The Texas Lottery Courier App Scandal

Speaker 1: There's a small storefront in North Austin, Texas called Winners Corner. From the outside, it's pretty unassuming. It's like a nondescript building on a quiet street, and the sign out front, I found it on Google Maps, says board games, lottery, gifts. You walk in the door and there's technically stuff for sale. A few board games stack near the register. Under Texas law, lottery retailers have to sell something other than lottery tickets, and this shop shows Monopoly. In 2024, Winners Corner sold $179,000,000 in lottery tickets. That is more than any other retailer in Texas and more than the next 25 combined. That is because Winner's Corner is the physical front end for Jackpocket, a lottery courier app that lets users buy tickets from their phones. The app handles the orders, the machines in the back behind the monopoly boards print all the tickets, and scanned images are sent to the buyer. This is less a story about a security breach, and more about a mathematical vulnerability in game design. There is a fear that the lottery, one of the few forms of legal gambling in certain states, is a game with an aging out player population. You need players to have prizes, and young people aren't playing the lottery as much as previous generations, so that line has been going down.

Speaker 2: Yeah. They're too busy sports betting online.

Speaker 1: Literally. In most states, that's so much more popular. But in some states, the lottery is the only legal gambling. So there's this desire to figure out how to make the lottery compete in that modern gambling world of sports betting apps. And across The US, courier app companies like Jackpocket, lotto.com, and lottery.com are the answer to this. Trying to be like Uber for lottery, for younger users who have never bought tickets in person to begin with. And in Texas, where gambling is tightly restricted and the lottery is one of the few legal games in town, this new breed of courier app helped push ticket sales past $8,000,000,000 in 2023. In Texas, by the letter of the law, it's illegal to buy lottery tickets remotely. The laws are pretty old. They technically prohibit buying the ticket over the phone, but, like, the spirit of the law is clear enough that these courier apps always existed in kind of a gray area. In April 2023, the Lotto Texas jackpot had rolled over 91 times. This had swelled to about a $95,000,000 prize, the largest in more than a decade. And finally, one evening in April, a winner. Lottery courier apps in Texas can't sell you a ticket remotely, that contradicts the no buying over the phone rule, but what they can do is provide you a service. To buy a ticket themselves and to enter into a contract with the user to hold that ticket in trust, and then give them either the ticket or the prize in the event of a win. How is this different? A question they should have asked before April 2023. By automating the buying process, they created a vulnerability once the prize got over a certain size, that basically turned the lottery from a game of chance into a math problem. Because if the prize gets above a certain size and you can buy as many tickets as you want very, very efficiently, there comes a point where the cost of buying out all 25,800,000 possible number combinations intersects with the otherwise astronomical cost of doing so, which is exactly what a London backed gambling syndicate decided to do to the Texas lottery once the pot reached this size. Brilliant. It's very, very clever.

Speaker 2: Brilliant.

Speaker 1: Using software, these courier storefronts and dozens of high speed printers, they bought nearly every one of the, again, nearly 26,000,000 possible combinations, skipping a handful to avoid, the chance of splitting the pot. And by gum, the Brits, they won.

Speaker 2: Shocking.

Speaker 1: Shocking. Math. Math. After taxes, the group walked away with 57,800,000. They'd gamed the game, and they'd done it technically by the letter of the law. Texans were not fans of this. The, like, Boston Tea Party energy radiating off of this was, like, potent. This was the inciting incident of a story that reached something of an end recently after a massive fallout. There were lawsuits, legislative hearings, investigations by the Texas Rangers. The state's longtime lottery director resigned, followed by his deputy. And recently, in 2025, the state formally banned all third party courier app sales. At one point, they came within a vote or two of dissolving the Texas Lottery Commission entirely. Critics called this a heist in broad daylight. The lieutenant governor called it the biggest theft from the people of Texas in the state's history. I found this fascinating. A technology meant to automate playing the lottery to bring it to the youths being used to automate gaming the lottery. So we'll start here with the story of the Texas lottery courier scandal here on hacked. Just gonna play that play that whole thing beginning to end.

Speaker 2: Oh, I I intended to have an AI read or, like, we don't have to put this in, but I there's a JavaScript library that essentially is a music production suite, and I and, intended to make a, like, a remake of our theme song using vibe coding and this library and, got distracted doing other things. So that's on me.

Speaker 1: I I do wanna hear you were sending me videos of music that people had vibe coded, which is just such a fascinating concept of, like, if beat 16, play hi hat. Like, that that way of thinking about music is so interesting to me, and I'm I'm I'm personally holding my breath for the vibe coded version of our theme song. Is it gonna be its own song, or are you gonna recreate the current one?

Speaker 2: My intention was to recreate the current one, but the problem became that not a lot of the models are smart enough to listen to music and transcribe music. So I couldn't find an easy way to, like, stylistically take our theme song, produce prompts to guide a vibe code. So I think I might just raw vibe code it.

Speaker 1: Just get an an original

Speaker 2: Here's the scenario. We have a, like, a tech podcast. You know? Please make me a a a JavaScript script that automates the production of what could be theme music and just see what comes out.

Speaker 1: I'm gonna swing the other way and do a version of the theme music on, like, a multitrack tape deck recorder. Like, go full analog. We'll throw a bunch of, like, text spaghetti at the wall and see what the best version gets us.

Speaker 2: AIs are pretty damn good at coding now. Right? Yep. Coding is logical. It's mathematical. It's music. If you know music theory, hook theory, it's very similar. Mhmm. So, like, AI should be pretty good at making music. And I think, actually, given a lot of the platforms that AI's make music, it is pretty good at making music. So I'm I'm just excited to try the code, feeds the music, and the vibes feed the code. I'm just excited to build that pipeline and see what comes out of it.

Speaker 1: Or we strip down and just do the vamped ad libbed, acid jazz version that we do on mic of every episode of Hack, of course, brought to the people by post security. Of course. Of course. It goes without saying.

Speaker 2: Goes without saying. And I wanna talk about the feedback we got from just our, like, little tech chat the other day. At the end of the last episode, Jordan and I just left our mics on and had the conversation that we inevitably would have had with the mics off Mhmm. And left it in. And we got an overwhelming, I'll put that in air quotes, I'm in a positive response to that. And I just wanted to let people know that, anecdotally, you have a lot of power over us. It's true. It's like it's Spotify comments, DMs, emails. If you if you take the time to reach out to us, it it we read everything. We acknowledge everything. We pivot when we think it makes sense, and people like that. So I think we're gonna do more of that.

Speaker 1: Yeah. I think our next episode, we might just go pure hot mic just just for

Speaker 2: the fun of it. Just for the fun of it.

Speaker 1: Just for the fun of it. So today, I'll be, I think, probably another combo. I've got this story that I wanna talk about because I recently was traveling quite a bit for for the old wedding season, and I downloaded I found one story about this. And then as I was getting on the plane and I knew I was gonna lose data, I downloaded a bunch more information and sources on it and spent an entire flight reading about it, and then spent a good chunk of the trip reading about it and then spent the flight home reading about it. So I have I I wanna dig into what happened in the Texas lottery because it's a fascinating, like, game design story. I think when we get back from the break, we'll just just talk about some stuff.

Speaker 2: Let's get into it. Before I pitch it back to you, I'm gonna say that this storefront Mhmm. That is the face

Speaker 1: already Did you find it on Google Maps?

Speaker 2: No. I didn't.

Speaker 1: It's good.

Speaker 2: But, I should. I should. The physical manifestation of this online gambling platform, I noticed this a long time ago in some of the podcasts that I listen to. A lot of them have betting ads. You know? Yeah. Big pills betting. Yeah. Class issues. All the same.

Speaker 1: Cornerstones of the genre. Exactly.

Speaker 2: The they always come with, like, a warning label at the end, and it always refers to some obscure casino. Yes. And it's because the same thing's happening there where it's like all of these platforms, no matter how big they are, have to operate statewide on, like, through partnerships with these small gambling institutions. So you've got these massive international gambling franchises that are, like, operating out of these, like, hoedunk casinos in, like, Nevada and stuff. And you're like, oh, weird.

Speaker 1: And not only do you have so it's not only in operating inside of the state, as you said, which is true, but you also have, like, interest state politics, which is the laws governing gambling vary based on which state you are in and websites. Geofencing is a famously easy thing to get around. So now you have people gambling in effectively other states and the giant amount of legal turmoil that that creates not just for the users, not just for the app front end, but for that otherwise normal sleepy little casino that is technically the, like, licensee like, license holder for that gambling website.

