Hi everyone and welcome to my talk about trusted platform modules or TPMs for short. My name is Jonas Wittschel, online I also go by the nick of Diabonos on sites like GitHub, Reddit or an IRC. I have been actively involved with the Arch Linux project for about a year now as a trusted user and I am also one of the maintainers of the TPM2 software project on GitHub where I maintain TPM2 TOTP which I'm going to show off today as well. So to get started with the actual talk, the first question I imagine some of you might have is what actually is a trusted platform module and why should I care about it? Well, a trusted platform module is a small chip on your computer and it's totally separate from your main system so it has its own memory and processing capabilities and it can do cryptographic operations like encrypting stuff or signing stuff and the idea is that you can store secrets on the TPM totally separate from your main system and do operations there and you never expose them to your actual system. So why is this important? Well, an example many of you might be familiar with are SSH keys. An SSH key is essentially a small secret you use to authenticate against servers on the internet. And usually these secrets are stored on disks, they might be protected by a password but still if an attacker manages to get a hold of your system they can be able to, well, exfiltrate the file, sniff the password and then they can do anything they like with your SSH keys. And the idea is with a TPM you can store this secret in the TPM and then ask the TPM, okay, I need you to sign this data to authenticate against another server. Still if an attacker gets into your system they are able to talk to the TPM and do stuff with it of course but once you switch up of the computer they can't do anything anymore with it and if you suspect there's something wrong with your system you can just wipe it, reinstall your operating system and continue using your keys because they are always stored there and never exposed to your main system. So the next question you might have is, okay, great, now do I actually own a TPM? Well, the good news is that many devices already come equipped with a TPM especially laptops because I think it's some kind of the Microsoft certification requirement and even if you don't have a separate chip many modern processors do have one implemented in the firmware. So in this case of course the distinction between the TPM and the main system is a bit blurred but still it's way better than just storing your secrets on disk. And unfortunately there are two different incompatible versions of the TPM specification. There's TPM 1.2 which is old and deprecated by now because it uses absolute cryptography like SHA1. So you don't want to use this if you can. The new specification is TPM 2.0 where all cryptographic algorithms are flexible so if one gets obsolete you can just exchange it. Unfortunately these two versions require totally different software stakes so today we're only going to talk about TPM 2.0 devices and to find out whether you have one of these you can just look for the device file DEV TPM RM0 on your system so if you've got that you know that you have a TPM 2.0 device that you can use. Even if you don't have one there are software emulators available so if you want just to get started with the concepts or even if you haven't a TPM to play around with it without fear of losing important data or breaking your TPM somehow you can use one of these. Please don't use them to store actual secrets because they just store everything on disk so it's not more secure than just storing your SSH keys in a file as usual but for playing around it's quite nice. So next question is probably okay I want to use the TPM how do I do that? Well fortunately the TPM specification is open you can just freely download it. There's also a standardized C API and there are multiple open source implementations of this API. The one we are going to use today is called TPM 2.0 TSS and related software so you can just download that from GitHub and start coding. Of course this is great if you want to create new programs if you want to make existing programs aware of a TPM that might be a bit of work to get it into all software in existence fortunately there are other existing standards to access cryptographic tokens like these USB smart cards you might have to store for example SSL certificates one of these standards is called PKCS11 and there is some kind of bridge between this standard and the TPM which is called TPM 2.0 PKCS11 so you can use this for all software that is PKCS11 aware like OpenSSH or also Firefox for example and if you want to protect your SSL certificates you might be interested in an OpenSSL engine that exists which is called TPM 2.0 TSS engine so there are existing compatibility bridges to use the TPM with existing programs that confirm certain standards but if you just want to play around with a TPM just to see what it can do I'd recommend installing TPM 2.0 tools it's a set of command line applications and basically every application just exposes one functionality of the TPM so you can just play around with that read the man page everything is documented quite nicely to see what a TPM can do before you do that you want to add your user to the TSS user group because by default the TPM is just available to root so to get access as a normal user because you don't want to run all these tools as root add yourself to the TSS user group log in, log out, log in again and then you can get started okay now for some practical demonstrations first I want to show you how to protect your SH keys the example I've already talked about using your TPM so we are going to use this PKCS11 bridge I've already talked about and so you need to install the software of course as I said you need to add yourself to the user group and then you can get started with the example which I'm going to show you now so first what we need to do is we need to initialize a store because the TPM itself has only a very limited amount of memory so what you do is instead of storing all your keys in the TPM you are storing them on disk but protected with a key that is only available to the TPM so it's just as secure as storing everything in the TPM because you can't do anything with the on disk files so we need to initialize the store on disk and create this key that is only available in the TPM which is called a primary key and this command does this then once we've got this we need to add a token so this comes from the PKCS11 standard so think of a token as one of these smart cards you can store multiple of these tokens in one TPM so it doesn't make too much sense in the context of your TPM but you can use for example different tokens for different purposes like SSH keys, SSH host keys OpenPGP keys whatever to add this token we need to specify the idea of the primary key we just created so this number is usually one we give it a label so we know what it is for we want to use it for SSH keys and we also need to specify two kinds of passwords the first is some kind of admin password so you can use this one to for example if you forget the user password you can reset it with this one but usually you just use this user password here for everything else so now we've got a token we now can proceed to actually add one of these secret keys to it so we've got TPM to P2 add key we need to specify which token we're going to use so we call that by label then we can give the key a name so for example if you're using different SSH keys for different hosts you will probably put this here to identify which one is which it's just a label that isn't used for anything important then you've got the key algorithm so in this case we're using an elliptic curve algorithm with key strings of 256 bits and again we need to specify the pin we've just created so now we've got the key now everything is set up we just need to make sure now that SSH can actually work with this key so we need to get the public card of the key which we can do using SSH key gen with the DA argument and then you specify the path to this library TPM to pks11 which we are using which is this path here and this outputs the public part of the key so now you can copy this to your system that you want to authenticate against and once you've done this you can now authenticate against the system using SSHI again you need to specify the path to the library and of course the server that you want to authenticate against so if you do this you need to input the password you've just created and as you can see everything worked nicely and you get also some kind of debugging output so these warnings are not important but for example if you manage to mistype your password it will tell you this as