Ryoku

Wow. I'm sad to admit we see a LOT of this kind of job posts in my city (Mexico city, Mexico). And they get plenty of answers too.

I am entertained by the relation between the last two quotes in the article.

I find it interesting how focused this article is in the "traditional" male gender role. It doesn't even touch the subject of different friendship types and relations when involving other genders than 'male'.

Without denying that sex has it's toll in the physical (duh) and psychological treats of a person, I do believe that traditional gender roles are the only roles taken into account for this article, making a great deal of assumptions on how males act towards friendship. Does anyone know if there are studies such as the ones mentioned in the article that take into account a less black and white view of gender roles or that digs into other types of friendships?

I would be worried about the health of your computer. My work's T420 lenovo doesn't seem to lag THAT much, in fact, I hadn't noticed much of it until I got to read the comments here...

Scratch that, just after I wrote last paragraph I opened the site on Chrome (Instead of FF) and it lags heavily in there. I don't know if it might be because some FF plug ins block third party things like facebook connect and Google analytics...

I find it weird, the difference of fps between Chrome and FF with this site is HUGE in my computer.

So, if your home is out of energy you're locked out? I don't know how common that is in USA. But where I live, you'd be trapped under an hours-long storm while waiting for the power to come back during rain season.

It keeps hitting me... If you're doing something wrong, why would you be wearing your badge?

That is correct. Facebook campaigns don't work for actual conversions. But it is in large part due to the casual way most users navigate the website; which is not going to change. Fake accounts or not you will get a large amount of users that have no relation to your product 'liking' it. This is not necessarily bad. I am not sure if this still applies to USA because of the people that have been leaving Facebook lately. But in my country (Mexico), Facebook is used to give 'presence'. We don't expect any actual ROI or new customers directly from Facebook campaigns, but a user looking at a high number of likes does make a difference in trust perception.

That said, this problem is not present in Google because of the way they present the ads and the way users are navigating when they find them. I believe for this reason Google will always have a great advantage over Facebook and although we won't stop spending a small amount of money to keep a higher amount of likes in Facebook it won't be near as much as we do for Google.

For the same reason, that Facebook's reaction to ads is based in the way users navigate the website, I don't think Facebook will never get a ROI similar to Google.

I was waiting to find an article clearly speaking about this; which I think is the elephant in the room when it comes to female tech founders. The issue, as it points out, is not being able to hack; or being able to learn, etc. Society has been proven over and over that females can do just as good as males. The issue, I think, is purely social. Most people still see women with through a veil of prejudices, and this will only change with time as more women venture into that part of the industry.

Founding is barely about learning how to code. It's more about human relationships and networking. And as long as the image of a female entrepreneur keeps been looked down at, this problem will keep rising. May be it's not as easy to see in USA but I've seen it clearly in my country (Mexico) in small-medium businesses conventions and with clients.

Congratulations Dave, very nice work. I've been toying with the idea of starting to develop many small mobile and web apps during the course of next year, not really looking for revenue but for the sake of creating tools and games that might be useful for someone while helping me not to get creatively stuck.

I think it is less secure because it centralizes all the security in one single layer. AKA the email address you are using to handle the credentials. Once you have access to that email, then you have access to everything. Contrary to what happens now that at least raises more flags when your accounts start getting password changes, etc.

Well, I think we are talking about two completely different points and, per your past response, that nothing I've said really makes sense to you. Of course I think the solution is useful from a UX perspective, it's awesome. But from a security point of view you are leaving all the security out in a single layer and whenever that layer (single email address) fails, then there's nothing left.

>How is it not helping? Now you have all your accounts requiring two-factor auth to log in, rather than just some of them. You also only have one server to secure, which will presumably be run by people whose sole job is to secure that server.

Yes, you are left with only one server to secure, and yes it is most likely run by people who are good at it. But this is exactly why it's a good example of candy security: As soon as you get past the first wall, there is nothing else stopping you from getting access to everything. And you can't really presume all users will have double auth activated, nor that they will be as cautious with that single set of credentials will be.

I'm glad you have a portable device which you can use to access your email. Not every user does. But you're right. Please use and implement candy security structures.

Yes. But it also, I think, makes it easier to follow certain attack patterns that are already known and commonly used.

For example, setting an email forwarder to an account an attacker controls in most cases won't even be noticed. I think it opens more attack vectors than the good it could do to have this kind of integration rather than just a password manager.

Giving more control to a single manager (in this case an email account) also means you will have to set greater security standards for it. For example, are you going to type your password (which also controls all your accounts) to your friend's, school's, airport's, etc's computer that could be infected?

Passwords are insecure? Of course they are insecure. That's why we are trying to implement two factor authentication. But having 1 account with 2 factor auth controlling 20 accounts with 1 factor auth isn't exactly helping. At all.

Compromising one email account is easier than compromising several credentials.

It was just an example. My point is, by relaying all entrance control to an email, you are giving it master password access. The only thing you are doing is relaying the security issues to wherever that email is hosted; most of the times, a free and third party service over which you have no control. No, it is not more secure to keep your car, home and security box keys together.

You are not increasing security, whatsoever. You are setting all the security in an email service, which we already know are not the most secure services at this moment.

