danielpal

Hi, we already do. We charge websites, banks and apps to enable two-factor auth on their sites. See https://www.authy.com/developer/pricing.

Hey James,

"- Are the HMAC keys stored or synced to the desktop? No, nothing is stored in the desktop. Everything remains on your phone."

"- Is there a password protection similar to the keychain to access these passwords? We store the pair phone details on the keychain. But this is only the phone bluetooth id etc."

"If my desktop is hacked into and a key logger has my password as they usually do, it will now also be able to copy these one time passwords at will and use it frequently to log into my account."

No, again nothing is stored on your computer.

Probably. At this point we are testings things out and want to move as fast as possible. We want to make Two-Factor Authentication completely transparent, and we'll be launching other exciting things to see how they work in the real world.

Once we have the experience nailed out, we'll ported to other platforms.

Hi, I'm Daniel, Authy Founder. We've worked almost 18 months on this product, it's surreal to finally see it out.

Anyway, you can read more about why we did this here: http://blog.authy.com/thefuture

We released Authy-SSH last september and this was by far the biggest feature request. You will be shockingly surprised if you knew the names of the companies that not only share unix accounts (which is very common) but were actually sharing Two-Factor Authentication keys.

I can explain difference between Loom and Dropbox. I am not affiliated to Loom, I am just a beta user. I am also a payed Dropbox customer.

Dropbox is great for general purpose files, and files you edit (doc's, pdf's, etc). Is just like a general purpose folder that is synced to the cloud.

Loom is focused only on media content (photos and videos). As opposed to Dropbox, were you navigate files and see pictures thumbnails, Loom organizes pictures in albums and displaying them etc is awesome. Also sharing pictures with other's is very well thought out, you can easily share 100+ pictures in an instant.

I would say Loom is like the iTunes of Pictures. Dropbox is like iCloud.

I'll chime in because theres a lot of mis-information here.

My credentials: I am the founder of Authy, we do two-factor authentication using SMS, Phone Calls, TOTP App and Hardware Tokens - we protect over 80,000 accounts including CloudFlare, Coinbase etc, so I am very familiar.

On 2FA using SMS:

1. Yes it's not as secure as a dedicated TOTP App but:

2. SMS phishing doesn't matter here. SMS phishing would allow the attacker to send message as you but not receive messages. In order to compromise Two-Factor SMS auth he would need to be able to receive them.

On VoiceMail Security:

1. True, voicemail is insecure. But if your Two-Factor Auth provider knows anything about security, he can help you. For instance we just helped Coinbase with Voice verification. In order to protect the verification codes going to VoiceMail, we require the person to input a number before reading the token.

Eg. Hello, this is Coinbase, if you are expecting this call, please press 1. [ Only on 1] your code is, “1,2,3,4,5,6,7”. Again “1,2,3,4,6,7”, last time “1234567”.!

So if you can only use SMS or Phone Call Two-Factor Authy, by all means use it. If you have a Smartphone it's better if you move onto a dedicated TOTP App.

The biggest weaknesses this days on Two-Factor Auth is not SMS or the carriers, it's the implementation. Unfortunately although implementing TOTP is easy, a secure Two-Factor system is not. Most are using recovery codes, e-mail and defective recovery mechanisms, which is how this systems are being by-passed.

http://www.slashgear.com/dropbox-hack-allows-bypass-of-two-f...

Find yourself a good Two-Factor Authentication provider. I would recommend Authy, but I am biased so I'll recommend Duo-Security.

I am not sure if it's possible to get your employee's to learn to spot the output of everyone else. You will be able to, as you'll probably spend significant time interacting with everyone, but your employees won't. Each will be focused on their own project and won't have enough visibility across the company to notice output.

However all of them will notice if someone arrives late and you don't do anything about it. We had one specific case were someone constantly arrived 2-3 hours late. People very "subtly" started complaining (and I mean very subtly). No one ever mentioned or talked about what the person was working on or if he was producing great code (his code was very good btw). Neither did they asked why he was arriving late - they only assumed it was not OK and felt it was unfair.

Great post, with some very interesting ideas. My experience has been that although it sounds great to be "super" flexible, it's really hard to run a company that way. As you add more people to the team, people will mimick the worst behaviors to restore fairness - "if jon always leaves at 5, then it's not fair if I stay late" and suddenly people start slacking. Strengthening the rules later is also really hard, but at some point you realize you have to.

That doesn't mean you push people 60 hours or weekends, but you enforce minimums like 9-5 and you make sure everyone feel's everyone is equally contributing and that everyone is trying hard.

The NGINX advisory is here: http://mailman.nginx.org/pipermail/nginx-announce/2013/00011...

This is almost 2 months old.

What a lot of people haven't considered is that it's likely that the NSA had a big breakthrough on Integer Factorization and their capable of breaking RSA public key crypto (used everywhere you see HTTPS)

Then they can just save all your encrypted traffic and break it on demand.

