Snowden: FBI obscuring crucial details in Apple case - <AUTHOR> https://twitter.com/snowden/status/700823383961792512 <comment><USER2> More on All Writs Act of 1789.

The Dangerous All Writs Act Precedent in the Apple Encryption Case

[http://www.newyorker.com/news/amy-davidson/a-dangerous- all-w...](http://www.newyorker.com/news/amy-davidson/a-dangerous-all-writ- precedent-in-the-apple-case?mbid=social_twitter)

"Tim Cook, the C.E.O. of Apple, which has been ordered to help the F.B.I. get into the cell phone of the San Bernardino shooters, wrote in an angry open letter this week that "the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create." The second part of that formulation has rightly received a great deal of attention: Should a back door be built into devices that are used for encrypted communications? Would that keep us safe from terrorists, or merely make everyone more vulnerable to hackers, as well as to mass government surveillance? But the first part is also potentially insidious, for reasons that go well beyond privacy rights.

The simple but strange question here is exactly the one that Cook formulates. What happens when the government goes to court to demand that you give it something that you do not have? No one has it, in fact, because it doesn't exist. What if the government then proceeds to order you to construct, design, invent, or somehow conjure up the thing it wants? Must you?"

<comment><USER3> I can't think of a single thing the government has done in the name of surveillance and security that have actually helped catch any terrorists.

All those body scanners at airports? How many terrorists have they managed to catch?

(Meanwhile, TSA agents steal items from baggage all the time)

If all that surveillance couldn't catch the school shooters, the Boston bombers and this couple, is the only solution even MORE surveillance?

<comment><USER4> Do you think they would actually be doing a good job if you (public) knew about the instances surveillance helped? If you were tasked with catching terrorist, what would you do?

<comment><USER5> Yes, if the TSA had stopped a single terrorist, they'd be at least stating a number, if not the facts. Given they won't even give a ball park number is pretty good evidence it is a big fat zero like all the investigative journalism has found. Not like organizations like the TSA can keep a secret.

<comment><USER4> Why would they be stating the number? How can they know if they intimidated or prevented attacks by mere existence? Statistically, mere police patrol presence reduces crime, which is not directly related to detective work.

But, TSA is kind of parallel to surveillance, my question was about whether we could possible judge the success of that, and other intelligence in the most secretive of government operations.

</comment></comment></comment></comment></comment><comment><USER6> No tinfoil intended here, but it strikes me as very unfortunate that the Supreme Court Justice most likely to be opposed to this recently passed away last weekend.

In my not-a-lawyer opinion, I think that Apple will absolutely take this as far as it can. With only an 8-member court, Anthony Kennedy becomes even more important than ever.

We should be lobbying SCOTUS harder now than ever before. We need them to rule against this far more than we need to be calling congress people.

We need the Supreme Court to act with the effect of precedent. But I'm not optimistic. We would need Roberts and Thomas to back off their national security platforms, and we need RBG and Kagan to understand the problem better.

Kennedy is a wildcard, but if we can explain the issue in plain English to those key people and get them to agree, this is doable. Alito and Sotomayor will fall in line.

If we do our jobs as members of the body politic, write amicus briefs, and hound the members of the court, this is doable.

Thomas and Roberts can be swayed. So can RBG and Kagan. It would be an easier 5-4 decision with Scalia still around, but this is possible without him, and we need to focus our efforts.

I'll be putting my money where my mouth is over the weekend and creating a website that submits comments to the individual justices. I'll also be asking for help/edits on the boilerplate I'm offering as a starting point.

<comment><USER7> Did you see Robert Cringely's article where he comes to a very similar conclusion? Ironically, although he sees the same gambit, the two of you seem to be interpreting the situation completely opposite. If I'm reading you both right, you believe Scalia was the most likely to side with Apple, whereas he thinks Scalia was a sure vote for the FBI?

      What's going on is Justice Antonin Scalia is dead.

      Had Justice Scalia not died unexpectedly a few days ago
      (notably before the Apple/FBI dustup) and had the FBI
      pursued the case with it landing finally in the Supreme
      Court, well the FBI would have probably won the case 5-4.
      Maybe not, but probably.

      With Justice Scalia dead and any possible replacement
      locked in a Republican-induced coma, the now eight-member
      Supreme Court has nominally four liberal and four
      conservative justices but at least 1.5 of those
      conservatives (Justice Kennedy and sometimes Chief Justice
      Roberts) have been known to turn moderate on certain
      decisions. This smaller court, which will apparently judge
      all cases for the next couple years, is likely to be more
      moderate than the Scalia Court ever was.

      So if you are a President who is a lawyer and former
      teacher of constitutional law and you've come over time to
      see that this idea of secret backdoors into encrypted
      devices is not really a good idea, but one that's going to
      come up again and again pushed by nearly everyone from the
      other political party (and even a few from your own)
      wouldn't right now be the best of all possible times to
      kinda-sorta fight this fight all the way to the Supreme
      Court and lose?

      If it doesn't go all the way to the Supremes, there's no
      chance to set a strong legal precedent and this issue will
      come back again and again and again.

      That's what I am pretty sure is happening.

[http://www.cringely.com/2016/02/19/the-fbi-v-apple-isnt- at-a...](http://www.cringely.com/2016/02/19/the-fbi-v-apple-isnt-at-all-the- way-you-think-it-is/)

<comment><USER6> I did see that, and I think that Cringley is--like many other people who haven't paid attention--seriously misinterpreting Scalia's history on the court.

My own, admittedly amateur, interpretation is that he's largely internally consistent with his ideas of protecting person freedoms and advocating in favor of judicial restraint.

I see citizens united as an exanpsion of Scalia's attitude about protecting personal freedoms (and this is an expansion I disagree with, btw). His logic in Bergofell was that the court doesn't have the authority to meddle further in religious matters than it already has and needs to exercise restraint.

In my opinion, the argument is stronger in Bergofell than it is in Citizens United, even though I agree with the result of the former and disagree with the latter.

I could be incredibly wrong, but I think that over 30 years, Scalia has been a champion of individual rights and protections more often than not. Much to various people's chagrin at different times.

That has sometimes led to good results and sometimes led to bad. I feel comfortable in this case making the assertion that Scalia would have definitively come down on the side of Apple, and done so in the heavy-handed manner that he was known for and probably persuaded a fence justice like Kennedy to side with him in this case. But possibly also bringing RBG in with him at the same time.

Yes, it's all prognostication at this point, and I know that. But in my opinion, the bigger picture of Scalia outside of Citizens United and Obergefell are the history of someone who would have opposed the order against Apple.

Cringley is just being Cringely: bigoted, hateful, and wrong. As usual.

But then again, I could be really wrong. It does happen sometimes.

<comment><USER8> I am uncertain how one could consider Scalia's jurisprudence as advocating civil liberties.

<comment><USER9> Scalia's opinion in Heller is a good example helping to restore the 2nd Amendment as meaningful along with the 1st and 5th.

<comment><USER10> And his opinion in _Crawford v. Washington_ essentially restored the Confrontation Act of the Sixth Amendment. [0]

I may have disagreed with Justice Scalia on a great many points, but he was one of the foremost defenders of the rights of criminal defendants.

[0]Crawford v. Washington, 541 U.S. 36 (2004)

</comment></comment></comment></comment></comment></comment><comment><USER11> He is suggesting that the FBI sees this as an opportunity to set a precedent and doesn't care about the data?

If so, in FBI logic, in the future there could be a more legitimate need for Apple to comply because a suspect could have a WMD. But so far no such threat exists.

However, let's distort the issue and exploit this opportunity now knowing few will go against law enforcement tactics against the San Bernardino killers?

Because they will need the power in the future but the public has to be scared into acting now to prevent the real hypothetical future attack?

<comment><USER12> No, the public has to be scared into standing by while the courts force Apple to unlock a phone for the FBI, so there will be adequate precedent for doing so later in in more mundane cases, like drug dealers, gangs, and so on.

The thing that scares law enforcement is that in recent years, they've been handed piles of easy evidence that is recorded permanently and easy to access. While before you actually had to do an active man-in-the-middle attack, known as "wiretapping", and that required a court order with good evidence, now there's a ton of communication that is already recorded on persistent media, and all they have to do is find some excuse for taking a look at it to get a lot of extra information without much trouble.

<comment><USER13> This is the most reasonable explanation I have read so far.

Especially given that surveillance tools tend to "trickle down" wrt the severity of the alleged crimes required to use them.

</comment></comment></comment><comment><USER14> I've written up a summary of the current situation for InfoQ here:

[http://www.infoq.com/news/2016/02/fbios- update](http://www.infoq.com/news/2016/02/fbios-update)

Basically, the FBI shot themselves in the foot by changing the password for the iCloud account within a day or two of the incident, instead of consulting with Apple. This meant the phone couldn't auto backup data which is why the snapshot of the data is not necessarily the most recent. Had they not done this they would have been able to connect the phone to a power outlet and a wifi connection, and it would have uploaded the data to Apple's servers from which they could have asked Apple to acquire the data.

Both Apple and the FBI have been requested to appear before a bipartisan committee to answer specific questions about the case.

<comment><USER15> "The auto reset was executed by a county information technology employee, according to a federal official. Federal investigators only found out about the reset after it had occurred and that the county employee acted on his own, not on the orders of federal authorities, the source said."[1]

[1][http://abcnews.go.com/US/san-bernardino-shooters-apple-id- pa...](http://abcnews.go.com/US/san-bernardino-shooters-apple-id-passcode- changed-government/story?id=37066070)

<comment><USER14> That's not the information reported by Reuters this morning [2]

"San Bernardino County reset the password on the iCloud account at the request of the FBI, said county spokesman David Wert."

Sounds like both sides are blaming each other for the event.

[2] [http://mobile.reuters.com/article/idUSKCN0VS2GC](http://mobile.reuters.com/article/idUSKCN0VS2GC)

<comment><USER16> That's actually the best piece of news coming out of the whole affair at this point: despite almost 10 years of practice, authorities still don't have a consistent procedure to deal with iPhones, not even relatively old models. Some groups here and there might know it, but it has not trickled down to average grunts.

</comment></comment></comment></comment><comment><USER17> The phone in question is a government issued work phone? Hadn't heard that before. Pretty big detail that isn't mentioned often.

<comment><USER18> Yep. It's his employer's property. The shooter intentionally destroyed his personal iPhone before the attacks.