Speaker 2: I I think I talked about this in an episode, like, maybe a year ago, but I'm a big tennis fan. I travel, go watch tennis tournaments, go to one in California quite frequently, which is geofenced away from online gambling, which is a pain because we like to bet a little bit on tennis to make it more exciting. And, but the thing that I always love is the people sitting in the crowd doing the real time, like controlling the gambling environment around the game. There's literally a person lazily plopped in a chair inside the stadium with a big application in front of him who's turning the bets on, turning the bets off, recording what had happened, recording if it was an ace, recording all the details of it to fill the bet so that you can't be gaming the system with latency.

Speaker 1: So, like,

Speaker 2: so you can't yeah. Sure.

Speaker 1: So that you couldn't have someone in the actual arena feeding you information that you could then slip a a bet in somehow Totally. Before the official result results got posted.

Speaker 2: Yeah. Because the especially, like, TV feeds are often offset by eight, ten seconds. Mhmm. So if the gambling headquarters were watching the games on TV, people on the ground would have, like, temporal arbitrage to be able to put bets in knowing the outcomes before the platforms did. And and so they there's this they literally pay people to go sit in all of these stadiums and live record what's happening.

Speaker 1: Kind of a sick job.

Speaker 2: Yeah. Call me.

Speaker 1: Call me. Get at me. You wanna fly me out to some Yeah. It would be so lost on me if it was tennis, but I would just show up in a fancy little outfit to record the results

Speaker 2: of a

Speaker 1: tennis match somewhere.

Speaker 2: Every every one of these people that I've ever seen do not look like fancy little outfits. It's like they look like Russian mobsters.

Speaker 1: I mean, that's that's that's a fancy outfit of its own. Yeah. Yeah. Really.

Speaker 2: But but, yeah, if you need somebody to do the Aussie Open or Wimbledon, like, pick me up. I'd happily go. I know what all of the bet things are. I gamble. I bet on tennis. Like, I'm I'm a competent person.

Speaker 1: I think you're gonna like this story. The thing that got me onto this was this phrase I saw, Uber for lottery tickets. Mhmm. Mhmm. This idea that people still play the lottery, but over time, the line has was trending down for a little bit. And there was a desire to figure out how do we get people that wanna do everything on their phones, that don't wanna go to a storefront and buy a piece of paper to gamble like it's the nineties, playing the lottery. And especially in places that rely on the tax revenue and especially in places where that's the only form of legal gambling. And as such, we get this suite of services, jackpocket, lotto.com, lottery.com. They have emerged to try and modernize traditional, lottery. They are not official lottery operators. They're these middlemen that buy the tickets on the user's behalf and then deliver the ticket or the prize to them in a bunch of different ways depending on the size of the prize. You log into a website or a mobile app. You can order an official state lottery ticket digitally, and then you pick which game you wanna play, Powerball, Mega Millions, State Lotto. You pick the numbers, or you can go for, like, a quick pick just like going into a store, and you enter into this little agreement with the app. You don't get issued the ticket digitally. Instead, you the courier system routes it to a human or automated, like, retail partner that enters into that contract with you. Each courier service has to has that licensed brick and mortar retail outlet in every state it operates in. So Jackpocket has the Winner's Corner that we talked about in Austin. Lotto.com uses a little tiny, little storefront called Players Cafe. They're these massive businesses with these teeny tiny little retail brick and mortar front ends. It's very They're wildly profitable tiny retailers. A $179,000,000 out of this one little shop, and it's printers in the back. Printers and Monopoly boards. It's wild. Mhmm. They all work slightly differently. Jackpocket, generates, like, a high resolution scan of the actual ticket and delivers it to, like, the user's app. Lotto.com just skips this and gives you the numbers. The important part is that they have to physically secure the ticket and then store it in a secured vault on behalf of the user. That ticket has to exist physically somewhere. It's not purely digital. There's a piece of paper.

Speaker 2: So to claim it, you need the physical thing.

Speaker 1: Exactly. Then if you win to claim it and to fill facilitate that payout, there's different ways it works. If the price is below $600, they typically redeem the ticket on the person's behalf and just credit it to the user's online account. If it's larger than that, there's typically a process of delivering that physical slip of paper to the user securely in some way, ensured mail and in person hand off depending on the size of the prize. It's very, I'm editorializing here, it's very janky and weird and slapdash and different based on the state and the context. It's it's nebulous.

Speaker 2: It's it's a weird like, I'm just thinking about it as, like, a business process problem. Like, what kind of headache it would be to be like, yeah. We sell a 176,000,000 sheets of paper a year, and we have to keep them, like, notarized and filed and secured. And recall has to be a 100% or else we're gonna get sued. Yep. Like, it's like it's it's like the it's like a data storage business more than it is anything else.

Speaker 1: It's data

Speaker 2: storage physical data storage.

Speaker 1: A 100%. It's physical data storage of pieces of paper that potentially represent huge sums of money that the user has a document of. So you can't even say, we don't know what it's like, no. They have proof of receipt.

Speaker 2: Mhmm.

Speaker 1: So it doesn't matter if, like, the winner's corner in North Austin burns to the ground. You've entered into a contract and you are liable. So we get into, like, what size of physical fireproof safe can store this many lottery tickets. It's that kind of a problem.

Speaker 2: For for $95,000,000 Right. I'm getting on a plane and going to Austin, picking up my physical ticket myself and taking it to the lottery office. Like, ain't no way a courier is getting that.

Speaker 1: Oh, completely. And you kind of have to go to them in that case because let's say you wanted to be the pushy customer and say, no. You bring it to me so I can get back on a plane and fly to Texas and redeem it because this is geo locked.

Speaker 2: Yeah.

Speaker 1: Totally. Which is another major feature of these apps is that, like, they need very good geolocation APIs because there is, again, intrastate legal differences for how gambling is moderated. It's theoretically legal in some states to gamble in their lottery from outside of state. Inside of that state of which it might be illegal to gamble in another state's law like, it's these apps sit in this weird tangly knot intersection of a bunch of different laws and tech jurisdictions. It's really interesting.

Speaker 2: It's it's the starting a tech business in this space, it just seems like it's such a regulatory nightmare. Mhmm. Like, I'm sure it's wildly profitable, and they figure it out. But it just like the I know when it comes to gambling, alcohol, any of the sins, you know, the regulation handbooks are, like, regionally dependent. They're federally enforced. There's so much it was like when marijuana shops opened in Colorado, and they couldn't even take their money to the bank because the banks were federally regulated and still can considered it a crime. And it's, like, just such an insane thing.

Speaker 1: I think that might someone in the comments flag if I'm wrong about this, but I think that might still be the case in The States maybe. That because it's not still federally legal and banks are still federally administered, it's still very, very difficult depending on where you are operating a cannabis business, not the topic of this episode, to use traditional banking, for your business. So you end up having a lot of, like, you know, safes and basement type situations for, like, big businesses.

Speaker 2: But, yeah. Yeah. But, back to gambling, like Mhmm. Jordan and I live in neighboring states, Canadian provinces. I'll call them states for our American listeners. We actually share the same oversight in our gambling, the Western Canadian, Really? Yeah. WCLC Liquor Corporation. I think it started as as booze and alcohol regulation and then moved into gambling. I think it's a liquor corporation. Don't know. A quick Google would tell me, but I'm not worth worth worth doing it. So but I can't redeem a British Columbia lottery ticket in the same lottery. So, like, if it's the same draw, I can go to Vancouver to see Jordan, buy a ticket Yeah. Bring it home to Alberta, and I can't redeem it or scan it. If I want to claim it, I would have to fly back to British Columbia to redeem it even though it is being operated, executed, and regulated by the exact same corporation. Yeah.

