5 ms·

"I don't keep any cookies or browse history" Why not? "I get the numeric code sent to me. I go to Google Voice on my computer" This seems like it defeats the

"I don't keep any cookies or browse history" Why not? "I get the numeric code sent to me. I go to Google Voice on my computer" This seems like it defeats the purpose of 2FA. Am I wrong? Isn't 2FA supposed to work by proving that you own a device for which it was set up on? "always download all the images made by Google Charts because that service will die at some point" Probably. If it matters to you, learn some JavaScript and build stuff in highcharts. And next time, never rely on a service that you don't pay for. Also, it's clear by this post you hate Google, especially its suite of exceptionally shitty products, and not the Web.

pp19dd 11y ago
Regarding image-google-chart, and other google APIs: I was going to voice my support for this complaint, as I have a number of still popular projects that use it (and will need fixes or updates), but I had to rethink that. Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term.
- TeMPOraL 11y ago
  > Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term. I totally agree. SaaS is ephemeral. Personally I don't expect to see a SaaS site being active for more than two-three years, because the goal of most startups is to get bought, at which point they'll happily let the product die or turn into a piece of crap. If I use a third party service, I do that with an expectation that my project is temporary and will die/get superseded faster than the service it relies on.
harperlee 11y ago
Upvote for "never rely on a service that you don't pay for"; I think that idea needs to be said out loud more often.
- waps 11y ago
  How exactly does paying come into the picture here. I'd bet that, for example, FoundationDB's customers would disagree with you.
  - danielweber 11y ago
    Because it enables a very simple transaction: I am exchanging money for your good and/or service, so you try to provide me the best experience you can. If Starbucks gave away free coffee but monetized their restrooms, their coffee would eventually end up full of diuretics.
    - TeMPOraL 11y ago
      It doesn't work with SaaS startups. The goal of a typical startup is to get bought. The so-called "exit". Which basically means they don't give a crap about their users. They'll lie to you on their front page that the want to create an awesome service, but it's all a trick to get you to sign up - because the more people sign up, the bigger growth they have, and the better chance of getting bought. And when the buy offer comes, the product gets shut down, paying customers or not.
      - harperlee 11y ago
        It might not hold always, but it is a very good rule-of-thumb. Normally, a company (either startup or not) cares most for its clients, because they are the ones that pay its topline and ultimately its workers' salaries. Other parties (users, providers, government, whatever) also have power and can also influence the company's behaviour, but clients normally have it easiest. That does not always hold, as I said. Another example is you being a commodity client; if the company is, for example, more interested on big clients, your interests might not be the first concern for that company. But they will have you in mind, nonetheless, as the bad service you receive can signal something bad for bigger clients. Sometimes, even big clients are commodities, as they can't wield a lot of power, so the company can act not in its client's best interests (monopolies or tax burden when price is inelastic are scenarios that come quickly to mind).
VLM 11y ago
"This seems like it defeats the purpose of 2FA. Am I wrong? Isn't 2FA supposed to work by proving that you own a device for which it was set up on?" The bug is in the design of 2FA. Sooner or later Google will get rid of GV and I'll just move to another provider to front-end my SMS spam instead of sending it to my phone. The other failure mode is best displayed by my bank not realizing their site is accessible via mobile, so my two factors when customers log in on their phones are the phone people log in with and the code they're sending to the customer's phone, oh wait that's only one factor. Although in the second example the bank wins by security theater. The bank does offer a phone app that demands access to pretty much everything on my phone presumably for marketing / spam purposes or just being weirdo creeps, so needless to say I won't leave it installed, although I did try it for a short period of time. However the bank phone app sucks so I didn't lose much by uninstalling that creep-app. Also the creep-app doesn't do 2FA and seems to be permanently logged in, so I've downgraded my account access to merely the phone lock screen level of security, which isn't very good.
- girvo 11y ago
  Damn. I never thought I'd be happy about my usually behind-the-curve bank, but my bank's app has me type in my user code, password and then identify with my fingerprint. Now, someone could still steal my phone and login to the banks website -- but that'd also require my fingerprint or cracking the very long passphrase, which while it can be done, if that's what I'm up against I've probably got bigger issues than my bank account being raided...
- gnur 11y ago
  The "factors" in 2FA are most commonly, something you know (a username/password) combination and something you have (your phone). Even if you log on on your phone, it's still something you know and something you have, this does not diminish the 2FA.
- pas 11y ago
  2FA means something [only] you know and something [only] you have (the phone number), the 3rd factor is usually something you are (biometric). So using a password and the SMS on the phone is still 2FA as far as I know. However, I also consider my home PC to be safe enough that I don't want 2FA on it. Nope, banks apparently don't want to waste money on considering this user story. Or that what about registering multiple tokens/phone numbers. Got a new phone? Just burn the old one, you can't have backup login methods!
deleted 11y ago
[deleted]

pp19dd 11y ago

Regarding image-google-chart, and other google APIs: I was going to voice my support for this complaint, as I have a number of still popular projects that use it (and will need fixes or updates), but I had to rethink that. Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term.

