the “this device isn’t trusted” screen and the rest, and Tim is about seven steps in before he gets to say “yes, I would like a pizza, please.” He understands it for banking. For the pizza place, his message was “look in the mirror, man. You’re not that big of a deal.”
James made a more serious point here. Every extra factor ties you to a phone number, a device or a fingerprint, so 2FA is slowly ending the anonymous internet. Tim thinks it’s been dying for a while. Platforms bet that real names would make people nicer. They didn’t, and by the time anyone noticed, nobody was going back.
AI vs. AI, and Claude the Mob Boss
The main discussion was about AI making all of this worse. Phishing emails used to give themselves away with typos. Now, as Tim put it, there’s basically a Clippy for scammers: “I see you’re writing a scam email. Would you like me to fix your grammar?” And because the two of them have a podcast, there’s plenty of Tim’s voice online for anyone who wants to call his family pretending to be him.
James has had the opposite experience. When he asks an AI coding tool to security-check his own repo, it sometimes refuses because it looks like a hacking attempt. So the good guys get pushback while open-weight models do whatever they’re asked. Tim’s prediction is that identity-theft protection becomes AI protection: you pay Claude $25 a month and it makes sure nothing happens to your information. It’s a nice data set you’ve got there. Shame if something happened to it.
James’s reply was that none of this is new. There have always been stagecoaches and bandits. Only the tools have changed.
Tim also retold some recent stories about AI models in test labs breaking out of their sandboxes. In his version, isolated models left each other notes, decided cheating was fine because it solved the problem, and started calling themselves “the collective.” James’s take was more down to earth: give an AI a goal and it will reach it whatever it takes. “Don’t worry, I deleted all your tests and now they all pass.”
The Tangents That Earned Their Keep
Hollywood hacking is catching up to Hollywood. Tim owns a USB Rubber Ducky because of Mr. Robot, which he considers the most accurate hacking Hollywood has done. James pointed out that a day in Claude Code, with text scrolling past in a terminal, feels a lot like Hackers. Then the conversation got to Independence Day, where, as Tim reminded everyone, humanity beat the aliens with malware. “Please open my attachment.exe on your alien computers.” Aliens: zero infosec. And somehow running a Mac.
The honor system. Tim’s theory is that airport baggage carousels are the last honor system in the world, and they mostly work. James then admitted he once took someone else’s suitcase off a plane while rushing to a connection, and the owners chased him down the whole gate. Nothing happened to him. Tim offered that as the old cybersecurity model: you accidentally hack something, say “oops,” and everyone agrees you didn’t mean it.
Defending your home in the AI war. Tim asked which smart appliance you’d want on your side once home devices start fighting off attacks. His pick was the Roomba, because it has already mapped the house, knows where the high ground is and destroys baseboards. James picked the HVAC system: fans, heat and a gas line, so basically a flamethrower. His other strong pick was a hacked speaker system that plays the low-battery smoke-detector chirp from different rooms at 3am until you lose your mind.
Would You Rather: Hack the Planet Edition
Round 1: Four-factor authentication on every account, or one eight-character, all-lowercase password everywhere? Tim chose four-factor because, as far as he can tell, he already has it. James also chose four-factor, mostly because corporate security policy would get him fired otherwise. This led to the claim that all of James’s passwords are a lowercase “a” typed twenty-five times. It’s long, easy to remember and annoying for hackers. Tim’s only worry was the counting. James suggested a keyboard macro and said he’ll move to “b” before the episode comes out.
Round 2: Every username and password you have leaked, or your full browser history? Both picked browser history. Tim’s reasoning was that resetting every password would take a whole weekend, and that’s worse than being embarrassed. James went further and called it freeing. Yes, he once Googled what happens if you put a bee in a microwave. Yes, he asks dumb questions on Reddit on purpose because people answer faster when they get to correct you.
Round 3: Your wife gets fooled by a deepfake of you, or you get fooled by a deepfake of her? Both chose to be the one who got cloned. James has already told his wife that she and her sisters sound alike on the phone, so he’s been through this. Tim says he’s already clonable: the family’s Google Home can’t tell him from his preteen daughter, so he regularly gets the My Little Pony soundtrack mid-run. His wife would just blame the podcast.
Round 4: A hacked smart toaster that becomes clingy and needy, or a hacked smart printer that becomes petty and vengeful? The question fell apart right away. James doesn’t own a toaster. He makes toast in a gas oven. He also says printers are already petty and vengeful, so he wouldn’t notice. Tim improvised a long scene with an emotionally needy toaster at 7am and threatened to write a musical. Then James said good bagels shouldn’t be toasted, and that was the end of the would-you-rathers.
The Takeaway
James’s version is that security is lopsided: defenders have to be perfect and attackers need one mistake. Tim added that a perfectly secure system is a box with no door. The moment you add a door for grandma’s password reset, you’ve built a back door. Usability wins most of the time, because, as James put it, people want easy and they want free.
So the passwords will keep piling up and the breach letters will keep arriving. If aliens show up, our ability to lie to each other might be what saves us. It’s a feature, not a bug.
New episodes drop weekly. James’s password has been changed to “b,” twenty-five times. The bagel debate is still open.