Top Web Design Mistakes of 1999 - <AUTHOR> http://www.nngroup.com/articles/the-top-ten-web-design-mistakes-of-1999/ <comment><USER2> I've said it before, I'll say it again: it's time to divorce the present browser into several different regimes:

• A reading app. Styled on ePub readers, services such as Readability / Instapaper / Pocket, or bibliographic tools (which serve to manage content for searchability client-side). Inclusive of forums-oriented software and feed- reading.

• An applications platform. Preferably with a consistent set of widgets (one of the key failures of present Web design).

• An e-commerce platform, with payment and security features integrated.

• Free-standing media playback tools (already substantively extant).

[http://redd.it/256lxu](http://redd.it/256lxu)

Web design is not the solution. Web design is the problem.

If I could have a tool to 1) remove all styling from a site, 2) reduce it to fundamental semantic markup (and here the HTML5 standard actually does provide a solid framework), and 3) apply _my own_ preferred settings (fonts, margins, font-size, foreground/background colors) to every damned page, with minimal styling allowed, I'd be far happier.

<comment><USER3> Great text, and I agree wholeheartedly. I wonder how much work would it take to script the browser to work mostly in Readability/Pocket-mode.

Off-topic: I've noticed you're using a subreddit as a personal blog/wiki. Could you share more about your experience with such system, apart from what's written at the end of your FAQ?

<comment><USER2> On reddit as a blogging / wiki engine:

• Any time you don't have to set things up yourself is a win.

• The built-in features, including markdown, flairs, moderation tools, RSS, and comments, are great. The more so with RES (the reddit enhancement suite browser extension(s)).

• I'd really prefer a better management of images. I use imgur for image hosting, and with RES these _tend_ to appear with content, but users not using RES get a sort of bastardized version. Since I tend to use images for conveying more information (charts, graphs, and similar data visualization) this matters.

• Post archival. I'm reaching the point where some of my earlier posts are going to get archived ("frozen") and will no longer be editable or commentable (6 months after creation). Since I'm building a reference trove and want to be able to revise content as I develop ideas (my Questions post in particular: [http://redd.it/1v052g](http://redd.it/1v052g)), this is a bit of a drag. I've got a secondary blog that I may rev up as this becomes an issue. I can still access the source for those to port them elsewhere, but it's still a bit of a pain.

• Post length. Turns out that for text-only subs it's 40k chars, not 10k, which was kind of nice to realize. That's around 26 pages rather than 6 per post (typewritten, 250 words/page), which should be enough even for me.

• CSS. I've clearly restyled the site a bit, and I really like being able to do that. About 98% satisfied with what I've accomplished, and a few recent fixes (such as being able to create hierarchical header and list numbering in the Wiki) are really nice.

• Post flair. It's not as complete as tags would be, though the discipline is somewhat useful. I wish it were easier to maintain, though all told it's OK.

• Draft mode: A negative. I really wish I could start to compose something and save it _without_ publishing it. Blogging platforms offer this.

• RSS. I'm absolutely and unapologetically in love: [http://redd.it/1sxfar](http://redd.it/1sxfar)

• Those short links aren't bad either.

• Engagement from elsewhere. After a few months I am routinely getting far more (and better) engagement than I was on G+ ("the Other Place"). Links to other subreddits (particularly popular ones) have grown engagement markedly.

• Better moderation and engagement stats. It's nice to see my traffic stats, though it would be even better to have breakouts for 1) most visited posts and 2) specific user engagement stats. I use RES's user tagging to identify useful and not-so-much people, color-tagging as well. But seeing who's really engaged and contributed would be nice.

• Ways to deal with deleted posts. I've had a couple of instances of people posting good information only to have the post later disappear. I'm aware that there are some sites which archive reddit content, but I've learned to reincorporate that content where and when possible.

• RES again: the RES post editor is fucking amazing. Side-by-side view of markdown and rendered text, in particular, full page width and height. I'll <F-11> the tab to full-screen and write without any distractions. Compare to the clusterfuck that's G+ and weep.