well of course if you want to authenticate against multiple system typing in your password every time you do SSH becomes old pretty quickly so what you probably want to do is you want to add this key to your SSH agent which is the standard way to manage multiple SSH keys so you can do that as well using SSH add with the s argument and again you specify the path to the library and then you should get this output if I do SSHA add L you can see that the key has been added to the agent cool so this is probably the easiest way to make your system more secure using ATPM just store your SSH keys there of course remember to do backups so if you're playing around with that you don't want to have this as the only key because something might go wrong but yeah that's quite a nice way of making use of ATPM so the next example open pgp keys I am gonna skip over a bit because I'm afraid I won't have enough time to show the actual example but I have all the instructions on the slides and the slides should be available on the conference page by now so if you want to do that you can look it up there in more detail unfortunately using ATPM to manage your open pgp keys it's a bit more difficult because one of the problems is that newpg does not support kac as 11 tokens it has its own kind of standard but well that's a bit hard to work with there is a branch to work with ATPM natively which someone created a while ago unfortunately it hasn't seen much development I think the last comment was in 2018 so at the moment it's a bit hard but you can do it there is a compatibility layer that connects pkcs11 tokens to newpg which is developed externally the name can be found on the slide the issue with that is that it only exists it only supports existing keys that are already stored on the token so you cannot migrate your keys that you already have to the token but you have to create new ones there so I don't recommend actually generating the whole key on the tpm because if you lose your computer or restart your tpm the keys will be gone and this is not so great for pgp keys of course but what you can do is if you have separate sub keys for every device to do signing then you can store these signing keys on the tpm so I think that's kind of a cool usage but I wouldn't recommend storing the whole key there and the other limitation but somebody would have to put it in the work but that would be doable but it hasn't been done so far is that this compatibility bridge I'm talking about only supports rsa keys so if you want to have more modern elliptic curve cryptography keys that is not possible at the moment so yeah, as you can see on this slide it's a bit annoying I'm not gonna demo it but yeah, this would be the setup and again you can find the slides on the conference page so you can look it up there okay, so this should give you some idea what you can store in a tpm and how you can use it the other thing I want to talk is how can you use a tpm to secure your boot process so the idea is of course now if an attacker gets into your system they won't be able to exfiltrate the actual keys but they will still be able to do something with the tpm wouldn't it be nice if your tpm could just say okay, something is wrong here I don't give access to these keys because I sense that some attacker has compromised the system and a tpm can do this so it can grant access to your secrets only if the system is in a known good state well, what is a known good state? the root of trust in this case is your device's efi firmware to trust your hardware vendor as usual if you don't do that you're already pretty lost and what your efi firmware does it can measure certain configurations or system states into so called platform configuration registers on your tpm so every time a certain kind of event occurs it measures this into your tpm and you can then proceed to seal your secrets against these configurations so only if the configuration matches access to the secret will be granted and well, what kinds of measurements are there available? there are different kind of platform configuration registers for different kind of events I'm not gonna talk about all of these but only about the most important ones or the ones you might be wanna use for your own setup so the most important pcr you always want to include in your measurements is pcr0 because it stores the hash of the efi firmware if you update your firmware or someone changes it somehow that should make everything else invalid so this is important to include and then you've got pcr4 and pcr4 stores a hash of all the efi binaries that have been executed in the boot process so usually this is at least your bootloader and probably also your kernel as well and to be more secure you should look into making a unified efi bundle to store your kernel, the init ramfs and the kernel command line in one single efi application how you can do that you can look up in the ArchWiki because in this case you measure everything in there you can't change the init ramfs anymore for example to put malicious binaries in there so in this case to make use of the tpm in full potential you want to do this and the other interesting pcr you might want to be aware is pcr7 because it stores the secureboot state so secureboot is a way you can sign the binaries that are launched during the boot process and only so the firmware only executes binaries that are signed by your trusted keys and pcr7 measures whether secureboot has been turned on or off so that nobody modifies your BIOS configuration to just turn it off and it also measures the certificates that have been used during boot so if you're using your own keys you will be sure that only your own keys have been used not for example the Microsoft key to load something else if that is already stored in your efi firmware by default so what I'd recommend is if you want to go that route either if you're using secureboot with your own keys you want to use at least pcr0 and 7 and if you're not using secureboot you probably want to use pcr0 and 4 combined with always one of these unified kernel images if you're using pcr0 and 4 it means after every kernel or in-end ramfs update you will need to recalculate everything after an update so you will have to reseal your secrets to the new values so this can become a bit annoying I'd recommend doing secureboot because then you only have to make sure that the signing keys match so you can just use pcr0 and 7 and how do I do that now how do I verify that my system has not been tempered with during boot well the easiest way probably to do this is to use tmtotp which I'm a co-maintainer of as I said as a full disclosure tmtotp allows you to store a time-based one-time password or totp secret in your tpm and it shows it every time you boot your system so totps you might be familiar with from two-factor authentication in the internet so the idea is you store a secret on your phone and a secret on server and you need to then input the secret as the totp you get shown on your phone which changes every 30 seconds because it's derived from the secret store there and the current time you need to input this 6-digit code to authenticate against the server in this case it's the other way around your system shows you this 6-digit code which changes every 30 seconds and you can verify it with your phone to see whether the two match and when you boot you look up the code on your phone if the two match then you can be sure that your system configurations or at least the part you measure as I said this depends on the PCR series has not changed and there are already hooks available for mk in its tpao and draket so this totp should get shown automatically during boot and if you have Plymouth installed it gets a bit more fancy but usually it's just plain text output which works as well of course so how do you do that? yeah of course you need to install the actual software and then I can demo that quickly as well for you let's clear that up you just do tpm2 totp generate and you specify the platform configuration registers you want to seal against I'm using secure boot with my own keys so I will be using 0.17 here and generate a key let's make that a bit smaller now you get a QR code you can scan with your favorite totp applications on your phone and then you can do tpm2 totp calculate which should show you the 6 digit code of course this talk is pre-recorded so by the time you are watching this if you scan this code this will not match anymore which is fine but if you do it yourself on your own system the truth should match now otherwise the time is not correct on either your computer or laptop and on your phone great of course you need if you're using mkinitcpao you need to add tpm2 totp to your hooks so you would then add it at cmkinitcpao.conf