4 ms·

> The major con is you have to trust that they are using a secure system. From my discussion with the founder on that HackerNews thread yesterday (and his othe

> The major con is you have to trust that they are using a secure system. From my discussion with the founder on that HackerNews thread yesterday (and his other comments on the thread), it seemed clear that they didn't have a good enough understanding of the space - both the technical security requirements and the existing solutions. If you're not clear on what problem you're trying to solve, I doubt that you understand the domain well enough to solve it properly - at least when it comes to security. Security is one field where 80% of the way isn't "good enough" - in fact, 80% may be worse than nothing at all.

dcu 14y ago
Take it easy men, He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community.
- chimeracoder 14y ago
  > He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community. First, he was way off the mark on a number of unrelated elements, not just the key-strengthening algorithm. While it's good that he owned up to his mistake, it's clear from his wording that he was shaky on the actual principles of security and encryption, not just My standards for a security-sensitive product are far higher than for anything else. Any person in any position of authority should have a very clear understanding of the security fundamentals being used. The last thing I want in a 2FA application is for an overeager PM to make a decision that inadvertently compromises the security of the product, in a well-meaning attempt to improve the UI, branding, monetization, etc.
  - newman314 14y ago
    Exactly. Product design and technical implementations do not happen in separate silos. And I want the security products that I use to inspire a much higher level of trust than some generic tool.

dcu 14y ago

Take it easy men, He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community.

chimeracoder 14y ago
> He already stated he was wrong. Do not punish him for wanting to answer fast and be open with the Hacker News community. First, he was way off the mark on a number of unrelated elements, not just the key-strengthening algorithm. While it's good that he owned up to his mistake, it's clear from his wording that he was shaky on the actual principles of security and encryption, not just My standards for a security-sensitive product are far higher than for anything else. Any person in any position of authority should have a very clear understanding of the security fundamentals being used. The last thing I want in a 2FA application is for an overeager PM to make a decision that inadvertently compromises the security of the product, in a well-meaning attempt to improve the UI, branding, monetization, etc.
- newman314 14y ago
  Exactly. Product design and technical implementations do not happen in separate silos. And I want the security products that I use to inspire a much higher level of trust than some generic tool.