We all need to start considering moving to Elliptic Curve Cryptography.

Trust, but verify: https://www.youtube.com/watch?v=As6y5eI01XE

From the video I see I will be able to:

1. Compare it to other similar dogs.

2. Show the stats to the veterinarian to get more input.

Using #1 and #2 should be sufficient.

$15

Disagree 100%. Just pre-ordered one. I am a very attentive and interested dog owner.

Here's what I'll get:

1. I pay a dog walker to exercise my dog every-day for 1 hour. I want to make sure he is actively walking and not just sitting around the park.

2. Dog Sleep: I want to keep a healthy sleep vs activity percentage.

I think this is great. I love this trend of constantly tracking vs going to the vet every 6 months to find out whats wrong.

On the "pay investors legal fee's", I was recently very shocked of how many things investors want their Portfolio companies to pay for them.

For instance, if investor is required to travel for Board Meetings they will require company to pay for it. Also some investors will make companies do regular financial audits with a firm of their choosing and force the company to again pay for it.

My biggest questions is, were does the 2% annual fee that investors charge their LP's go? I know some firms have on-site staff to help their companies with recruiting, PR etc, but most don't.

Hey Michael, you can try ours, it's specifically designed to work along with certificate's instead of passwords:

http://blog.authy.com/two-factor-ssh-in-thirty-seconds

(disclaimer: I am a founder of the company).

Saving this so I can re-post it in 2 years to show how wrong this was.

They said they Hashed and Salted password so it's unlikely the hackers will get "actual" passwords by brute-force

However what I've seen happen after this attacks is usually they attacker use the e-mail addresses to do phishing attacks and just get passwords that way. They already know their e-mail and that they are living-social customers. Expect a phishing e-mail that looks like coming from living social.

Readability note: Theres a really annoying iFrame in top right (join Tumblr), fixed position that makes it impossible to read the blog and follows you.

Screenshot: https://twitter.com/danielpalacio/status/327525758065070080/...

There's no way to close it. Is this something that Tumblr adds?

I had the same experience. AA lost a bag, then had to wait almost 4 months to get reimbursed a mere $600 dollars (I asked for $2800).

Worse, is that they only reimburse for items for which you have receipts (who saves all their receipts?) and they can refuse to refund you for anything. At the end they refund me for the bag cost plus a present for which I had a receipt. No refund for anything else I had in the bag.

Looks like the salary is only to filter possible employees and only internally used by pitchbox employees. They want to make sure if you talk to a possible employeer they can match your salary expectation.

Careful here. I am not saying is true or not. But a facebook comment and then another accusation by the same person under a different name JennNella is not proof that he has a rape conduct.

Doesn't seem right to just trash someone's reputation over a Facebook comment. And the article is just blurry observations, like I believe, I heard....or most of Silicon Valley already knows....

I don't understand why there's a big issue with being indexed? In fact they should be indexed if they remove the e-mail address from the page. Isn't the goal of this pages to sell more? Don't people use search engines to find stuff to buy?

The whole thing is just a big misunderstanding.

Can anyone explain if it's possible for this patents to just go from one company to another? Like what's is stopping IP Nav and Parallel Iron from just creating a new corporation and transferring their IP if Rackspace succeeds in this lawsuit?

Seems like they can just start shell companies in order to avoid being counter-sued.

I am not sure if that is true. That worrying about dilution is a form of downside risk mitigation.

Primarily, if you don't worry about dilution you'll loose control (unless you have some sort of special stock that gives you more voting power). Control for me is probably the most valuable thing I have. And, Although selling stock is not the only way to loose control, if you don't worry at all you'll loose control fairly quickly.

Lastly, your employees will also loose moral as they see VC's own pretty much the whole company.

Although some founders might pursue high valuation as a way to get validation, the majority or at least good founders pursue high valuations to avoid dilution.

Another big reason would for recruiting. I've seen that's become increasingly common that job offers include options as prices instead of percentages. Eg you'll get $500,000 in stock based on the last round valuation as opposed to saying 0.5%. This is increasingly common in later stage companies and it seems to be very effective. Now companies in early stage with high valuations can do the same.

This is absolutely not true at all. This is the same non-sense girls are taught growing up that they are not "good" at engineering. My experience has been, once engineers start interacting with customers they like it and they are good at it. Some aren't but is not the norm.

Yeah could you explain a bit more in-depth how the security monitor works? What sort of vulnerabilities it catches etc.

PS. The site looks great, I am importing my first repository right now. Great job!

I used to view innovation as: making it possible to do something that wasn't possible before (going from 0 to 1). But under that definition alone, SpaceX would not be very innovative. It's just sometimes when you go from 1 to N but the N is so large (like SpaceX case) it's probably a different kind of innovation. And by making the N that large, it's starts to look a lot like 0-1 and new opportunities arise, like the chance of getting to Mars (which is definitely 0-1)