and put the tpm2 totp hook in your hooks variable do it before your encrypt hook because otherwise you won't be able to see it in time so do it as early as possible and then during build it will look something like this this is if you've got Plymouth installed to have a nice graphical boot I don't usually do this it's on the AUR so if you're not using Plymouth it will be just a plain text hook it will not look as exciting as this but it will also show the current time and the 6 digit totp secret so this is great if you have interactive access to your system and can actually verify this code if you have a remote server it might not be possible to check this code every time before you input your disk encryption keys so what you would want to do for remote servers is you would want to store the disk encryption key in the TPM and store it against a known good system configuration so if that doesn't match anymore it won't input the key and won't boot your system essentially so you have to come fix that because someone has tempered your system somehow and if everything matches it just basically inputs the key automatically and boots up without your user input so this is basically what BitLocker does in the Windows world because it stores the key in the TPM on Linux that's a bit more annoying at the moment but will hopefully get better quite soon because now there is not a very standard solution that I'm aware of but the one that probably comes close is Clivis, it's also packaged in the official Arch Linux repositories there are Drakeit hooks available for it so if you are using Drakeit you can use it pretty much out of the box for mkinux cpa oh unfortunately there is no such support at the moment but if you want to look into this at the moment I recommend Clivis but fortunately it will get better pretty soon because native support for storing the secret in the TPM is planned for crypto setup 2.4 so that's why I'm not going to show a demo today because hopefully the next version of crypto will have that already set up for you and you can just use it out of the box and I'm very excited for this so hopefully in another year's time we can come back and I can just show you that it's going to be real easy so hopefully I've given you some ideas about how you can use a TPM and why it's nice to store secrets there instead of storing them directly on disk I've also briefly touched the subject how you can verify the integrity of your system using these platform configuration registers as a last word of warning please always do backup of course because you don't want to rely only on the TPM if you manage to clear it by accident or something goes wrong with the software you don't want to lose all your disk encryption keys or your PGP keys so please always backup on some encrypted hard drive somewhere else where you store all your data so if you're interested in this topic of course there's this Q&A session starting now on the conference ISE channel so I welcome any questions there if you want to know how to get started for example contributing to the software yourself or there are also some more tutorials available which software already has TPM support and how you can achieve it you can look at our web page which is shown here there's also if you have any further questions there's a mailing list and a Gitter Chat so ways to get in touch quickly thank you very much for listening to my talk and I welcome any questions you might have now we have some questions for you not about this talk about TPMs and the first question is from Jonatan what's the advantage of using TPM for storing keys as opposed to storing keys on an encrypted disk well if you're storing keys on an encrypted disk the keys are secure as long as the disk is encrypted for sure but as soon as you unlock the system so if an attacker is inside your actual life system then the keys are not protected anymore because the attacker can have access to everything that's stored on disk because it's encrypted then so the idea is even if your system is compromised if you store them in a TPM the attacker can't get to the actual secret they might be able to use the TPM but as soon as you switch off your computer you know nobody's doing any bad stuff with your keys because they are never exposed to your main operating system our guest had a question that was almost the same is it possible to use TPM to store disk encryption keys yeah so that was the last part of the talk I apologize for not going into detail there because it's just because I believe that the native support that cryptocurrencies will hopefully gain pretty soon will be much easier to set up so I didn't want to go into detail you have a couple of options now you can write your own mk in its DPA or or you can use the ones that are pre-built for example the ones from clevis for drake but at the moment that's a bit complicated to set up so hopefully the next version of cryptsetup will make that all very easy then we have a question from J4 and J0 and John it should be pronounced can you do secure boot with TPM also can it be prevented from being rewritten by artisuit on a USB so secure boot and TPM are somewhat complementary so you can use both at the same time and in this case a TPM can for example be used to store your disk encryption keys and only release them if your secure boot setup hasn't changed so what you do is you verify using secure boot that your if I have binaries have not been tampered with then the TPM guarantees that only the secure boot keys that you are using so probably your own keys not the ones for example from your distribution or Microsoft have been used but only your own keys and well if you boot art ISO usually you don't have that one signed with your own keys so it wouldn't boot using secure boot and if you turn off secure boot then the TPM won't return your keys because your configuration has changed so you would have to sign your art ISO with your secure boot keys and in that case I'd assume that's actually what you want to run then we have a question from Hexshain it seems to me that trusted boot overlays with secure boot in some ways does it yeah so secure boot is basically just guaranteeing that your system only executes trusted binaries you can do that with a TPM so trusted boot without using secure boot but it's not so convenient because then every time you for example update your kernel your binaries change that you run during boot and so the system stays these PCRs I was talking about change as well and therefore it's quite nice having this combination of secure boot and a TPM but you don't have to do it you can use secure boot without a TPM of course and you don't necessarily need secure boot while running a TPM to secure your boot up it's just a bit more convenient in my opinion Lars to ask the next question do you not actually need the type of passphrase on boot time if you have set it up with TPM that's something you can configure yourself so personally my setup requires typing a passphrase as well as storing part of the encryption key in the TPM so you have to have both for example if you have a remote server you probably don't want to type in a passphrase and this next version of crypto setup should also make this possible either just to store the disk encryption in full in the TPM or to secure it with an addition of a passphrase so that's basically what you get in the Windows world with BitLocker at the moment already because they can either choose to just unlock the system automatically or require a second pin to be typed in addition to the protection that the TPM offers to the disk encryption key and then RISFerry 111 has the next question how does TOETP actually derive a code from the key and time is it something as simple as hash key plus time yeah basically so it's an HMAC algorithm which is basically just a hash derived from a secret which is stored in the TPM and the current time and the nice thing is that the TPM can actually do this HMAC calculation itself so in the previous version of the specification this was not possible but now you don't actually need to release this key anymore at all to the operating system because just the whole HMAC operation is done in the TPM you just have to fed it the current time that still comes to the operating system so it's potentially untrusted that's maybe some kind of attack vector but the TPM doesn't have real-time clock so this part is not secure but the the secret part of the HMAC is stored in the TPM in a release from Grazulini nice talk Jonas but how do you account for time difference between your phone clock and the TPM to TTP output will take more than 30 seconds to display the right token so the hooks actually display the TTP after 30 seconds has passed so once as fast as it can be