Passkey Phishing Attack Is Good News - DTNSB 5064

0:00Being a serious business owner takes hard work, patience, and a drive to keep moving forward. So it's important to find a serious business card that goes the extra mile. With the VentureX Business Card from Capital One, you earn unlimited double miles on every purchase. And with big purchasing power, you can spend more and earn more. This is your sign to take your business to the next level. The Capital One VentureX Business Card. What's in your wallet? Terms apply. See CapitalOne.com for details. Your team just added its 67th AI tool and also your 67th security blind spot. The good news? The Vanta agent works like a GRC engineer in the background, finding every app your team uses, scoring the risk, and drafting fixes for you.

0:41Vanta is the platform used by over 16 ,000 fast-moving companies like Ramp, Cursor, and Harvey, who are shaping the future with AI and staying ahead of AI risk. Get started at Vanta.com. In a world where AI is changing every role in every industry, knowing who actually has deep expertise matters more than ever. Upwork connects you with the highly skilled freelance professionals with proven track records, so you can hire with confidence. Upwork gives your business fast access to highly skilled specialists with deep expertise, so you can fill critical skill gaps, launch projects faster, and scale support up or down without committing to full-time headcount.

1:19With Business Plus, you can access the top 1 % of talent on Upwork. AI-powered shortlisting delivers a curated shortlist of top freelancers matched to your goals in under six hours. No endless searching required. Thousands of growing businesses already trust Upwork to hire highly skilled freelance professionals for everything from one-off projects to ongoing support. It's free to sign up, and posting a job is easy. Visit Upwork.com right now and post your job for free. That is Upwork.com to connect with top talent ready to help your business grow. That's U-P-W-O-R-K dot com, Upwork dot com. This episode is sponsored by HeyGen.

1:59AI is great at saving time, but only if it actually fits into your workflow. That's what makes HeyGen so compelling. Instead of spending hours setting up lights, cameras, and retakes, you can turn a script, photo, or presentation into a polished video of you in minutes. No production crew required. Whether you're a creator, consultant, attorney, financial advisor, or real estate agent, HeyGen helps you create consistent, professional video content without making content creation your full-time job. It's rated the number one AI video platform for small business on G2, features some of the industry's most realistic AI avatars, is trusted by more than 30 million people and 85 % of the Fortune 100, and supports over 175 languages, so you can communicate with audiences around the world.

2:42Here's the wild part. Record yourself for just 15 seconds, and HeyGen builds an AI avatar that makes professional videos for you on demand, so you can post everywhere your audience is, as yourself, without filming every time. Your first three videos are free at heygen.com slash pod. That's H-E-Y-G-E-N dot com slash P-O-D.

3:06This is the Daily Tech News for Monday, July 21st, 2025. We tell you what you need to know, follow up on context, and gosh darn it, try to help each other understand. Today, there's a hack on passkeys. We'll explain why it shows passkeys advantage over passwords, while also revealing a key weakness. I'm Tom Merritt. And I'm Rob Dunwood. Let's start with what you need to know with that big story. So, you may hear about a vulnerability in passkeys out there. It's a real story, but, you know, depending on who's reporting it, they might play up certain parts of it. And so we thought we'd start off by explaining what's going on, both the good and the bad.

3:44And the good news is this is not a vulnerability in passkeys itself. Passkey security has not been compromised. The bad news is that some clever actors have figured out a way to trick you into authorizing an account using your passkeys. So it's a phishing attack. We'll explain. Security company Expel observed the attack from threat actors. these are threat actors sometimes you might see them referred to as poison seed so it's actively being exploited the group is using the cross device authentication feature to fish people pass keys are encrypted and stored on your device they're behind biometric protection they are fishing resistant however to let you use a pass key stored on one device to log into another device, say you've got the passkey on your phone, but you want to log into your computer, a service provider can offer a couple of different ways.

4:41Now, the more secure way would be to do it by Bluetooth. And then Bluetooth sends the signal over Bluetooth directly from device to device with the passkey, you're logging in, being able to log you in on the other device. And that would never leave your device. So that would not be useful to the phisher. The other method and the more common method is a QR code that you scan with one device in order to send the signal that, hey, yes, that device is allowed to sign on with the passkey that's on this device. And that's the method that PoisonSeed is exploiting. So in order to exploit this, the attacker first has to get you to a fake site that looks like a legitimate login site.

