danielpal

No they don't. They have a $35M credit line that should get them 12 months. Further, most of their expenses are around Sales and Marketing, and further the increase in their expenses is mostly more head-count (not ad's etc.)

Reducing the sales headcount to last years head-count and they would be profitable by end of year.

One thing that I noticed, is that the more expensive the hotel, the worst is the WiFI. Same applies when I have to pay for WiFI - the more I pay, the worst it is.

I've found that 3 star hotels that offer free WiFI usually have the best speeds/service. Whereas 5 star hotels that usually charge $14.95 daily have the worst.

This seems to extreme. Starting with 2%, likehood is he was diluted 50 - 55% across the 3 rounds. He end's up with 1.1%. Given the $390M exit, he get's $4.2M. This doesn't take into account liquidation preferences, but also doesn't take into account incentive plans either.

Let's say due to liquidation preferences he only takes half of that ($2.2M). Given that he just made $2.2M and Salesforce is keeping RelateIQ as a whole subsidiary, they'll want to make sure they retain the talent. So they will probably sweeten the deal with an incentive package of 60%-80% of that(1.3M). All in all, given he stays 3-4 more years, he'll likely come out with 3.5M to 6M.

Sorry, couldn't resist. Shameful self-promotion, but this is why companies shouldn't implement their own two-factor authentication. Getting everything right is hard and chances are that you aren't reading or informed of the latest attacks.

At Authy we are obsessed with Two-Factor Authentication and spend a huge amount of time looking at whats happening in the ecosystem, which new attacks do we need to be aware of etc. It might look easy to build a quick two-factor authentication system, but history will repeat itself, and like passwords we'll see lots of bad and insecure implementations because its harder than what people think.

The important thing to know here is that you not only have to change your current certs you ALSO HAVE TO REVOKE THE OLD ONE.

If you only change your current cert to get a new key but you don't go through the revocation process of the old certificate if someone managed to get the old one they can still use it for a MiTM attack - as both certs would be valid to any client.

OK fair, 64K. But is it actually possible to control were you get the 64K from or is it just off the top of the stack?

And is it actually possible that the top of the stack has your private key?

"This vulnerability can be remotely exploited to leak encryption secrets from Heroku applications, allowing an attacker to retrieve the private key used for SSL encryption and decode data obtained by intercepting traffic"

Does anyone know if this is "actually" true?. By looking at the bug it seems you can dump up to 64 bytes at a time from the stack. Given that the attacker doesn't control were from the stack at all and looking at the code the top of the stack is probably holding some random structure, is it really possible for the attacker to retrieve the private key?

I just want to be sure before spending a bunch of money to replace re-issue all certs.

This is a really interesting project. I have so many questions and it seems others too. It would be great to do an AMA on Reddit or something.

So one question: This "targetting capability" that HIV controllers have, which your goals is to give it to all of us, does it also have any other benefits? Does it also help protect us from other viruses?

I completely disagree. In fact I find it worse when a link opens in the same tab and then I have to navigate back and find the place that I was at .vs. having to close a new tab I did not want.

"And I think over a decade of user confusion and frustration resulting from target="_blank" backs that up."

Do you have any links to to back this claim?

Authy founder here (we do Two-Factor Auth for Coinbase).

Looks like you didn't have Two-Factor enabled https://news.ycombinator.com/item?id=6947037). Enable it now. We've stopped lots of Coinbase account password compromises. Most of the time we see that the e-mail was hacked.

Do the following:

1. Enable Two-Factor Authentication on your e-mail.

2. If you use GMail, go to Settings -> Forwarding POP/Imap. Check that no "weird" addresses are added to your account.

3. Change your E-mail password.

4. Change your Coinbase password.

If you have Two-Factor enabled we can also temporarily block your account if you suspect a hacker is trying to get into it. Contact us at support@authy.com and we'll block it.

Hi Daniel from Authy here. I helped with the design of this infrastructure last year and I was a little shocked we weren't able to do automatic fail-over with PostgreSQL.

I'd be interested to know if anyone here is running a Postgres pool that handles automatic fail-over how are you doing it? Specifically which watch-dog are you using, how are they handling slave to master promotion, how do you add more slaves automatically and how do you load-balance.

I think the biggest issue is the huge oversimplification of YC.

If I were to eat sushi at Jiro ('jiro dreams of sushi') and I said: Couldn't eat at Jiro's, heres what you're missing:

  *You sit at the bar and an old guy serves you raw fish.*

It wouldn't be inaccurate, but it would be a gross oversimplification of what it involves and the effort put by Jiro beforehand.

I too was part of YC and I don't think your articles captures the essence of YC even in a small way.

Send me an email to dpalacio@authy.com and I'll give you access to our Authy OpenVPN plugin free.

This is the sort of thing that sounds reasonably nice and we all wish we could do. However it stops working really fast.