done and then every 30 seconds so every after every full 30 seconds has passed of course if your system clock and for example smartphone clock don't match then you're going to have a problem but at least you can detect that pretty easily because if you're not using Plymouth that is but just the plain text version you get the current system time of your laptop computer or whatever so you can at least see where it's going wrong of course again the system time is not something trusted so one possible attack vector is that somebody messes around with your system clock and just pre-generates a lot of the CO2D values so that's something you keep in mind but yeah that's not an attack vector particularly including in a threat model and then the last question we have time for is from Sirac was there any research into the physical security of TPMs were just stealing a TPM means stealing the keys inside yeah so if somebody gains physical access to your TPM I wouldn't be entirely confident that they couldn't extract it so of course that's again not really part of the threat model but yes if you gain physical access to the TPM probably you can with some kind of microscope and everything get out the keys somehow so I think there has been some research I'm not an expert on that at all but yeah I think this is definitely a possibility yeah and that was the questions we had time for next up is the lightning talks after the break


Hi, my name is Mark Schultz. This is a preview of my talk securing approximate homomorphic encryption using difficult privacy based on joint work with Bayou Li, Demi Ali-Machancho, and Jessica Sorrell. The talk concerns polyhomomorphic encryption. The cryptosystem is said to be polyhomomorphic if it admits to privacy homomorphisms or ways of combining encryptions of m and m prime into encryptions of their sum and their product. This suffices to compute arbitrary boolean functions. It's often formalized as an evaluation algorithm such that on input a circuit d and an encryption of a message m, one obtains a cyber-tech c prime that decrypts to dm. Sometimes it only decrypts to a nearby value, though. The difference from the correct value is known as the error. There are many constructions of FHG in the literature. CKKS in particular is not correct. Instead, it has a small error. This scheme will be of central importance to our work. Li and Machancho have suggested mCPA security is the wrong notion for the passive security of incorrect cryptosystems. The correct cryptosystems, decryptions of honest and generate cyber-techs are simulatable and therefore give no information to an adversary. The incorrect cryptosystems, these decryptions can leak information even if the user is only honestly interacting with their oracles. This occurs for CKKS and leads to a distinguishing attack and key recovery attack. Li and Machancho propose a new security definition, which they call NCPAD security or NCPA with decryption oracles. This is different from NCCA security as you can only decrypt honestly generated cyber-techs. In the setting of correct encryption, it's identical to NCPA security, but as CKKS shows, for incorrect encryption, there's a separation between the two notions. Li and Machancho left it as an open problem to achieve NCPAD security for CKKS. After they published their attacks, many libraries implemented countermeasures. These all roughly post-processed decryption by inducing large enough noise in some way, where large enough is controlled by some user, controlled parameter. Our work is to characterize what large enough means concretely. In the full version of our words, we used a variant of differential primacy and considered two separate notions of correctness. In this preview, I will simplify to Gaussian noise funding and static correctness. By static correctness, I mean that the norm of error can be publicly bounded by some function of both the circuit to evaluate and some bound of the norm of the input. The concrete security notion we use is that of C-bit security of Machancho-Waltzner. The particles that have C-bits of security in some cryptographic game, if for every adversary, there is a concrete trade-off between the running time of the adversary, TFA, and the advantage that adversary achieves in the game. We relax this notion to something we call CS-bits of security, where now for every adversary, either this inequality bounding the trade-off between the T of A, the running time, and the advantage is satisfied or a separate inequality bounding solely the advantage of the adversary achieves the satisfied. This is a concrete weakening of the notion of C-bit security. That's easiest to see graphically. This is a graph of the logarithm of the running time of the adversary to the logarithm of the inverse of the advantage. In terms of this graph, a protocol has 128 bits of security if the parameters that any adversary achieves attacking this protocol falls into this blue region. In particular, there are no adversaries that achieve the parameters that are contained in the white region. The notion of CS-bit security enlarges this set of allowed adversaries slightly. For the particular example of S equals 96 bits of security, it enlarges it to this cyan region. This set of additionally allowed adversaries is a non-trivial set. There are new adversaries allowed by this attack, but all of these adversaries have explicitly low advantage. In the example at hand, all of them have advantage less than two to the minus 96, independent of the running time. And if one wants to achieve higher advantage, one has to go back to the old adversaries, the ones that previously existed from the 128-bit security optimization. So while this does concretely introduce new adversaries and is therefore a weakening of the security notion, it's in a controlled way that we view as likely acceptable in many situations. Using this novel notion of concrete security, we're able to get significant gains. Our main theorem can be raised as follows. This CTKSNC bits of NCPA security, post-processing by adding S over two plus the logarithm of the bound of the size of the error contained in this hypertext, bits of IID gaussian noise achieves CS bits of NCPAD security. This is S over two additional bits of noise if one thinks about it. It's nearly tight for S bits of NCPAD security. In particular, we have an attack that shows that S over four additional bits is insecure. By using this weaker notion, this CS bits of hearing notion, we can obtain substantial gains for even a moderately large S. Concretely, using S equals 96, we can attain a countermeasure that has 15 bits of smaller parameters, which is 20% of the total noise that we do an app. And for S equals 64, this becomes 30 bits smaller, which is roughly 35% of the total noise. While we apply this to the setting of FHE, we expect this to be broadly applicable whenever one is competing, combining a computational primitive in our case FHE with some statistical primitive in our case differential privacy. In summary, we find that post-processing with between 25 and 82 bits of additional Gaussian noise is suffices to achieve 128 S bits of NCPAD security for a wide range of S between 32 and 128 in particular. The precise S which one chooses should be application dependent in a way that will be elaborated on in the full version of the talk. CKKS limitations that support 128 bits of plaintext precision can easily fit a countermeasure. Implementation with only 64 bits of plaintext precision may be more difficult to secure with our countermeasure. While one can secure them likely by choosing small enough S or by exposing less plaintext precision to users of the library, this may make CKKS in these small precision settings less competitive with other FHE schemes. While our countermeasure uses large amounts of noise, we have a lower bound on this noise, at least in setting of C bit security with Gaussian noise. So this large amount of noise does seem interesting.