5:23Maybe they're mimicking your corporate login site. Maybe it's a Microsoft 365 site, something like that. So if you avoid clicking on a fake link, you will not fall for this attack. But you know what? We're all human. We all click on links we shouldn't sometimes. So that's the vector for the attack. You, if you don't know this is a fake site, enter your login ID like normal. And then the fake site uses that to start the login process on the legitimate site. You don't see that, but it's doing that in the background. It asks the legitimate site to use the cross-device authentication. and then the legit site will provide it with a QR code, which the attacking site takes and displays to you, the end user.

6:06If you scan that QR code and authorize the login on your device, the attacker gets authorization to log in because it's the one that actually asked for that QR code. So what do we do about this? Well, on the side of the sites providing the login, Expel recommends the following, limit geographic locations of logins and create a system for travelers to be able to log in. That way, if the attacker is in, I don't know, Dubai, and you're in San Francisco, it can go, wait a minute, why is this login that usually comes from San Francisco coming from Dubai? And if you travel to Dubai, you can say, hey, I'm traveling to Dubai to your corporate site, whatever.

6:42You can also routinely check on common security key brands and locations in case they were able to mimic you somehow. And then, of course, the obvious one would be limit cross-device logins to Bluetooth authentication. You, as a user, just need to follow the normal advice about clicking links for logging in, checking the URLs are legitimate. And also, if you're not expecting cross-device login, like if you're not logging in on a computer and you know the passkey's on your phone, if you know the passkey's on your computer and you get a QR code, well, then be suspicious. Something's up. Rob, you got any other thoughts on this?

7:18Yeah, it's a bummer. I mean, have we thought about just telling threat actors, just stop it. just stop doing this to make it easier on us. Can you just cut it out please? Enough is enough. Just cut it out. But here's the thing, we really have to start thinking about accessing links to get to a log on site in the same way that we would have a bank call us and then ask us for information. If a bank ever calls you, they know who you are. They don't need your login. They don't need your password. They don't need any of this. You don't even want, you know, Sometimes if it's a malicious person, they only say, well, just call us back at this number and you can verify that way you're calling us.

7:58You don't even want to do that because they gave you the number. We have to kind of think about all links this way. We should just never, ever click on something that takes us to a place where we're logging into something that we care about. That just has to get socialized out there because, as you said, that will absolutely shut this down. It takes this man-in-the-middle attack essentially to make this happen. You've got to go to a fake site for this to work. if you never go to the fake site, you are ultimately going to be relatively safe from this. Yeah. And then, you know, like we said, if you never use cross-device login, then you wouldn't be victim to this because if it presented you with one, you're like, I don't do that.

8:37Maybe you keep your pass keys in a vault, like 1Password or something like that. But then, of course, that limits the flexibility of this. Again, you have to rely on your site to support the Bluetooth method, but you can choose to use that all the time if that's available to you. I'm with you though. It is disappointing that we have gotten to the point where it's like, oh man, even passkey, we can't just not think about yet. Although I would like to point out that the password multi-factor authentication method that the passkey is meant to replace is rife with multiple, like hundreds of versions of this that are easier to implement for the attacker.

9:20So this is a more difficult and a more narrow one. So passkeys have made an advance and they are better than having a password because the password's stored on a remote server that they can access. And it's easier to phish you because you don't have to go through all of the jumping through hoops to show a QR code and trick you into putting that. If you go to the login site that's fake and you put in your login and your password and your multi-factor authentication, you've been phished. You've been hacked at that point. So it's much easier to do this with passwords. I guess it shows how popular passkeys are that threat actors are like, well, we got to figure out a way to get at people who use passkeys now.

10:03As long as it's beneficial to them to get into stuff they're going to figure out a way and this is one of those ones where pass keys are still infinitely more secure than passwords we just have to be careful don't click a link to go to your log on page just go just just know your log on page have a bookmark on your device that will take you to it that was given to you by you know by your organization don't just click on an email link or anything like that that'll take you to a login page and then log in because that's ultimately where we will run into problems with this. And listen, if you're like, oh, I've done that before, forgive yourself.

10:39None of us are perfect. We all have those moments, but do what you can to remind yourself and limit that as close to zero as possible. And that's going to help. One of the things that a lot of companies already have in place, and it was illustrated here in this article, is that the company that you're trying to log into, if they don't recognize the IP address that you're coming from, it looks like this is not a regular thing. They'll just stop you. They might make you jump through an additional hoop, but how often are you in Dubai logging in? If that is, if that's like a once every four or five year thing, then jump through the hoop.