<comment><USER19> I hadn't really looked at the details, because the fundamental question of "Can the courts compel work/backdoors from Apple?" is much more important IMO, but this really makes it feel like a fishing exercise from the FBI. Though possible, the chance that the attackers used an employer-owned phone to discuss/plan/coordinate the attackers seems rather remote if they a) had personal phones, and b) took the time to destroy them.

<comment><USER20> It's not a fishing exercise at all. It's a "let's prove that we can create a backdoor for further use" exercise.

</comment></comment></comment></comment><comment><USER21> Senator Feinstein wants with compel Apple to put in a backdoor though legislation: [http://www.mercurynews.com/politics- government/ci_29527867/t...](http://www.mercurynews.com/politics- government/ci_29527867/trump-bashes-apple-over-privacy-fight) Would suggest anyone living in California let her know what you think.

I went to a RightsCon in the midst of the Arab spring. Talked to folks with friends that were being "disappeared" based on what was on their phone.

Meanwhile, David Chaum is suggesting a secret sharing scheme: [http://www.therebel.media/david_chaum_restoring_internet_pri...](http://www.therebel.media/david_chaum_restoring_internet_privacy)

"Chaum's proposed Privategrity system would use nine special servers in nine different countries to encrypt users' data. The theory is, the system would almost always prevent mass government surveillance but would allow government access to combat terrorism or child sex abuse."

<comment><USER22> If Feinstein is weighing in on any issue with any technical depth, look carefully at what she's proposing and what she's opposing. More often than not, she's wrong, and her true motivation is likely to pander to a knee-jerk emotional reaction, without careful regard to the technical implications.

<comment><USER23> I guess that makes Apple's encryption the newest "shoulder thing that goes up."

</comment></comment></comment><comment><USER24> Snowden's analysis is rather lacking.

He claims that the FBI already has all of the suspect's communication records as retrieved via service providers, but ignores the important detail that iMessage uses end-to-end encryption, rendering any such records unobtainable by the service provider.

Yes, the last backup was six weeks prior to the phone being seized, but this only means that the phone may well include six weeks' worth of pertinent evidence. And there is nothing to suggest that the FBI is only interested in messages between co-workers.

Ultimately, the phone's data would need to be decrypted and analysed to see if the first four assumptions that Snowden makes are actually true.

The final assumption is that there are other feasible technical measures that could be taken to crack this phone. This would perhaps be the most interesting point, but Snowden chose to not expand upon it at all.

<comment><USER25> Normally I don't like Snowden, but in this case I think he raises great points all around, the biggest being that the non-work phone (Operational Phone) was completely destroyed. Do you think with that sort of OPSSEC that they slip up and use a work phone? Doubtful.

But hey, the FBI exists to turn over every stone. The real story here is that they specifically chose this case to go after Apple because they suspected the backlash if Apple tried to fight it would be more than they could handle.

<comment><USER24> Even if there's less likelihood of useful evidence on the suspect's work phone, it's still worth checking.

The FBI's request isn't too bad really. It's not like they are requesting Apple to build a new mass surveillance tool or anything similarly far- reaching. This is limited to the domain of digital forensics, and how best to extract data in a criminal investigation, against firmware that is hostile to cracking. Given that, by design, the phone has been locked down to only accept Apple-signed firmware, then Apple is really the most feasible choice to assist in bypassing this.

<comment><USER26> Unless we believe that individuals and corporations are at least somewhat autonomous. If this were Apple's device then sure, I think they should be compelled to make an effort to unlock it, but it's NOT Apple's device, and it hasn't been since it left the warehouse. Apple, in this case, is just an industry expert that happens to know quite a bit about the device. If you couldn't compel MSFT to hack the phone, you shouldn't be able to compel Apple to hack the phone. If you get a warrant to open my safe you can compel me to give you the combination, you can HIRE a locksmith, but you can't compel the locksmith. Compelling the locksmith is a completely foreign legal precedent.

<comment><USER24> I think you are rather downplaying Apple's capabilities here.

Apple is the only entity who can reliably alter the firmware to remove the forensics-thwarting restrictions, due to updates requiring a chain of trust all the way up to Apple's root certificate.

The physical device may not be owned by Apple, but the firmware installed upon it certainly is, both legally (due to copyright law) and cryptographically.

<comment><USER27> _> The physical device may not be owned by Apple, but the firmware installed upon it certainly is_

This is an interesting observation, actually. It suggests that there is a (legal) price to be paid for retaining tight control over firmware.

</comment></comment></comment></comment></comment></comment><comment><USER28> Maybe I'm too far-out there, but what do we _really_ know about the NSA's quantum computing abilities?

Given their budget and their ability to keep things under wraps (eg: consider the scope of PRISM and how they ran that for close to a decade), is it that crazy to think this is a debate they don't care about winning?

Teams at universities made 16 qbit machines something like 5 years ago. D-wave claims 512 qubits today. I don't think it's out of the question that NSA is far ahead of both of them. D-wave employs "100+ people" according to Wikipedia. NSA is estimated to have upwards of 30,000.

It makes a lot of sense, then. NSA got caught with their pants down, naturally backlash from it is still happening today. So if your opponents are going to be winning some ground back, the best PR move is to have them win ground that doesn't matter. (Or that won't matter in a couple years.)

I think these debates about the necessity of key escrow and modified firmware are conversations they're having with the intention of losing, to prevent meaningful pushback but to still provide the illusion of it.

It just doesn't make sense to me that they would invest billions into dragnet infrastructure with the knowledge that something as inevitable as letsencrypt or an iPhone passcode could make it all useless.

Edit: wording and some additional comments

<comment><USER19> > D-wave claims 512 qubits today. I don't think it's out of the question that > NSA is far ahead of both of them.

I don't doubt that NSA have some techniques that are not public knowledge, but is it feasible that they are that far ahead of academia/industry? (IIRC, D-Wave cannot run Shor's algorithm, so is not particularly useful in breaking cryptography). Even if they are, I would expect them to be having these legal battles hoping to win - if there is a plausible, non-classified, way to access the data, maintaining secrecy of these techniques is much easier.

> that something as inevitable as letsencrypt and an iPhone passcode could > make it all useless.

Widespread, well-implemented crypto is probably less inevitable than this makes it sound. letsencrypt etc. probably make the surveillance dragnet less useful, but sloppy implementations and unforeseen weaknesses (e.g. Heartbleed) probably render it still rather useful.[1] Encryption usage, through increasing, is also not a given for people who may be targeted by NSA et al.[2]

[1] In terms that it can be used to gather information. Whether it is actually useful from a security standpoint, and if it is price worth paying, is something I strongly doubt.

[2] See, e.g., [https://theintercept.com/2015/11/18/signs-point-to- unencrypt...](https://theintercept.com/2015/11/18/signs-point-to-unencrypted- communications-between-terror-suspects/)

<comment><USER29> Yes, it would seem that maintaining plausible deniability about their methods (through something that amounts to a kind of parallel construction with an unwitting party) would make a lot of sense. Even if they _don 't_ have the capability, there are game theoretical benefits towards pursuing this.

</comment></comment></comment><comment><USER30> It seems like "parallel construction."

[https://en.wikipedia.org/wiki/Parallel_construction](https://en.wikipedia.org/wiki/Parallel_construction)

The FBI already have what they need, by illegal means. Unfortunately, due to security, they're stuck.

<comment><USER13> I used to think, in such moments, that I was on the way to getting paranoid. These days, I more often think that maybe I should be a lot more paranoid.

It has become really hard to figure out what to believe and what not. The whole affair could simply be a PR stunt. Maybe the FBI wants to create a precedent so they can get an easy access to everybody's phones where they consider it convenient. But maybe, they actually do not want that phone at all and want to create precedent where people think, "Oh look, now I know for sure the Feds cannot get at my iPhone". At times, it all seems like plots within schemes within hidden agendas.

<comment><USER31> > It has become really hard to figure out what to believe and what not.

This. Thankfully it is also becoming obvious to more people the necessity of end to end encryption and open source software. Then - depending on the level of paranoia - we would only need to deal with the encryption tech.

<comment><USER13> Back when I was 16, playing Shadowrun, we used to say that paranoia was not a disease, but a survival strategy.

There are moments when I get close to freaking out about it. I am currently reading Gravity's Rainbow, and now, for the first time, I _get_ the paranoia in that book, I feel it. It is even less pleasant than I had imagined.

And even with FLOSS and the best encryption technically possible, we have to ask ourselves, what does it lead to?

In a society where the state no longer trusts the citizens, where citizens need to use military-grade encryption to keep the intelligence services from accidentally flagging them as potential terrorists because they have a gross sense of humor or a weird hobby, the very fabric that holds society together begins to erode.

If we go down this road, we will become even more estranged and isolated than we are now.

<comment><USER32> Foucault's Pendulum is also a fantastic book about paranoia of this sort, and how it draws people in.

</comment></comment></comment></comment></comment><comment><USER33> The intelligence community never lets a terrorist attack go to waste.

I'm convinced they have a wish list in wait for every tragedy. Next on the list was getting a back door on every cellphone.

<comment><USER34> _I 'm convinced they have a wish list in wait for every tragedy_

That's not even remotely debatable, unless you believe the 350+-page Patriot Act was written within a month after 9/11.

<comment><USER35> That's not unbelievable.

<comment><USER36> > The Patriot Act is huge and I remember someone asking a Justice Department > official how did they write such a large statute so quickly, and of course > the answer was that it has been sitting in the drawers of the Justice > Department for the last 20 years waiting for the event where they would pull > it out. \-- Richard Clarke (former National Coordinator for Security, > Infrastructure Protection and Counter-terrorism)

Often political changes are artifacts of opportunity. I don't personally think that its evil that the justice department had a laundry list of civil rights violations waiting for an opportunity to propose them. It's the responsibility of the public and earnest lawmakers to be aware of efforts to exploit sentiment and resist bad law regardless of when it's proposed.

</comment></comment></comment></comment><comment><USER37> There are allegations that the FBI could easily decrypt the phone if they actually wanted to, found here:

[https://www.reddit.com/r/technology/comments/46exkr/john_mca...](https://www.reddit.com/r/technology/comments/46exkr/john_mcafee_ill_decrypt_the_san_bernardino_phone/d04tyzm)

[https://www.reddit.com/r/news/comments/46np5t/san_bernardino...](https://www.reddit.com/r/news/comments/46np5t/san_bernardino_shooters_apple_id_passcode_changed/d06q9ff)

Any truth to this?

