Some popular security advice no longer matches how attacks work. In Inverted Podcast #26, Jeroen Kemperman, Dana Kaufman, and Dario Salice talk with Bob Lord, founder of Hacklore, about security folklore that wastes effort, confuses users, and creates a false sense of safety.
They dig into myths around public Wi-Fi, everyday VPN use, constant password changes, juice jacking, QR codes, and more. The episode also covers Secure by Design, using better data to drive security decisions, passkeys, and new myths forming around AI. For inverted product teams, clearing folklore matters because the wrong advice steers roadmaps and customer messaging away from real risk.
About the guest
Bob Lord is the founder of Hacklore. He previously served as CISO at Yahoo and held senior security leadership roles at Twitter. Through Hacklore he works to replace outdated cyber advice with guidance grounded in how modern attacks actually succeed. Learn more at hacklore.org.
Key takeaways
- Security guidance can outlive the threats it was written for and become folklore.
- Advice like blanket VPN use or constant password rotation often misallocates attention.
- Myths create false confidence and crowd out higher-impact controls.
- Passkeys and password managers beat ritual password change policies for many users.
- Sell and prioritize security with evidence and stories tied to real attacker behavior.
- Move security upstream with Secure by Design instead of piling tips onto end users.
Topics covered
- What Hacklore is and why security myths persist
- Public Wi-Fi and related folklore
- Juice jacking fears versus modern threat reality
- QR codes, VPNs, and everyday cyber advice
- Password changes, password managers, and passkeys
- Why bad advice harms users and security programs
- Selling security with stories and data
- AI-era myths already forming
Chapters
00:11 Welcome & Introduction
01:10 Meet Bob Lord and Hacklore
03:12 The Public Wi-Fi Myth
10:48 Juice Jacking and Security Folklore
15:57 QR Codes, VPNs, and Everyday Cyber Advice
20:36 Password Changes, Password Managers & Passkeys
26:32 Why Bad Security Advice Is Harmful
34:48 Selling Security Through Stories and Data
39:20 AI Security Myths in the Making
44:27 Final Thoughts: Move Security Upstream
Episode notes by topic (searchable excerpt)
These notes expand the public chapter list and takeaways from the episode page and YouTube listing. They are editorial summaries for search and skimming — not a full transcript or invented quotations.
Hacklore and why security myths persist
Bob Lord, founder of Hacklore and former Yahoo CISO (with senior security leadership experience at Twitter), joins Jeroen, Dana, and Dario to explain how popular security advice can outlive the threats it was written for and become folklore that wastes effort and creates false confidence.
Public Wi-Fi myths
A dedicated chapter challenges blanket fear of public Wi-Fi as the primary everyday risk narrative, and redirects attention toward threat models that better match how modern attacks actually succeed.
Juice jacking and related folklore
The discussion contrasts juice-jacking fears with current attacker economics, illustrating how vivid stories can crowd out higher-impact controls even when the underlying risk is rare for most users.
QR codes, VPNs, and everyday cyber advice
Chapters on QR codes and everyday VPN use argue that advice like blanket VPN use often misallocates attention relative to phishing, account takeover, and recovery weaknesses that inverted-product teams actually fight.
Password changes, password managers, and passkeys
On passwords, the episode favors password managers and passkeys over ritual constant password-change policies for many users — aligning user guidance with controls that reduce real account-compromise risk.
Secure by Design and selling security with evidence
Later segments cover why bad advice harms users and security programs, how to sell and prioritize security with stories and data tied to attacker behavior, AI-era myths already forming, and the closing push to move security upstream with Secure by Design instead of piling tips onto end users.
FAQ
Who should watch this episode?
Security professionals, CISOs, product marketers, PMs who write user-facing security guidance, and anyone tired of recycling advice that no longer matches the threat landscape.
What is Hacklore?
Hacklore is Bob Lord’s effort to document and debunk persistent cybersecurity myths so people and organizations focus on controls that actually reduce risk. More at hacklore.org.
How does this connect to inverted products?
Inverted products win when real harm drops, not when tip lists grow. Product and security teams need accurate threat models so features, defaults, and education target attacker economics instead of folklore.
Related on Inverted PM
- Podcast #27: How the World of Authentication Is Changing
- Podcast #23: Recovery
- Podcast #17: Bug bounty
- Meet the hosts
- All Inverted Podcast episodes
Connect with the hosts and guests on the video or on LinkedIn to continue the conversation.
🎧 Find the Inverted Podcast on LinkedIn, Spotify, YouTube, Amazon Music/Audible, iHeartRadio, or invertedpm.com.
Explore more
Browse all Inverted Podcast episodes, read the blog, or meet the hosts.
Related: Episode 25 – Product design for trust & safety · Episode 17 – Bug bounty