11:13So I think that that, you know, will help a lot of organizations with this by just, if you don't recognize the, the, you know, the IP address, make them do some additional things to check just to get, you know, to get around this. But at the end of the day, just don't click on links to go to log on pages. Do your best. DTNS is made possible by you, the listener. Thanks to Philip Less, Howard Yermich, John Atwood, and Dr. X1728. Yay. Thank you, patrons. Episode prep gets messy when research, Slack threads, and script trackers are all in different places. That's where ChatGPT work comes in. Give it the goal and connect to the tools where work happens, like apps and files, and it can help pull the pieces into a draft you can review without you having to re-explain the project at every step.

12:02For example, ChatGPT work can gather team feedback from Slack and use it to suggest updates to a project brief in Google Docs. You stay in control reviewing the draft and deciding what moves forward. Put ChatGPT to work on your most ambitious ideas and projects. Get started at chatgpt.com by selecting work mode. Available on Plus and Pro plans. This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love.

12:45It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. One second, you're enjoying your day off. The next, your phone buzzes. A window's been broken at home. You're miles away. In one second, everything can change. That's why ADT's security systems can monitor your home 24-7. They're backed by the most company-operated monitoring centers in the industry, so you're always supported during an emergency. When every second counts, count on ADT. Visit ADT.com to learn more.

13:22There are moments that reveal who we are and who we're meant to become. For those born to lead, such moments call for a vehicle of equal distinction. Dynamic by design, uncompromising in execution, the Range Rover Sport was engineered for those rare individuals who demand the world and possess the conviction to claim it. When your time to lead arrives, you need a vehicle that rises to meet it. The Range Rover Sport. Exclusive offers available now. Explore further at rangerover.com. Hi, this is Kim and Penn Holderness from the Laugh Lines podcast. This episode is sponsored by Oli, your wellness partner for back to school and beyond.

13:59Back to school season is here. Packed backpacks, packed lunches, and packed schedules are officially back. Oli Kids Sleep helps little dreamers wind down with a gentle blend of melatonin, L-theanine, and botanicals for restful sleep. Translation, an easy way to put those school night negotiations to bed. And for the grown-ups, Ollie's Sleep helps you fall asleep, stay asleep, and wake up feeling refreshed. Because as you know, the morning mayhem comes early. Visit ollie.com and stock up on back-to-school must-haves today. That's O-L-L-Y dot com. These statements have not been evaluated by the Food and Drug Administration, this product is not intended to diagnose, treat, cure, or prevent any disease.

14:45There's more we need to know today. Let's get to the briefs. Low latency, low loss, scalable throughput, or L4S, is a mobile internet technology that prioritizes latency-sensitive packets like video calls and cloud games to reduce buffering and stuttering. L4S marks packets that experience congestion, and then software on your device can make adjustments to reduce the congestion. T-Mobile US is expanding its use of the technology on its 5G advanced service. Nokia and Vodafone conducted the first trial of L4S last year. Singapore's Sintel has been using it as well. And T-Mobile and Comcast have been deploying it in the US.

15:20And users don't need to do anything as the protocol is network-driven. NVIDIA's GeForce Now cloud gaming service is one of the several companies that support it. Yeah, you do need the company to support it, but you don't need to do anything. And it's in the company's interest to support this because it's going to work better and you're going to be more likely to use their service. And I know T-Mobile is getting the news today because they're expanding their access in the U.S. But I looked it up and Verizon, Vodafone, you know, or most of the the major carriers out there are implementing this and will implement it over the next couple of years.

15:55This is this is a great story where you don't have to do anything. it's just going to improve your service. Yeah, T-Mobile is definitely getting a headline because they're making news about it, but everybody's kind of working on it. And it will just be better for us as consumers once this gets rolled out across the board. I guess if you're comparing with somebody like, hey, how come your FaceTime calls never stutter the way mine do? It's not just coverage. It could be L4S implementation. Hasn't come to your carrier yet. Microsoft SharePoint is used by many companies for internal organizations.

16:27things like intranets, company cloud, document sharing, all of that sort of thing. Attackers are actively exploiting two vulnerabilities and are targeting companies that host their own SharePoint servers on-premises. These do not affect companies that use SharePoint online hosted by Microsoft. That is an important point. You may not know which one your company uses, but if you're a sysadmin, you probably do. And if you're not hosting on-prem, you're okay for now. Now, one vulnerability lets unauthorized actors execute code in the on-premise Microsoft SharePoint server. A second vulnerability lets an attacker perform spoofing over the network.

