What do we mean by device security? Why should we care about this?

Hi, everyone. Sal Khan here from Khan Academy, and I'm here with Mark Risher, who is director of Product Management at Android at Google, to talk a little bit about device security. So Mark, welcome. And my first question is, what is device security? Are we talking about somehow keeping our mobile devices secure?

We are talking about that. We're trying to say, how do you make sure your device, your mobile phone, your tablet, anything that's digital these days is guarded against unwanted access? That could be coming from hackers in some other country; it could be coming from someone in the room next door. In all cases, we want to give you the right level of protection and security.

And I just want to make this tangible for folks, 'cause I think we all have a sense that, okay, you know, we don't want people messing around on our phones or on our tablets or our laptops, but when has device security not gone well for folks? (Mark chuckles)

There's more and more information on these devices. You know, we trust them with not just whatever the application itself is asking us, but often it knows where you are in the world, your location. It knows what you've typed in and what you've searched; it knows whom you're communicating with. All these different dimensions, you know, they can be exploited. For the most part, good things are happening, and I'm definitely an optimist in this space. But we want to make sure that people understand what's going on, understand who has access to the information, and then they can make the appropriate decisions and trade-offs so that they get the right level of control without sacrificing all that's really cool about technology.

I really try not to frighten people, but to say, you know, what could happen? What could happen if all of your location information were out there is, you know, on a continuum, from it could be embarrassing to bad things could happen in the real world if someone knows exactly where you're going to be at a given time. To, they cross-correlate that information with something else, and they use that to maybe send you a scam, send you a phishing warning, send you, you know, some sort of crime could take place. There really is quite a breadth, and unfortunately, these criminals are very motivated, and they're seeing positive results, so they do keep innovating. And that's again why we want people to have that right level of protection, that right level of control over their sensitive data on their devices.

Yeah, one of the things that immediately comes into mind in other videos we've produced, we talk about how two-factor authentication is really important because for someone to be able to get access to your password and your device is very unlikely. But to your point, if they do get access to your device or if they're able to track your movements in some way, they might be able to fake being you a little bit better and get access to all sorts of things or pretend to be you and embarrass you at minimum, or do worse—access to your bank accounts, et cetera.

Yeah, that's actually the one that I'm even more scared of. People might say, you know, "I don't do anything suspicious. I don't do anything risky. What do I care?" But the problem is that then what the attackers want to do is leverage your reputation to go after someone else. And that can be terrible. Some of you may have seen what we call the "Mugged in London" scam. You get a message that looks like it's from your uncle or your cousin or your grandmother or what have you, saying, "I've been attacked. Please wire money to me." And this is a scam. It's coming from the attackers who broke into that person's account and then sent it to all their family members. So again, even if you're not worried that you yourself have sensitive data, what you really don't want is somebody taking your reputation and using that to bootstrap their way into even more heinous crimes.

Wow. That's so powerful. I could imagine if someone close to me texted me right now and said that, I'd be like, "Oh yeah, how do I help them?"

Yeah, yeah, yeah.

It's a good word of warning.

And then both parties feel guilty about that. It's terrible all around. It's really this awful exploitation. I hate it.

Okay, whether or not you intended to do it, you scared me a little bit, which I think is good.

But there's hope. There's hope. We can work together, Sal.