• File storage. I've got a few things I want to be able to post which aren't images, and sorting out how to do that is a bit of a stumper. I'm thinking

• Comments search. As noted in the FAQ, it'd be really nice to have that. Oh well. Also a wiki search -- the wiki in general is handy but not particularly full-featured. I'm curious as to why reddit went NIH on that instead of incorporating, say, MediaWiki. I may branch out my Wikiing efforts to a different platform eventually.

• Search syntax: What reddit lacks in completeness it gains in features. The ability to look for content by user, subreddit, and other elements is a huge win, and I use search _a lot_. The ability to key my own subreddit's search URL into my browser's reddit search keyword means I get my own styling applied to reddit site searches. Yay me!

• Community support. There's a ton of help to be had on moderation, reddit features, CSS styling, and the like. That's been great.

• Expertise. I've got a former LLNL researcher and a nuclear powerplant operator among my readers, which for my areas of interest is great.

• User voting. Sadly, abuse of up/down arrows seems to be growing on reddit. While I'm a believer in _some_ user input on content quality rating, I'm increasingly convinced it needn't simply be open to anyone. Though it also lets me know when I'm touching on controversial topics.

• A projects board. Along with drafts, I've got a large number of writing ideas I'd like to tackle, and sorting out how to keep track of those (preferably integrated with the site) would be cool.

• Data liberation. I cap on Google _a lot_ , but the ability to extract all of my content from the site (and having created an archive extraction tool: [http://redd.it/21t7im](http://redd.it/21t7im)) is actually pretty cool cheese. Reddit doesn't have a similar feature that I'm aware of, though I can iterate over posts.

I'm not sure that another tool (possibly Drupal, which everyone seems to rave about) might not address more of my needs, but on balance I'm still pretty happy with reddit.

My primary challenges now are building a _relevant_ audience, actually creating content (I've got a half-dozen to a dozen half-written postings floating around), and the like.

</comment></comment></comment><comment><USER4> Almost all of this is still relevant today, except for _one_ part:

> 2\. Opening New Browser Windows

> Opening up new browser windows is like a vacuum cleaner sales person who > starts a visit by emptying an ash tray on the customer's carpet. Don't > pollute my screen with any more windows, thanks (particularly since current > operating systems have miserable window management). If I want a new window, > I will open it myself!

Nowadays, the bigger problem is on-page modal windows. Current operating systems now have very good window management, and browsers have zero window management, _except_ for the ability to block popup windows[0].

I get very annoyed by websites that break my ability to open links in multiple tabs/windows by right-clicking, or force me to use their built-in modal windows as a substitute for popups.

Most modern Google properties are culprits of this. For example: if you have a website with Google Apps for Business, it is impossible to open most links in new tabs - they force you to use the on-page navigation instead. The only solution is to open a second tab and navigate to the same location.

We became so afraid of popup windows that we've swung too far in the other direction, and are suffering the consequences.

[0] The solution is _not_ to create a window manager for the browser, by the way.

<comment><USER2> Any breaking of user-specified window management is bad. Producing pop-ups or new windows/tabs when not requested, _or_ preventing them. The key isn't _what the site is doing_ , it is _going against the user 's expectations and/or express preferences_.

<comment><USER4> > Producing pop-ups or new windows/tabs when not requested, or preventing > them.

Agreed - the common pattern I'm referring to is to have a button that the user clicks on to open a modal window.

This is ridiculously frustrating - it obscures the rest of the page, preventing me from navigating around that page or to other parts of the site without manually opening a new tab.

Occasionally those modal windows let me drag them around slowly with my mouse, but that's really only marginally better. I don't want every website to try and invent its own windowing manager, which is what many try to do.

</comment></comment></comment><comment><USER5> On a related note: It's amazing how miserable many popular "mobile first" "hip/modern" sites are to actually use on a mobile data connection/latency.

The modern web may be pretty, but it feels like general usability it at a low point.

<comment><USER6> And the related phenomenon that I've seen more of recently: layouts that try to be mobile friendly, but then have some giant horizontal element sticking way out and ruining the experience.

<comment><USER7> > some giant horizontal element sticking way out and ruining the experience

And more often than not, this giant horizontal element refuses to scroll down properly and makes the whole page sluggish like hell. You gotta love 2014.

</comment></comment></comment><comment><USER8> Websites: breaking my back button for 15 years.