Speaker 1: Yeah. That same weird, like okay. So there's a there's a an imaginary line, and the law changes radically based on which side of you're in with potentially huge outcomes. Obviously, the case in The States when it comes to this stuff. One of the few two states to explicitly legalize and license these apps early on was, like, New York and New Jersey were early adopters. They passed regulation to let you legally register these services. Jackpocket became the first one in 2021. There's a bunch of different, requirements to meet the standards of being allowed to do this geofencing inside of New York. In states like Texas where this all went down, that long standing law preventing lottery sales by telephone, didn't you could interpret that law to apply to Internet and orders, and you could interpret it in such a way that it doesn't apply to Internet orders, which is kind of what happened. It was pretty confusing. For years, the Texas Lottery Commission simultaneously claimed that it lacked authority to regulate or ban these these services, effectively allowing them to operate in a gray area even as this law preventing remote sales over the phone was on the books. It's very odd. The way it works in Texas is you get this regular retailer license often by just opening up a small convenience store, and then you sell the tickets via the app via this courier service app. The commission didn't initially impose additional rules on them. They were just considered a retailer selling lottery tickets like any gas station until this 2023 bulk buying fiasco forced Texas lawmakers over the course of the next two years to explicitly ban these courier apps and to threaten any physical retailer who even, like, cooperated with them.

Speaker 2: I don't know what the outcome of banning the apps is gonna do. Like, when something becomes a numerical guarantee, like being able to make $57,000,000 by investing 28,000,000 or whatever the numbers were, twenty six million dollars, Even if the British private equity guys gotta get on the plane and fly to Austin Sure. For $50,000,000, they're gonna do it. Yeah. You know? So it's like banning the app is not gonna solve the problem. Like, you've created a mathematical guarantee of winning. Even if it got split, they would have only made, what, like, $14.15, 18,000,000?

Speaker 1: Yeah. That's the money. Splitter vastly less than the odds of a win given a six number string set. The the much easier solution to all this is increase the number of numbers that you play with in the lottery.

Speaker 2: Yeah.

Speaker 1: That's looming over all of this for me is, like, you have massive fallout. You have maybe we don't have the lottery. You have all these big existential questions, and there's, like, or nine numbers.

Speaker 2: Not you don't even need nine.

Speaker 1: Yeah. You can go to seven. You you can literally go to seven.

Speaker 2: So just just to speak to our heritage again, the Canadian main lotteries were six forty nine. Six numbers, 49 possible outcomes. Like six digits, one to 49. That was how lottery used to be. We still have that lottery, but the payouts are often much less. We now have what's LottoMax, which is just a a seven number lottery. And the payouts are usually often $70,000,000 because it rolls over all the time because there's so many potential combinations Mhmm. That the probability of winning can sometimes take like, for a lottery that gets drawn, I wanna say, two or three times a week, sometimes it can take a month to get a winner. So it's like you only need one more number to just grotesquely expand the state space of potential, like, you know, the state space of potential numbers that could be chosen.

Speaker 1: And you've still insulated yourself where the total number of tickets even though it's the same rollover, this total number of tickets you would have to buy to guarantee a win as they effectively did here is so still so astronomically high that those lines on the graph won't intersect in a practical sense. And you have still some kind of a lottery. You don't have an easily gamifiable system.

Speaker 2: Yeah. Like, seven

Speaker 1: You crunching those numbeys? Yeah. You are.

Speaker 2: That I did it backwards. I did it backwards. Yeah. There are 86,000,000 potential outcomes at seven two's forty nine two seven. Interesting. So that's quite a lot.

Speaker 1: So there's the math side of it, and then there's, again, the the state level side of things. And I wanna I wanna keep I wanna move on, but it is worth talking about that there's a bunch of ambiguities outside of the math when it comes to the state lines. State statutes often require tickets to be sold at a licensed premise, which brings up this weird question of, like, if a player orders on an app from home, who is the actual seller, and where did that sale occur for legal purposes? Like, Colorado's state auditor noted that under the courier model, purposes. Like, Colorado's state auditor noted that under the courier model, it might not be clear who was selling the tickets or where they're being sold to. Like, a player might reasonably assume I made an online purchase, and therefore, a different set of laws and regulations exists. Than if they technically made the purchase in a physical store in a place they never set foot in. And this ambiguity and clarity creates, like, weird law enforcement issues when it comes to age and location. An investigation in Texas found that lottery.com, the courier, and they will come up again later, had sold over 500,000 tickets to out of state players, blatantly violating state laws that the tickets only be sold to in state customers. This occurred in 2022, which would suggest that lottery.com's controls on geolocation were in some way flawed or circumvented by the user base. And the fallout of that, this is important to the story, was pretty intense. Lottery.com's app was pulled from the App Store as its license was suspended, and its executives faced separate fraud charges. There was unrelated securities charges. Lottery.com got in a lot of trouble, and I want us to all remember that for a few minutes from now on.

Speaker 2: The yeah. I I given given how much time is spent on regeolocating our digital devices Mhmm. It's like, how much like, they have to be so far ahead of it. Like, I even know, like, when I'm traveling, sports betting, a lot of TV platforms, like, if you're, like, an f one fan or if you're trying to load, like, any kind of digital streaming platform from your home country Bingo. They only have rights for that content in your home country. Mhmm. So it becomes this, like, oh, I'm on the road, and I wanna watch this, you know, tennis match. And it's like, oh, I can't actually use these apps because they don't own the rights for that content to stream where I am. So then you kinda have to geo relocate to where you're supposed to be, and then all of a sudden it works again. And it's like this that's that's a a real I what am I trying to say? I'm trying to say that's a really fast moving target and a big liability for these companies, and I'm sure it's part of the risk planning.

Speaker 1: It's also a very low barrier of technical entry for compromising a system with, like, millions, if not tens of millions of dollars on the line, which makes it really, really interesting that you have, like, hey lottery.com. Why did 500,000 people buy lottery tickets from you from outside of this state when there's explicitly a law against that? And you know that because you use this geofencing, technology.

Speaker 2: But the the other thing I'll shoot back is, like, I can fly to Austin tomorrow Mhmm. Walk into a corner store and buy a lottery ticket. I'm not from there. Mhmm. It literally, there's no the barrier to buying the ticket is literally no different. It's just that there's some arbitrary antiquated law that requires me to be physically present at the point of purchase in that in that physically present in that state while I make that purchase.

Speaker 1: It it is arbitrary at the scale of one ticket for sure. Yeah.

Speaker 2: It has nothing to do with residency requirements, has nothing to do with anything. And then I like and I'm just gonna keep going because I think that when you're talking about regulations and stuff and and all of the complexities around this, I think it's largely based on the fact that US lottery winnings are taxable. Yes. In Canada, they are not. So the states want their percentage of tax. So if you're an, you know, a Florida resident buying a ticket in Colorado that has a higher state tax and you win, they don't want you to redeem it because they want their portion of it. Where in Canada, it's even more arbitrary because we don't have tax on lottery wings. So it's like, who really cares where you are? Mhmm.

Speaker 1: I think that there's something there's the tax thing, which is a practical economic benefit of having the win occur inside of the state where the money was fed into the lottery. Mhmm.

Speaker 2: And

Speaker 1: then there's kind of just like a spiritual defeat of we poured all of this money inside of our state into this lottery, and then who won it? Someone completely outside of it. Like, there's just almost something about, like, a Texan winning the Texas lottery that I think matters to people. I think that's part of why people got so mad. Like, the money sucked, but there was just something really icky.

Speaker 2: Oh, we wanted one of us to

Speaker 1: win. Bingo. Yeah. And instead, enter Bernard Marantelli, a British bookmaker loan for not known for launching the betting startup Colossus Bets, and his financier, I wanna make sure I get this right, Zelushko, the joker, running a check, a reclusive Australian billionaire famous for exploiting gambling systems at scale. These these two people, fascinating characters. They're they're quite a bit of experience, in high volume statistically optimized betting, often targeting systems whose odds could be bent with enough money and math and time and resources. And in the Lotto, Texas it would seem they spotted something of a target. Relatively low odds, 25,800,000 possible combinations and no legal caps on ticket purchases. And then third thing, the existence of a digital courier system that made bulk buying feasible. You take all three of those things, pretty good odds, no cap on ticket purchases, and a remote system for purchasing these, and you've got this sweet spot where once the prize gets above a certain point, funnel money at it and you can win this thing. Remember how we spend a little bit of a of time talking about how in 2022 lottery.com kinda got wrecked after their own little scandal of selling all those tickets out of state a few minutes ago? Guess what courier company that had recently regained its retailer license and was struggling after that massive fallout, was more than happy to facilitate the dump truck of sales that this would, require.

Speaker 2: I didn't could you imagine being, like, a person working there and getting a phone call being, like, hey, I need to speak to somebody about buying $30,000,000 in tickets. I wanna I wanna kick back on the retailer kickback.

Speaker 1: And you've just gotten the license back and people are like

Speaker 2: If you're gonna make a $26,000,000 purchase, you know that the retailers get a percentage of each ticket.

