I took the last two and a half weeks off from work and blogging (and a lot more) and attended the 2024 Paris Olympics with much of our family. It was a fantastic experience and a great vacation too.

Although I've watched the Olympics with excitement since I was a kid (and so has the Gotham Gal), neither of us had ever been to an Olympics. So a few years ago, we decided to take two weeks off mid-summer in 2024 and go to Paris and attend the Olympic Games. It was a great decision.

We saw eleven events over eighteen days and also took a vacation within a vacation and rode the train to the beach for a few days in the middle of the first week. We timed that getaway perfectly as we avoided the two warmest days in Paris of the entire two weeks.

We were concerned about the heat in Paris in August when we planned the trip last year. Much of Paris is not air conditioned and many Parisians head out of town for August to go to the beach or the countryside. But we got lucky. It was sunny and warm for most of the two and half weeks we were there but not hot and steamy.

Paris did an incredible job hosting the Olympics. The metro ran perfectly the entire time we were there and it was very well marked where to transfer and get off to get to the various venues. The events and venues were well-staffed and there was always someone you could ask (in English) where to go.

Place de la Concorde, a huge open plaza right in the center of Paris, was turned into the center of the Olympics and they held a bunch of "urban sports" (break dancing, 3x3 basketball, skateboarding, etc) there.

There were venues all around Paris and even out in the suburbs (like Equestrian at Versailles). We only went to venues we could take the Metro to although we got to see parts of the suburbs of Paris that we had not visited before like La Defense and Saint-Denis. We came away from this two weeks with an even better feel for a city where we have visited many times and have owned two apartments in over the last twenty years. That was a big win for us.

Paris was pretty quiet which is typical of August and it was clear that many Parisians had left town. But about half of the places we like to go out to eat, drink, have coffee at, etc remained open and it was pretty easy to get into anywhere we wanted to get into.

The events were full. Even though many of the locals had left town, the tourists filled the seats. We saw people from all over the world, particularly China and Japan, and European countries like Netherlands, Germany, and Italy were also noticeable.

But of course, we were there for the events and they were great. We saw beach volleyball, track and field, swimming, diving, table tennis, regular tennis, gymnastics, break dancing, and a lot of basketball.

Here are some of my favorite photos I took of the events

It was great to see the Olympic athletes, including former Olympic athletes, at all of the events. They come to compete but they also come to support the rest of their team. Many are there for the entire two weeks and they are out and about. That is really great to see.

We learned a lot about how to do an Olympics right. Some events are great in person. Others not so much. If you don't know a lot about an event, it really helps to have the commentator telling you what's going on. That is particularly true of events that are judged.

We saw a lot of gold medal matches/finals/etc and the corresponding medal ceremony. That's a great thing to see and I'd encourage anyone going to the Olympics in the future to make sure to see some of that.

I'd also say that you don't need the full two weeks to experience the magic. We had friends who came for the first week and loved it. And we also know people who came for the second week to see some of the finals and that was great too.

I am so glad we took the Olympics plunge. We are veterans now and are seriously considering going to LA in four years. If you live in LA, I would encourage you to stay in town and go to some of the events. It is a really special experience.

Over the last month, a half dozen people I know have been targets of account takeover attacks and unfortunately, a few of those attacks were successful. Most of these account takeover attacks were aimed at Coinbase accounts.

I have written blog posts every time I have been hacked and explained how it happened to me and the mistakes I made and how others can avoid what happened to me.

This post is a bit different because I have not been the target of an account takeover in the last month. But because so many people I know have been, I feel like writing on this topic again.

First and foremost, we should never ever give anyone, even a Coinbase employee or an employee of another financial institution, our account login credentials. The hackers are doing a great job of masquerading as employees and we are easily fooled. AI will only make this easier for hackers. But rule number one is never give anyone your account login credentials, even someone who appears to be an employee of the institution that holds your assets.

