danielpal

It does seem like cost are negligible today, but on deeper analysis theres a lot of costs beyond simply hosting.

Just from memory for my startup (Authy.com), initial costs were:

Domain: $1000+

Design: $3000

Video: $3000

Hosting: $400

Depending on your skills this initial costs will vary. An although I agree you don't need external investment to cover them, you should at least plan to invest $10,000US to cover your initial costs.

Details are really important. That doesn't mean I could possibly handle every single detail myself, I can't. We have a whole team that handles different parts of the system and they are fully qualified. In fact the engineers doing this feature did write the correct implementation. I simply made a mistake answering the question.

I think people are confusing the Authy Google Authenticator Support with the Authy product.

We do not sell Google Authenticator or aim to be a replacement for it. We simply added the possibility to add Google Authenticator tokens into the Authy App - mostly since our existing clients wanted this -.

Our Service, it's usage etc are completely separate.. If you are not using Authy you can simply use Google Authenticator App.

The only thing in common is we both use RFC 6238 which is an open standard for Time based OTP's.

This is exactly what happened. Although I am involved in product on 100% of the time, I don't deal with specific implementation details, the engineers working on the solution deal with that. So I tried to be a truthful as possible and answer all the questions I could, I simply got some details wrong. One of the engineers noticed and I rectified my answer.

My mistake we are using PBKDF2 already on both iOS and Android.

One of the developers added PBKDF2 while doing the implementation. I didn't know exactly how they had implemented the encryption - so I asked to clarify.

So to be completely clear:

1. We use a 256 bit key derived using a salt and PBKDF2.

2. AES is used in CBC mode with a different IV for each account.

3. The key is store on the cellphone only and is never transmitted

This doesn't work the way you think it does. The app itself it's backed up by Android OS, who know were, with every single account without any encryption.

If you use Google Authenticator App this is true. If you use Authy App without backups, this is also true. But if you enable Authy Backups then you will always be able to get your accounts back, no matter what.

We were limited by Google Authenticator usage, so yes, backups are absolutely awful, but it was the only way we saw fit in case you had to upgrade/lost your phone.

Now our service Authy and it's Tokens are completely different. If you sign-up to Authy.com and use our Tokens, those are:

1. Full 256 bits secret seeds.

2. They are never backed-up.

3. Guaranteed to only exist on 1 phone at any given time.

4. We not only regenerate new tokens for new device, we also allow 1 click remote reset of the device tokens.

5. We have a huge number of improvements over Google Authenticator.

7. Tokens are not 6 but 7 digits long.

This version added support for legacy Authenticator Tokens. The existing Authy tokens like CloudFlare, DNSimple etc are not limited to the Google Authenticator addon.

#1. Agree. Although non-technical people do find them useful. You yourself are just a bit more technical and have a better grasp. Problem is some of our users didn't even know how to install an App etc. We are thinking of ways of making registration easier.

#2. Because you only have to enter it once and it's a complex field, you should see what you are typing.

#3. App shouldn't crash. The reason you have to go through the online process is mostly for security, you wouldn't want it to be just super easy. The other problems seem like bugs.? We'll fix those, can you e-mail me at support@authy.com, i'd like to get repro steps.

#4 Thanks!. Let's get the above fixed.

I like Authy, but more importantly I simply refused to pay domain squatters for domains.

Thanks!. We're using Blossome, a blog engine I wrote for developers:

https://github.com/danpal/blossome

I've been meaning to add lots of features, I jsut haven't had the time. This holiday vacations I am going to the beach, so I'll be hacking on Blossome there a lot.

Absolutly not. It's one secret seed but you use the time to generate different One Time Passwords every 10 seconds, which means you never reuse passwords.

This would be the equivalent of having 2 passwords, one of which you change every-time you use it and it's fully random.

EXACTLY!

Hm, which iPhone do you have? Is it a 3GS? We use very detailed images etc that just don't look great on non-retina display. Retina images will look great.

We're not using PBKDF2. Were using AES-256, we pad the extra bits and use a random IV for each account. However you can enter a 32 character encryption key and you will get a full 256 bit key for encryption.

That's not at all how backups work. In order for a hacker to download the and decrypt the account they would need to:

1. Access to your e-mail to click a link confirming you changed your cellphone.

2. Access to your phone # to be able to get the SMS message with the registration key.

3. The encryption key you used.

If they can do all 3 they would get access to your account. If you feel that the level of security there is not good enough for you, you can disable the backups and key will never ever leave your phone

Not at all. The attacker would need to get the encryption key and also access to the Authy Backup. Then they also need the password for your account. That said, backups are optional, you can skip them and your account will remain on your phone only.

It is very simple, as it should be.

Both Authy and Google are based on open standards:

Specifically: http://tools.ietf.org/html/rfc6238

So you can add support as long as you support the standard.

When you scan the QR Code with you camera we read a secret key and store it inside your phone securely.

Great great screencast. The product it also looking awesome. Congrats!

Because the majority of people don't even now what encoding is, less care about it.

This is likely going to hurt Instagram more than Twitter, but Instagram can now afford it.

Though some part of me can't help but to feel somewhat glad. Twitter has been treating developers like crap for the past year; is somewhat comforting to see them getting a taste of that.

You think that the experience of selling 1 company (viaweb) trumps over the experience of funding over 300 companies across 7 years, 2 of which are worth at least 1 billion dollars?

Thats like saying, given that Apple experience comes from building the first computer they must not know anything about mobile.

YC experience comes from doing YC itself.

This is fantastic.

The thing I like the most about ruby is how much thought is put into code readability and programming experience.

My favorite features of this release:

1. Keyword arguments: I can stress how important this is for code readability and also prevents some bugs.

2. Refinements: This is going to make code easier to maintain and more "custom". I can't wait to add a few things we constantly use on String etc.

We use twilio(first), then bulksms then clickatell and finally nexmo. Sometimes we send 2 SMS's because the carrier takes too long to confirm if the SMS arrived.

This is something google specifically does. And it's not something you can really do if you loose your phone (i.e you need two-factor authentication to get there to disable two-factor authentication). Plus is not something that is centralized (if you have X accounts you have to go to all X accounts and disable them), and then you need to reconfigure all X accounts.

Honestly that's a lot of work. I've been using Google Authenticator for 2 years now with 7 accounts. Everytime I change phones (twice now) it's been a nightmare. Also since I travel, half the time they don't work.

I am going to build Google Auth support into Authy and it will be 10 times better that the Google Authenticator App....how I wish Google would do it, but they have abandoned Google Authenticator long time ago (they didn't even bother to support retina display's).

We tried push notifications, but they were unreliable. (people disabled them, they were delayed etc, doesn't work with bad reception).

We're working on something better.

Agree. This is happening, slowly but surely. Hopefully we at authy can help make it faster.

What's wrong with that?

We take security seriously, and our product is rock-solid. That doesn't mean we need to act as if we were distant/dead.

If you ever contact support or read our documentation etc you'll notice we are very approchable and don't bother appearing serious/distant like other enterprises do - our product speaks for itself.

We do support almost every country, but depending on network congestion SMS is not that reliable.

If you are waiting for the registration PIN? Click the text-me the pin again (if you do so twice) the button changes to call me. Then we will instantly call you. Let me know if that works.

You will be very pleasently surprised very soon. We will support google authenticator and it'll be awesome...I can't wait to share - I wish apple was quicker approving apps - If you want a version sooner I can share via testflight if you wish, that way you can also help us make it better. E-mail me at d@authy.com and I'll make it happen.