Speaker 1: Yes.

Speaker 2: So like I would negotiate that. Be like, I'm about to spend $26,000,000. You get 5% of it. That means you're gonna get, you know, whatever, 1,300,000. I would like 300,000 of that back. Like, I'd negotiate that if I was about to do a $26,000,000 buy.

Speaker 1: You wouldn't be alone in that, and you're gonna be furious at the numbers you hear lately because I would I would argue that that opportunity is was maybe not taken advantage of, to its fullest, which is an interesting twist in a situation where it feels like a lot of opportunities are being taken advantage of. So using dozens of terminals across Texas to print nearly, again, every possible combination, they used, QR codes for sort of the part of the automation. In order to do this, lottery.com actually had to request dozens of extra like, in order to just fulfill this order from this, like, British

Speaker 2: gambling printers?

Speaker 1: They had to get extra lottery ticket terminals

Speaker 2: Oh, yes.

Speaker 1: Which the lottery's vendor rushed to install at four of these makeshift, like, front end locations, including a warehouse and a defunct dentist's office that they spun up. And these terminals were operating, like, simultaneously in parallel and were just printing tickets around the clock for three days. The bottleneck would have been manually entering numbers. So instead, it was quite shrewd, they had an automated system generate QR codes for each possible combination, effectively creating these little bet slips that instead of having to take the time to type it in, you could just scan it with a camera app, and it would it would speed up each one of those. And then they had crews of staff, including family members of children using smartphones to scan these QR codes into the machi machines, achieving an output of over 100 tickets per second

Speaker 2: Wow.

Speaker 1: Aggregated across the different terminals. They purchased 99.3% of all possible combinations for the lottery. They deliberately omitted a small fraction of combinations like 01/02, 03/04, 05/06, certain birth dates to minimize the risk of splitting the jackpot, and all of those printed tickets were stacked in labeled boxes so that the winning combination could be located afterwards. They needed to be able to actually find it in there.

Speaker 2: Let's hang there for one sec because that seems insane to me to, like, omit a fraction of the tickets because, like, probabilistically, they have the same probability as winning as any other number. Granted, there are distributions, and people do analysis on this stuff. Mhmm. Like, there are numbers that hit more frequently. But to leave imagine you lost because you cheaped out by $70,000.

Speaker 1: You didn't pick a birthday. I didn't quite get that either. I don't get why you would rather not I don't get why you would rather a guaranteed loss for a marginal savings at the Mhmm. Than the than the terrible possible income of splitting the pot and at least making some of your investment back. Like, to me, that would seem like a hedge. I didn't get that. It came up in multiple pieces of reporting that they avoided certain numbers to avoid a pot split, and I I don't get why. There's some way and I never saw that commented on in all the report. Like, I I missed either I'm missing something there or they know something. I would guess that the high stakes international gambling boys, of the Commonwealth know something about lottery gamification that I don't, but I I didn't get that either.

Speaker 2: That that would be that would be my like, I assume we're missing a piece of the data that these professionals Yeah. Did not. I'm sure there's a reason why they didn't do it. It wasn't to save, you know, a couple 100 k. Bit. A 100%. And open the risk window up to losing it all. Yeah.

Speaker 1: So you end up at the end of that with this massive dump truck of lottery tickets indexed, inboxes, ready to go on the day. The lottery happens. It's rolled over multiple times. The prizes swell to $91,000,000,000. And sure enough, the syndicate's ticket hits the jackpot. It was the sole winning ticket, so crisis averted. They claimed the 90 plus million dollar prize anonymously via a Delaware LLC called Rook TX

Speaker 2: Nice.

Speaker 1: And took a lump sum payment, yep, of $57,800,000 yielding an estimated profit of about $20,000,000 after all of the expenses of doing this scheme. Lottery.com, the courier whose tickets enabled all of this, earned $264,000 in commissions from the massive sales volume.

Speaker 2: That's lower than I would have expected, honestly.

Speaker 1: It's simultaneously a lot of money and not nearly enough for the heat that this all threw off. Yeah. But I think that's not not enough money for what happened here.

Speaker 2: Like, setting up like, getting a month lease on a former dentist office, bringing people in, running twenty four seven crews for 250 doesn't it seems like, it it is still, yes, a lot of money,

Speaker 3: but I would have

Speaker 2: assumed it would have been bigger. Like, if I was them, I would have negotiated a percentage of the winnings.

Speaker 1: Which I'm guessing is just flat out illegal.

Speaker 2: Yeah. Probably.

Speaker 1: But said about the company that was just yeah. They got their license back from the previous illegal thing. The courts deemed that illegal. I think I can say that. Like, yeah. It's all very odd. People did not like this. It came up pretty quickly who owned this company, and there was a lot of fallout. At the time, Texas Lottery officials sort of publicly stated a belief that a feat like this was impractical, and they said, quote, this caught them kind of by surprise. In reality AK. Yeah. In reality, there were warning signs about this. The New Yorker piece about this that recently came out due to the the sort of recent bannings, I highly recommend you read it. It centers on a character, a lottery watchdog named Dawn Nettles, a woman who by herself publishes something called the Lotto Report, which is a a small regional publication focused entirely on the Texas lottery. She's like the bulldog kind of hero who had been, like, big short style, like, banging the pot, being like, there's a problem. Someone's gonna game this. Look at that British Australian weird gambling tag team. They're about to game this. Oh, wow. They did. She was the one she was the one warning that an out of state group was attempting to screw every player and retailer that was playing the game. Executives at a rival courier, lotto.com, alerted the lottery director a week in advance as this whole thing was being booted up saying that, like they learned about the terminal request, and they pieced it together. And they were like, the optics of this to the Texas Lottery is gonna be atrocious if an outsider wins this local jackpot. It's gonna set us all back. Please stop this. And it forged ahead regardless. The then director approved the extra terminals. It's a free market. It forged ahead. Two years later, this all kind of had been, like, boiling, boiling, boiling in the aftermath and blew up into a full fledged scandal. Texas's lieutenant governor decried it as, quote, the biggest theft from the people of Texas in the history of Texas, likening it to, like, a big robbery. It's a that's a little over the top.

Speaker 2: Little train heist.

Speaker 1: It's a little train heist, but Go

Speaker 2: go Texas. It's got

Speaker 1: a good Texas energy to it. Yeah. Their investigation's launched launched by the attorney general and the Texas Rangers. The Texas Lottery Commission's leadership is upended. The longtime director, a guy named Gary Grief. Gary Grief. Great name. Abruptly retired, and his deputy, a guy named Ryan Mandel, took over to resign, a few months later missed criticisms that he too was part of all this. Until just recently at time of recording, in 2025, the commission does this about face and bans all of these third party courier app sales in Texas. They immediately revoke any retailer license found to be assisting these couriers. They passed bills to criminalize online ticket sales and threatened to abolish the lottery in its entirety if it could not ensure its integrity from this type of thing happening. What's interesting about all this is that at the time this occurred, this bulk buying scheme appears to have been legal under the then existing letter of the law.

Speaker 2: They cashed out. They cashed out. So, like, they got their money. Yeah. So it's like nothing prevented it.

Speaker 1: No. There was they they knew what they were doing. This was all totally legal. Like, it was gamification, it was a vulnerability in the game design, not in the law. And that's a very, very important, seemingly trivial distinction, but a very important one when you have, like, $95,000,000 on the line.

Speaker 2: Yeah. Sure.

Speaker 1: It's the

Speaker 2: Pepsi courier jet problem.

Speaker 1: Couldn't have put it better. Deep cut, but couldn't have put it better. Yeah. Yeah. Yeah. Yeah.

Speaker 2: I don't know if you ever, like, chased the the rabbit holes, gone down the rabbit holes in in regards to, like, people that game points systems, credit cards Yeah. Online.

Speaker 1: Yeah. Yeah. Yeah. Points guy. I love that stuff.

Speaker 2: I like, I I I haven't looked at it in, like, decades, but, like, I I have a friend that was into it, and I was just like like, I guess, like, if you need purpose, like, this is a fun thing to do to, like

Speaker 1: Like a game? Like yeah.