</comment><comment><USER9> I don't know if I should praise the author's insight or scorn the rest of the world for not moving beyond these mistakes.

I'm just kidding... I know scorn is the right option.

<comment><USER10> Maybe because we live in a world where Jakob Nielsen[1] is referred to by the generic "the author." Not a good sign.

No scorn directed at you, just making a point that his myriad work should be ingrained into anyone building for the web.

[1] [http://www.nngroup.com/people/jakob- nielsen/](http://www.nngroup.com/people/jakob-nielsen/)

<comment><USER11> The picture in that link has the strangest quality - he looks like he's a young person that has undergone some Hollywood makeup magic to make him look older. Maybe it's something about the light or his skin or something that makes my brain assume that someone just dyed a young person's hair grey. Very strange.

</comment></comment></comment><comment><USER12> "appropriate behavior of these design elements is defined in the Windows Vista User Experience standard"

This isn't from 1999. Something's amiss...

<comment><USER13> Here's the original [http://web.archive.org/web/20000815063033/http://www.useit.c...](http://web.archive.org/web/20000815063033/http://www.useit.com/alertbox/990530.html)

In fairness, apart from removing dead links to Amazon books on the likes of Win 98 UI guidelines (probably not a big seller any more) and adding in a handful of internal links to slightly more recent iarticles, it's pretty much untouched. Talk about evergreen content...

</comment></comment><comment><USER14> It's interesting to read that, aside from actual design "mistakes" this article also includes some, I would say, etiquette based suggestions which seem innocence/naive in hindsight. It wasn't too much earlier than this that registering a domain name carried some sort of responsibility to create site that was appropriate for it. Boy, those days are definitely long gone!

Not using link-bait titles, always including a biography,not jumping on buzzwords, etc. This is definitely still fine advice for a quality site. At the time I certainly didn't image the future web would be cluttered with sites doing absolutely anything and everything possible to get clicks and views.

</comment><comment><USER15> 4\. Lack of Biographies "My first Web studies in 1994 showed that users want to know the people behind information on the Web."

My first Web studies in 1994:

Internet Access

1\. Log into Ralph. At the % prompt, type the following: telnet FSCAT.OCLC.ORG and press Return or Enter. FirstSearch responds "You are connected to OCLC Online Reference Services. Enter your authorization."

2\. Enter your FirstSearch authorization number and press Return or Enter. FirstSearch responds, "Enter your password."

3\. Enter your FirstSearch user password and press Return. FirstSearch responds, "Welcome to FirstSearch." Follow the menus to search any database.

4\. Use BYE to log off FirstSearch. Just enter bye and press Enter or Return. FirstSearch asks, "Are you ready to disconnect?"

5\. Enter y for yes and press Enter or Return. FirstSearch responds, "You are disconnected."

6\. Disconnect from the Internet using the instructions on your screen.

</comment><comment><USER16> Minor addition for 2014:

11) Breaking the scroll behaviour

<comment><USER2> Scrollbar modifications is a growing gripe of mine.

Even minor stuff. G+, for example, defaults (or defaulted to) to an exceptionally narrow scrollbar, a conspicuous violation of Fitts' law: make your UI control widgets as large as possible to allow for easy access.

I can only surmise that a designer was using Mac OS or another platform in which gesture / multi-touch controls worked around the need for scrollbar access. With a touchpad-disabled, TrackPoint-equipped, mouseless laptop, this was a frequent frustration.

<comment><USER16> Also happens the other way round - just try to scroll at e.g. [http://store.y-3.com](http://store.y-3.com) with a Magic Mouse/Trackpad — Basically impossible since you'll hit the page end just by touching the mouse.

<comment><USER2> Don't get me started on sites that hijack l/r arrows _to navigate between pages on the site_ rather than align text on page.

Fucking NY Times.

</comment></comment></comment></comment><comment><USER17> what about text as images?

[https://developer.apple.com/wwdc/](https://developer.apple.com/wwdc/)

<comment><USER18> The images there all have ALT tags, so that should be okay. Images comprising only text is (obviously) more bandwidth-heavy, though, so that could be seen as a bit of a mistake. It's not a design mistake though, it's more of a "care about your users" mistake.