TeMPOraL 11y ago
> Conclusion: free lunch is over. Some of us developers are learning that we can't rely on a free (or even paid) service for any long term. I totally agree. SaaS is ephemeral. Personally I don't expect to see a SaaS site being active for more than two-three years, because the goal of most startups is to get bought, at which point they'll happily let the product die or turn into a piece of crap. If I use a third party service, I do that with an expectation that my project is temporary and will die/get superseded faster than the service it relies on.

harperlee 11y ago

Upvote for "never rely on a service that you don't pay for"; I think that idea needs to be said out loud more often.

waps 11y ago
How exactly does paying come into the picture here. I'd bet that, for example, FoundationDB's customers would disagree with you.
- danielweber 11y ago
  Because it enables a very simple transaction: I am exchanging money for your good and/or service, so you try to provide me the best experience you can. If Starbucks gave away free coffee but monetized their restrooms, their coffee would eventually end up full of diuretics.
  - TeMPOraL 11y ago
    It doesn't work with SaaS startups. The goal of a typical startup is to get bought. The so-called "exit". Which basically means they don't give a crap about their users. They'll lie to you on their front page that the want to create an awesome service, but it's all a trick to get you to sign up - because the more people sign up, the bigger growth they have, and the better chance of getting bought. And when the buy offer comes, the product gets shut down, paying customers or not.
    - harperlee 11y ago
      It might not hold always, but it is a very good rule-of-thumb. Normally, a company (either startup or not) cares most for its clients, because they are the ones that pay its topline and ultimately its workers' salaries. Other parties (users, providers, government, whatever) also have power and can also influence the company's behaviour, but clients normally have it easiest. That does not always hold, as I said. Another example is you being a commodity client; if the company is, for example, more interested on big clients, your interests might not be the first concern for that company. But they will have you in mind, nonetheless, as the bad service you receive can signal something bad for bigger clients. Sometimes, even big clients are commodities, as they can't wield a lot of power, so the company can act not in its client's best interests (monopolies or tax burden when price is inelastic are scenarios that come quickly to mind).

VLM 11y ago

"This seems like it defeats the purpose of 2FA. Am I wrong? Isn't 2FA supposed to work by proving that you own a device for which it was set up on?" The bug is in the design of 2FA. Sooner or later Google will get rid of GV and I'll just move to another provider to front-end my SMS spam instead of sending it to my phone. The other failure mode is best displayed by my bank not realizing their site is accessible via mobile, so my two factors when customers log in on their phones are the phone people log in with and the code they're sending to the customer's phone, oh wait that's only one factor. Although in the second example the bank wins by security theater. The bank does offer a phone app that demands access to pretty much everything on my phone presumably for marketing / spam purposes or just being weirdo creeps, so needless to say I won't leave it installed, although I did try it for a short period of time. However the bank phone app sucks so I didn't lose much by uninstalling that creep-app. Also the creep-app doesn't do 2FA and seems to be permanently logged in, so I've downgraded my account access to merely the phone lock screen level of security, which isn't very good.

girvo 11y ago
Damn. I never thought I'd be happy about my usually behind-the-curve bank, but my bank's app has me type in my user code, password and then identify with my fingerprint. Now, someone could still steal my phone and login to the banks website -- but that'd also require my fingerprint or cracking the very long passphrase, which while it can be done, if that's what I'm up against I've probably got bigger issues than my bank account being raided...
gnur 11y ago
The "factors" in 2FA are most commonly, something you know (a username/password) combination and something you have (your phone). Even if you log on on your phone, it's still something you know and something you have, this does not diminish the 2FA.
pas 11y ago
2FA means something [only] you know and something [only] you have (the phone number), the 3rd factor is usually something you are (biometric). So using a password and the SMS on the phone is still 2FA as far as I know. However, I also consider my home PC to be safe enough that I don't want 2FA on it. Nope, banks apparently don't want to waste money on considering this user story. Or that what about registering multiple tokens/phone numbers. Got a new phone? Just burn the old one, you can't have backup login methods!

deleted 11y ago

[deleted]