I also have a web service and we used to let people get away with this sort of stuff. First year it worked. Second year, the amount of fraud was impacting bottom line and some of this users turned out to be the ones that used "support" the most. So we started banning bad users and blocking their support requests. The overall impact to the "good" users is pretty noticeable now. Not only can we reply to their support e-mails faster, but the overall system is also faster.

My mentality shifted. Now I think you "owe" it to the "good" users to remove/ban the ones who steal. They are most likely not zero sum, but pretty negative.

I discovered recently this sort of things works amazingly. At my company it used to be that it would be impossible to hold a punctual meetings (theres was always at least 1 person who would arrive 10+ minutes late).

We made a rule, if you arrive late you invite everyone to donuts. It didn't work. Then we made it donuts + coffee. Boom it worked flawlessly. Every single meeting now starts on time. People make a huge effort never to arrive late and it's had a great impact on productivity.

A bubble occurs when prices are driven by view on the future that are implausible or inconsistent. It seems that current high prices are mostly driven by "investment" competition - meaning that startups can raise prices at early stage because there are too many investors.

This doesn't seem to be happening at later stages (B rounds) or public companies.

What this means is that returns for initial investors is going to be lower - but it still might be sustainable. Companies usually will grow past +$15M when they do well.

I'm tired of seeing everyone call every damn company a business cause it isn't so. A startup is a company designed to grow fast. It's can be profitable business who's been around for years. Making that distinction, while a side tangent, is worth making.

You are missing the point. Call them however you want, startups or businesses, makes no difference. The point is I didn't just seek out to "proof" Sam was wrong - that would miss the point too. Instead, I followed the same steps he did.

He made a list of "breakout companies" and noticed most of them were startups that bridged the digital world with the real world. In my case the distribution was uniformly.

Perhaps do the same experiment yourself? Debating what is or what isn't a startup is not as valuable.

From my list of top startups:

Heres the ones that strongly supports it:

  1. Square: Easy payments for the real world.   
  2. AirBNB: Lodging on the real world.    
  3. Pinterest: What I like of the real world.    
  4. Twitter: Whats going on right now in the real world.  
  5. Palantir: Intelligence of the real world.    
  6. Uber: Transportation in the real world.

Startups against it:

  1. Dropbox: Storage for my digital life.  
  2. Evernote: Notes for my digital life.    
  3. Box:  Enterprise collaboration.    
  4. Splunk: Visualizations of digital things.    
  5. Cloudera: Hadoop for Enterprises.

Not sure if it's very strong - seems like they are equally distributed.

Congrats to A16Z.

My biggest memory of Sinofsky is just after he joined the Windows 8 team. I went to the copy room to get a notebook. Sitting in a corner, on top of one of the desks, in meditation position was a guy working. That was quite odd, I had never seen anyone "working" in the copy room. So I started talking the the guy, and it turned out it was Sinofsky. In over 2 years on Microsoft it was the first time I saw a top executive on our building. I saw him many more times - in the cafeteria, in other peoples office, almost once a week at least.

He was intimately immersed with the product and the people. Contrast to the rest of the execs who you pretty much so once a year on the Microsoft company wide meeting.

No the app doesn't talk to Authy servers. It's completely independent. You could just keep using it.

It's just copying the current TOTP token over Bluetooth to your Mac. Nothing fancy. Simple yet very useful.

Yeah exactly, if the attacker has complete control over the computer, the least of your worries is Bluetooth.

He can steal your cookies, keylog your password/token, poison your dns and compromise your SSL Keys or simply steal a session.

We use Elliptic Diffie Hellman when you are pairing your iPhone to your Mac. The key is stored on both iPhone and Mac KeyChains. Every message between them is encrypted/signed using that key.

Business Model: We have an API that companies use to add two-factor auth to their sites/infrastructure. We charge for that. see www.authy.com/developer/pricing

2. The recovery process enables your phone. If you decided to enable backups(which is optional) encrypted versions of you accounts are stored in our servers (that's why it called backups). Authy employees can't gain access because only encrypted version is stored, you chose the encryption key and have to remember it.

Your tokens are only backed-up if you choose to (it's completely optional) and only the encrypted version is backed-up. It's also off by default.

GO BOILERS!

:). That's not me. I wish I was as good looking as the actor in the video. I am here: www.authy.com/about.

Hi Maver, unfortunately is likely your Mac doesn't have a Bluetooth 4.0 chip and Apple doesn't have an API on the iPhone to talk via 2.0. It will work on an Android though.

You can see: http://blog.authy.com/authenticator

But in general terms:

1. Authy tokens automatically sync even if you lose, change or upgrade phone.

2. Ability to do encrypted backups of Google Auth tokens. Same as above, they will sync if you lose, change or upgrade phone.

3. Bluetooth: Takes the hassle out of Two-Factor Auth.

4. Automatic time sync: Always makes sure your tokens work no matter what.

5. Key Rotation: We can automatically rotate keys if masters are compromised.

6. Privacy: WE DO NOT TRACK app usage or anything like it. We don't share data with anyone. Compare it to GAuth privacy policy.