Speaker 2: Yeah. The return on your investment of time is really quite low. You should just go get another job. But, but it like, I don't know. I just think it's a fun game that some people like to play, and I'll never, like, knock that, you know, as somebody that, like, puzzles and stuff like that. But it is such a weird world, and, like, this to me just makes total sense. Like Mhmm. If you've got a probabilistic certainty that you're gonna win, and you will and the the then the the risk becomes at what probability do you split or split three ways Mhmm. And, like, only cover your costs or not quite cover your costs, but then you look at the risk reward portion of being like, yeah. But if we don't split, how much you know, we make Yeah. $2,030,000,000 bucks. Yeah, to me to me, this is like I don't know. Like, Lotto's set up to be like this. And to if you're smart enough to recognize it and to have the ability to pull together the capital to execute on it

Speaker 1: And so it was, like So

Speaker 2: be it.

Speaker 1: They did. They got away with it. Totally illegal. Like, the the fallout was huge. A bunch of people got in trouble Totally. As a result of the Texas courier lottery courier app scandal, but it was not the people that won the Texas lottery. Totally. Yeah.

Speaker 2: I was gonna say the the one thing that does stand out to me is that the that the the outcome is always the banning. You know? No more of this. Like Yeah. This is, again, just like a knock on effect of the, like, technological revolution. It's like, all of our governance and and governmental and, you know, policy systems are based on a world that just no longer exists anymore. And it's like Mhmm. This is forcing them to all catch up. Like, look at what Airbnb is going through. Like, it's pretty much ruined affordable housing in most urban metropolises.

Speaker 1: It has not helped.

Speaker 2: Yeah. And it's like and the and the response now is governmentally just banning it. Like, you the province, I e state that Jordan lives in has a statewide ban on it now. And I think it's only approved in, like, a small handful of, like, hyper touristy places, but that's guaranteed to go too because the same thing is happening, like, in the province that I live in. The cost of living in those tourist towns was already so high. And now that, like, an apartment can rent for $700 a night, you know, makes it economically much more viable to be rented as a short term rental than to rent it to a small family working hospitality jobs for $2,000 a month. Mhmm. So it's like it's just it's yeah. We just our world's moving, and it's only going to keep moving faster than we know how to respond to.

Speaker 1: Yeah. And, like like, housing, very different than housing in almost every way that counts. But similar to that is is you also just have, like, the cultural context of how people feel about the thing. Like

Speaker 2: Mhmm.

Speaker 1: There's a lot of anxiety about housing in the places where we live. And weirdly, in Texas, like, the relationship with gambling is a very fraught political issue. That New Yorker article spends a lot of time talking about that where it's like, you have giant schisms over things like like something like gambling. It's like, are you the kind of person that thinks that no freedom, liberty, you should be allowed to gamble if you want to? Are you the kind of person that thinks that it's a a sin and it should be illegal. Like, that's where that cultural line sits there. And then you have something like this where a British guy and an Australian guy game that thing that you already think is a sin and make off with tens of millions of dollars of money from mostly Texans. It's really, really interesting. Yeah. Just on the topic very briefly, and we should move we should go kick over to ads. But after I finished reading about this, struck by the fact that this was technically legal, I went looking at other lottery compromise type situations to see, and they're overwhelmingly not. And that's kind of what makes me find this so fascinating is that they were able to exist inside the letter of the law while circumventing it, whereas previous ones have failed to do so. There's a guy in from 2015 to 2013, a guy named Eddie Tipton. He was the information security director for the multi state lottery associations. It was his job to protect the integrity of the lottery draw. He wrote a secret backdoor into the random number generator software used by several state lotteries, and the code caused the machines to produce predictable numbers on just three dates per year. Even better? A pattern that only he and his accomplices knew so they could go out and across Iowa, Colorado, Wisconsin, Kansas, Oklahoma, routed through people on these special specific days knowing this random number prediction to go out, buy tickets over to over this stretch of time. Just sneakily in the background, they collected just shy of $20,000,000. It didn't unravel until 2010 when he was caught on a gas station, like, surveillance camera buying a winning ticket himself in Iowa. That was what ended up falling apart. He he he told a story about what it was, but a forensic audit of that random number generator revealed the unauthorized code, which they then were able to look at the winners on those three specific dates it all unraveled. But so many of the other stories of lottery compromises are that kind of thing. And I found it so fascinating that, like, this hack worked because it was not illegal. Mhmm. It was like, no. There's a vulnerability here, but it is not a legal one.

Speaker 2: Yeah. You you used the word circumvent, and it kinda sounded like you meant circumventing the law, but they didn't circumvent the law. They just circumvented the, like, system.

Speaker 1: Yeah. I I and I misspoke just now. It was the it was the law. They didn't there was no the vulnerability was on the game design side and in the law, but in different directions.

Speaker 2: It's Yeah. Yeah. I feel like the if if you've got a situation where your possible combination count Yeah. Is lower than the prize pool, like, if the cost of of playing every number is lower than the prize pool, you need to run it needs to become a special event of something. Like, maybe then you like you were saying, add another number Bingo. Split it up into two separate pots. Like, you need to do something to dole it out a fair way because if it's like, who can say no to mathematical certainty of, like, a high probability return of a lot of money? Like, these guys couldn't, and, like, I don't judge them for it. Like, good good for them.

Speaker 1: If I told you that that guaranteed if you just go bet like, you would mortgage your house if you had this level of mathematical certainty. The most risk averse person, it becomes rational to do this.

Speaker 2: A 100%.

Speaker 1: And Yeah. Yeah. And that that's sort of what these two guys did professionally was was sniffle out those mathematical certainties.

Speaker 2: Anyway, should we kick it over to the ad pool?

Speaker 1: I think it's I think it's time to to head on over and then we can chatty chat when we're back. Identity attacks, phishing, credential stuffing, session hijacking, account takeover. These are the number one causes of breaches right now, but most security tools still focus on endpoints and networks and infrastructure. And meanwhile, the browser, the place where all that stuff is really happening, where people actually work, that's been mostly ignored. Push changes that.

Speaker 2: They do. They've built a lightweight browser extension that observes identity activity in real time. It gives you visibility into how identities are being used across your organization, like when logins get multifactor, when passwords get reused, or when someone unknowingly enters credentials into a spoofed login page. Then when something risky is detected, Push enforces protections right there in the browser. No waiting, no tickets, no compromise. It's visibility and control directly at the identity layer.

Speaker 1: And it's not just about prevention. They monitor for real time threats like adversary in the middle attacks, stolen session tokens, and even newer techniques like cross IDP impersonation, where the attacker bypasses SSO and MFA and registers their own identity provider. Think about it all taken together. It's sort of like endpoint detection response, but for the browser.

Speaker 2: Yeah. And the people behind it, amazing. All offensive security pros, published tons of research, came on our pod, talked about their their software, their backgrounds, their everything. They break down exactly how these things work. And, yeah. They are great. So definitely check it out. Identity is the new endpoint, and Push is treating it that way. Check them out. Pushsecurity.com.

Speaker 1: That's pushsecurity.com.

Speaker 2: During the Adwater slide, I was sliding into thoughts about if you're a lottery, you're gambling corporation generated code not reviewed frequently, highly analyzed, you know, MD five hash to make sure that it never gets changed in the background? Like, how is there not multiple levels of security to make sure that nobody mucks with the random number generator? Like, to write code in there that would be specific enough to only become predictable on specific dates would be actual code. Like, you'd be able to see that if you were reading through the source code. That surprises me, the lack of code control. I don't know why, but I was just thinking about that during the ad break.

Speaker 1: Sure. And we should move on because we've subjected the people to enough lotto talk. But

Speaker 2: I think Support the arts buy lotto tickets.

Speaker 1: Support the

Speaker 2: arts buy lottery

Speaker 1: tickets. Not an official endorsement. But you're saying that is the person who would be in charge of that. And to me, that that thought of, wow, this this random number generator is really quite deeply important to this whole system is one path you could go down, or you can go down the path with $20,000,000 at the end of it. And as long as you don't buy a ticket at a lottery station, it would have seemed that was working for a lot. That path was taking him to Yeah. Yeah. Yeah. $2,020,000,000 dollars.

Speaker 2: I can see I could easily see how you didn't make money going down that path.

Speaker 1: Okay. Different point.

Speaker 2: Different point. Surprised that there's less corporate controls that prevent that path from ever happening. Sure.

Speaker 1: I think that that is reasonable.

Speaker 2: Yeah. Anyway, to move on.

Speaker 1: To move on. The other day, you you and I were talking about this $16,000,000,000 credential leak.

Speaker 2: 16,000,000,000 credentials. Not dollar.