My second rule is to have most of your assets in a "vault" which is an account with withdrawal limits. I like a 48-hour withdrawal limit and also a multiple signer requirement. Many people don't want their assets tied up for 48 hours. In the event of a massive price decline or some other event, they want to get their funds out. So that is the purpose of the multiple signer requirement. It could be two signers out of three or three signers out of five. The idea is to introduce some friction into the asset send/withdrawal process so the hackers cannot simply move your assets out when they take over your account.

A modification of this approach is to whitelist certain addresses you can send to immediately and put friction on everything else. I use that approach as well, but not in lieu of the 48 hour and multi-signer requirements. I like to have a lot of friction on our family's assets.

My third rule is to use two-factors on your login credentials. I prefer a hardware two-factor device like a Yubikey or a Thetis device. The reason this is so important is that if you have a hardware two-factor device on your accounts, you can be certain that nobody has access to your accounts, even when you are told someone does. Time and time again, when being socially engineered, I have taken a deep breath and thought "they can't have my hardware key" and I ignored the attack.

A new attack vector that has emerged recently is users are fooled into entering a seed phrase given to them by an employee of an institution into a self custody wallet and then they send their assets to that new wallet. Not everyone realizes that a seed phrase is the key to self custody wallet. A seed phrase is, effectively, the wallet. We should never ever enter a seed phrase given to us by someone into our self custody wallet. That is like leaving your door wide open because a thief instructed you to. The really perverse thing about this attack vector is the hackers use the word "vault" to encourage users to do this. Don't ever "vault" your assets in your self custody wallet using a seed phrase given to you.

You need to have a setup that:

1. allows you to comfortably ignore all of these attacks

2. protects you from yourself in the case you do succumb (whitelisting + multisig + 2fa)

There are certainly other rules that you can follow, but if you follow these, I believe you can keep your assets safe.

I hope you will take the time today or this week to set your accounts up correctly. Too many people are getting their accounts taken over and wiped out. We need to protect ourselves.

Disclosure: I am on the Board of Coinbase and our family is a large shareholder in Coinbase.

I took the last two and a half weeks off from work and blogging (and a lot more) and attended the 2024 Paris Olympics with much of our family. It was a fantastic experience and a great vacation too.

Although I've watched the Olympics with excitement since I was a kid (and so has the Gotham Gal), neither of us had ever been to an Olympics. So a few years ago, we decided to take two weeks off mid-summer in 2024 and go to Paris and attend the Olympic Games. It was a great decision.

We saw eleven events over eighteen days and also took a vacation within a vacation and rode the train to the beach for a few days in the middle of the first week. We timed that getaway perfectly as we avoided the two warmest days in Paris of the entire two weeks.

We were concerned about the heat in Paris in August when we planned the trip last year. Much of Paris is not air conditioned and many Parisians head out of town for August to go to the beach or the countryside. But we got lucky. It was sunny and warm for most of the two and half weeks we were there but not hot and steamy.

Paris did an incredible job hosting the Olympics. The metro ran perfectly the entire time we were there and it was very well marked where to transfer and get off to get to the various venues. The events and venues were well-staffed and there was always someone you could ask (in English) where to go.

Place de la Concorde, a huge open plaza right in the center of Paris, was turned into the center of the Olympics and they held a bunch of "urban sports" (break dancing, 3x3 basketball, skateboarding, etc) there.

There were venues all around Paris and even out in the suburbs (like Equestrian at Versailles). We only went to venues we could take the Metro to although we got to see parts of the suburbs of Paris that we had not visited before like La Defense and Saint-Denis. We came away from this two weeks with an even better feel for a city where we have visited many times and have owned two apartments in over the last twenty years. That was a big win for us.

Paris was pretty quiet which is typical of August and it was clear that many Parisians had left town. But about half of the places we like to go out to eat, drink, have coffee at, etc remained open and it was pretty easy to get into anywhere we wanted to get into.

The events were full. Even though many of the locals had left town, the tourists filled the seats. We saw people from all over the world, particularly China and Japan, and European countries like Netherlands, Germany, and Italy were also noticeable.

