Earlier this week, a commenter named Y. Woodman Brown posted his online passwords in the Washington Post comments section to show just how little his online security mattered to him. It was quickly picked up by the press as an example of online security hubris. Naturally, we had to find him. Alex talks to Y. Woodman Brown and the person who hijacked his Twitter account after the passwords were posted.
Here's a brief excerpt from our interview, although there's much more (including a chat with Brown's hacker) in the episode.
ALEX: Despite what happened, you seem to have not changed your mind about your password-sharing philosophy.
WOODY BROWN: In the olden days, nobody even locked their front doors, not in the neighborhood I grew up in. And the choice is either live behind the locked door or don’t. And for me freedom is choosing not to live behind the locked door.
You know, I think that the way that this story was told on an internet was sort of an idiot who posted his password and got his comeuppance. Does it bother you that that’s the way that that story was told?
I expect it. It’s the conventional view. I suppose I did get my comeuppance if you consider that somebody then walked into my accounts on Facebook and added an extra page that said “Boy are you stupid.” I don’t know. I’m inviting you in. I don’t think that some Russian mob guy that invents something like the Heartbleed bug is going to waste his time looking for my money. I think he’s after bigger fish to fry. I think what I’m risking is teenage pranks - “Hahaha, I tagged your account. And what does that amount to?
But you know, you exist online as Y. Woodman Brown, which is your real name. And when I found your name, I looked all over the internet, and I found comments by you and you gave people the keys to write on the internet as you. Weren’t you concerned about your reputation as Y. Woodman Brown?
Uh...no, I guess not. I guess not. I suppose if Y. Woodman Brown was actually somebody in this world, I might have thought twice. But since I’m just your average joe, that didn’t occur to me.
I’m actually curious, if you don’t mind telling me, I found your presence all over the internet, but there’s very little on it about you. It’s mostly you commenting on things. And I was curious who you are. Not, you know, your address, but where you live and sort of what you do.
I’m just a technical writer.
And what do you do with your free time? I’m so interested in the person who gave his passwords on a Washington Post comment thread. I just think that it takes a level of bravery that I couldn’t begin to muster.
I guess during most of life, I’m a low-risk guy. You won’t find me bungee jumping, and you won’t find me doing clips that show up on Tosh.O. Believe me, I’m not daring enough to try that stuff and risk a Tosh-worthy accident. I think I know what you mean about bravery. There was this movie that came out - I don’t know how old you would have been, how long ago was it? "Good Morning Vietnam.”
Oh, I remember that, it was from the late 80’s I think.
So the moment that defines the movie actually is there’s where Robin Williams is teaching English as a second language to a group of people. He’s talking to an elderly man, and he’s saying to this elderly man “I’m attacking you! I have a spoon and I’m attacking you with my spoon! What do you do?”
So he says, “I’m sitting here. I do nothing.”
And Robin Williams says, “Well I’m coming after you, I’ve got my spoon, I’m going for you, I’m about to kill you!” and the man said something like, “Then I am dying.”
What he’s saying is “I subscribe to peace. So if you truly have the incivility to attack me to the point of death, then what I’m doing is, I’m dying." Real bravery is staying to committed to your principles even if it means your own death. That’s quite extreme. I’m not sure that I’m that far along, but I understand the theory.
Wow. You took me on a real journey with that answer. Now comes the confession period of this discussion. The way I found your email address is that I actually reached out to the person who hijacked your twitter account.
Oh, that’s OK. You don’t get to be 53, and put your password on the Washington Post, and not expect that something is going to happen.