Speaker 1: Yeah. I've been talk we've been talking about money so much.

Speaker 2: The let me I gotta give the prefix for this.

Speaker 1: Yes.

Speaker 2: Somebody that Jordan and I work with threw this up on Slack and was like, everybody should change their passwords. Mhmm. Like, there's all of these passwords in the in the the dark web. Like, they know all of our passwords. So, like, go reset all your passwords. And I immediately, like, fired Jordan a message, and I was like, this is I I don't this isn't meant to be rude, but it was comical to us because we spent so much time talking about this, preparing the show, making the show.

Speaker 1: Yeah.

Speaker 2: We just inherently know that every website has been compromised. Their entire password list has been fed into some massive directory that you can purchase on the dark web. Mhmm. To me, that's not new news.

Speaker 1: No. That person was right to use it as an excuse for everyone to just do a a good audit of their passwords and their multifactor factor authenticate. All that is good and well and true. And what's fascinating about it is the headline, you know, this sort of the narrative that was spun around at one of the largest data breaches in history, 16,000,000,000 user credentials. They're now online. You hear 16,000,000,000 user credentials, and a quick gut shot of that goes like, well, there's 8,000,000,000 people on Earth. Mhmm. So even assuming that only some subset of them are on the Internet and most of them have probably a lot of accounts, I have to assume some of my accounts are in there, and it it it begets urgency because if there's a new leak of that many, even if I knew I wasn't in one of the old leaks, at that scale, I must be peppered in that new one. It was a cybersecurity news outlet CyberNews revealed this discovery, talked about this massive set of credentials that have been exposed on the Internet, billions of usernames and password, stored in a format that's associated with a very common info stealer malware, like a little piece of malicious software that steals, you know, sensitive information from infected devices. It is worth talking about this because there's a there's a clarification about this massive credential leak that is is warranted. This was not a new breach.

Speaker 2: No. Nope. No.

Speaker 1: Researchers at a covering room places have confirmed that these credentials, like most of these credentials, the vast majority had been previously leaked, stolen over years going back ongoing. It's an this is an aggregate. Yes. These are from info stealers and credential stuffing attacks and a bunch of different data breaches. I'm guessing most of which we've talked about in this show, but they've been circulating for months and years. And what happened here was they were collected by a threat actor actor or security researcher. We don't know where it came from, but this was existing information that was collected and repackaged into this ginormous dataset, where it was then shared freely on the Internet, and CyberNews discovered it. We found ourselves here.

Speaker 2: If I'm gonna I'm gonna throw you a hypothetical, Jordan. Please. You're the vice president of marketing for a password manager. Is this not the greatest thing you've ever seen when Forbes

Speaker 1: Yeah. Sure.

Speaker 2: Like, all of the major news articles start running this massive thing about how all your old passwords are are compromised? Because it's true. Like, even, like, we run a we run a like, if you go back to listen to episode, whatever it was, five, problem with passwords, I talked about, like, having tiers of passwords. I've since moved entirely to a password manager, have massive unknowns for every account, and it makes my life so much easier. I just hope, for the love of God, that my password manager never gets hacked, which a few have. The this my password manager has the ability to look at all of these breach lists. Have I been pwned is is obviously the big one.

Speaker 1: Yeah.

Speaker 2: And it tells me what accounts have problematic passwords. And any of the accounts that get flagged are the ones running my passwords from episode five because they've been around long enough. Funny. And and the funny thing is is that they're all on accounts that I never use, and most of those websites don't even exist anymore. So, like, when I go through to clean up my dead password lists, half of them were, like, forums about synthesizers and, like, stuff that, like, I was into at that time. And I had an account on it, and I put in, like, a really garbage password that I I used my lowest tier of password. And, yeah, sure, it existed in 60 places. And at least 10 of those have probably been compromised over time. And now it's just publicly available. Like I could almost tell you, I could almost just read out. I'm sure somebody, some fan will go in and look up, find my emails, and be able to go in there and tell me what my old passwords used to be. It wouldn't be hard.

Speaker 1: Yeah. They age out. Like, that's a good way of thinking of passwords is that at a certain point, a password just simply ages out because somewhere down the line, some breach or compromise happened. But it is important that when we see a headline like 16,000,000,000, you know, credentials leaked, there was rock you twenty twenty four had 9,000,000,000. There was collection one, which is 20 like, whenever you get one of these, it is it is worth and and you don't wanna understate that passwords are still a huge vulnerability and credential identity theft is like that is how most of this stuff happens, but it is not 16,000,000,000 new credentials have entered into the world. Exactly. It is that there is constantly this aggregation and collection process that is unfolding between bad actors, researchers, every every curious people. People make these collections, and those collections get out in the world, and that is what has occurred here.

Speaker 2: So so to go back to my hypothetical Mhmm. You're the vice president of marketing. Sure. What are you doing? What are you doing with this information?

Speaker 1: I'm probably making a blog post that reads roughly like what we just said, which is couching this in context, which is that I mean, you could go a lot bigger than a blog post, but the the sensible thing to do is, like, there was this event that occurred. Here's what it is. And it is a reminder that all of this information is ever presently sloshing around on the Internet, and that's why you want a password manager. Like, it it the threat is different than that headline characterizes it, but it is still a good reminder of the threat.

Speaker 2: Yeah. Well, the I like to for me, like, I'll flip it back on myself. It's like, this isn't one compromise. You know? It was Sony here and this blog over here, this forum and this and that and Instagram and, you know, it's thousands of compromises that have led to this treasure trove. And there's no better justification for a password manager than that. Mhmm. If every password is unique to the site that it's used on, then does it really upset you? Because the big thing is is, like, cross usage of these passwords. You know? If I if I see that Jordan uses this password and then I go log in to his email using that password and it works Mhmm. Even though, you know, Google Mail or whatever might not have been compromised, if you're reusing your password Sure. Voila. All of a sudden, I'm into your email, which is, again, as I've described, a key chain because now I can just reset all your passwords from there now that I have control of your email.

Speaker 1: Yeah. Yeah.

Speaker 2: I mean, it's scams to all your friends.

Speaker 1: Yeah. It's it's it's the tiering of passwords thing that we always talk about. It's like you have to think about what is the top of that pyramid in terms of vulnerability. It's like Totally. All these accounts are not created equal. This one can turn into a compromise for this one, which can turn into a compromise for this really special one. So you have to, like, work your way backwards

Speaker 2: Mhmm.

Speaker 1: To hack yourself in your own head Yeah. And then secure against that, and then just do that over and over again. And hope you're hope you're good.

Speaker 2: So so if this comes out, and I'm VP marketing, I'm I'm I'm loving this. I'm reallocating our our annual marketing budget to this quarter, and I'm riding this stuff because Yeah. This is like, I've personally converted three people in the last two weeks to using password managers. And it's not not even because of this story, but I'm sure it's because they passively read something on the Internet, and they asked me a question about it because they know that I know about it. Yep. And I'm like, yeah. You should definitely use one. Like, one of them, a friend of ours from Chicago who was just staying with me, he he'd asked me a simple question about it, and he wanted to give it to his entire family because I told him that, honestly, one of the the gift that I often give nowadays is an annual subscription to a password manager. Mhmm. It's like I give those out as, like, presents. And, he did the same for his family. He looked up how much a family plan cost, and it was way less than I expected. It was, like, $4 a month or something. No. And I was like, yeah.

Speaker 1: They're table they're table stakes. It doesn't matter which one you use. There's so many of them, but the basic idea that, like, now you you have these very long randomized passwords for every single one of these thing like, it it's table stakes for existing on the modern Internet, I would

Speaker 2: say. I do. And I think we talked about this recently, but I do love like, I just reset a few passwords the other day. And one of the passwords that I entered into, it was PayPal. I reset a PayPal password on one of my PayPal accounts. They had a maximum character length. Really? And I was like, you were PayPal. Like, you were a money service. Why do you have a maximum password length?

Speaker 1: Is there any technical reason why that, like It shouldn't. Okay. I was like, I'm trying to think of, like, is there some galaxy brain thing of, like, oh, at past a certain point, it could be a vulnerability if you were able to do bit bit bit. Like, is there any technical reason you can think of why that's good, or is it just bad for for a company like PayPal to have that?

Speaker 2: Like, Like, when you put something through a hashing algorithm, it comes out as equal length. So it doesn't matter what you put in. You could put in a 4.8 gigabyte

Speaker 1: Text file.