<comment><USER19> No excuse for this now we have webfonts.

<comment><USER16> Only if you don't care about anti-aliasing.

edit: ...and Kerning, text-flow, font-weight, character maps and other gripes.

<comment><USER20> Surely webfonts allow for better anti-aliasing (with sub-pixel rendering), whereas images can only guess how the sub-pixels on your monitor are arranged.

<comment><USER21> Not always. Different operating systems and browser combos have different ways of rendering fonts. I've seen fonts that look good in OSX in Firefox look poorly in Windows with Firefox (Gentium in my case).

Also these images look like they used gray scale instead of sub-pixel rendering so the differences in pixel geometry should be more or less mitigated.

I'm sure in theory it could look better as actual text for certain setups, but this probably allows them to get the best looking text in the widest amount of configurations.

</comment></comment></comment></comment></comment></comment><comment><USER22> Regarding #5 "Lack of Archives," it seems like most modern sites commit a sin that's nearly as bad: lack of _reachable_ archives. At some point the Web collectively decided that The Blog was the one true format for information delivery, and now everything is presented backwards and you need to click "previous" a hundred million times to see last year's posts.

It's especially maddening when people try to use sites like Tumblr for webcomics and serial fiction.

<comment><USER23> Tumblr is an interesting case of optimizing for content creator experience and seriously neglecting many blatant issues with content consumer experience

</comment></comment><comment><USER24> I tend to see the past 10 years or so of the Web as a great irony for accessibility. It looked like finally a gospel to blind users who could get a nicely structured textual information. In reality, so many websites are simply broken to them with Flash and prevalent DOM manipulation. And every time something good happens (like use of CSS to separate content), something horrible is newly introduced or abused on the other side of the planet.

</comment><comment><USER25> This article has enlightened me about opening browser new windows. Forgive me father, for I have sinned.

<comment><USER12> This was all the rage before popup blockers and tabs!

</comment></comment><comment><USER26> The mailto one is invalid. There's nothing wrong or unexpected about URLs having different URI schemes than http or https. In fact you can configure the browser to send mailto: links to your email website instead of launching an application.

<comment><USER27> There's nothing wrong with linking different schemes as long as the user is expecting it. Most users click links without first examining the URL and the default assumption is that a link points to another page. If you say "click here to email me" or if the link text is an email address or whatever then, yeah, they'll expect a mailto. But if you don't get specific indicators like that, the user will tend to be surprised when their email is suddenly opening, especially if this involves opening Outlook or such, and it's not a good experience to unexpectedly be looking at the "compose new email" window.

</comment></comment><comment><USER28> If only the web stayed declarative...

</comment><comment><USER29> Not using labels with radio and checkbox input elements could be on that list again.

</comment><comment><USER30> Plus ça change...

</comment><comment><USER31> A lot of them are still valid.</comment>


BBC adapting Terry Pratchett's iconic Discworld books for six-part TV series - <AUTHOR> https://www.theverge.com/2018/3/1/17066844/terry-pratchett-discworld-books-tv-adapation-the-watch <comment><USER2> This is good news. They've already done some of the books for the radio, and those weren't awful.

[https://www.bbc.co.uk/programmes/b007k0v6](https://www.bbc.co.uk/programmes/b007k0v6)

[https://www.bbc.co.uk/programmes/b007jmk0](https://www.bbc.co.uk/programmes/b007jmk0)

<comment><USER3> Sorry, this episode is not currently available on BBC iPlayer Radio

</comment></comment><comment><USER4> Hire the people who worked on The Frankenstein Chronicles. They really did a great job on getting the dirty London/Ankh Morpork right.

Regardless I'm skeptical if they can pull Discworld off. Probably a good idea to start with a Vimes mystery if the casting is good.

<comment><USER5> Sky's The Colour of Magic (really The Colour of Magic and The Light Fantastic) wasn't bad iirc.

<comment><USER6> Hogfather was very good as well and I'm a massive fan of the books.

Hogfather been my absolute favourite.

<comment><USER7> Yeah, my girlfriend and I agree. Hogfather had the best translation of the three Sky productions. The cast was great and it managed to hit the right tone the entire time.

</comment></comment></comment></comment><comment><USER8> Six episodes for the entire Discworld? I fear the worst.

