brennenHN

9 ms·

61.
by brennenHN 14y ago
This is the most intense fan fiction.
62.
by brennenHN 14y ago
Is Udacity making money?
63.
Computers are going to disappear(brennenbyrne.com)
3 points by brennenHN 14y ago|0 comments
64.
by brennenHN 14y ago
Great List, there are a lot of cool companies on here.
65.
by brennenHN 14y ago
Google+ whatever, the writing in this article is really bad. There are so many confusing pronouns, redundant sentences, and poorly integrated quotes that I had a hard time making it through the article. Whats up wsj?
66.
by brennenHN 14y ago
There is a PIN to open the app that serves as the knowledge-based factor.
67.
by brennenHN 14y ago
Thanks, that's awesome.
68.
by brennenHN 14y ago
Keeping it on the phone means that we don't need to re-generate a new one or transmit your old one when you change computers. You're absolutely right that keeping the data safe on the phone is an important challenge and it's something we're
69.
by brennenHN 14y ago
Thanks! We definitely want to be open about what we're doing to help demonstrate the safety we're offering. Making that dialog intelligible to users of different sophistications in terms of security knowledge is a major challenge for us.
70.
by brennenHN 14y ago
That's a really good point about the cookie theft. We sign our cookies to make sure that they're inaccessible to others, but making sure they're non-transferrable/stealable is worth more consideration.
71.
by brennenHN 14y ago
1) If Clef ever goes away, you still own all of the data about your users, including their email, and you can easily send them a link to create a password for your site. 2) You are depending on our uptime, and of course this is a huge prior
72.
by brennenHN 14y ago
We do not use usernames or passwords at all. A session key is passed in the QR code. An asymmetric key pair is generated on the phone when you create an account, and the private key never leaves the phone. When you scan in the session key,
73.
by brennenHN 14y ago
Yes, you have to have the phone, but this is still possible.
74.
by brennenHN 14y ago
A telephone or a smartphone? We've actually architected a solution for non-smartphones, but it's not implemented yet.
75.
by brennenHN 14y ago
It's part of our terms of service now that we can't sell the information, I'm not sure what else we can do to prove that other than continue not doing it.
76.
by brennenHN 14y ago
The network connection is an integral part of what makes our system work, and the ubiquity of smartphones is what makes it viable at scale. In terms of trusting a startup, we're working on exposing more of what we're doing to demonstrate it
77.
by brennenHN 14y ago
Authy is doing great stuff, but they're still relying on passwords, which we want to eliminate entirely. We're working on contributing to some Rails gems that would make it much easier to integrate, but the Django and Wordpress suggestions
78.
by brennenHN 14y ago
Clef offers every website drastically increased security for their logins from day one, and the site doesn't have to worry about re-implementing security best practices. Also, since Clef is a single-sign-on solution, only one QR code needs
79.
by brennenHN 14y ago
This is a feature which will be out with our next release. When we detect the visit from a smartphone, we change the QR to a button, and when it is pressed we redirect you through the app, where you verify your PIN, then redirect you back t
80.
by brennenHN 14y ago
This is a fair point. We really want to be respecting users' privacy, which is one of the reasons we've focused on a business plan that doesn't count on selling that data about our users. We do think that a central identity is a better solu
81.
by brennenHN 14y ago
This is a feature that is coming soon. Instead of scanning a QR code, you will be shown a button. Tapping it will route you through our app, where we will confirm your PIN, and then back to your browser where you will be logged in.
82.
by brennenHN 14y ago
This is a feature which will be out with our next release. When we detect the visit from a smartphone, we change the QR to a button, and when it is pressed we redirect you through the app, where you verify your PIN, then redirect you back
83.
by brennenHN 14y ago
Haha, I definitely don't take that as being an ass, it's an important question and it's part of an area that we're trying to improve. We have a section of our website clef.io/lost where you go when you lose a phone. It asks for your email a
84.
by brennenHN 14y ago
On the iPhone, all of the data on the phone is hardware encrypted using the device keychain. The Android app does use PBKDF2-derived PIN-based encryption to store the data. A rooted device would be cracked more quickly than an unrooted one,
85.
by brennenHN 14y ago
We've actually done a lot of consumer research and there are a few things that we think made the Open Sesame project uninteresting to consumers. The first is that it was too early and too few people had smartphones, the second is that it on
86.
by brennenHN 14y ago
We have done a lot of security research and have written a paper which we will be submitting for publication in security conferences in the Spring. We are not smarter than everyone else, and are following the work of several people who are
87.
by brennenHN 14y ago
Even in the best case, knowing what the four digits are, there are 24 possible options. We rate limit the PIN to 3 wrong attempts per day, so an attacker would need 8 days to be certain to gain access to an account. It is easy to remotely d
88.
by brennenHN 14y ago
You're right. Google had an "Open Sesame" project a while ago that used a QR code on top of a password to make logging in more secure. Doing both was just an extra pain and users didn't enjoy it, so they gave up on it.
89.
by brennenHN 14y ago
Good point! There is still a phishing vector of attack that we haven't solved in this release (you call it MitM, but really it's just advanced spear-phishing). We're working on several ways to solve this problem using geolocation and on-pho
90.
by brennenHN 14y ago
Our goal is to get rid of passwords entirely. It is becoming more and more obvious that our memories are no match for raw computational power and clever social engineering, and that we need to be securing our identities with a much better m

More ›