Speaker 2: In your ISO, and it'll come out with, like, a specific fixed length. Yeah. Right. And it's like, so why do you care what length my password is if you're that might implies that you're not using hashing. And then if you're not using some sort of hashing algorithm, what are you using? Like, typically, if if it wasn't PayPal, I I would just assume that they were saving it unencrypted and that they'd set the field length to a specific number, which is terrible security.

Speaker 1: But we've talked about so many things where it's just like, oh, yeah. It's just a plain text file. Maybe the file was encrypted, but inside of it, it wasn't. Yeah. It's just like that that's come up so many times on this show. And I'm sure that is not what PayPal is doing.

Speaker 2: No. Definitely. It's PayPal.

Speaker 1: I know

Speaker 2: I Yeah. Like, my bank is connected to it.

Speaker 1: They're an international banking institution for all intents and purposes. Like, yeah. It's PayPal.

Speaker 2: So I was shocked. I'm pretty sure it was PayPal. I should put a flag in there that if it wasn't PayPal, please don't sue me, but I'm pretty sure it was PayPal. Yeah. Because I'm

Speaker 1: on the show and talk about security, and we'll we'll we'll let you we'll proudly, correct that. Interesting.

Speaker 2: Yeah.

Speaker 1: Dodgy. Dodgy? Anyway, password managers, use them.

Speaker 2: Password manager, use them, reset your passwords. Punky. Go to have I been pwned and see all the times you have been pwned. Look up all your emails. I wonder if I go there now and look up Scott at Hack podcast, what comes up. Anything else exciting happen? I feel like I'm I've got a bunch of things ready for our next, like, I don't have, like, notes and stuff for me, but I just have, like, next chatty chat episode. Like, whenever I read something, I'm like, well, I'm gonna talk to Jordan about this. I want his take on it.

Speaker 1: My I have a a chat with myself and our and our team Slack that is just basically a list of links I wanna talk about. I'm very excited for the next episode to do a a a true chatty chat. No prescripted did a bunch of research story. We're we're we're gonna try being just a hot mic podcast just for the fun of it.

Speaker 2: I think one thing that I would like to just have a if we're gonna go into the, like, talk about what we care about

Speaker 1: Yeah.

Speaker 2: We recently talked about how Apple was way behind in the AI war. Yes. And there's a bunch of news coming out that Apple might be buying perplexity.

Speaker 1: And you're a per and you're a perplex wow.

Speaker 2: I can't say that word. Yes. Yes. You can.

Speaker 1: I really can't. Buy it. And I'm pretty good at saying words. And you are a perplexity user.

Speaker 2: I am. I am. As I discussed earlier in the episode, I use perplexity for on flight research and stuff. Yeah. Yeah. 16,000,000,000? Is it my making that up, or am I just taking the number that we use from the credential link? I think there was a discussion around Apple might be paying upwards of 16,000,000,000 for perplexity.

Speaker 1: It would make sense. I I I can't speak to what the rumored price would be. I had seen Apple, the people talking about that Apple, like, perplexity could make sense as an acquisition for Apple, who seems to be struggling with the development and implementation of their own LLMs, generative content. Not that Genmoji aren't the future of computing or anything, but they seem there's a story there and and maybe, some acquisition of a bunch of talent and preexisting tech could be really cool, and maybe a perplexity is the thing. I also saw rumors that Meadow was sort of, like, buzzing around them a little bit, but they seem to have a little bit of a better toehold on the tech.

Speaker 2: Meta? And this is Meta was apparently going into OpenAI and throwing just insane amounts of money at senior people. Oh, to try and, like, work in

Speaker 1: a way. Sure.

Speaker 2: Yeah. One of the one of the news articles I read about that was that they were offering some senior people a $100,000,000,000 signing bonus to come join me. Yeah. Exactly. I'm watching Jordan's eyes get huge.

Speaker 1: Like an involuntary response at the size of that. And that has to be, like, a psychological thing to be like, oh, the head of that department went over to Meta. That tells a story to all the other people that maybe that that's the place to go. Because I cannot imagine that one person could provide that amount.

Speaker 2: The the the crazy part of that story isn't that Meta is trying to buy talent because they see the market opportunity is gonna keep growing. It's the fact that I didn't read of any successful conversions. So, like, what kinda like, what's going on at OpenAI when somebody's coming up to you and, like, handing you a blank check to come join and make a boatload of money? Like, you like and you're saying, no. I'm good.

Speaker 1: Oh, yeah. So there's a few ways you could go with that. One is, disinterest in working at Meta could supersede financial compensation in some way. That's a lot.

Speaker 2: 100,000,000 for a lot of ethics.

Speaker 1: I would agree. About. But I'm just drawing out the space here.

Speaker 2: Yeah. Yeah. Yeah.

Speaker 1: There's I simply don't want to work at Meta so much. There's something about OpenAA's compensation model, be it the stock, the crazy trillion dollar evaluation not

Speaker 2: for profit that they are.

Speaker 1: Maybe there's a path to a similar amount of money, and they're going, you know what? I'm gonna stick on this road. It's been working really well. So there's not wanting to be at Meta, a financial reason for wanting to stay at OpenAI. And then there's the r slash singularity. Oh, no. They've invented God in a basement, and they're about to release JetBrank. Yeah. That level AGI, and it's there's that. There's the kind of crazy sci fi conspiratorial direction, the money direction, and then the inverse money direction. And I don't know which which it is.

Speaker 2: You've got to assume, like and this is just, you know, we are in the chat mode. But, like, you've got to assume that the $100,000,000 signing bonus is to offset employee option value. Yes. So, like, if you've been around for a long time

Speaker 1: Yeah.

Speaker 2: Your initial options dole out was at, like, 20¢ a unit and a $20,000,000 valuation. Now OpenAI is valued at TBD. No. Enough. Lots.

Speaker 1: Yes. Sam Ullman seems to be, like, at a generational level, more gifted as a fund raiser than anyone alive, I would say. He has proven to be the person that can raise money in a way that I've I can't think of any contemporary to. It's it's it's it is as not I'm not gonna say as remarkable of what they've achieved technically because they've achieved some stuff technically that's pretty damn remarkable, but boy is he good at it.

Speaker 2: But, also, like, if you've just given a $6,700,000,000 signing bonus to Johnny Ives Yeah. Like, how much money do you theoretically have in enterprise value? So, yeah, anyway, that's what I forgot what we were talking about. Perplexity, Apple. We got to OpenAI. I would sort of jump back to perplexity because as a perplexity user and as somebody who's been building AI agentic systems, frequently and commonly these days, Something I'm quite into into. Perplexity is just an agentic wrapper and it's a really good agentic wrapper. But like there it's a like, I feel like I could build some of the basic perplexity functionality,

Speaker 1: not in a

Speaker 2: in a deployable production ready enterprise way, but, like, in in, like, couple weeks. So it's like, I'm not sure, like, they don't have their own models. They're definitely gonna have a lot of consumer I think they do have a few

Speaker 1: of their own models.

Speaker 2: But if you're a perplexity user, and you pay for it, you can frequently choose which models you you want. And the models that get used are the standard ones, the anthropic models, the OpenAI models, the Google Geminis. So it's like they're literally just built a platform that's better than the default chat that wraps around those models anyway. And and I'll say that, like, that gap is shrinking. Like, Gemini has gotten very good. OpenAI has launched Deep Research. Like, Deep Research started as, like, an open source project. And it's like, I can go fork that branch right now and build off of that and probably build a lot of perplexity like functionality pretty quick.

Speaker 1: That might in the last episode, I made a big swing that for Apple, letting the LLM that a person interacts with be a a customer choice And giving those, like, hooks into the system might be how Apple steps into the AI world. And that kind of maybe makes a lot of sense with perplexing where they're like, oh, we're not really worried about the model. We're worried about the hooks and the user interactions. It could just be what they might be doing.

Speaker 2: A super gifted team to be like, here's iOS and macOS. Yeah. Where do we hook this in? And how do we best hook it in? Because I will say perplexity has done a great job of that. Like, they're and they're and they're agentic systems. Like, the perplexity labs thing, it will write code to generate me charts and graphs. Like, I'll be in the middle of, like, like, make me a a document on this so I can learn about it on the plane. And you'll be watching it go through doing all the subset research and, like, gathering all the pieces and structuring the document. And then it'll wanna show me a bunch of visuals, and it'll write a bunch of Python scripts that output pings. And I'm like,

Speaker 1: cool. Pretty good.

