Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
SG Steve Gibson Steve Gibson Software developer and security researcher who founded Gibson Research Corporation, maker of the SpinRite disk maintenance and recovery utility and the ShieldsU...

“So much of our infrastructure has been put on the internet under the fragile assumption that the device's authentication front end is flawless. Unfortunately, now more than ever, flawless is what it needs to be. Yet we keep encountering example after example of readily bypassable mistakes in authentication. Authentication is hard. Apparently, it's impossibly hard.”

Security Now · Software Engineering & Infra · November 2026

“So much of our infrastructure has been put on the internet under the fragile assumption that the device's authentication front end is flawless. Unfortunately, now more than ever, flawless is what it needs to be. Yet we keep encountering example after example of readily bypassable mistakes in authentication. Authentication is hard. Apparently, it's impossibly hard.” — Steve Gibson, Security Now

Context

This closes Steve Gibson's coverage of attacks on internet-connected industrial refrigerators in France, and leads into the episode's main story: a long-hidden authentication bypass in OpenSSH on musl-based Linux.

Transcript

Security Now Around 1:26:48 into the episode
Steve Gibson

And, you know, it's like, now you do. Well,

Leo Laporte

you had journal control. You had syslog. You know, you were logging everything that happened on the machine, but that's not enough with these AI agents. They're little guys running around inside there and they're doing stuff. And you need to know what they're doing. Absolutely. On we go.

Steve Gibson

…systems, including systems in France. So this is the sort of story with the, as I said before, with the wide coverage that it received that will, let's hope, work to get other internet-connected device makers to re-examine their security or take their security more seriously or buy some compute from OpenAI. Fuck it if you have to to check the security of your devices before the bad guys do. So much of our infrastructure has been put on the internet under the fragile assumption that the device's authentication front end is flawless. Unfortunately, now more than ever, flawless is what it needs to be. Yet we keep encountering example after example of readily bypassable mistakes in authentication. Authentication is hard. Apparently, it's impossibly hard. And in fact, that's what today's main topic will be about. And as I said, it is a doozy, which we will get to shortly. First, Leo, we're going to take a break and then look at feedback from our listeners.

Leo Laporte

Indeed. All right. Well, thank you, Steve. Our show today brought to you by Delete Me. We actually use DeleteMe to protect our management from hacker emails. Your business invests in cybersecurity, I'm sure. That's why you listen to the show. But what about the personal information cyber criminals…

Steve Gibson

Okay, so Don Edwards writes, Dear Steve Gibson must take issue with the notion you discussed last week, episode 1103, about a web server behind the protection of the Cloudflare WAF, the web application firewall, being, quote, off the internet, unquote. Much like AV software, the WAF can only offer…

Leo Laporte

it to get out there. Wow. What

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from Security Now