Episode Summary
Executive Summary: Tim Ferriss interviews hacker and entrepreneur Sammy Kamkar about how curiosity, reverse engineering, and open-source disclosure shaped his career. They cover his MySpace worm, privacy research, car and USB exploits, online dating experiments, and the ethics of publishing vulnerabilities. The conversation frames hacking as a method for understanding systems, improving security, and using data-driven experimentation in everyday life.
Main Topics: Hacking as a mindset and method (Priority: 5/5): Kamkar explains that he approaches problems by analyzing inputs and outputs, then reverse-engineering systems to understand how they can be manipulated or improved. USB and hardware exploits (Priority: 5/5): He demonstrates a wearable microcontroller that can take over computers via USB and discusses a modified toy device used to intercept wireless signals, including car key fobs. Privacy, tracking, and disclosure (Priority: 5/5): Kamkar describes Evercookie and his work exposing hidden tracking practices by major tech companies, arguing that public demonstrations can force meaningful security changes. MySpace worm and legal consequences (Priority: 5/5): He recounts how a prank-like MySpace exploit spread exponentially, triggered a Secret Service raid, and led to restrictions on his computer use. Online dating as an optimization problem (Priority: 4/5): Kamkar describes applying A/B testing, analytics, and automation to dating profiles and messaging, including testing photos, subject lines, and response rates. Security culture and ethics (Priority: 4/5): The discussion contrasts white hats, black hats, and gray hats, emphasizing that publishing vulnerabilities can help users and pressure companies to fix flaws. Influences, tools, and personal growth (Priority: 3/5): Kamkar cites mentors, books, conferences, and forced offline time as major influences on his development and social growth.
Key Arguments: Security flaws are best understood by testing real-world inputs and outputs, not by assuming systems are safe because vulnerabilities are invisible. Open-source disclosure can create change; Kamkar argues that public demonstrations of privacy abuses pushed browser vendors to simplify cookie deletion. Data-driven experimentation improves dating outcomes more reliably than intuition, especially when testing photos, subject lines, and response behavior. Many consumer devices, including cars and USB systems, are vulnerable because manufacturers optimize for convenience and cost over security. Forced time away from computers helped Kamkar become more social and broaden his life beyond technical work. Ethically, the goal should be to avoid intentional harm while still exposing weaknesses that protect users and consumers.
Data Points: MySpace photo limit: 12 photos - Kamkar says MySpace originally capped uploads at 12 photos, prompting him to find a way around it. Age when he got his first computer: 8 or 9 - He says his mother bought him a computer when he was around eight or nine years old. Age when he moved to Los Angeles: 13 - Kamkar says he moved from Pittsburgh to Los Angeles with his mother at age 13. Age when he was using Counter-Strike cheats: 14-15 - He describes developing cheats and reverse-engineering game behavior as a teenager. MySpace worm spread: 200 -> 400 -> 800 -> 2,000 -> 4,000 -> 8,000 -> 1,000,000+ - He recounts the worm’s exponential spread across MySpace profiles. Secret Service restriction: 3 years - He says he was prevented from touching computers for three years after the MySpace incident. Community service: 720 hours - Kamkar says he completed 720 hours of community service, plus extra hours due to documentation issues. Extra community service: ~800 hours total - He says he ended up doing roughly 800 hours in total. Online dating messages received: Close to 100 messages in one day - As a fake female profile on OKCupid, he received nearly 100 messages quickly. Dating test location: Another state - He says he tested subject lines from a profile in a different state to measure open and response rates. Car key frequency example: 433 MHz - He mentions observing a car key signal on 433 megahertz with his modified receiver. Defcon attendance: Over 10,000; about 15,000 per year - He estimates the hacker conference’s annual attendance at roughly 15,000. MySpace peak status: Number one site on the internet - He says MySpace was the top website in 2005. Company size during raid: About 30 employees - He says his startup had around 30 employees when authorities searched the company. Age when he was 29: 29 - He states his age during the interview as 29.
Pivotal Quotes: "if you don't think about how it actually affects somebody, then you're doing that." — Sammy Kamkar: On the ethics of hacking and the difference between black-hat and responsible disclosure. "I want to show people the lack of security that exists today and hopefully help protect them." — Sammy Kamkar: On why he publicly demonstrates exploits and vulnerabilities. "I would say the best subject line was fuck you." — Sammy Kamkar: On A/B testing subject lines in online dating to maximize open rates.
Implications: The episode shows how hacker-style thinking can improve security, product design, and even dating strategy. It also warns that convenience-first systems are often fragile, and that public, evidence-based disclosure can drive industry change.
About The Tim Ferriss Show
Tim Ferriss is a self-experimenter and bestselling author, best known for The 4-Hour Workweek. In this show, he deconstructs world-class performers from eclectic areas (investing, sports, business, art, etc.) to extract the tactics, tools, and routines you can use.