Speaker 2: Pretty pretty good. Like, they've done an exceptional job at it. So it's like, I could see I could see Apple finding value in that for sure. Because the thing for me is, like, when I look at Apple intelligence and its intelligence and its implementation on my phone and my computer and my iPad, I don't see it. It's not there really.

Speaker 1: Not currently.

Speaker 2: It's like, sure. It might like, I'll open up a message to to send you a message on text, and I'll get this little rainbow text strip. And it it takes me longer to close it. Like, I just don't even want it there because that's not what I was gonna say.

Speaker 1: No. It it's never it never guesses what you wanna see. Right? The text summaries are comically bad. Like, I I I have more screenshots of those that I've sent to people of what their text was summarized as

Speaker 2: Yeah.

Speaker 1: Being like, this is how I receive it's like and I think I just turned them off at this point. It's not it's not good.

Speaker 2: So, yeah, maybe that's maybe that is what I Apple's identified as their, like, weakness because I could see that because I don't love how they've integrated intelligence. I from the sounds of it and the research that I've done, their back end teams, like the Apple ML people, the MLX people, seem really good. Mhmm. I think that they're really pushing the right direction with that with the foundations models platform and the micro models that they're fine tuning that will actually run locally on your devices. Like, I think they're Great ideas. Yeah. I think they're they're moving in the right direction in a lot of those things, but the actual user experience piece has been, I would say, like, not good.

Speaker 1: It's been rickety. And then meanwhile, ex John ex Apple person, Jony Ive, you'd mentioned the 6 and a half billion dollar acquisition of so OpenAI purchased the hardware startup cofounded by Apple designer, Jony Ive, $6,500,000,000, a very weird multimillion dollar rollout video about them being friends in San Francisco. Kinda cute. It was a whole thing. Dominated a little tech news cycle for a minute here. And then last week, this must have stung. OpenAI scrubbed all mention of IO, the hardware startup that they actually purchased for $6,500,000,000 from their website, including the announcement, including the nine minute video that I referenced due to a court order following a trademark complaint from a company called IO about their name IO spelled differently. But I'm just imagining what it must feel like to spend 6 and a half billion dollars to get to release a nine minute mini documentary about you and Johnny I bumming around San Francisco Yeah. Have a glass

Speaker 2: of wine

Speaker 1: and glass of wine and then getting a court order and having to just quietly take it all down. Oh, that's gotta sting.

Speaker 2: And and here's the thing is, like, the they're pro like, all of the all of the leaks and chatter about what they're building, like the little iPod shuffle that goes on your neck.

Speaker 1: Yeah.

Speaker 2: Google a XR glasses, the Apple glasses, Metas, the Ray Bans, they just launched Oakley, Oakley meta glasses. I don't know. I just feel like without vision, like, without some form of visual interface, there's gonna be so much deficiency in the potential output that you could get from the AIs. Mhmm. Like, I could see, like, the I don't know if you're getting I'm getting flooded with gross online ads for Timu, AI bracelets. Yes. Just listen to everything that you say all day.

Speaker 1: To an app on your phone.

Speaker 2: Follow it to an app on your phone, which feeds it to an LLM so you can ask questions about it. Like, oh, what did Jordan say about this? What did Jordan say about that? And, like, the last thing on the planet that I would ever buy. But the, I just don't see as much value in that as I do in something that's helping me interact with the world, not just paying attention to me interacting with the world and coming out with it. So

Speaker 1: Yeah. I it feels like what it's gonna be is a big software innovation that they bottleneck behind a piece of hardware that everyone collectively, all three two one in unison goes, that could have just been an app. Like, that seems like where this is going. Yeah. Is that the hardware is like, well, no. But it it now it it's it's closer to you, so it can hear better. And there's a camera, so it's watching. And it's like, my phone does have all those things. Totally. It it maybe there's something magical about wearing a necklace outside of your shirt, and then you get into a whole like, I don't know. But it really sounds like it's gonna be that OpenAI rolls out some kind of agentic assist life assistant y type piece of software that's probably very, very good

Speaker 2: Oh, for sure.

Speaker 1: That they bottleneck behind hardware. Like, that seems like what this is gonna be. It's like, yes. If OpenAI made a phone, this would be on their phone, but it'll probably be hidden behind the paywall of a piece of very slick Johnny I have Johnny Ive hardware.

Speaker 2: So the I looked at Perplexity's valuation just for interest. 14,000,000,000 is a rough Internet approximation. And then I was like, I wonder what OpenAI's is. OpenAI's is rough Internet approximation of 300,000,000,000. Yeah. 300,000,000,000. 300,000,000,000, and they spent 65,000,000,000

Speaker 1: on this. I'm so we're gonna follow this hardware thing because I

Speaker 2: I find this 6.5.

Speaker 1: Oh, 6.5.

Speaker 2: Sorry. 65. 65 would be insane.

Speaker 1: I misspoke.

Speaker 2: Not that 6.7 isn't insane.

Speaker 1: It is.

Speaker 2: For a 30 person company. Yes.

Speaker 1: Yes. You're paying for Jony Ive. You're paying like, he's an extremely good industrial designer. Credit, like, obviously, iconic. Like, Jony Ive, hooray.

Speaker 2: Hooray.

Speaker 1: $6,000,000,000? My god. You could buy the Bauhaus School. Yeah.

Speaker 2: Yeah. Yeah. Yeah. Yeah.

Speaker 1: You could get all the designers in the world. So maybe there's some massive technical innovation on that hardware that none of us are seeing, and it truly is an iPod moment type thing. Like, I don't know. Right? Probably an iPhone moment is a better now analogy there. But maybe. But Maybe? Or it was a really expensive video.

Speaker 2: $200,000,000 per employee. Is my math right on that?

Speaker 1: Six point. That would be that would be more than the, the meta $100,000,000 acquisition could. Yeah.

Speaker 2: Yeah. True. True. True. But, yeah, just an insane insane insane money. It's gonna be fascinating to see what happens. And here's the thing. It's like we talked about earlier in the story about lottery is, like Yep. The government's gonna have to step in and regulate and respond to this at some point. And as they do, it will be two to five to ten years later than it should have been. We could point to crypto for this. We could point to Airbnb for this. We could point to so many different things. But they will step in eventually. Mhmm. And it's like, what is the next ten years gonna look like?

Speaker 1: Mhmm.

Speaker 2: And that one of these companies gonna do is gonna be wild.

Speaker 1: Well, we'll talk about this in the next episode, the the pure chatty chat.

Speaker 2: But,

Speaker 1: there have been a bunch of Disney v Midjourney esque lawsuits that have culminated in the last two weeks. And then as that's happening, some rumors of a Disney plus OpenAI collab. So the the rubber of intellectual property versus intellectual property eating AI models is starting to get it's starting to get real, real hot. I think that's definitely something that we need to talk about in the next episode of Hack Dun

Speaker 2: dun dun.

Speaker 1: Brought to you by Push Security. I think that's another one in the bucket for now, though. Though.

Speaker 2: I agree. I agree. See you guys next time.

Speaker 1: We'll catch you in the next one.

Speaker 4: Visible puts the ultimate wireless hack in the palm of your hand. You get unlimited five g data and hotspot designed to keep you connected, all powered by Verizon's five g network. Plans start at $25 a month or get the premium Visible Plus Pro plan and save $10 on your first month with promo code hack. Tap the banner to switch today. Terms apply. See visible.com for plan features and network management details.

Speaker 3: It's damn hard to brew a beer as simple yet well balanced as two hearted IPA. You need quality ingredients, the perfect single hop recipe, and a dedication to doing things the right way. Luckily, it's not that hard to drink it, though. You just gonna pull that little tab thing on the top, and voila. Two hearted IPA. Never half hearted. Two hearted. Bell's Brewery, Comstock, Michigan. Please drink responsibly.

Speaker 5: Ryan Reynolds here from Mid Mobile with a message for everyone paying big wireless way too much. Please, for the love of everything good in this world, stop. With Mint, you can get premium wireless for just $15 a month. Of course, if you enjoy overpaying, no judgments, but that's weird. Okay. One judgment. Anyway, give it a try at mintmobile.com/switch.

Speaker 6: Upfront payment of $45 for three month plan equivalent to $15 per month required. Intro rate first three months only, then full price plan options available. Taxes and fees extra. See full terms at mintmobile.com.