<comment><USER2> If the government hacks the iPhone themselves, they don't get the legal precedent they are so desperate to establish in this case. This paves the way for legislation that forces technology companies to install backdoors in software/hardware. This case is not about the data on the phone itself, the government is simply continuing its march towards comprehensive surveillance systems.

Secret Memo Details U.S.'s Broader Strategy to Crack Phones

[http://www.bloomberg.com/news/articles/2016-02-19/secret- mem...](http://www.bloomberg.com/news/articles/2016-02-19/secret-memo-details- u-s-s-broader-strategy-to-crack-phones)

"Silicon Valley celebrated last fall when the White House revealed it would not seek legislation forcing technology makers to install "backdoors" in their software -- secret listening posts where investigators could pierce the veil of secrecy on users' encrypted data, from text messages to video chats. But while the companies may have thought that was the final word, in fact the government was working on a Plan B. In a secret meeting convened by the White House around Thanksgiving, senior national security officials ordered agencies across the U.S. government to find ways to counter encryption software and gain access to the most heavily protected user data on the most secure consumer devices, including Apple Inc.'s iPhone, the marquee product of one of America's most valuable companies, according to two people familiar with the decision."

<comment><USER38> > This paves the way for legislation that forces technology companies to > install backdoors in software/hardware

But... the fact that Apple can do anything is a result of the OS update backdoor in the first place in this case! If this were a 5S this entire court case wouldn't be possible. This court ruling is not "Apple needs to install a backdoor". It's "Apple needs to exploit the backdoor they have a key to".

<comment><USER39> The argument is that once they have this precedent in hand, they can then use it to force Apple to _alter_ the code in the secure enclave of all current Apple devices so that the security services can gain access to them on demand.

Or else, even if this case doesn't give them sufficient precedent to force that kind of access, it's certainly a legal stepping stone along that route, which is precisely why the FBI is taking the case all the way even though it's clearly not necessary in this specific case - the NSA is perfectly capable of gaining access to the phone in question if they want to & according to Snowden they even have the legal right to do so since it was a work-issued phone where the issuee had signed over the right to scrutinise it at any time.

<comment><USER38> >The argument is that once they have this precedent in hand, they can then use it to force Apple to alter the code in the secure enclave of all current Apple devices so that the security services can gain access to them on demand.

Sure... if there's a warrant for a specific phone, and that Apple even has a way to update the Secure Enclave (my understanding is that updating the Secure Enclave wipes the contents).

One overreach I could see happening from this precedent is getting Apple to participate in a targeted wiretap: Target brings phone to iStore, Apple "accidentally" wipes Secure Enclave (installing backdoor), and target could now have phone hacked later. Contrived, but I think this would be precedent.

But in no way is this ruling a precedent to push out a backdoor to every iPhone ever made. And the precedent that Apple must help unlock an iPhone has existed for over 100 years I think. Based off of the whole "digital key" == "Physical key" logic of the courts, if Apple didn't want to help exploit the backdoor, a judge could probably rule to force Apple to _hand over its actual signing keys for updates_. Awful, but the precedent is totally there

<comment><USER39> In the medium term, my guess is that they want to force Apple to alter the code in the secure enclave of all iPhones manufactured so that in the future the phones can be backdoored on demand either by Apple under warrant or the FBI themselves. In the former case the NSA would of simply acquire the necessary keys by whatever means they preferred.

At the moment, for phones with a secure enclave, this isn't possible: Apple intention was to create a system that they themselves can't crack precisely in order to prevent anyone else from being able to crack their phones. It's possible that the NSA has physical attacks that can work around the secure encalve now, but these are always vulnerable to future improvements in the devices - the government would vastly prefer to have some kind of mandated access.

Winning this case is a step along the path of building up the legal precedent for them to be able to do this. Sure, by itself it won't be sufficient, but they don't expect it to be - it's a stepping stone along the route.

</comment></comment></comment></comment></comment></comment><comment><USER40> I would like to see some clarification on point #5. The only other option I see for the FBI is to continue manually bruteforcing PINs, the arduousness of such a task being why they requested Apple's help in the first place. Is he talking about 0days?

<comment><USER41> Manually bruteforcing PINs is actually not a way to get in here, the phone will wipe the keys that the pin protects after 10 attempts.

I'm not sure what method Snowden has in mind for decrypting this device without going through Apple. It seems like it must be a 0day.

<comment><USER42> Depending on the device/iOS versions, you're able to bypass the count limits.

<comment><USER43> The FBI is asking that Apple provide them the ability to bypass the PIN timeout limits.

In modern iphones, those limits are handled by the secure enclave. However on the 5C in question, the limits are done in iOS and can be disabled by flashing a custom version of iOS. That's what the FBI is requesting.

</comment></comment></comment></comment><comment><USER44> Everytime I hear such stories remember about Overton window [1], its a way from unthinkable to policy,

Around 10-15years ago privacy issues were almost unthinkable (phase #1) (average person didn't think about privacy too much), then wikileaks came out, then Snowden (phase #2, radical) and so on.

Sure FBI has access to phone calls in San Bernardino case, but they are making buzz in news, in order to step to next level, probably from sensible phase into popular, then naturally next step would be `policy phase` and surveillance would be totally legal and everyone will accept this, if not we, then next generation would accept it.

[1] - [https://en.wikipedia.org/wiki/Overton_window](https://en.wikipedia.org/wiki/Overton_window)

</comment><comment> cat-dev-null Does anyone have additional follow-up details of the supposed black SUVs at Apple Cupertino? VEEP, POTUS, TLA, etc.

EDIT: Previous item: [https://news.ycombinator.com/item?id=11120365](https://news.ycombinator.com/item?id=11120365)

<comment><USER45> Looking in that thread, it seems no pictures were ever posted (or if they were, they are there no longer).

</comment></comment><comment><USER46> If Snowden's allegations are true, then it seems pretty clear that the FBI already has all information they claim they need, and doesn't need Apple's help. Rather, this seems to be a "land grab" by the DOJ/BHO Administration to secure government access to all communication devices, all in the name of "National Security". Not unlike the 2001 Patriot Act. Very sad.

<comment><USER47> And a PR move from Apple.

</comment></comment><comment><USER48> This may have already been stated, but in case it hasn't ...

If Apple, as a legal "person" [1], can be compelled against their will to create something that does not exist at the government's will, then what is holding the government from compelling an individual to do the same?

[1] [https://en.wikipedia.org/wiki/Legal_personality#United_State...](https://en.wikipedia.org/wiki/Legal_personality#United_States)

</comment><comment><USER49> The lies that so many of the citizenry buy into are far from nuanced. Rather, they are bald-faced. Often, the liars simply rely on Status Conferral, Ignorance, and Indifference to get by. I contend that Twitter is as much hindrance as help.

It has been a long time since the citizenry last needed to fully engage the Check Boxes of Government: Soap, Jury, Ballot, Ammo. A lot of folks are having a hard time believing the last one is an option. Know Your Roots, indeed.

</comment><comment><USER50> I am more concerned about the idea that the phone password was changed after the government obtained the phone. How is that story not gaining more traction?

</comment><comment><USER20> Does anyone know which version of iOS 9 the device is? Plenty of security updates just in 9.2.1 alone: [https://support.apple.com/en- ca/HT205732](https://support.apple.com/en-ca/HT205732)

I'm sure if must be an early version of iOS 9. Probably lots of zero days (that are no longer zero days) available.

</comment><comment><USER51> I don't think the backups they got are viable because apparently the suspect's employer changed the iCloud password.

</comment><comment><USER52> I think apple should tell the court/gov to f __k off!

</comment><comment><USER53> Off topic, but this is exactly the scenario that Twitter wants to replace by expanding the tweet size limit. Instead of a picture of text, we could expand to real (presumably searchable) text.

<comment><USER54> Right. Perhaps they can begin by rolling this out only to individuals who have verified accounts.

<comment><USER55> I think it would be nifty to treat it as if it were a specialized form of embedded media like pictures and videos. Wall of text as a media type, and maybe even support links to, say, pastebin-type sites (or don't, this parts not critical). Then you still have tweets as the basic unit of Twitter and preserve some consistency.

<comment><USER56> Look up Twitlonger. Various clients have that built in, and it basically but the first few words in the tweet alongside a link to the full text.

<comment><USER57> Look up OStatus. I don't know why people place all their eggs in one walled- garden basket.

<comment><USER56> Network effect, basically.

Everyone is on Twitter, therefore everyone is on Twitter.

</comment></comment></comment></comment></comment></comment><comment><USER58> I'm a fan of snowden, but this is wrong on so many levels it's hard to understand why anyone thinks his points are valid? This is about privacy and technology - depending on the specifics. I'm not sure what these points are speaking to, because it's none of the relevant issues...I guess it's just to contradict the FBI?

1\. Can't prove all when there's data that hasn't been retrieved (encrypted data). What they do have is irrelevant.

2\. What they do have is irrelevant...is this a pattern?

3\. What they do have is irrelevant. Also, coworkers aren't what they are looking for...wtf

4\. Irrelevant...wtf

5\. Unsubstantiated and unlikely that Apple has a way to break it's own strong encryption. Apple probably can disable the bricking-by-attempts. If the FBI are so damn confident the 256-bit AES key can be bruteforced, they can damn well do it themselves.

<comment><USER20> ?? I think he's just saying that this is a pretty unlikely source of intel and not worth creating a massive security back door over. 5 isn't really unsubstantiated. I would be curious to know exactly what version of iOS the device has though</comment></comment>


HTML/SASS Boilerplate Starter - <AUTHOR> I made a HTML, SASS w/ Gulp, Live Reload, bootstrap starter template on github. Is this a decent way to go about it for static sites? Could I add anything else to make it a little more robust? Thanks. https://github.com/BabbagesCabbages/starter-plate <comment><USER2> Is there a live demo somewhere, or just the github?

<comment><AUTHOR> Just the github. The live demo would just be the bootstrap starter template. But you think it would be better to have have pictures and breakdown what it all does with a info website?

<comment><USER2> Absolutely. The friction here is people have to pull the github, boot it, and load it into a browser just to see if its what they want. This translates to not even cloning the repo.