17:08You don't want either one of those things. Microsoft has issued patches for the vulnerabilities for users of SharePoint subscription edition and SharePoint 2019. And a patch for SharePoint 2016 is in the works. Microsoft also recommends that customers turn on and configure anti-malware scan interface. or AMSI. So I want to be very clear here because a lot of times people hear on-prem and they think, oh, that means we're running it in our own data center somewhere, maybe in our building. On-prem here also means if you're running it in a VM. So if you're not running this in Microsoft 365 Cloud, if you're running this in Amazon, if you're running this on Google, even if you're running this in your own tenant on Azure and it's not managed by Microsoft, that is still considered on-prem.

17:54So you want to be careful with that. This includes VMs as well. That's a really good point. Thank you for explaining that. Because yeah, I think when people think on-prem, they're like, so here in the office building, right? And it's got a more amorphous description there. The first of Meta's Oakley version of the smart glasses are shipping and the reviews are out. On the surface, these do the same things as the Ray-Ban versions do. Capture images and video and answer your questions using Meta AI, ZDNet found the Oakley designed to be more comfortable, even though they weigh the same 49 grams as the Ray-Bans do.

18:27I personally like how the Oakley ones look a little bit more, but that's just a personal preference. The Oakley charging case is bulkier, but it offers 48 hours of charges versus Ray-Bans cases, 32 hours. The Ray-Bans start at$240. So there are a bargain compared to the Oakleys. Oakley HTSN limited editions are$499. The$399 Oakleys don't ship until later this year. So like I said, I do like how the Oakleys look a little better, but I am a little bit disappointed because I thought I was going to get the Oakleys that like all the athletes wear, like the ones that the baseball players are wearing.

18:58And just that one big lens, it's almost like a visor that goes across the whole front of your face. I thought that's what we were going to be getting when I heard that these were coming out until we saw the pictures. But I do personally like how these Oakley ones look a little bit more than the Ray-Bans. Yeah, I'm the same way. I think I like Ray-Bans for day-to-day use, but Oakleys are good for outdoor use, and that kind of bears out how this works. So I have the original Ray-Ban metas, and let me tell you, the battery life is limited. You only can do 30 seconds. These second-generation Ray-Bans are so much better, and I've been wanting to upgrade, but I've been holding off because I kind of wanted to see the Oakleys.

19:38But I think I might wait for the$399 Oakleys later this year because they get a few more styles to choose from then. Yeah, and I wanted them as sunglasses too. So if I got to wait until later in the year, am I going to be wearing sunglasses in the wintertime? I'm not a snow-type sports person, so I know folks will wear them for that. Sure. It's dark where I'm at in the wintertime, so I don't know how to be wearing the sunglasses. two senior officials in the uk government told the financial times that the uk home office is trying to figure out a way to back down on its demand that apple provide a way for the government to access secure communications if you remember back in february apple removed the option for advanced device protection in the uk apple's advanced data protection or adp is the option that lets you protect your iCloud access with end-to-end encryption that's different than end-to-end encryption and I'm in messaging.

20:29Messaging still has end-to-end encryption in the UK. And ADP can apply to messages you store in the cloud, but this is simply saying Apple doesn't hold the key to my iCloud. So that is ADP, ADP not being offered in the UK. If you use cloud to store things, Apple holds the key, which means the UK government could go theoretically at some point and ask for your key. Apple has filed a legal challenge against the order that makes them do that. Meta has actually joined that case. And at the moment, the case is still proceeding at the Investigatory Powers Tribunal. So it's not that they have backed down.

21:07It's that the Financial Times found some sources that are like, yeah, we need to figure out a way to back down, but we haven't figured it out yet. Yeah. I've said when we first heard about this, it's like, okay, okay, we're going to get rid of ADP. We're not giving you a backdoor. We're just going to be like, nah, we're good. Your move, Europe. UK, yeah. That's not something that Apple is going to do. So I think that they absolutely are trying to figure out, okay, how can we get out of this and maybe save a little bit of face? Because Apple, I don't see them ever acquiescing to this. The financial time sources are positioning this as a reaction to pressure from the United States, which is probably true, but I imagine there's some internal pressure as well.

