Social Engineer: YOU are Easier to Hack than your Computer

This video features a conversation with Rachel Tobac, an ethical social engineer who demonstrates how human vulnerabilities are often easier to exploit than technical systems. She begins by revealing the host's personal details—full name, hometown, and past hobbies—gathered from open‑source intelligence (OSINT), shocking him despite his cautiousness. Rachel shares her background: a Defcon social engineering contest participant with no security degree, she leveraged improv skills to build rapport and extract sensitive information, founding Social Proof Security after early successes. The discussion then shifts to common organizational weaknesses, such as poor identity verification, MFA fatigue attacks, and the dangers of password reuse. Recommendations include moving from knowledge‑based authentication to app‑based or hardware tokens like YubiKey.

The hosts explore OSINT challenges, noting that even after extensive data removal, AI‑powered reverse image searches can uncover decades‑old photos from local newspapers or relatives' social media. A live demonstration showcases voice cloning: using a short audio sample, Rachel clones the host's voice, spoofs his caller ID, and tricks a friend into revealing a security question answer in real time. The conversation highlights how quickly attackers can now impersonate trusted contacts with minimal voice data, urging verification through a secondary channel.

Broader societal risks are examined, including AI chatbots reinforcing delusions ('AI psychosis') and the dangers of always‑on AI companions like the 'Friend' pendant, which may erode social skills and enable sycophantic behavior. Rachel criticizes placing the cybersecurity burden on users and calls for corporate responsibility, advocating for agentic AI to handle content moderation—a job she once nearly had at Facebook where exposure to horrific imagery was routine. She concludes by advising people to be 'politely paranoid,' cross‑verifying suspicious requests because scammers rely on victims not double‑checking through another method.