But of course, we were there for the events and they were great. We saw beach volleyball, track and field, swimming, diving, table tennis, regular tennis, gymnastics, break dancing, and a lot of basketball.

Here are some of my favorite photos I took of the events

It was great to see the Olympic athletes, including former Olympic athletes, at all of the events. They come to compete but they also come to support the rest of their team. Many are there for the entire two weeks and they are out and about. That is really great to see.

We learned a lot about how to do an Olympics right. Some events are great in person. Others not so much. If you don't know a lot about an event, it really helps to have the commentator telling you what's going on. That is particularly true of events that are judged.

We saw a lot of gold medal matches/finals/etc and the corresponding medal ceremony. That's a great thing to see and I'd encourage anyone going to the Olympics in the future to make sure to see some of that.

I'd also say that you don't need the full two weeks to experience the magic. We had friends who came for the first week and loved it. And we also know people who came for the second week to see some of the finals and that was great too.

I am so glad we took the Olympics plunge. We are veterans now and are seriously considering going to LA in four years. If you live in LA, I would encourage you to stay in town and go to some of the events. It is a really special experience.

Over the last month, a half dozen people I know have been targets of account takeover attacks and unfortunately, a few of those attacks were successful. Most of these account takeover attacks were aimed at Coinbase accounts.

I have written blog posts every time I have been hacked and explained how it happened to me and the mistakes I made and how others can avoid what happened to me.

This post is a bit different because I have not been the target of an account takeover in the last month. But because so many people I know have been, I feel like writing on this topic again.

First and foremost, we should never ever give anyone, even a Coinbase employee or an employee of another financial institution, our account login credentials. The hackers are doing a great job of masquerading as employees and we are easily fooled. AI will only make this easier for hackers. But rule number one is never give anyone your account login credentials, even someone who appears to be an employee of the institution that holds your assets.

My second rule is to have most of your assets in a "vault" which is an account with withdrawal limits. I like a 48-hour withdrawal limit and also a multiple signer requirement. Many people don't want their assets tied up for 48 hours. In the event of a massive price decline or some other event, they want to get their funds out. So that is the purpose of the multiple signer requirement. It could be two signers out of three or three signers out of five. The idea is to introduce some friction into the asset send/withdrawal process so the hackers cannot simply move your assets out when they take over your account.

A modification of this approach is to whitelist certain addresses you can send to immediately and put friction on everything else. I use that approach as well, but not in lieu of the 48 hour and multi-signer requirements. I like to have a lot of friction on our family's assets.

My third rule is to use two-factors on your login credentials. I prefer a hardware two-factor device like a Yubikey or a Thetis device. The reason this is so important is that if you have a hardware two-factor device on your accounts, you can be certain that nobody has access to your accounts, even when you are told someone does. Time and time again, when being socially engineered, I have taken a deep breath and thought "they can't have my hardware key" and I ignored the attack.

A new attack vector that has emerged recently is users are fooled into entering a seed phrase given to them by an employee of an institution into a self custody wallet and then they send their assets to that new wallet. Not everyone realizes that a seed phrase is the key to self custody wallet. A seed phrase is, effectively, the wallet. We should never ever enter a seed phrase given to us by someone into our self custody wallet. That is like leaving your door wide open because a thief instructed you to. The really perverse thing about this attack vector is the hackers use the word "vault" to encourage users to do this. Don't ever "vault" your assets in your self custody wallet using a seed phrase given to you.

You need to have a setup that:

1. allows you to comfortably ignore all of these attacks

2. protects you from yourself in the case you do succumb (whitelisting + multisig + 2fa)

There are certainly other rules that you can follow, but if you follow these, I believe you can keep your assets safe.

I hope you will take the time today or this week to set your accounts up correctly. Too many people are getting their accounts taken over and wiped out. We need to protect ourselves.

Disclosure: I am on the Board of Coinbase and our family is a large shareholder in Coinbase.