<comment><USER9> No, just the guards series and it sounds like not even adaptions of existing stories but rather ones based upon the watch in general. If the BBC pulls off another Sherlock and manage to get a decent writer then I think it could be great, but if they do a repeat of the mediocre adaptions done by Sky a few years back then it will be a sad coda on the inability of studios to do Pratchett well...</comment></comment>


"I have nothing to hide" is the wrong way to think about surveillance - <AUTHOR> http://www.wired.com/opinion/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/

<comment><USER2> The right way to think about surveillance, in the US anyway, is as follows: the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and _particularly describing the place to be searched, and the persons or things to be seized_.

<comment><USER3> Papers, houses, persons, and effects does not include communications or other people's papers about you. We need a new Wiretap Act for this era.

<comment><USER4> > does not include communications or other people's papers about you.

One could say that the type information I have is ill-relevant: it is still covered by the 4th amendment (it is my papers, houses, persons, effects). So, it doesn't make logical sense that information I hold about other people is in some way not covered under the 4th amendment.

</comment></comment></comment><comment><USER5> The discussion from the original posting on Moxie Marlinspike's blog is at [https://news.ycombinator.com/item?id=5869394](https://news.ycombinator.com/item?id=5869394)

Daniel Solove's "Why privacy matters even if you have nothing to hide" is a good complement to this piece. [https://news.ycombinator.com/item?id=4105485](https://news.ycombinator.com/item?id=4105485)

</comment><comment><USER6> For arguing with these "I have nothing to hide" folk.

I'd like to put up a website[1]. At the website, I'd begin posting my personal details. Telephone records, Credit Card Bills, Utility bills, etc. Eventually have a lot of info on there. Not because I like surveillance or don't enjoy my privacy, but because now I can go and make really snarky comments and arguments to the "I have nothing to hide" brigade. Invite them to post all of their data, show their hypocrisy when they don't, or show what we can all learn about them if they do. Anybody else interested?

[1] Trouble is I suck at websites.

</comment><comment><USER7> Among other flaws, the titular phrase comes with hidden assumptions:

"I have nothing to hide", _assuming_ ":

\- everyone accessing my information, now and forever in the future, is honest

\- those monitoring me and agree with me about what's good and bad and their definition never changes in a way that hurts me

\- my information can never be stolen by crooks, advertisers, etc

and so forth

</comment><comment><USER8> Even if you have nothing to hide people you depend on might have something to hide. If a politician cheats on his wife, and only a small branch of the government knows this, they could use this to bribe him.

</comment><comment><USER9> My response to the "I have nothing to hide," or "Don't break the law, and you have nothing to worry about," crowds is the following: If you have nothing to hide, then you should not be opposed to having a "black box" installed in your car. This way, the next time you are pulled over for any reason, the police/highway patrol can just plug into your black box, and if you have exceeded the state speed limit at any point (since it was last read), they can just give you a ticket on the spot.

<comment><USER10> Why wait to get pulled over? They could mail the fine the moment the infraction occurs. Actually, now that I think of it why mail it? Could just debit your bank account directly and save everyone a lot of time.

<comment><USER11> I remember watching an episode of the defunct show Seaquest DSV as a kid, and this was partially there. It was an automated checkpoint that recorded the 'speeding,' but the ticket/payment/etc all happened automatically with a notification to the user.

<comment><USER12> It's more or less like that in France. Automatic speed checks leading to mail in your box with the fine to pay.

<comment><USER13> Likewise in the UK. 95%+ of speed checks are automated cameras with [http://en.wikipedia.org/wiki/Anpr](http://en.wikipedia.org/wiki/Anpr)

</comment></comment></comment></comment></comment><comment><USER14> I think there is a parallel between copyright industries going crazy trying to make digital copies obey the rules of physical copies and our current horror at our loss of privacy. pg had an essay that starts by comparing copyright theft in the digital age to a restaurant owner trying to charge for smells.

Maybe surveillance is the wrong way to think about privacy.

</comment><comment><USER15> I have everything to hide until the government has nothing to hide.