I'd suggest having a live demo that allows people to inspect and play around with it.</comment></comment></comment>


Dear Flash plugin, love OSX - <AUTHOR> http://codesketch.com/2010/01/16/dear-flash-plugin-love-osx/

<comment><USER2> I've worked in Flash for a decade. My experience with it has gone from dabbling with it in high school to experimenting with it in college to doing serious AS development in professional design work. I've come to a certain level of familiarity with and acceptance of its shortcomings, while trying to hone my sense of where it is and isn't appropriate to use.

And alas, it feels like that "is" part gets just a tiny bit smaller every day. For all its quirks and annoyances, Flash is a great environment and it opened the door to really rich web experiences long before the W3C ever imagined them. It still has a lot of advantages today, but the W3C is quickly catching up, and I get a definite sense that Adobe is losing the focus that Macromedia once had. They're continuing to develop Flash as if today were just a futuristic version of 2003. But Flash isn't going to stay relevant in a vacuum.

One of these days, someone (maybe even Apple) is going to come out of nowhere with a beautiful, visual HTML5 Canvas + JS authoring suite and Adobe is going to realize just what they've been taking for granted. And by then it may be too late.

<comment><USER3> Some already exist. Check out Cappuccino (which I use and has been amazing) or Sproutcore (which Apple now owns, I think). There are others as well.

</comment></comment><comment><USER4> For me the single best web experience improvement in the last year has been to install ClickToFlash: <http://rentzsch.github.com/clicktoflash/>

Suddenly, Safari didn't slow down or crash unexplicably, fantastic.

<comment><USER5> I think the only thing that would make my Safari experience more wonderful would be ClickTo(Animated)Gif.

<comment><USER6> Before there were dozens of decent ad-blocking extensions out there I was a big user of Privoxy. It had an action called "deanimate-gif" that would display only the first frame of the animated image.

I'm not sure if Privoxy was downloading the _whole_ image in the background in order to extract the first frame, and I don't know if deanimation used _less_ CPU or RAM than just displaying the animated versions, but I loved the feature regardless.

</comment></comment></comment><comment><AUTHOR> Adobe is ridiculous. Flash on OS X is a joke. It makes sense why Apple is so hesitant to allow it on the iPhone.

<comment><USER7> Silverlight is even more unstable for me in Safari, and Flash is fine for me in non-Safari browsers. I don't know if this is everyone's experience, but on my part I'm more inclined to blame Apple and Safari than Adobe.

On the slowness front, maybe Flash is slower on Mac, but it's hard for me to fault Adobe on this either (even as a Mac user). If I had finite resources, I too would allocate more of those to the majority platform.

<comment><USER8> Silverlight is a breeze in Safari for me. It doesn't eat all of my CPU and the fans keep it down. When I watch a flash movie however on my Mac the fans kick in and it sounds like it's gonna take off or something. Click2Flash let's me load the m4v equivalent on youtube but that's unfortunately only for youtube.

<comment><USER7> Interesting. I'm using Click2Flash and I had tried the m4v option, but I get consistently lower framerates for that than with Flash on Leopard.

<comment><USER9> I've noticed that either using Snow Leopard or using the "Play fullscreen in QuickTime" option cause better framerates. I think it has to do with support for the <video> tag.

</comment></comment></comment></comment></comment><comment><USER10> Anybody who thinks that sounds bad should try running Flash on a PowerPC. It can't play standard size Youtube videos at an acceptable framerate on a G5, while it provides acceptable performance on an Atom-powered netbook running Windows.

The situation on Linux is a little better, but performance and reliability are still poor. Developers should keep this in mind when choosing to use Flash as a cross-platform environment.

<comment><USER2> My parents have an old G4 iMac. Despite its age, it has no trouble with high- resolution h.264 videos in Quicktime.

And yet QVGA Youtube clips play at about 3-6fps.

</comment></comment><comment><USER11> Too bad the original post doesn't accept comments.

Yes, Mac performance can be an extra challenge -- think of discussions in 3D, video-editing, or gaming communities. Things get more complicated when you're in a browser -- particularly on a Mac, you can see changing performance when changing browsers. Video will continue to further improve on PCs with hardware decompression, but on Macs Adobe is still hoping to persuade Apple to open those APIs to browser plugins. Adobe's own goal is to make things transparent across hardware/OS brands. And Adobe is interested in adding authoring-support for "HTML5": <http://blogs.adobe.com/jd/2009/06/adobe_on_html5.html>

<comment><USER12> google's opengl browser plugin, which works fine, speaks otherwise.

it's not an api problem. it's that adobe's software is shit.

</comment></comment><comment><USER13> Is there a technical hurdle that has given Adobe performance problems on OS X? Or is it really just the relative market share leading to few development resources on Mac?

<comment><USER14> Look, let's not kid ourselves, the problem is not technical. I'm sorry, but this stuff isn't rocket science, and even if it was, this plugin has existed for over 20 years, so they should have figured it out by now. Just think to yourself how much better the browser has gotten in that time frame, and its roughly how much worse the plugin has gotten.

The reasons are clearly either politics or incompetence. Now, I'm not sure _what_ those politics might be. I don't personally believe that its that Adobe is "angry" at Mac or something, but I for example know that they are absolutely paranoid about accepting changes to the core code (even obvious crasher fixes require a ton of approval and consideration).

It really is to their own detriment. Regardless of how big the Mac market may be (its too big now to ignore and getting bigger), its a very powerful market of people that matter: i.e. developers. If Adobe got their act together, they would wipe the floor with JS, HTML5, etc. I mean, they _almost_ do now, its purely due to their inability that they haven't completely and absolutely taken over the web.

Of course, the same can be said of standards. Taking 10 years to have any sort of measurable change on the W3C side is equally unacceptable (and we still ended up with a video solution that guarantees Flash will dominate this field for the next 10 years). Its always funny to me when people talk about whether "standards" or "flash" is winning, because it seems like a race where both parties are running backwards.

<comment><USER15> _this plugin has existed for over 20 years_

14 years.

 _Regardless of how big the Mac market may be (its too big now to ignore and getting bigger)_

Nu-uh. [http://en.wikipedia.org/wiki/File:Operating_system_usage_sha...](http://en.wikipedia.org/wiki/File:Operating_system_usage_share.svg)

 _because it seems like a race where both parties are running backwards._

[http://www.time.com/time/health/article/0,8599,1925723,00.ht...](http://www.time.com/time/health/article/0,8599,1925723,00.html)

<comment><USER14> _14 years_

Sorry, you are absolutely correct the plugin itself came out in 1996 with the original software having been developed earlier by PenPoint.

_[http://en.wikipedia.org/wiki/File:Operating_system_usage_sha...](http://en.wikipedia.org/wiki/File:Operating_system_usage_share.svg) _

Not sure what that is supposed to prove, some would argue that that is a sizable chunk (bigger than Windows 7 currently). But that's really besides the point since the argument was that the people that matter are running it.

<comment><USER15> When you want to deliver video or games on the web then it's flash, period. There is no alternative, consequently adobe doesn't need to care about a few crying developers.

As you pointed out this _may_ partly change at some point in the future with the HTML video tag, but that happens independently of happy or unhappy developers.

<comment><USER14> Yes, we all know this is the case, this is not novel information and I will in fact take it a step further and say that its not just games but just about _any_ media products on the web where Flash is the only answer. For example, it is completely unrealistic to make a YouTube or Vimeo or even ESPN.com without Flash today.

My point is that they could have _more_ than just the pure media market if they got their act together. Its never a good place to be when the only reason people use your software is because theres _nothing_ else, and not because they actually like it. Additionally, assuming that there will never be an alternative is just silly. When your developers are unhappy, they _will switch_ once its possible. The fact that Google Docs and similar apps are being done in JS+HTML should be scary to Adobe, if it isn't then they are frankly not very intelligent. Google _will_ define the web tomorrow, and you better believe the second they can realistically go Flashless they will.

Again, all these same arguments apply on the standards side as well, they have dropped the ball and missed the same opportunities again and again, which is why Flash is still in the running (again, both survive due to eachother's weaknesses rather than their own strengths).

If Flash absolutely sang on every computer, it would be a much more difficult argument to make to go the standards route. Not necessarily impossible mind you, but certainly much harder. If it worked well and exactly the same on every computer, then its a hard thing to beat.

<comment><USER15> Mostly tuning in again to express my amusement over the downvotes from the (certainly large number of) flash haters. :-)

As for your points, yes, I didn't mean to argue any of that. Just wanted to set straight that from a business angle Adobe doesn't _need_ to care about that 6% rounding error at this point.

They're waging a platform war which is different to, say, the browser war. Their dominance is so overwhelming that developers have no choice but use them, no matter how much it sucks - adobe knows that very well. That may not have been the reason for their consequent neglect towards the minority platforms from day 1. But not spending more resources _today_ on remedying that situation is most likely a conscious decision (mixed with a bit of incompetence).

They know that making said developers crazy happy at this point doesn't help them one bit against the coming open standards. When the HTML video tag arrives then flash will be pushed out of the video niche, no matter how good it is or how happy the developers are.

Consequently there's simply not much reason for them to spend resources on making the OSX or Linux plugin better. Their focus is on the mobile market now, which is a battle that they really need to win if they want to maintain any relevance in the future.

<comment><USER16> _Adobe doesn't need to care about that 6% rounding error at this point_

I don't have any hard statistics but my anecdotal experience is that the developers of new, "Web 2.0" applications are more like 60% using macs, not 6%.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Apple doesn't have a public API for Adobe to hook into to allow for hardware acceleration. As far as I know, there's nothing Adobe can do to remedy that situation.

Adobe wants to bring better video performance to the Mac, but Apple is not supporting them.

Here's the source: <http://theflashblog.com/?p=1641>

<comment><USER18> I don't buy that. Flash can do everything Parallels can, and - like the article said - inside Parallels flash is running faster!

<comment><USER19> So you are suggesting the Flash plugin starts up an instance of windows so it can utilize the hardware acceleration?

The issue here (with the 10.1 hardware acceleration) is that it requires updated video drivers, and Apple controls those drivers on OS X, and Apple hates Flash. Maybe they will eventually add support, but why would they hurry if they don't like it in the first place?

<comment><USER20> He is suggesting that if there is no public API for Flash to use then there isn't one for Parallels to use either, yet Parallels manages a better job running Flash in IE on Windows all virtualised than Flash manages on it's own.