Now, when you think of coffee, you might think of a melky, sugary frappe of some sort. You might think latte or cappuccino. They're everywhere these days. If you think that's normal, sorry folks, you're wrong. In most other areas of the world, cultures actually get the benefits of coffee because they don't add anything to it, including milk. Now, there's two reasons you're actually drinking coffee. Caffeine, that's probably obvious, and the polyphenols in coffee, which may not be obvious. Now, coffee, because of the caffeine and because of the polyphenols, helps uncouple your mitochondria. And I've written an entire book about how important it is for your health to uncouple your mitochondria, basically make your mitochondria work less hard, and tell your mitochondria to divide and make more of themselves to share the workload. That's what uncoupling does. And caffeine and the polyphenols in coffee are both great ways to do that. The other recent evidence is that polyphenols are actually some of the favorite food of your gut buddies, and the more polyphenols that you add to your diet, the more diverse and happy your gut buddies become. So polyphenols are actually a prebiotic. Now, unfortunately, when you add milk to your coffee, the proteins in milk bind to those polyphenols, and they're unfortunately totally unavailable to feed your gut buddies they basically become worthless. So what do you do? Well, let me give you an example of what not to do that's actually staring us in front of our faces. There are several cultures that add milk to tea, like the British. And I trained in London for a year, so that is something they do. And there are several cultures that do not, like the Japanese and Chinese. Now only the Japanese and Chinese actually get a benefit from the tea because the milk proteins have not bound up the polyphenols. Sadly, the British have lousy longevity, and the Japanese and Chinese have fantastic longevity. And one of the factors is the fact that they're not binding the polyphenols in their tea. Sadly, it's even been shown that this affects blueberries that you mix into yogurt. Binding the blueberry polyphenols with the yogurt makes them, unfortunately, useless. Now, some people will tell you that adding milk helps to prevent staining of their teeth due to the polyphenol binding. Please do not listen to this. In this case, staining your teeth is a good thing. And if you're super concerned about it, just use a straw or brush your teeth or do an oil pull after you drink your favorite beverage. Now, America loves coffee. If you must add a creamer to your coffee, use something like coconut milk creamers or macadamia nut creamers. But buyer beware, macadamia nut milk, and I won't mention the brand, now has added pea protein to make it more creamy. And as you probably know, pea protein is loaded with lectins. However, there are some macadamia creamers, not milks, that don't have that pea protein added. So read the label carefully. Coconut milk is always a great idea because it will not bind to those polyphenols. Now, I see far too many people trying to be dairy-free and adding almond or oat milk to their coffee. Quite frankly, they're destroying their gut and their health. Now why? Because almond milk, unfortunately, is made from the peels with the peels and the whole almonds. The peel actually contains lectin. And as I've written about before, and you'll see in the new upcoming book, that almonds and almond flour are some of the most food-sensitive producing compounds that my patients react to. Sorry about that. But what about oat milk? Well, oats and oat milk have become trendy. But I urge you to go on the internet and look for a recent YouTube posting of a young woman who was wearing a continuous glucose monitor and went to Starbucks and had an oat latte and traced her blood sugar levels. They shot through the roof and then a half hour crashed down into the 40s or 50s. And she literally had to be woken up from her nap. So this stuff is just pure unadulterated poison, sugar poison. And as I've released in previous videos, oats, even organic oats in this country, have levels of glyphosate round up and another cancer-causing chemical in them, according to Consumer Reports and the Environmental Working Group. It is not a healthy option. If you've got to have a creamer, use a coconut milk or macadamia nut creamer that virtually has no protein, or look for a number of the popular MCT creamers out there, which don't use for the most part these problem makers. Now, interestingly enough, as you know, I spend a lot of time in Italy. And I've always been fascinated that the Italians may have a cappuccino in the morning. But almost all baristas will cut you off from cappuccinos about 10 o'clock in the morning and only agree to serve you espressos, or if you must have a little foam, a espresso macchiato. Now, a macchiato in Italy is just a little dollop of foam on the top.  So even the Italians understand that they really don't want to mess with a good thing for most of the day. Now, some of the world's longest living people, people with the longest longevity, actually boil their coffee all day and then drink it black. Why are they so smart? It turns out that the longer the coffee grounds are exposed to the water, the longer the polyphenols are taken up in the beverage, in the coffee you're drinking. So boiling it all day, as strange as it seems, is actually a really smart idea. Now, the other thing that surprises people is your drinking coffee for two purposes. Caffeine and the polyphenols. The more dark you brew the coffee, like French roast or dark roast, the less polyphenols are in that coffee. So if you're going to buy coffee for roasting or for drinking, try to buy the lightest roast. Surprisingly, everybody thinks that the darker the coffee, the better it is, the more polyphenols, but it's exactly the opposite. You want light roasts, worst case scenario, medium roasts, stay away from the extra dark roasts like French roasts and you'll be doing yourself a favor by giving your gut buddies more of the polyphenols that you're actually drinking coffee for. And for goodness sakes, stop putting milk in your coffee. It does not do a body good and it does not allow your gut buddies to get the benefits that they're looking for and in turn, they'll help you. So have a cup of Joe, but have it black, folks. If you're really miserable, add my new favorite sweetener, alieolose to it, add a macadamia or coconut creamer or add a MCT creamer and you'll get the smoothness you want with all the drawbacks. If you found this video helpful, I think you're going to love this one.


Want the next best health and wellness pick? We've got the hottest pick in the sector. Join Rich TV Live community by clicking the link down below.


All right, I've got enough fiberglass in there going up the sides that I feel I can call this heavy-duty Can't tell if I have rain incoming or if it's just cloudy Well luckily I can work on this in the rain anyway Darn, I've got thunder and lightning. I better call it a day. Oh But I did get these all fit in there pretty well not Attached with anything, but they fit quite nicely. I can feel a few sprinkles Just race that lightning home Often that I want a bigger motor on this boat, but right now I would like a bigger motor Oh, there's the rain lightning still over half a mile away, and there's home right there There's still nine Bellatrix. All right. I have just enough resin in my paddles here To lock them in place, so I'm gonna let that harden and while that's hardening I'm gonna deal with something I've been ignoring Alright, these bearings are getting stuck Not all of them. Two of them are good. The two that I put the two good ones in the middle because I can't get those ones out The two sticky ones I put on the outside and what I think is happening here is the rollers Are ending up twisting which isn't a huge problem Except that they're wedged in too tight So they're actually wedging themselves against the inner part of this and the ring on the other side This one so they're just kind of getting stuck So if that theory is correct, I Can drill out these rivets Pull this out a little bit Put it back in and it should be much smoother These things did run smooth when I just made them and then after being out here for a few days a week or whatever Now they're stiff. It could just be because there's dirt in them and it's causing more friction I Want them to be able to work in non optimal Circumstances because I'm going to be using them in real life, you know, I won't always have optimal circumstances So I'm not going to clean them out. I'm gonna leave whatever dirt or whatever's in there Making them sticky and I'm gonna try to make them work well with that. You know, there's another thing I'm thinking that might be an issue So the rollers push on this part and this ring, right? Now if these are skinny They'll just rub against like the bottom edge of the roller, but since they're kind of fat They're they're rubbing kind of higher up on the roller than Maybe they should definitely would cause more friction The rollers definitely won't fall out. However, I think this should be skinnier and this Ring in here should be skinnier Maybe I can find a way to sand them a little bit and kind of bevel them so that Only the the skinny park touches and then I got my three-row it's drilled out Hit this on Wow, it's in there tough All right, I think I figured out the problem It's that when you know when these are perfectly straight no problem, but they end up tilting a little bit