Bob Lord 🔐 :donor:

Personal account where the owls are not what they seem.
🦉🏔️🏔️🪵☕🍩🥧🕵️‍♂️👍
Also:🔐🔑🔒💻

Website: https://www.ilord.com
Twitter: https://twitter.com/boblord

Last Notes

2026-02-09 14:46:01 UTC

The latest Hacklore newsletter is out. Be sure to subscribe!
Boost for reach! 🙏
https://buttondown.com/hacklore/archive/hacklore-the-valentines-day-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/041/204/022/784/669/original/22b79b9e6eaafd89.png

2026-01-05 19:42:00 UTC

I’m working on the next hacklore newsletter, and the holiday season delivered a fresh wave of peak hacklore! 🎁 😜
📬 If you want fewer security myths and more reality-based advice for everyday people (including ways for you to help!), subscribe here: https://www.hacklore.org/about

2025-12-25 16:33:27 UTC

- reply

It is!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/781/164/293/064/334/original/14b560f9c7edb1d4.jpeg

2025-12-25 16:22:48 UTC

- reply

If you get the chance to go to The Village, I recommend it. We stayed next to Number 2’s residence. Amazing.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/781/114/560/345/329/original/0dedae57ce874fb8.jpeg

2025-12-09 17:45:58 UTC

- reply

What are the best anti-scam resources I can link to? It's not the focus on Hacklore but I can make sure there is a smoother on ramp to good guidance.

2025-12-09 16:22:37 UTC

- reply

I posted some thoughts here:
https://medium.com/@boblord/methods-of-delivery-vs-intrusion-the-hacklore-edition-b042f51954a6
Feedback welcome!

2025-12-09 16:05:46 UTC

- reply

I made the edits to the references to "URLs". Thank you for that insight that got past all the proofreaders!!!!!
As for the other part about being able to determine the risk level for a site, well, that might be more of a challenge than copy editing. ;-) But fully agree.

2025-12-09 02:02:00 UTC

Does your cybersecurity awareness training contain any hacklore?
I’m collecting examples of hacklore in the wild. Whether it’s training slides, quiz questions, or instructions that focus on rare threats instead of the ones causing the most real-world harm, I want to see it all.
Post some screenshots or notes here, or email them to "info" at hacklore.org. Let’s help organizations replace stale guidance with advice that truly keeps people safe.

2025-12-02 00:53:55 UTC

Looking forward to the family's annual viewing of the two best Christmas movies: Three Days of the Condor, and The Conversation. 🕵️🎄

2025-11-28 15:02:52 UTC

🎅 ✈️ 🚃 🚗 How can friends and family can keep their online accounts secure during the holiday and travel season? This article does an outstanding job of explaining what really keeps accounts safe vs hacklore. 🙏
https://www.thetimes.com/article/cfd5f639-db6b-41f1-a583-d9adbf64bea3?shareToken=39c1ba3cdbc6dd583aa58c3d628751b8
More info: https://www.hacklore.org/ 🔐
📢 Spread the word! 📢

2025-06-14 18:42:14 UTC

"Create an image that summarizes what you know about me."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/683/185/267/987/966/original/a06371060b422036.png

2025-01-11 18:44:44 UTC

𝙏𝙧𝙚𝙖𝙩 𝙖𝙡𝙡 𝙣𝙚𝙩𝙬𝙤𝙧𝙠𝙨 𝙖𝙨 𝙝𝙤𝙨𝙩𝙞𝙡𝙚. This is no longer a paranoid theory, but today's objective reality.
Wired article on phone surveillance:
https://buff.ly/4jcAqEY
My case for encrypting all the things:
https://buff.ly/4iA9i25

2024-12-24 15:56:09 UTC

In light of the Crowdstrike outage over 5 months ago, what specific changes has your organization made to your enterprise security program? What changes to policies, procedures, training, alerting, testing, and your written IRP have you made? Please share!

2024-11-28 19:42:06 UTC

- reply

Why is our plan to train users to avoid the built-in dangers of software and software deployments instead of 𝘀𝗵𝗶𝗳𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗯𝘂𝗿𝗱𝗲𝗻 𝗼𝗳 𝘀𝘁𝗮𝘆𝗶𝗻𝗴 𝗰𝘆𝗯𝗲𝗿 𝘀𝗮𝗳𝗲 to those who can best affect change?

2024-11-28 19:42:06 UTC

- reply

1️⃣ How was the enterprise laptop fleet misconfigured to make this possible?
2️⃣ What products were so dangerous that a single click led to arbitrary code execution? (Think about the specific make/model of browser, mail client, OS, or other software.)
Now, here’s the real question: Why are we training and blaming users for these failures if the true issues lie in 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘂𝗻𝘀𝗮𝗳𝗲𝘁𝘆 and 𝗽𝗼𝗼𝗿 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲?

2024-11-28 19:42:05 UTC

“𝗔𝗹𝗹 𝗶𝘁 𝘁𝗮𝗸𝗲𝘀 𝗶𝘀 𝗼𝗻𝗲 𝗰𝗹𝗶𝗰𝗸”. How many times have you heard someone say that? How often have 𝙮𝙤𝙪 said it?
Take a step back and ask yourself if this is 𝘳𝘦𝘢𝘭𝘭𝘺 how the hacks happen in 2024. Just one click? Really? If that were true, we'd be asking these questions:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/562/283/178/955/968/original/1d15c9f28967f746.png

2024-11-17 04:31:05 UTC

Some thoughts on the quiet HTTPS revolution:
https://medium.com/@boblord/the-quiet-https-revolution-637a1c40ec6a
🔐
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/496/413/877/454/875/original/3cdfb2a383233404.png

2024-11-01 03:26:20 UTC

💡 Humble suggestion: When giving cybersecurity advice to non-security professionals, skip asking them to "consider" actions. The background knowledge needed to "consider" risks and responses takes years of understanding threats and tech failures.
Make the hard call—either tell them to do it or leave it out. Clear, direct guidance improves the chances that they will implement the advice.