Parallels does not have updated video drivers from Apple, why should flash need them to match what parallels does now? Whatever Parallels installs or does to handle dismay updates, Flash plugin could do.

<comment><USER19> "Parallels does not have updated video drivers from Apple"

Parallels doesn't run in a browser.

<comment><USER21> However, a browser runs in Parallels. Which should really be much more difficult, when you think about it.

</comment></comment></comment></comment></comment></comment><comment><USER22> This is exactly what happens when you allow one proprietary plugin to become dominant. I have no doubt that that it's not in Adobe's best financial interests to devote more resources to the OSX Flash plugin. It's a small subset of the market. Most users are just going to suffer with what they have. Adobe loses nothing by offering a subpar experience on OSX at this point. I understand it's not realistic to simply say "don't use Flash, ever" because open standards aren't entirely interchangeable with the wide range of Flash apps out there. That being said we should certainly be trying to minimize the amount of Flash used on the Internet. As an avid user of Click2Flash I find it's quite easy to avoid Flash the majority of the time.

</comment><comment><USER23> Try Flash on Ubuntu. Things like VDPau are open source and can be leveraged for GPU acceleration, yet it's still not there. Besides video and games, I have zero clue what it's useful for. Shitty band websites?

<comment><USER19> You say that like "video" and "games" aren't a huge industry.

</comment></comment><comment><USER24> The 10.1 beta2 for OSX is slightly less horrible (<http://labs.adobe.com/technologies/flashplayer10/>). It's still just as crashy, but slightly less CPU-killing.

</comment><comment><USER25> Adobe is really hurting themselves here. If most of the use of Flash on the web is video, content creators now have raw Theora or H264 in <video> as stable alternatives, with Flash becoming an IE-only fallback mode.

</comment><comment><USER26> Dear Flash plugin and Adobe,

Fuck you.

</comment><comment><USER27> This might seem a little polemic - and it is - but I have been wishing Flash a quick death for years now. I simply hate it. No justification of existence for uncaring companies like that in the web of the year 2010. We don't need Flash!</comment>


A Tale of BFS - <AUTHOR> https://medium.com/@egonelbre/a-tale-of-bfs-4ea1b8ab5eeb <comment><AUTHOR> In case it is not clear from the title, this is an article about optimizing a BFS implementation in Go.</comment>


Lost at sea: a man who vanished for 14 months (2015) - <AUTHOR> https://www.theguardian.com/world/2015/nov/07/fisherman-lost-at-sea-436-days-book-extract <comment><USER2> I'm attending a memorial a memorial service for my uncle this weekend. He set sail a year ago to fulfill his life long dream of sailing around the world alone. He did not have the required experience or reliable enough equipment. Some months ago his wife received distressing text messages, sent via a cumbersome satellite communications system, indicating he was boarded by pirates. In fact we believe now he was suffering delusions from dehydration after his water purifier failed. We received no further communications. The Coast Guard coordinated a search based on his last known location in the Pacific. Nothing was found of him or his ship. A judge later reviewed the communications and letters from experienced sailors, and signed a death certificate.

And now this is the second story about someone lost at sea being rescued that I've stumbled upon today. It's a good read, thanks for sharing. I suppose it's good to be able to have some hope that perhaps my uncle could show up on a remote island one day, though it's also hard. At a certain point though you have to accept the odds, find a way to grieve. Sadly, I already have experience with this as a cousin of mine went spear fishing alone one day in the ocean and never returned to shore. That was years ago and no sign of him has ever been found/identified since.

</comment><comment><USER3> I think this fascinates people in part because we sort of think it can't happen anymore. With 7 billion people, GPS, satellites, airplanes, cell phones, we think you can't get lost like this, you can't be so extremely alone. We think space is the only frontier left.

It flies in the face of our mental models of our world. On top of that, it is an extraordinary personal experience that is fascinating for that aspect. So many of us struggle hugely to cope even with the support of modern civilized life. I can't imagine figuring out the logistics of coping practically with such a situation. Coping psychologically is even more unimaginable to me.

<comment><USER4> People who hike the Appalachian Trail & co get lost and die every year. Doesn't take much. Now that is a tiny patch compared to the pacific ocean which is basically half the globe. Even if you can get a distress signal out by the time help arrives you might be in a different position or already dead, not to mention that the question remains if help ever comes. Helicopters can't fly very far, ships take days if not weeks. You might be able to post on Facebook but outside help is not an option (personal experience, not kidding!)

<comment><USER5> If you were able to post on Facebook, why didn't you have a GPS signal from which you could deliver your co-ordinates over the internet? (Just curious, not sure if I'm missing something)

<comment><USER2> As gp said, you could tell people exactly where you are, but it takes a long tome for anyone to be able to reach those coordinates by ship. If your power source dies and you drift in the interim, now it takes many ships and a coordinated effort hopefully involving aircraft for a chance that you'll be found. The ocean is a very large place and a ship doesn't exactly leave tracks.

</comment></comment></comment></comment><comment><USER6> I read a great book back in the '80s called "Adrift", the story of Steven Callahan, who survived 76 days lost at sea. At the time, it was believed to have been the longest solo survival-at-sea.

[https://en.wikipedia.org/wiki/Steven_Callahan](https://en.wikipedia.org/wiki/Steven_Callahan)

[https://www.amazon.com/Adrift-Seventy-six-Days-Lost- Sea/dp/0...](https://www.amazon.com/Adrift-Seventy-six-Days-Lost- Sea/dp/0618257322/ref=sr_1_1?ie=UTF8&qid=1509159114&sr=8-1&keywords=adrift)

Unlike the man in OP's story, Callahan was adrift in a small life raft and had only a tiny emergency kit aboard with which to save himself with. He used those meager supplies to perform some miracles, including a very clever technique that he came up with to patch his raft when it developed a leak.

<comment><USER7> Ray Mears explored this event on Extreme Survival: [https://youtu.be/cIJ7cI2aIwc](https://youtu.be/cIJ7cI2aIwc)

It includes an interview with Steve and a demonstration of how he patched the hole in his raft.

A brilliant show!

</comment></comment><comment><USER8> Another case of a person lost at sea (and in this case, never recovered), is Evi Nemeth, author and professor of systems administration, who disappeared along with six others on June 4, 2014.

[https://en.m.wikipedia.org/wiki/Evi_Nemeth](https://en.m.wikipedia.org/wiki/Evi_Nemeth)

[http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objecti...](http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=10893482)

[https://news.ycombinator.com/item?id=5958974](https://news.ycombinator.com/item?id=5958974)

[http://www.theregister.co.uk/2013/06/30/unix_luminary_among_...](http://www.theregister.co.uk/2013/06/30/unix_luminary_among_seven_missing_at_sea/)

</comment><comment><USER9> I never understood how this guy didn't look more emaciated when he was found. Can you really catch enough birds and turtles to last 14 months and look reasonably fit?

<comment><USER10> The pictures of him are after receiving both food and fluids. The article discusses the edema he experienced. That's probably why his face looks so full. His hands and forearms still look awfully skinny to me.

If the recent picture is what he looked like prior to the whole thing, he lost a _lot_ of weight on that boat.

<comment><USER11> you can see the edema in his ankles.

</comment></comment></comment><comment><USER12> All could've been avoided by a simple wateproofed satphone with an emergency plan. Inmarsat ones are like $650, plus a few hundred a year for emergencies.

<comment><USER13> A £200 EPIRB (10 yr battery life, waterproof, float) would be more sensible.

However, if you are a poor coastal fisherman with no intention of going far offshore... ?

</comment></comment><comment><USER14> Gendry?

</comment><comment><USER15> This story does add up. Likely fake / staged, with just enough facts to make it feel and sound credible.

> Why is he so plump?

> Where's the sun tan?

> Could he really drift 8,000 miles across the ocean in 13 months?

> Do urine and turtle blood add up to a credible alternative to fresh water?

> How did he survive and his crewmate did not?

Source: [http://www.express.co.uk/news/world/458050/Is-the- castaway-s...](http://www.express.co.uk/news/world/458050/Is-the-castaway-s- story-too-good-to-be-true-Doubts-cast-over-miracle-fisherman)

<comment><USER10> > _Why is he so plump?_

Look at his left hand, at how his knuckles protrude from his skinny fingers. He's emaciated. His face is probably not plump but swollen from edema arising from the sudden influx of fluids. The article discusses this.

I imagine if he were "plump" all the people who encountered him after he washed ashore would have noticed.

> _Where 's the sun tan?_

Looks fairly tan to me. I imagine if he were healthy he'd look even darker, since being starved isn't conducive to a healthy complexion. People tend to look pale when they are sick.

> _Could he really drift 8,000 miles across the ocean in 13 months?_

6700, not 8000. That's only 15 miles a day. (And only 18 for 8000 total)

> _Do urine and turtle blood add up to a credible alternative to fresh water?_

Not for 14 months but he didn't claim to be drinking urine and turtle blood exclusively for that time.

> _How did he survive and his crewmate did not?_

This question is just dumb. How does anyone survive when someone else doesn't?

If both survived it would be significantly less believable.

If this is a hoax, it's pretty impressive. Apparently he killed a man to make it stick.</comment></comment>


Times loses almost 90% of online readership as a result of paywall - <AUTHOR> http://www.guardian.co.uk/media/2010/jul/20/times-paywall-readership

<comment><USER2> So, are they making more money now? Isn't that the goal? If you want a gazillion readers, give away a high quality publication for free. If you want to be able to make a high quality publication, though, you need society to bear your costs, and not everyone will want to do that, so you will need to charge and your readership will decline. The toal isn't readers: it is providing provable value.</comment>


HP's webOS Enyo team going to Google - <AUTHOR> http://www.theverge.com/2012/5/24/3042441/hp-enyo-google

<comment><USER2> Great fit for Google. I wonder if they are heading to the Android team or the ChromeOS one.

</comment><comment><USER3> solid win for google - but HUGE loss for HP.</comment>


Resources for Middle School Girls to Learn Programming - <AUTHOR> https://spin.atomicobject.com/2018/04/06/girls-learn-programming/#.Wsdxw60vRik.hackernews <comment><USER2> Probably shouldn't be asking this, but why isn't this just a post promoting resources for middle school kids to learn programming? Why does everything have to be polarized by sexism?