21:51There are probably high-level people within the UK who are like, wait, I can't use ADP. I need ADP. Like, I am a target of foreign governments. I am a target of this. I don't want weakened security. I want the most security I can get. And they're not even worried about the UK government. They're just worried about the fact that that key isn't as safe as they can get it, and they want it to be as safe as they can get it. And the rest of the world has the ability to do this, just not the UK. The latest beta version of WhatsApp for Windows is a major change, basically going from a native Windows app to a wrapper for the WhatsApp web version through Microsoft Edge's WebView2 tech.

22:29The new version has a simplified UI for settings, including WhatsApp channels and more status and communities features. It also uses more RAM. Yeah, that might be the only thing most people recognize. Like, this thing seems to be checking up more on my computer these days. But I think power users will notice this, you know, but it's easier to maintain for WhatsApp because they've just got the web code now. Well, here's the thing. Here's the thing. Meta is actually saying that the web version is less functional than the desktop versions for both Apple and for Windows. So that's not going to make power users happy at all to actually, hey, throw your troubles because we want to make it easier on us.

23:10We're going to make it less functional for you. That generally does not go down well. No, it doesn't. At the 2025 RISC-V Summit in Shanghai, NVIDIA announced support for the RISC-V instruction set in its CUDA platform. If you know, you know. This means the open source chips can be used alongside NVIDIA's CUDA-based systems the way ARM and x86 chips are now. And if you need it in even simpler terms, It means RISC-V chips in the data center at some point, like not tomorrow, but now possible. So expect some Chinese companies that have limited access to NVIDIA's other tech to explore this. And another thing that Tom's Hardware pointed out was people who make embedded systems might be willing to try this out for the cost saving.

23:53Reuters reports that it's been seeing documents indicating that Chinese E-makers Neta and Zeker inflated sales in recent years. The companies issued cars before they were sold, which let them report them as sales under Chinese regulations. Neta did this for 64 ,719 of its 117 ,000 reported sales between January 2023 and March 2024. Chinese state media also reported this story and indicated that the government is investigating the companies and called for the practice to end. This is not great news for the EV industry as a whole, as Wired has a story about several EV models being canceled by Honda, Nissan, Ford, and others.

24:30Yeah, yeah. A couple of stories here, you know, not great for the EV market, but this insured story in particular, Netta and Zika are not disobeying the law. There are two different numbers they report. There's a wholesale number and there's a retail number. And if they insure a car, they're actually, I think, required to report that as a sale. However, what it looks like is that Netta was ensuring every car it could so it could report it as a sale. Zeker is trying to say they were just ensuring cars that were display models in showrooms and therefore had to report them as sales, but they weren't trying to juice the numbers.

25:12And maybe that's true. Maybe it's not. Zeker's numbers were not nearly as inflated as Netta's were. I mean, 64 ,719 to 117 ,000. I'm not a massive aunt, but I'm pretty sure that's like half. Yeah. So, you know, over half. I don't know. Maybe this falls into the alternative accounting practice. Yeah. No, Netta was clearly manipulating this. Maybe Zeker wasn't, but Netta was. In fact, there were some stories in this Reuters report that customers were being told that they had insurance on their car when they bought it and were kind of surprised. Like, oh, OK. but then the insurance would expire like after a month because they had insured the car long before it went on sale.

25:54So yeah. It seems like they would know if you only do that month the month insurance, that's really expensive. Yeah. For the car company. I don't think that was the number that they were trying to be concerned about. No, definitely not. Microsoft rolling out updates to its Windows and console Xbox apps to show cloud-based gameplay in your recently played titles. So they can show in your library and let you access game saves as well. This is handy if you play a game on your console, but it's not available on PC. Your Windows app can still show it in your library and therefore you can play it through Xbox Cloud Gaming on Windows.

26:30It will show the other way as well on your console, but PC games aren't playable on console yet, but they might be. That might be in the office. I cannot wait for that day. It can't come soon enough. and pokemon presents will stream at 9 a.m eastern on tuesday july 22nd kotaku reports that joe merrick of serabi noticed the korean pokemon youtube channel let slip that the announcement will be 24 minutes long that's not the longest but on the longer side and kotaku notes that the stream was announced in may a lot further ahead of the usual time yeah i even serabi was like people are going to make a big deal out of 24 minutes but here's the lengths of all the previous streams and there's some that have been longer in the past.