I'm gonna exaggerate it just for So it's easier to see and then they start to you know rolling against the side rings, right? and If everything is loose enough, they'll just kind of slide along like that instead of actually rolling up They'll just slide back and kind of stay like that, right? But I have everything in there so snug that these can't slide and It's just getting stuck So You need to take some off this Just make them a little bit looser and it didn't become an issue until these got some dirt in there and some grit And they got harder to slide around, you know Okay, here's why I think this All right, so this rolls out a little bit. I guess the things are biased so they Slowly rolls out slowly rolls in this way until it hits the Ring and then it's stiff No ring on this side. They're not getting wedged in it's just Pressing up against this ring And now if I just try to push the inside out It's pretty stiff. It's not that easy to move so This you know this whole thing needs to be able to slide more easily Now one way I could test this theory is I could wax the inside of this and then see if they run smoother I do have some wax Wax in there a bit of wax on that guy. Let's reassemble In the other way, so you've got caught there for a second, but then it just slid out and started going smooth again Yeah That is much better. So definitely When I put some grease in these I do still want to loosen them up a little You know I won't always have Grease in there and water could get in and splash the grease up and it dries I just wanted to be able to work in really crappy conditions and in excellent conditions. Man, that is so much smoother now They're all fiberglassed on Looking good Now what? I guess that wheels pretty much finished. I don't like he's a bit of sanding in paint But I can't do any of that stuff till the fiberglass is totally cured. I Guess next is chairs Chair here and over there and then one here and on the other side So I'm thinking the two front chairs because it's the front of the boat two chairs on this side They'll be kind of low and I want the backs to be able to lay way back So you can almost lay all the way down maybe even just lay straight down So you can like super chill out while you're pedaling this way And then this one I Can either move this out of the way or I can just make the chair a little higher So in your legs will come down like this And then this one you'll be sitting higher And that'll be kind of good because then you'll have a good a better view for you know wherever you're going So yeah, make this a higher chair and this a lower chair also that'll make it so The pedaling isn't always the same So if your legs get tired of pedaling in one way you can switch to the other way and I'm gonna make the boat So it can go both directions, so you can pedal that way or that way even if you're the only person on the boat Well, you know what else I can work on to rudders speaking of going directions And if I'm gonna make the boat omnidirectional well bidirectional, but I'm just gonna call it omnidirectional I'm gonna need posts at this end to put the Things on rudders presuming. I use these posts. I think I think that sounds good Another thing I need to check hello. It's kind of too late now Is that this looks like it's gonna be in the water even if the boat is not weighted down with much? I'm not super sure where the water line is gonna be but yeah, I'm pretty sure Those paddles will be in the water At least like halfway in the water even with the boat not loaded, you know, just like a person on it And if not, I'll just have to cut some stuff and lower the thing, but I think it's gonna be all right


When it comes to Yu-Gi-Oh! Master Duel, there really is no shortage of amazing dragon monsters. As for this video though, the only dragon we're interested in is Gendora, the Dragon of Destruction. I knew I wanted to build a Gendora deck the second I rewatched the Dark Side of Dimensions movie and watched Yu-Gi summon Gendora Cross, the Dragon of Demo, and it's banned. Yeah, it's banned in Master Duel, it was too good. But that's fine because we still have two, count them two, other cards in this Gendora archetype. With the main boss of this deck being Giga-Raze, Gendora the Dragon of Destruction. Which requires us to have three different Gendoras in the graveyard to activate his effect. And now that one of them is banned, there's only two possible targets. You know what, it's still fine, he's still that good of a card. And hopefully we get the chance to prove that in today's duels as we take the Gendora deck into some online ranked matches. If you like these videos and want to see more, definitely make sure to hit the like button and subscribe. But with that said, let's go ahead and get into the duels. And now it is time for the first duel with Gendora. And I'm already off to a bad start with the coin toss. Not that it really matters, I don't really have a particular going first or second. Because I don't know the deck that well. Oh brother, I don't know what it is about this background dude. But people that play with this background actually scare me. Anyway, this is quite a hand. I don't know if I even want to use this. I think I want to go with the old, you know what? That's exactly what I'm going to do. I'm going to go with a little bit of a trade-in.  Because we can get Gizmek back from the graveyard anyway. So this might just be a 3 plus 2. Ooh, we love to see that. Then I'm going to pot of desires just to get some banishing going. And no, I'm not going to Gizmek just yet. And then there's Gendora. There's Gendora. We already got him dude. Oh my God. Alright, so I'm just going to set, I'm going to set 2. I'm going to set 2 and use Gizmek to banish. Oh, the plays here dude. Look at the cards that are already banished. The deck is so thin. And now that we have Gigeray's Gendora, we could just wait it out. Just wait it out. No, I can't laugh yet. All we have to do is hope that Gigeray's is enough to get over everything. What is this? Okay, so it is a Cyber Dragon play. I don't know if we live here. I knew this guy was Cyber Dragons the way he clicked going second, bro. I knew there was a tinge, just a tinge of Cyber Dragon on that, bro. There was a tinge of Cyber Dragon play there. Do we live against Cyber Dragons? I actually have no idea how this deck works. I watch it, but whenever somebody plays Cyber Dragons, my eyes glaze over and I just wait to die. Wait, can he get the Omni-Negade here? Because that would be really bad for me. Oh, brother. Here comes the Cyber-Load Fusion. I literally have no clue if we're still alive. I can get Gizmek back as long as he doesn't banish it for whatever reason. Cyber Twin Dragon. Is this correct? Am I? Wait, am I supposed to be afraid? I don't think I have to be afraid. I think we live in. I think we live in, boys. We out here. We live in our best lives. This is just Necroface, which hopefully will draw soul release and we'll be able to banish Necroface anyway. Necroface is just here to help fuel Gendora. Yeah, go main phase two then. Yeah, yeah. But let me get Gizmek back real quick. Ooh, I am thinning the deck out. This deck is looking mighty thin. Yo, what's your diet plan looking like, deck? Damn. Hold on. There's soul release. Oh my goodness. Wait, wait, wait.  Wait, hold on. Is this dumb? This may in fact be dumb, but I'm going to do it anyway. I'm going to bring forth Gendora by tributing my first Gendora and then also getting rid of Necroface. I can bring forth Gendora Gigarrays with already 7,800 attack, but that's not all. I'm also going to activate its ability to destroy all other cards on the field and then I'll play the spell card Soul Release and I can target any cards in our graveyard.  I think get rid of them. I'm also going to banish Necroface and by banishing my own Necroface, I'll banish even more of our deck to the graveyard. I don't know if this decks me out. Hopefully not. As a Cyber Dragon player yourself, you should have seen this outcome coming. Gendora attack. Oh my God. That is, bro. Bro, that was sick. Gendora is so cool. I love Gendora, bro. Oh, Gendora is so quick. Are you kidding me? That was the perfect first duel. What? Not the best hand I've ever seen in my life. So we're just going to go with a quick pot of extravagance. If this gets negated, that's okay with me. I just want the extra draws. We'd like to see a Gizmek here. We do see a Gizmek, but I don't want to summon Gendora right now. Should I leave myself open to it? Wait. Oh, I can just special summon this for my hand. I'm going to do that then.  