<comment><USER3> Thought the same thing... I would have enjoyed any of these resources when i was in middle school.

Ah but "nerds" can only be boys and boys can pull themselves by their boot straps.</comment></comment>


Floating Feasts – Gourmandism on the high seas - <AUTHOR> http://www.newyorker.com/magazine/2014/11/03/floating-feasts

<comment><AUTHOR> Or perhaps we should instead feast on

 _Floating Point Routines for the 6502_ , by R. Rankin and S. Wozniak [1976]

[http://www.6502.org/source/floats/wozfp1.txt](http://www.6502.org/source/floats/wozfp1.txt)

(Both ship and chip lifted from Raymond Chen's "link clearance" at [http://blogs.msdn.com/b/oldnewthing/](http://blogs.msdn.com/b/oldnewthing/) )</comment>


Show HN: We want to become India's TurboTax. Feedback? - <AUTHOR> http://cleartax.in

<comment><USER4> Hello Archit, Fellow Indian Geek here. I must say good job on the site, you have managed to make something that is usable. Here is some of my suggestions:

1) I think you need to get a fancy logo. current one is too plain according to me.

2) You are asking customers some sensitive & yet I do not see "Privacy Policy" which is what stopped me from entering PAN No right at first step1. If its already there, highlight it

3) A Strong TOS would indemnify from liability. so, You should add a TOS & make customers agree to it.

4) Any Particular reason Pricing is hidden from Homepage?

5) In welcome email that you send. add few details like name, userid etc. It makes it more original & less fake.

6) I understand you want a "Lean UI" but I think more naked than Lean. so spice it up a bit - add some fancy transitions, better typography(Try webfonts) etc.

7) For entering Date,javascript validation message says: "Please enter date of birth in format: 25/10/1984". isn't giving specific format DD/MM/YYY more accurate. Further, Any reason you are not using Date Picker?

8) Make Login Button more prominent. so user won't try to register again. Your current homepage encourages to everybody to click on that big orange button which is not something you want your existing users should be doing.

9) Taxes aren't something that most people understand. so even after such Intutive UI, people will have questions. so highlight your support methods available(Phone, email etc).

10) Last & most important: Don't just be a pretty interface to official Website. You never know when incometaxindiaefiling.gov.in becomes irctc.co.in. That's too risky business model. Try to add more value to service.

Hope it helps

<comment><AUTHOR> Thanks for the detailed feedback.

Actually we have a pretty strong privacy policy. I should put it on the front page: <http://cleartax.in/meta/privacy>

When you sign up, you agree to the terms and conditions. Maybe I should emphasize that a bit more on the signup page: <http://cleartax.in/meta/terms>

<comment><USER4> You're welcome!

About TOS & Privacy policy. I couldn't find these after searching. Maybe place it in Footer, FAQ.

</comment></comment></comment><comment><USER5> While it is good that you kept the UI very lean, you would probably benefit from having a UI/UX guy help you with making the app feel a bit more 'dressed up'. Currently this looks like a developer designed it (I should know, I suffer from the same problem).

Also, having worked on pretty much the exact same product for the French market, one thing I remember people liked was help sections. By that, I mean big long blobs of text that explain the law in detail. On each form page you could display the relevant explainations, and then compile that into a searchable index, and even use that on dedicated pages for SEO purposes.

Oh and maybe you wanna say 'the easy way [to do your taxes]', rather than 'an easy way'.

<comment><AUTHOR> Mikael,

Can you elaborate a little bit on what you mean by "dressed up". I am looking for feedback here :-)

Yes its mostly a developer driven UI.

About Help Section: I am continuously building out the help section from what people ask on our support aliases.

About SEO: Excellent tip. We have seen traffic come to our few blog entries on certain long tail google queries. So we will be working on this next.

I don't see your email on your profile. Maybe I can pick your brains about what you did for the French Market.

<comment><USER5> By 'dressed up', I mean choose a set of colors (say 3) and use them for recurring elements in your pages (titles, questions, etc). Try to use colors and white space to visually separate questions, rather than borders (ex: the legend tag uses borders). Use colored backgrounds to give a sense of vertical space. Also, most sites have a footer, that helps give a sense of space too.

I personnaly would stay away from using yellow/blue/pink/green on the same page (at 1:00 in the video).

I can send you my email, but I don't see yours in your profile either :p

<comment><AUTHOR> Feedback noted.

I just added my email id to the profile. Thanks.

</comment></comment></comment></comment><comment><USER6> Check out this demo video: <http://cleartax.in/meta/demo>

I wish taxes in the US were this simple. I've been thinking for a long time that some good UI/UX designers should be in charge of redoing the US tax code and forms. If it's too complicated to be usable/understandable by a person without special training, then it shouldn't go in the tax code.

<comment><AUTHOR> Actually I lived in the US for 5 years. My tax return was fairly simple - <USER2> TurboTax asked a lot more questions to maximize deductions and tax credits (which were not applicable to me)

We have made an "opinionated" UI where we show only the common deductions. If you want a not-so-common deduction, you can claim it, but its not part of the regular workflow.

</comment></comment><comment><USER7> I used this to file my wife's tax return the other day. The experience was quite good (going by Indian standards). Few things based on my experience.

1) There should be a flowchart explaining the steps. Something like Enter information -> Generate ITR V -> Send it to CPC. I was lost when I was asked to post something somewhere and had to look up the process of e-filing on the net.

2) While entering information each text box/textarea has a information on the relevant field of Form 16. That should link to a pic to sample Form 16 highlighting the field. Somethings were ambiguous.

3) More information on what types of Tax Filings are covered. I had to ask you guys to ask about self employed tax filing (and you guys responded very fast, which was great) because I didn't find a FAQ.

4) Information on when do you have to pay and how much. I was never asked for any payment. Which is good, but I'm still kinda confused how that happened. :)

5) The step where it was submitting the information to the income tax website kept timing out. I guess it was maybe because the endpoint was not responding. I tried it the next day during working hours and it went through. You can maybe automate this by giving users an option to automatically retry.

Few questions I had after using it was.

1) Will you guys add support for digital signatures? 2) Will you also allow someone to apply for a digital signature and get it? 3) What is your business model? Do you charge a fee for each filing?

Overall I'd give you a rating of 4 (on a scale of 5). I wish there were more such utility services in India.

<comment><AUTHOR> Thank you for the detailed feedback! Very actionable.

1\. We'll add the flowchart. This is a very good idea :-)

2\. I'll do a sample picture example for form-16

3\. Its constantly evolving - but that's no excuse. We'll put up a clear page.

5\. Good idea. Feedback noted.

On Questions

1\. Digital signatures are coming very soon.

2\. We are also going to support buying digital signatures via the website. I still need to figure out how to do it in the least confusing manner :)

3\. We plan to sell CA review services of your tax return. Still figuring out whether to charge for each filing.

We'll work hard to get to that 5 out of 5 rating :-)

</comment></comment><comment><USER8> Just curious: how much would I have to pay to get cleartax pro?

Also, you might want to fix the Mr Bose example: "ClearTax (an Income Tax website) rode to his resuce". I'm not entirely sure that I consider the story to be a positive endorsement, by the way :) It seems too contrived to be true.

Edit: I found out there's a demo video from HN. You might want to make that link a tiny bit more prominent. I love the video, by the way.

<comment><AUTHOR> We are still arriving at a good pricing model.

Right now we charge from $5.5 to $30 for professional CA support. (CA in India is similar to a CPA in the US)

<comment><USER8> I /hope/ Ayush's PAN info in the video is fake :)

In my opinion, your prices are too low on the higher end. A normal tax return preparer charges something like Rs 250 (negotiable, particularly on bulk deals) to around Rs 500 for a simple ITR-1/ITR-2 return. For people who require audited returns, It would be an order of magnitude more. I take it you don't do those :)

Either way, best of luck!

<comment><AUTHOR> Actually we are starting to get requests for higher-end cases.

Lot of people who earn income from business and profession would like a quick, friendly UI to get their taxes done. Its hard to design though :)

We aren't supporting auditing yet. We have to figure that out.

</comment></comment></comment></comment><comment><USER9> I will give you 3 quick points : 1) target NRIs and their tax questions. You will not find any more eager paying customers than NRIs who can get help with their taxes and also help in filing . Search the forums and you will will hundreds of queries and questions . Leverage those to come with a custom product offering for them 2) Get some Branding : you will need some solid reputation or word of mouth for people to come to you. Explore tie ups. 3) Get some white hackers to test your site. There is nothing more important than convincing people that they can trust you with important financial data. Have your sites "worked on" thoroughly. :-)

I can give more but not for free ;-)

Pat email@example.com

</comment><comment><USER10> Many software professionals in India use this brilliant <http://www.ynithya.com/taxcalc/>

<comment><USER11> The above said spreadsheets does not work with open/libre office. If you are looking for openoffice version you can use <http://freedom-matters.in/>

</comment></comment><comment><USER12> Two technical things if you are really serious. Localization. Make sure you can support the 22 official languages. And you need a mobile strategy. Mos of your potential users are going to come from. When you consider that brazil had more notebook shipments than India though the population is 1/5th. By my estimation, in India the mobile phone us the Internet.

<comment><USER13> I don't know what the rules are like in India, but in America you don't have to pay taxes if your income is below a certain amount. I'm guessing that most of the people who don't know English are going to be in that lowest tax bracket.

<comment><USER8> The rules are similar, and a bit more generous if you're female, or above a certain age. As for the other part of that statement, you'd be surprised at how many people in that bracket can speak English - at least well enough to use a cell phone :)

<comment><USER13> > you'd be surprised at how many people in that bracket can speak English - <USER3> > least well enough to use a cell phone :)

I think you missed the point - it's not about whether people in that bracket can speak English, it's that there aren't any people in the tax-paying bracket that can't.

<comment><USER8> Indeed. In my defense, anecdotal evidence: quite a few people in what we call the super-senior citizen bracket (yes, really) do pay taxes, and more than a few of them don't speak English.

</comment></comment></comment></comment></comment><comment><USER14> Wish I have seen this last week :). Had to pay 250 bucks to a CA. I tried filing through the income tax website before that.. it looked okay, but you have to jump through a lot of hoops before getting it right. Also, it looked too flaky so didn't dare to go with e-filing..

</comment><comment><USER15> Honestly, no one pays taxes in India. Your product has no market. I can speak at length about this, but it's part of the reason real estate values in India increase by 30% year over year. Everyone hides their black money in real estate investments.