27:14But I think what Kotaku was trying to say is like, there's a lot of signs pointing to them having more interesting announcements coming up. So good to know. If you have feedback about anything that gets brought up on the show, you can get in touch with us on social networks. We are at DTNS show on X, Instagram threads, Blue Sky and Mastodon. If you're on TikTok and YouTube, you can find us at Daily Tech News Show.

27:42This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. Your team just added its 67th AI tool and also your 67th security blind spot. The good news? The Vanta agent works like a GRC engineer in the background, finding every app your team uses, scoring the risk, and drafting fixes for you.

28:26Vanta is the platform used by over 16 ,000 fast-moving companies like Ramp, Cursor, and Harvey, who are shaping the future with AI and staying ahead of AI risk. Get started at Vanta.com.

28:42We, in every episode of DTNAS, with some shared wisdom. Today, a loyal patron shares insight about their university's challenges with students and faculty using AI. Yeah, they wrote, I currently work in the area of student conduct at a major university, so I have a more boots-on-the-ground view of the current situation. Our office partners with faculty to investigate and adjudicate allegations of all forms of academic misconduct, including misuse of generative AI. We are seeing students using AI in ways we have not prepared for and that we cannot fully address via written policies. One newer example is students feeding course materials into ChatGPT or Gemini and prompting it to make a study guide.

29:25They say the study guide is more manageable than 15 weeks worth of slides, syllabi, lecture notes, and so on. The problem there is that the model sometimes spits out incorrect summaries or information and the student is not able to recognize when that occurs. resulting in some very odd answers that they are unable to explain on exams. An example on the faculty side of things would be faculty sometimes upload student documents to AI checkers, which are notoriously unreliable, then file a report with our office based on those outcomes. In both of these cases, individuals are uploading academic works that are not their own into LLMs or other databases, which creates an additional layer of concern beyond the possible misuse in general.

30:08I feel for educational systems over this type of stuff because AI is coming so fast. And in one of these cases here, I'm thinking it would be really cool to just load up your syllabi into like notebook LM to make a study guide. You're not trying to cheat. You're just trying to study more effectively with what was given to you. And that's still problematic. And then, of course, I would not want to be on the end of being told that something that I actually wrote myself indeed looked like AI. because AI said it looked like AI. We know we can't trust AI. So yeah, I really do feel for the educational system from the lowest levels to the highest levels because this stuff is coming faster than they can adapt to it.

30:50Yeah, and they will adapt, but it's gonna be overwhelming like our loyal patron here is saying for a long time. And you can look at any one of these given examples and say like, oh, well, one solution could be the professor should do the summary and make sure it's correct. And then that way the students get a summary. And maybe that's a great idea. Maybe some professors will do that. But that solves one example, right? There's all kinds of other examples that were not cited here. It's that there's tons of unanticipated uses here. And until this all shakes out and until LLMs hit that top of the hype curve, where we kind of just know what they're good for, we're going to keep having unusual uses of them.

31:37Well, folks, what are you thinking about? We'd love to know. If you've got some insights into a story, share it with us at feedback at dailytechnewsshow.com. Big thanks to our loyal patron for contributing to today's show. Thank you for being along for Daily Tech News Show. You can keep us in business. Just become a patron. If you haven't already, go check it out. Lots of perks available at patreon.com slash DTNS. I'll talk to you soon.

32:06The DT &S family of podcasts. Helping each other understand. Diamond Club hopes you have enjoyed this broker.

32:20With the Spark Cash Plus card from Capital One, you earn unlimited 2 % cash back on every purchase. And you get big purchasing power, so your business can spend more and earn more. Steven, Brandon, and Bruno, the business owners of SandCloud, reinvested their 2 % cash back to help build the company's retail presence. Capital One, what's in your wallet? Find out more at CapitalOne.com slash Spark Cash Plus. Terms apply. Hey guys, it's Drew from the comment section. Some days my skin just needs a little coverage and other days I want to go full glam. For those everyday moments like running errands or grabbing coffee, I've been loving the Merit Minimalist Stick because it's a foundation and concealer in one that gives me a really natural skin-like finish.

33:03But when I want more coverage, I'm reaching for the Hourglass Vanish Concealer every time. I know I'm not the only one who struggled to find the right foundation or concealer shade, which is why I always shop at Sephora. They have the best brands all in one place with so many shades, coverage options, and finishes, plus expert beauty advisors, free samples, and shade matching tools both online and in-store. So whether you're looking for barely there coverage or full glam, Sephora can help you find your match. Thank you.