May be, such login can be applied inside a company's network, where you have control over the security of the servers, certificates, network encryption, etc.

Now if you think about it from a social engineering perspective. It is much easier to get access to a single email account than to every account you own. And about persistence of access... There's this thing called email forwarder. If I get access to your email, I would create a forwarder for all the email you receive to one I control; chances are you won't notice it in a long time.

Then a new and huge list of security problems arises when you have to bother the user with getting a new code every time if they have the sense of closing their browser and cleaning their cookies each time they close their browser (which could be as often as whenever they leave their computer); the fact that loosing control of a single email makes you lose control to the account in every site using this system, which beats the idea since that email is most likely password protected anyway; etc, etc.

In a nutshell: "In most cases you won't need to do this often" is a HUGE fallacy. It depends on the security rules you work/live by. Plus, it would make it really annoying to use if on top you're using TOR.

Yes, passwords need to be fixed. They are weak, problematic and a security cheddar cheese. It is why we are now implementing two factor authentication. Changing the "fixed password" strategy to a "random and time limited password" strategy isn't exactly solving more issues than it raises. Again, from a security-wise stand point.

May be if this was implemented with something different than your email. Like, for example, a bank tokens or cell phone verifications... which, again, are part of a two factor authentication because by themselves they would be too easy to break.

Think about the following scenario: You use X site with this email auth system and, for example, Thunderbird. Stand up and go to the bathroom or a meeting or whatever without locking your computer. Presto! I won't even need to guess a password and get access. Of course getting access to X site would be the least of your worries in that example, but it illustrates the point I'm trying to make.

At this point, airport security is there to make people feel safe. That's it.

Do you really think a plane full of people who know they will die unless they do something about it, will let a terrorist get away with it? On the other hand, do you really think so many people would have continued to fly as often as they did before 9/11 without some sort of reassurance that something is being done to prevent highjacks?

Terrorism can be anywhere, and it does not need an airplane to happen. Now, if terrorists are not going to use planes to cause terror then you should be thinking on the next thing that's going to be used. There are many uses for perceived security and not all of them involve keeping people safe.

This is not related to the topic in question.

This is one of the worse ideas I've heard of; security wise. Not even at a tech-level. All your data and credentials are a robbery away. Of course, if you get robbed you can probably call in your credit cards from your cellphone... oh... Now, on the tech side... magnetic? Really? We've been through this, it's not secure. It might sound secure in an ideal world where the user doesn't do stupid things like handing over both the card and the phone to someone just to avoid getting the notification or to be shown how it works... or because it's a "store requirement". But we are not in that world, nor we will be.

I just have one issue with this. It's a social engineering gold mine.

This is idea makes my shoulder surfing senses wet. Seriously, it might sound like a good UX idea in theory, but lets go to practice: People are not going to use that button in the safety of their homes. Why? Because they don't care. It is not a secret that the average user doesn't give priority over commodity to security; that's the basic principle behind no-tech hacking.

The best UX experience collides with the best security experience, we need to find the middle point. This is not the middle point. Passwords are now broken from concept, that's why we are evolving into two factor authentication. Making a broken security method easier to crack (even if it may only happen when certain circumstances are met, like doing it in an airport of coffee shop) is not the way to go.

I don't see anything surprising here... Pick a government, any government, do you really think they don't recruit their best hackers for such team? Or was the general thought that only China's gov makes viruses to target other countries? I even know someone in my country who got recruited into our gov's hacking team after being arrested.

Wow. This has just turned into a great example for one of my classes. I don't think there's a better way (other than hands-on examples) to show the severity and widespread of such security holes.

I have to agree with pudo. Sending a user's email to a third party service has many privacy implications. I don't care if you share, not share, store, not store, or whatever; users are trusting you not to share their emails and you should comply.

That's pretty interesting, I didn't know of those services.

Well, in order to protect the hashes in said cookies you would end up doing something similar to prevent malicious users from just spoofing them. If you use id/hash tables the way you propose the hash is acting just like an id and is then vulnerable to the same issues. The problem is not that the id is there, but that you need a method to make it hard to spoof.

Well yes, it could be teaching developers. But you would be teaching a single solution for a single problem. I think it would be better to entice solutions that target the bigger issue on security awareness. All this new tools that make it so much easier to develop complex applications have huge benefits, but I believe they are also pushing new developers away from understanding the concepts behind what they are doing. As someone who started as a designer and grew on my own into development, I've seen this issue first hand.

Yes, it is an old issue, the problem is that it's still there. Developers keep doing it for production, it is common knowledge for people involved in security, but not for developers, which is worrying. Take a look at this results http://www.lmgtfy.com/?q=inurl:secret_token+filetype:rb#

I don't think the answer is having GitHub do anything about it. The word has to be spread, yes. But not that way. Developers need to know about the importance of all their files and their security at development, else just think of what will happen when GitHub is not around or when they use another form of Git, etc. Problems need to be solved from the root and that means teaching developers to be more security aware, not making tools that will make said awareness easier to forget.

Well, not so much as new releases, except for one. But this year I really enjoyed: Reamde by Neil Stephenson (Can't get enough of that guy) The Art of Deception by Kevin Mitnick Close to the Machine by Ellen Ullman