<comment><USER16> >"no one pays taxes in India"

I and millions more pay taxes. True about black money, though, but those are business people. Salaried people pay taxes at source, we do not get cash at all.

<comment><USER15> And the people who are employed by tiny companies get paid in only cash, and also do not pay their taxes.

I will admit that "no one" is an exaggeration, but India is one of the worst countries I could think of to try and start a product that helps people figure out their taxes.

<comment><USER17> Exaggeration and over generalization. You should check with a decent CA on the number of people availing their services to file tax. And just so you know there are 30 million people filing tax returns every year. Quite a low number (in comparison to the population) but definitely not a small market.

</comment></comment></comment></comment><comment><USER18> I like what you are doing here, but you need to be upfront with the pricing before making a user sign up. Having to give up some personal information before even knowing what the product will cost me gives me a negative feeling.

<comment><AUTHOR> I'll put a pricing page up. I can see how its confusing.

</comment></comment><comment><USER19> Some splash page design thoughts: [https://img.skitch.com/20110724-qejdafa6fjpwg3gx86q1xmxdgh.p...](https://img.skitch.com/20110724-qejdafa6fjpwg3gx86q1xmxdgh.png)

<comment><AUTHOR> Wow, thanks for taking the time out!

Couple of Questions: \- Why do you suggest taking the copyright out?

\- I thought hyperlinks should follow typical convention, people are used to clicking them.

<comment><AUTHOR> I understand now about the hyperlinks. Just checked google.com and it has the same behavior. Blue links and underline on hover. :-)

Feedback noted.

</comment></comment></comment><comment><USER20> Just a minor note on English: in "Keep a safe electronic copy of your taxrecords with us" _tax_ and _records_ should be two separate words, not one.

<comment><AUTHOR> Thanks. I'll fix that!

</comment></comment><comment><USER21> While it's great that you're using HTML5 Boilerplate, you should probably change the default favicon and the pink selection highlight colour :)

<comment><AUTHOR> Thank you. Feedback noted.

I kinda like the pink :-)

</comment></comment><comment><USER22> Make sure you load test! www.soasta.com

</comment><comment><USER23> Add some color to the logo

</comment><comment><USER24> Don't try to become the "Something of Something" or "Something meets Something". Instead, try to become simply Something. That is all.

<comment><USER25> "X of Y" is a great pitch starter for a startup. You give the audience something to peg their thoughts on and go from there. Otherwise, potential for confusion before the "aha!" moment is too large.

AirBnB was "We are the eBay of spaces" for a long time. Now that everyone knows AirBnb, everything else is "We are the AirBnB of %s"%('tutoring', 'car rental', 'casual sex', ...).

Do you have a better sentence to get the listener to say "oh I see!" and have their eyes dart all over the place as they think of all the potential uses?

<comment><USER26> I don't know, this might be good way to explain your idea to a non-investor but for VC's I've read the opposite: [http://www.businessinsider.com/entrepreneurs-dont-tell-an- in...](http://www.businessinsider.com/entrepreneurs-dont-tell-an-investor- your-startup-is-like-company-x-for-y-2010-7)

I think instead you can better form your pitch like this: [http://techcrunch.com/2010/11/03/madlibs-pitch-adeo-ressi- fo...](http://techcrunch.com/2010/11/03/madlibs-pitch-adeo-ressi-founder- institute/)</comment></comment></comment>


Downsides of Google Authenticator - <AUTHOR> https://www.zdnet.com/article/using-google-authenticator-heres-why-you-should-get-rid-of-it/ <comment><USER2> Strongly disagree with the premise of this article:

\- Passcode or biometric locks on an app are a gimmick and offer negligible value.

\- The keys not being backed up or or synchronised across devices is not a bug, but a feature. You're supposed to keep offline backup keys. Any sort of synchronization feature adds a ton of attack surface.

\- In particular, Authy, LastPass and 1password have a giant attack surface compared to a simple app like Google Authenticator. They also rely on centralized services and if you also keep your passwords in there, you eliminate the whole point of two factor authentication.

\- One important risk with authentication apps is compromised updates, and Google Authenticator has a very low risk of this since it's backed by Google's strict security processes.

What you should actually do is to move to U2F/WebAuthn and pester any of your service providers that do not offer it. Yes, if you need to replace a token, you'll have to go through all accounts and change it. There's is absolutely no way to prevent this without compromising on security.

<comment><USER3> I've used Google Authenticator for a long time, but the lack of backups is a really serious downside. What I would really like is encrypted backups using a strong passphrase that I can write down on paper (like Authy), but from a trusted source like Google, and with no other features to widen the attack surface (no internet access, no SMS).

Without backups, having a phone die or get lost is a very frustrating experience. If you use backup codes, you have to go re-register 2FA on every account with backup codes. And of course some don't offer backup codes.

You could screenshot and print out the QR code at registration time (I've done this for a few accounts), but shared printers apparently retain history of everything they've printed, so you'd need to own a personal printer, which seems absurd.

You could write down the TOTP secret on paper instead. Ideally with multiple copies and then move them to different physical locations. That's a big hassle to do for each new account registration, which seems to happen every few months.

Encrypted backups solve this easily: you get one key, which you write down once and distribute to different locations if you want. After that there's nothing new to do for new accounts at registration time. And restoring onto a new phone after one dies is also easy.

<comment><USER4> Totally agree, I had my phone stolen a few years back. Had to buy a new one. What a surprise when I restored Google Authenticator and all my sites were gone.

However I do have an issue with 1password's feature of auto-filling those codes, seems like it's just invalidated the whole "something you have" party of MFA.

For me Authy is a happy medium

<comment><USER5> Google Authenticator is backed up on iOS if you use an encrypted local backup via iTunes (or macOS Catalina) or iMazing.

<comment><USER6> Mmm, does that mean that now your iCloud password unlocks all your 2FAs?

It isn't that bad, it still a 2nd factor, but it's worth considering it.

<comment><USER7> When you make an encrypted backup, you enter a separate passcode. So it's not your iCloud password.

</comment></comment></comment></comment></comment></comment><comment><USER8> Last time I checked, by default, Authy codes were susceptible to SIM-swap attacks.[0] This is a bad article.

You should perhaps consider switching off of Authenticator to an Open Source manager like AndOTP; I think that's something reasonable to propose. But I don't understand the argument that I should be very concerned a lack of biometric locks, but not concerned about invalidating the "something you _have_ " part of 2FA.

I don't think it's horrible if someone uses an app like Authy. It's better than nothing. But this article didn't need to exist -- if you use Authenticator, just keep using it, it's fine.

[0]: [https://nitter.42l.fr/DanielShumway/status/10920819670074982...](https://nitter.42l.fr/DanielShumway/status/1092081967007498242#m)

<comment><USER9> Authy only has SIM issues if you give it your phone number. Don't do that.

<comment><USER8> The linked article is recommending Authy over Authenticator because backing up codes on multiple devices is too hard. If you're going to disable remote backup on Authy, then there's almost no advantage to switching away from Authenticator in the first place. Authy also doesn't allow local export of tokens, so there's no advantage there. I guess with Authenticator you lose the ability to lock your local tokens with a 4-digit pin, but who cares? 4-digit pins are not secure.

I just checked on an old installation of Authy, and as far as I can tell there is no way to remove a phone number from the app itself, only change it. Maybe when you're installing you can skip that step. You can turn off remote backup entirely, but see above.

If you use Authy, fine. It's still better than nothing. Really, getting people to use 2FA at all is the important battle, and the fight over which 2FA app is best is probably a waste of time. But Zdnet should not have written an article recommending people switch away from Authenticator to Authy when Authy's _primary selling point_ is actually an attack vector that its own support website recommends disabling[0].

More to the point, the setting makes me trust Authy less in other security areas, because it's an attack vector that they easily could have plugged years ago -- and it makes me think they haven't actually thought that much about security. It's just bad UX to ask users for an encryption password when a single setting will non-transparently bypass that password requirement for some tokens.

[0]: [https://support.authy.com/hc/en- us/articles/360012427914-Is-...](https://support.authy.com/hc/en- us/articles/360012427914-Is-the-Authy-App-Susceptible-to-a-SIM-Swap-)

<comment><USER9> You're right... I take back my comment. For some reason I thought that I had removed the number from Authy. I definitely have multiple devices turned off, which is definitely a confusing bit of UX.

I had a long thread with @philnash (Twillio which owns Authy) not too long ago... this is his reasoning...

[https://news.ycombinator.com/item?id=22022814](https://news.ycombinator.com/item?id=22022814)

While I do not agree with him about having SMS enabled at all, I can listen to his reasoning.

I also agree with you... Authy has been treated a bit like a bastard child once it went to Twillio... the updates are few and far between. The UX isn't great and hasn't improved.

Seems like a good opportunity to build something better.

</comment></comment></comment></comment><comment><USER10> Bitwarden is a pretty good solution for this! It's not the smoothest since the browser extensions don't know how to fill in your codes like they do your password but it's leaps and bounds above the UX for Google Authenticator.

Being able to access my codes from any device with a web browser is very nice.

INB4:

"But this reduces your security."

* Yes, but I'm already using a password manager with 64 char generated passwords on every site.

* If you're able to compromise my Bitwarden password you likely have enough to remove the 2FA on all of my accounts anyway.

"Why even have 2FA at that point then?"

* Because some things in my life require it.

<comment><USER11> I've found the Bitwarden browser extension has an option to automatically copy the 6 digit code after the username+password autofill. Can't remember if it does it by default though. See:

Settings / Options / Disable Automatic TOTP Copy

</comment></comment><comment><USER12> Since FreeOTP (iOS and Android) is open-source and free, it seems trivial to add an export/import feature that can store/load from an password-protected (argon2), encrypted (AES) file.

[https://freeotp.github.io](https://freeotp.github.io)

[https://github.com/freeotp/freeotp-ios](https://github.com/freeotp/freeotp- ios)

[https://github.com/freeotp/freeotp- android](https://github.com/freeotp/freeotp-android)

This isn't suitable because it doesn't allow saving it as a file:

[https://github.com/freeotp/freeotp- ios/pull/129](https://github.com/freeotp/freeotp-ios/pull/129)

</comment><comment><USER13> > Is it risky "centralizing" this data? Sure, but I don't see it any more > risky as using a cloud-based password manager.