Yeah. Why not get a little bit of protection here? Just play Gizmek. All right, then we just pass because I just want to play with Gendora Giga Ray. Sadly, let me know down below in the comments. I know it's the same monster, right? But Giga Ray's Gendora does not look as cool as Gendora the Dragon of Destruction. I know they're the same monster, but look at these blades, dude. What the? Oh, Gendora Giga Ray's, he kind of hide in the blades, bro. You got to come on, bro. Do better. Oh, brother, another Cyber Dragon player. What is going on? So it's just OTKville out here, huh? Well, you're severely underestimating me. I hope you know that, bro. I've OTK'd another Cyber Dragon player in my past. Wait, that's your battle phase. That's your battle phase. I don't know why the Gendora deck has me talking like a villain right now. I think it's just because I'm going up against other OTK. You call that a battle phase? If you ain't doing at least 10,000 damage, I don't even want to talk, dude. Monster Reboot. My gizmek. He's trying to rob my gizmek. I won't let you. I won't let you take it. Run, gizmek, run. Don't let him get you.   I don't know why that was so funny to me.  Please let me draw a Necroface. Necroface, please. Eater of Million. Actually, not too bad. I'm not going to lie, because you know what Eater of Millions allows us to do. I'm able to banish cards from my Extra-X. I'll banish all these important cards. I took, like, Breakio Radius. Real big stuff, so I'll get rid of Breakio. I'll get rid of Dark Paladin. All very playable cards, by the way. Very important that if you want to run this deck, you do have to copy my Extra Deck list one-to-one. I always carry a Linker Evo.  Goddamn. Wait, how many cards are you asking for, man? What does Eater of Millions do? Five or more cards from your hand-fielder, Extra Deck? This man is eating, eating. Bro, you're good. Like, honestly, you're good. That guy can eat, dude. Then I'm in a lure of darkness, because I think it's time we start going for the play here. Ooh. All right, well, I'm going to get rid of... Hmm, but do I? I think I do, actually. Is that crazy to say? How many cards are banished? Oh, my God. Do I win? I might win. Bro, hold on. Let's win the game here for...  This could be the... I have to trust my gut on this one. I'm going to get rid of Gizmek. I have to trust my gut on this one. Oh, no, I can't normal summon Gendora, because he can't be special summon. Wait, I can still Pot of Desires? I'm going to do that then, damn. This is a very dangerous play. I'm pushing myself to the edge here. Okay, now it's time, bro. Anyway, I'm going to get rid of a couple Gendoras here. I don't need that many Gendoras. And then I'll summon Gagora's Gendo. Damn! And then I'm going to activate his effect. Just destroy everything. Oh, my God. And then I'll play Grenmaju. Damn! Oh, my God. Too bad to say that... No! God, damn. This deck kind of toxic. Wait a minute. Damn. Bro, I don't even know if I want to go first or second. I guess I'll just go first. God, damn.  All right, so I'm going to... Do I activate Chaos Zone? I think I am going to just activate Chaos Zone. Why not, right? Yeah, I knew activating Chaos Zone was the big brain play there. That was just a genius maneuver on my part. Let's go ahead and get into the next one. Another duel, another opening hand. And we got Dimensional Fissure. We do have to be careful, though. Dimensional Fissure is a good card, but it will stop us from actually being able to summon, you know, our boss monster, Gendora. Because you need to be able to send them to the graveyard. Performa Palin. Performa Palin. Well, here's the deal. I'm going to go ahead and slam my gizmecton frame one. Don't mind me. Yeah, we just slam in the old gizmecton. Did I banish any Gendoras? Oof. Oof. Not the best banishes I've ever seen, but what's important is we're just thinning the deck. The pendulum scales have been set with wisdom eye magician and Performa Pal pendulum. And they're gone. Hey, bro, I look... Wait, hold on, hold on, bro. Sorry, I know I was distracted. I looked down and looked back up.  I looked down and looked back up and... I'm not even joking. I don't know how the video is going to be edited. I hope you guys see what I saw, because I looked away after... What did I say? I was like, the magician was like, and he's gone. I looked out at my phone for one second, bro. I ain't going to lie. I was playing a quick iPhone minigame. But then I look up and, bro, what happened, bro? Harmonizing magicians out here. Performa Pal Celestia. Wisdom eyes back. Oh, he's back. Hey, what up, dude?  And now he ain't playing at all. And never mind. He's Link summoning. Oh, brother, this guy links. Heavy met. Oh, no. No, no, no, no, no, no, no, no, no, no, no. I'm getting magicianed on. Pendulum magicians are in full force today. And I don't know if I can actually beat them. What I need to do is I need to draw Gandora. Yeah, my plan has not changed at all. This deck is so... I literally... I do not look at what my opponent is doing at all. That is crazy. I mean, I guess I could also just slam down Grenmaju. Oh, autograph sorcerer. I did not say autograph on purpose, but I will call him autograph sorcerer intentionally now. Oh, this guy famous, bro. Let me get that autograph. I'm not really too worried here. In fact, I might even be able to... Oh, I'm not going to be targeting anything, dude. I'm not targeting anything. Do you have any negates here? It's still... I just realized it's still turn one because I definitely played Gizmek on his turn. But that was... It has not been my turn yet, but I do deserve this. I did take his turn rudely. God, the Supreme King and the Heavy Metals is such a cool combo. I actually did look up this deck cuz I was like let me let me force feed myself some pendulum knowledge so I do sort of get what he's going for here he's just kind of recycling heavy metal foes effect to once again bring out autograph magician yep there he is autograph I call him autograph magician it's not even it's not even astrographs magician it's astrograph sorcerer what a autograph magician for the rest of this video this dude's name is subject to change oh brother another supreme king he's he's link he's being a genius he's he's playing he's good he knows every aspect of this game he's good he knows everything about the link loops he's good he knows every aspect of summoning astrograph sorcerer what am I attack it have I just realized that happened oh brother he can negate a spell card once per turn which is not terrible I can just swing over that can I actually he might be able to negate me but he can't even there's no cards in the graveyard yet even if he negates me the cost will still go off but should I try to bait him with dimensional fissure because there really isn't a reason for me to he won't take the bait we just have to banish we're going banishing boys yeah negate me now dude do what you must I've already I've already done what I came here to do there he goes there he goes fellas that's fine by me I completely understand all right I'm gonna summon eater of millions and get rid of my extra deck again don't mind me just getting rid of the old extra deck and I also am going to get rid of soul release because I don't think we'll be using it and it's just a little more attack yeah I'm okay with that that's it good bye soul release the summon eater of millions nice max see huh well I won't be doing any of that I won't be doing any of that anyway it's time to start doing some attack mode calculations let's see can you survive this oh is the answer no wait wait wait oh you want me to hit you instead that's no problem that's no problem I'll go ahead and hit you instead anyway I don't know this deck is toxic oh my god gandora except gandora didn't even play the game that time oh bro what is this I bro put them up then bro if you want to fight so bad bro put them up now this right here is a hand folks this right here is a hand I'm going to activate pot of extravagance and then I'll just get six cards banished no big deal we might have to activate gizmek here which we will do we will do that just to get a bit of safety here and then I think honestly that we're probably gonna leave it at that I can also play necro face but let me see what I banished real quick allure of darkness allure of darkness all right so we should just play necro face face down we'll play necro face face down and we'll end our turn that's where we'll leave it I ain't gonna lie this might just be a gandora kind of day hold on it might just be gandora's big day in the sun dude maybe gandora a gillian rays or whatever his name is isn't the answer oh don't don't play cards brother don't play cards brother cuz gandora does not care don't do it I'm trying to save you gandora does not care and phase huh and phase very very interesting but what would you say if I dropped another big mill on your head huh what would you say if