jessepollak

that's wrong, sorry! obviously, something about my media queries is off, will fix ASAP.

yeah, it's only a couple weeks old, so I'm working out the kinks. thanks for the heads up!

Thanks for the feedback, this was actually something I was pretty concerned about when I made it, but I decided to go with it anyways.

One question: do you think slowing down the color change would make a difference? I started with a 10 second animation through 5 colors, but it's currently a 30 second one. I might experiment with making it 1 or 2 minutes to make it more unobtrusive. thoughts?

This is exactly the explanation I needed, thank you.

I wonder what the rationale behind this decision was. It seems like a pretty easy way to mess up people like me :D. Any ideas?

Ah, so IE must implement the experimental version while no one else does?

it's brand new, so may be a little buggy. screenshot?

you don't happen to have a good online reference on Why We Tag Shit, do you?

Fair enough; although, in our experience users have enjoyed the flow much more than passwords. I'd encourage you to give it a shot and let me know if it's as unbearable as it seems to you.

On mobile, when you click the button, you're just redirected to the app where you approve the authentication request and are automatically logged in.

I would guess that it set off the voting ring detectors (rather than people manually flagging it; that would be pretty fucked up).

Sometimes, for posts like this that seem beneficial for everyone, I wish PG could just manually disable them...but that's a slippery slope to say the least.

At the Claremont Colleges (outside of LA, includes Pomona, Harvey Mudd, CMC, Scripps, and Pitzer), we've had success with almost the exact same strategy. At our last hackathon, we had a similar turnout (150+) and ratio (>1/3 women). Just to emphasize again the key things that worked for us:

* a commitment to beginners from the start

* a week of 2-hour classes (Hack Week) on building web applications from scratch targeted at non-developers

* a focus on learning rather than winning (although, we did advertise prizes)

* helpful mentors on call through out the tutorials and hackathon

* providing healthy food for those who wanted it

* having a diverse set of organizers, mentors and company reps who participants feel comfortable approaching during and before the hackathon to allay concerns about their participation

In my opinion, every single one of these things makes hackathons a better experience for everyone, so there's no reason not to do them. To say the least, we've had no problem with scaring away the typical "hackathon types" and this year, we're hoping to get close to a 50% ratio.

When you click the button, you'll just be redirected to the app where you can confirm or deny the login. If you confirm, you'll be redirected back and logged in.

We thought about building a mirror contraption that would allow you to scan the code on your own phone...sarcasm

send me an email, I'd love to help convince your workplace to integrate.

Yep, you can find our docs at http://developer.getclef.com.

Clef is actually 2FA already because it relies on both possession (the device) and knowledge (the 4-digit PIN that protects the app). We're working right now to (optionally) replace the PIN with finger print scanning, when available. Either way, the knowledge (or biometric) portion is much more about asserting ownership of the device (if it gets lost or stolen, you can deactivate online) than as part of the actual authentication process.

any particular reason why? I'd love to hear more of your thoughts...jesse @ our domain (if you have a second).

shoot me an email at jesse@getclef.com and I'll send it your way

We're working on the blog :D

I'll definitely make sure to look over passacre; it seems great.

And no problem on the footnotes, if you ever have any more questions don't hesitate to email me at jesse at our domain name!

Right now, sites need to explicitly integrate with us. We've thought a lot about creating something that manages passwords to bridge the gap. We've actually been working on this with some community members (Joe is here somewhere) and are hoping to roll something out in the next few weeks. Sorry for not addressing the footnotes!

1. exactly, we generate a digital signature similar to SQRL

2. right. from a technical perspective, the barcode is simpler than a QR code; however, it's actually proven really important from a usability standpoint. by animating the interaction, we have more control of the user's mental model of what's going on and can provide a much more intuitive user experience.

Nothing is stopping us from a technical standpoint. Multiple devices is something we plan on adding, but we're being really careful about it because it increases complexity and introduces more vectors of attack. We also think that a phone is tied to a user's identity more than a computer or a tablet, so that's what we're really focusing on. Give the flow a shot and let me know what you think.

That's me, thanks! We're glad you think we have a little more polish, but to be honest, we're really excited about any replacement to passwords making waves in the tech world. Ultimately, no single group is going to be able to tackle this problem alone, so the more critical thought we have, the better off we all are.

If anyone has any questions about Clef, I'd be happy to answer them, but I also don't want to distract from the discussion going on around this proposal.

In here, you talk a lot about scale vs. binary (evil vs. good). Shouldn't you also examine the morals of different startups on this sliding scale? Would you say that Google's "Don't be evil" motto is worse than nothing? Better than nothing? Somewhere in between?

Isn't Google making a conscious effort to try and do something (even if it's a little misguided) better than all the companies who don't do anything?

I'd be really interested to know what kind of work this analysis is done on. Is it manual labor? Or repetitive data entry? Or writing code? I'd be interested to see a breakdown between these different categories.

On this note, does anyone know the original paper where those graphs came from? I clicked through to the linked paper at the end, but no such graphs appeared.

Did y'all move away? If so, would you mind giving a little insight into why?

Yeah, you're naive.

Yes, there are slightly more violent crimes in Oakland than San Francisco (and there's more property crime in San Frnacisco)[1], but on the whole they are pretty equivalent in terms of safety; especially if you stick to the 'nicer' areas of both.

[1] http://www.sfgate.com/crime/article/Crime-up-in-Oakland-much...

Two random thoughts:

1. Shyp is raising $2+ mil at a $5mil valuation — doesn't that seem a little iffy for a first round.

2. I hate it when people capture my scroll, please stop that.

Other than that, Shyp looks awesome and syndicates looks great.

I would guess that it is this one: http://www.wordchamp.com/lingua2/Home.do.

I'm not sure about the technology or business, but I will say that I absolutely love the interactive sliding graphics on their landing page.

That was far and away the easiest and fastest walk through from download -> sending an encrypted and signed email that I've ever seen. Obviously, it only covers one platform, but it's a great start.

glad to see I'm not the only person failing here.

Seems like a good idea, but I'm pretty sure no one will ever user a captcha that repeatedly fails human input (even worse than reCAPTCHA).

Right now, we're working to create an easy to digest summary of our security architecture, so this is just a temporary measure.

I just shot you an email and will follow up with a more in depth summary.

This may help: http://hnnotify.com.

I like the idea — I'll be interested to see if you get any takers.