Using a cloud-based password manager is a _huge_ risk though. And if you've put both your passwords and your 2FA generators in the cloud, you now have single-factor authentication.

<comment><USER14> >> you now have single-factor authentication

In many cases that factor is now Google's security vs. the same reused password that is your hobby + the year you graduated high school. It this is what makes it convenient enough to always use, it's probably still a step up. It's at least a better, slightly more distributed factor. And even then they're distinct systems, possibly not even within the same cloud.

</comment></comment><comment><USER15> I stopped using Google Authenticator in 2013 when my tokens disappeared after a software update [1]. They were restored in the next update, but I didn't like not having access to the raw TOTP data.

I switched to Authy after the incident, and now use 1Password after I discovered their TOTP feature.

[1] [https://news.ycombinator.com/item?id=6325760](https://news.ycombinator.com/item?id=6325760)

<comment><USER16> Isn't that putting all eggs in the same basket?

<comment><USER17> Yes and no.

Yes, it puts 1Password as the only point of failure iff 1Password security is compromised. This would require knowing my Master Password, my Secret Key, and 2FA with either my OTP from Google Authenticator or a Yubikey to open the vault on a new device, or knowing my master password on a device that I already have 1Password set up on.

On the flip side however, for anyone who _doesn't_ know I use 1Password (oops), any credential stuffing attack or password leak is not likely to get anywhere, as they're not going to be attacking my 1Password vault.

</comment></comment></comment><comment><USER18> I use Microsoft Authenticator and it has cloud backups. Maybe it's unsafe, they promise it's super safe.

[https://docs.microsoft.com/el-gr/azure/active- directory/user...](https://docs.microsoft.com/el-gr/azure/active- directory/user-help/user-help-auth-app-backup-recovery)

<comment><USER19> I think you can turn off cloud back-ups if you want. That's what I use as well. Also -some- cloud backups don't work on it, if the tenant doesn't allow it. My Azure tenant does not, so you have to reset everything up if you get a new phone. It was a painful experience, since me and the main tenant holder both got new phones at the same time. Had to contact Microsoft directly.

</comment></comment><comment><USER20> Since we're apparently all sharing our 2fa methods I've really been liking the yubico authenticator. All the secrets are on the yubikey itself so if something dumb happens to my phone or computer I don't have to worry about them.

Plus, the same device does my FIDO2 / u2f / whatever it is this month for the services that support it.

<comment><USER21> U2F + Googles Advanced Protection Program = secure AF

[https://landing.google.com/advancedprotection/](https://landing.google.com/advancedprotection/)

</comment></comment><comment><USER22> I've settled on Aegis.

It is open source and allows you to export secrets to an encrypted file which you can copy around.

A bit more tedious than Authy and similar cloud sync solutions but lower attack surface and less tedious to back up than Google Authenticator.

Available on F-droid. Beware of Aegis knock-offs on Google Play Store that use similar name.

</comment><comment><USER23> I stopped using Authy because it has auto-update that you cannot disable. One day it auto-updated itself to a version that would not run on my OS. Also, it's an electron app, so it is absurdly heavyweight for the tiny bit of functionality it provides.

I ended up writing my own TOTP app. It's about 50 lines of common lisp code.

<comment><USER9> Authy Desktop

      Memory / Real / Shared

      71.3 MB 116.8 MB 96.3 MB

<comment><USER23>
      > du -sh Authy\ Desktop.app/
      142M Authy Desktop.app/

      > du -sh Clozure\ CL.app/
      35M Clozure CL.app/

<comment><USER9> disk space is cheap, ram is expensive.

<comment><USER23>
      > ps ax -o %mem,comm | grep dx86cl64
       0.4 /Users/ron/devel/ccl/v1.11/Clozure CL64.app/Contents/MacOS/dx86cl64

      > ps ax -o %mem,comm | grep Authy
       0.7 /Applications/Authy Desktop.app/Contents/MacOS/Authy Desktop
       0.2 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper
       1.1 /Applications/Authy Desktop.app/Contents/Frameworks/Authy Desktop Helper.app/Contents/MacOS/Authy Desktop Helper

No matter how you slice it, Authy is just an outrageous resource hog.

</comment></comment></comment></comment></comment><comment><USER24> For those who have not seen the previous HN threads this past year on 2FA, Aegis has emerged on Android which a number of folks (myself included) have migrated to using: [https://github.com/beemdevelopment/Aegis](https://github.com/beemdevelopment/Aegis) (links to G-Play/F-Droid in readme) A backup (encrypted or plain) of your seeds can be exported/imported.

<comment><USER25> This is amazing! Thank you very much, I will set it up along Google Auth in my phone and add it to my home "backup phone".

One thing that had bothered of Google Auth for a long time is the fear of losing my phone and having to go hunting down all the authentication information. And never considered Authy because using an "online service" for these kind of things just seems wrong to me.

</comment></comment><comment><USER26> This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented.

If you're putting all of your OTP codes in your password manager, that _completely negates_ the entire point of _two factor_ authentication.

And sure, maybe you think "well I'm not a high value target anyway, I don't need to really secure my devices", how many of you have work-related accounts signed into your devices? Even if you're just a lowly engineer, I can guarantee you absolutely are a target of sophisticated hacker groups (ironically you may even be _more_ of a target because these groups know that you don't consider yourself a target and therefor are more lax with your security).

<comment><USER27> It's bad practice sure, but to say that it "completely negates the entire point of two factor authentication" is ignoring the main attack password managers are good at defending against: credential stuffing.

Example: If LinkedIn leaks my password, attackers can't use it to gain access to my Gmail because (thanks to the help of a password manager) I use different passwords for all sites. They also can't use it to gain access to LinkedIn because I have 2FA turned on. Even if my OTPs are saved in my password manager, they would need my master password for that.

And if they have someone's master password, they're probably screwed whether or not they have OTPs in their vault because they likely have credit card numbers, addresses, social security numbers, etc in there too.

</comment></comment><comment><USER28> I'm not sure the author on zdnet understand the security implications for "Device surfing". That is conceptually convenient, but really a terrible idea! A new token should be generated for each separate device, but not all token providers support multiple floating tokens.

It's always a battle of convinience versus security, and I get it... people think that because some services have lowered security to allow device surfing, yet without knowing the implications, that it's then just some kind of abstract non-issue taken care of by magical security things not understood. In other words it takes a big leap of faith, that was improper.

</comment><comment><USER29> "Still using Google Authenticator? Let me recommend a replacement with a significantly larger attack surface."

I don't know what the current situation is for iOS, but on Android I've been using andOTP and it addresses pretty much all of the author's pain points (except for automated syncing between devices and the need to install it per- device, but you really should keep the number of TOTP-generating devices to a minimum; more devices = more opportunities for someone to steal that second factor of authentication).

</comment><comment><USER30> Authy. Fantastic replacement app. makes backing everything up a snap. I can log into Authy on one device by allowing on another, etc.

</comment><comment><USER31> Surprised is hasn't been mentioned, but KeePass has the ability to generate the TOTP codes as well. Database is stored encrypted and on your device. Use SyncThing and sync your database across multiple devices securely.

Lots of cross-platform apps to use.

</comment><comment><USER32> Related current thread: [https://news.ycombinator.com/item?id=22432828](https://news.ycombinator.com/item?id=22432828)

</comment><comment><USER33> I like Somu hardware key now. It is so small--fits inside USB slot--I keep it in an extender whem it's not in use.

And, not subject to attacks that work with passcode systems.

</comment><comment><USER34> Use an alternative like andOTP or Authenticator Plus which allow you to backup your keys.

<comment><USER35> +1 to andOTP. It's on F-Droid and still gets semi-regular updates. It's a bit obnoxious that it requires a password, but that just means an autofill from my password manager for free at-rest encrypted storage.

<comment><USER36> I believe if you use the Android Keystore, you can use it without a password and just authenticate with a fingerprint when it starts up.

</comment></comment></comment><comment><USER37> My Google Authenticator data survived me migrating to a different phone because my flow is:

1\. Backup old phone using Titanium Backup.

2\. Get new Android phone.

3\. Root it.

4\. Copy TB backup files from old phone to new.

5\. Restore apps and data on new phone using Titanium Backup.

Obviously it's not a procedure a normal user is expected to do...

<comment><USER38> In Iphone I just do backup and restore in itunes. Everything is migrated. I dont see why you need to do all these.

<comment><USER39> Keys that specify they can't be backed up are not migrated, they are not included in the backup.

</comment></comment></comment><comment><USER40> I use a Chrome extension instead. Works like charm.

</comment><comment><USER41> Just last night I was setting up "2FA" for my girls gmail account. It has so clearly become surveillance it's disgusting. The only options are google consumer apps (or the physical key). The opportunity to link a mobile device to a desktop for advertising purposes was too great.

I have little trust that google authenticator app is any different. But as far I can see you can't use any of these alternatives from the article.</comment>


Indiana Jones Initial Story Concept Transcript - <AUTHOR> http://moedred.livejournal.com/8269.html

<comment><USER2> This is only about a third or so of the full transcript (which is about 130 pages of typed text, of a 5 day meeting). You can find the pdf online (I haven't read it all so I can't comment): [http://www.google.com/search?q=raidersstoryconferencetranscr...](http://www.google.com/search?q=raidersstoryconferencetranscript)

</comment><comment><USER3> Ah, Lucas, if only he read this every time he made a sequel:

"It's a spaghetti western, only it takes place in the thirties. Or it's James Bond and it takes place in the thirties. Except James Bond tends to get a little outrageous at times. We're going to take the unrealistic side of it off, and make it more like the Clint Eastwood westerns. The thing with this is, we want to make a very believable character."

</comment><comment><USER4> I've only read about a third of this, but it strikes me as considerably more productive than most of the product/business design meetings I've been a part of.

Interesting to see how other industries build their ideas.

<comment><USER5> It probably helps that there are just three guys here, and that they have by this point already worked together very successfully on _The Empire Strikes Back_ , which was a large, long, and very similar project. So there's an unusual amount of trust and know-how in this room.

<comment><USER6> What did Spielberg do on Empire?

<comment><USER7> He made sure Carrie Fisher got her daily dose of ...euh... 'Rouge'! Oh, wait... that was on on 'War Of The Ewoks' (aka Bikini Harvest).</comment></comment></comment></comment>