I just milled out even more boom now it's my turn do not oh another performer pal papa but what would you say if I drew even more cards using pot of desire and now I've drawn my monster card but first actually hold on let me be cool about this first I'm going to bring forth the one and only wait no I can't banish this guy yet so I'll just do no please please I was gonna get both gandora's out it was gonna be so cool why why ooh a pot of greed icon nice I like that oh this is good this is good okay all right we're gonna save extravagance for next turn obviously oh he's reinforcement of the arming our arming he's reinforcement of the army already so what's he gonna get from this deck here this will tell us a lot about what he's playing for some reason I'm thinking heroes I'm looking at this guy he's screaming heroes to me he's just got the jade and energy I feel like he's gonna beat my ass and say that's game so you know go ahead he's gonna say not bad side go ahead bro what do you have for me in your deck that's so scary and door this deck is way more fun than I thought it would be oh my god oh phantom nights okay and some phantom nights that is actually gonna make it a little more difficult for me because now I'm going to have to banish his stuff it's going to be pretty difficult actually alright so he's sent fog way to the graveyard really alright but he's also sending another different one to the graveyard that's okay he's gonna be able to negate my effect here which is gonna be pretty huge actually he's gonna banish fog blade to bring out the main man probably going to go into an exceed play for the rank three phantom nights the one on the horse I can't remember its name there he goes wait he's linking he's linking is it a link monster who end up what Charubini monsters this card points to cannot be destroyed by card effects oh no wait that's very bad for me oh okay never mind there he is there's the old there's a phantom nights and I'm gonna have to finish this duel in one turn I don't even know what's happening target one face upon the monster and feel it gates 500 also the first time the target would be a striped battler card if I could is not okay okay that's not really a negate on me but it is going to stop me okay pretty pretty powerful first turn from him here he's this card's not pointing to anything so that's fine I don't mind that that's probably a fog blade face down which is probably the worst thing that it could be a gandora play would be sick but I have no ways to summon gandora turn one that is not the strength the summoning gandora for the normal gandora is just not the strength of this deck the door does not make many appearances but when he does it's really cool like he's actually pretty helpful but yeah not this time but he is nice trading bait Raiders night oh wait yes he's gonna destroy a card oh you can target one card he probably want to activate them there he goes arc rebellion exceeds what's this guy do oh so now he's gonna negate all of my effects flat out this is this might be a loss just based on this I don't know if I could get over that especially without my effects hmm yeah there's really nothing I have that would be able to get over this I don't have any spot removal in fact this entire deck is just about hitting them really hard with gandora I could try maybe I should run like a little bit of a you know a little sandy claws in the deck you know some maybe a Kaiju or two wouldn't hurt just in case I drew into them oof this is looking like a loss oh yeah there oh there's at least one fog blade down and there's probably two and this is looking like a lot hey gandora all right so let's just let's be smart about this let's be smart about this let's pot of desires first let's see if we even have a chance here I don't think we do I don't think we do in fact I'm pretty sure we don't I'm gonna trade in my gandora this is huge oh my god duties killing me gotta banish my gandora all right I'll banish one of my gandora's maybe I should have kept that honestly I'm gonna lure of darkness again and I'll banish probably only gate the effect anyway but I have to banish this guy each card in my hand okay so how much would I take for this one two three four five six I take six thousand damage it's a risk I have to take hopefully all my gandoras aren't in the graveyard I have to get rid of you and you and honestly I think that's all I can get rid of because I need at least yeah I need at least two I'm gonna take seven thousand here or no six thousand again okay okay okay hold on hold on wait no no I still don't think this works we're gonna try it I mean we lose anyway if this doesn't work oh it's got 5,000 fog blade understandable we knew this would happen wait oh damn the cost still hits all right well hold on because I always keep I always keep to around baby I always keep to around don't fog oh damn damn I always kept to around but it just wasn't enough it wasn't enough dude I don't even know who to go after here it really doesn't matter damn dude if game Dora if I had gotten through I could have done it but I messed up I messed up too many times the double fog blade got me also I just read this wrong I don't know why that card didn't negate my effects so I was really scared for nothing I think but still a good duel we just lost it now let's go into the final duel I actually have no idea how long this video is like obviously I can look over and I can see that I've been recording for like 30 minutes but I don't know I don't know what that relates to in terms of usable footage because the duals have been fast and furious with this deck there not a lot going on that was the most intricate one so far I think but we still misplayed this time though I'm gonna take things my own pace say less dude really just say less chaos zone do I even need chaos zone in this deck honestly I don't think I do I might just be better off running something else oh Zodiacs oh brother you know what would be sick though I just need it I need to get Necro face dude Necro face is such a good engine of this deck the insane also he banished 10 cards by the way he doesn't he doesn't know that I'm playing gandora and phase okay hey bro it's your funeral bro draw and there he and there he is folks that's it we just pot of desires here and win we just pot of desires and win actually wait I do need to I actually need to draw gandora here I forgot that I forgot that part of the wind condition is having gandora my no you know what that's fine you know what that is absolutely a okay we're totally cool with that really does not matter to me because I'll just perform a palp opera I'll just get my pops going bro is gandora my graveyard gandora is in my banished own weight because that could be he alright hold on hold on let me let me play a different way bro let me play a bit of a different way all activate the effect of chaos zone which allows me to get a counter each time a card is banished and then I'm going to use eater of millions to go ahead and bump that counter up and as I'm doing that this is where the big brain plays start happening folks nice eater of millions sitting at a solid 3,500 but that's not really what we're going for and then I did not get any chaos on stacks well I made a minor miscalculation I made a minor miscalculation that did not work I will tell you what that did not work I could play gandora right now it just it just wouldn't it just wouldn't do anything because I don't have gandora my graveyard but it's still probably good enough right just having the attack is good enough what do we think here I don't know is it good enough I guess I could see like it doesn't hurt to see actually what am I what am I sweating about bro there's no way he could stop me right I'm sure there's no way he could stop it but why would he play such a weak hand why would he play such a weak hand it doesn't make sense it really doesn't make sense but I'm going to overplay my boundaries anyway let's go bro I'm going to step over the line and summon gandora yeah I'm going for the OTK buddy can you stop me you can definitely stop me I overplayed my hand and I understand that truthfully I do nope truthfully there is just no thing is overstepping boundaries when you're playing gandora it's just just play gandora it's that simple and this deck was fun hopefully you enjoyed it if you want to see more gandora let me know because I I don't know I know this deck is a little one note but that was a lot of fun if you didn't enjoy it let me know down below what other kind of decks you'd like to see why you're down there hit the like button subscribe to the channel and check out some of the videos that should be on your screen right now other than that I've been down to do it and I will see you in the next one