</comment><comment><USER16> Freedom is to not have to care about surveillance.</comment>


Twitter API restrictions explained by Hitler [video] - <AUTHOR> http://www.youtube.com/watch?feature=player_embedded&v=u1LnLH1N7ow

<comment><USER2> Love it! Nice one even if it's quite outdated! :)

</comment><comment><USER3> Excellent! Thanks for the post!</comment>


Effect Mapping Handbook (beta) - <AUTHOR> http://gojko.net/2012/05/22/effect-mapping-handbook-beta-your-feedback-wanted/

<comment><AUTHOR> Here's a beta version of my new book, on Effect Mapping - a simple yet incredibly powerful planning method that fits in nicely with lean startup ideas, iterative/agile delivery and design thinking.</comment>


TypeLink.js  find important links by typing - <AUTHOR> http://weakwire.com/projects/typelink

<comment><USER2> Very cool!

Maybe an improvement: there isn't much constrast between the text and the background of the popup hint (at least on Firefox Nightly on Linux: <http://i.imgur.com/hqrF5.png>).

<comment><AUTHOR> Thank you glad you liked it. not maybe.. that is definitely an improvment . I will change the color on the next push and allow easy css override

</comment></comment><comment><USER3> Neet! When I try search though the "h" in Search gets added to the input.

<comment><AUTHOR> TY. Yes i see it does that will chrome. will look into it.

</comment></comment><comment><USER4> Great</comment>


Ask HN: How to become an industry "teacher" when you're a self-taught "student"? - <AUTHOR> Something really spoke to me the other day. It was this question that I read elsewhere:
If I were to interview you today, would you talk to me about bits of code you were asked to write that you had to go through cycle after cycle of peer review to get merged, or would you talk to me about complex systems you've designed, including training more junior engineers about coding principles, design patterns and how to be more effective in their job?
As someone who isn't quite expert level, but isn't a junior either, I would definitely have used "bits of code" response much more than the "training and leading others" response. But is it a stigma to stay in an industry for very long and not become a leader for newer people at your company?
I've been programming professionally for 8 years. I am starting to wonder if I'm expected to do more high-level work, and take charge in leading others, or if it's just impostor syndrome. Because sometimes I don't feel like I'm taken seriously at job interviews. I want to know of I'm treating programming too much like a "labor" job rather than a profession.
Is it bad that, at 8 years, I have never managed or mentored people at 8 years of working? Even in retail jobs, I have never been in manager or supervisor roles.
But I know friends in other professions who have been managers for many years now.
Would it be excusable if I have never been mentored myself? I have always been self-taught due to the environments that I worked in.
Because there seems to be the pressure that if I've been working this much, that I'm expected to think and do things more on a high level. And teach junior developers the ropes. Heck, I wish I had someone that could have taught me the ropes, when I was a junior.
I don't want to be the blind leading the blind. So how do I make the push and lead others? <comment><USER2> You ask good questions and you are not alone.

Often in the Software field, people who are titled "Manager" often describe their job as "protecting the technical team from the chaos upstairs." In some cases the manager would not be able to pass a whiteboard interview for the coding job. Compare that to a supermarket where the store manager might take a few minutes to show a teenaged employee the right way to mop a really big floor.

In the military there is the concept of a "Staff Sergeant" who is an enlisted person who has gotten into a leadership position over time and brings experience in soldiering to support and supplement the junior officer (fresh out of school.)

Roles such as the one you seek exist and are necessary, but it is not a career path that happens without a lot of effort on your part! Consider a role as a tech evangelist.

Send me a PM!</comment>


ShowHN: Identity.io, Opt-out of data brokers and regain control of your privacy - <AUTHOR> http://www.identity.io

<comment><AUTHOR> I've been concerned about privacy online for a while. There is an implicit trade that occurs on most "free" internet sites, your private information in exchange for some service – and it is not in the best interest of the sites to be transparent with the trade.

Chances are, you're already on a few data-broker lists, have shared something embarrassing out of context online, and have no idea how many different accounts you've signed up for.

I'm hoping to get some feedback on a site I've put together that is working toward solving this problem. It's called Identity.io and it tires to makes privacy online automatic and simple for everyone. So far, the site does the following.

1) Sends you an alert if a site you use materially changes the way the site works which reduces your privacy (i.e. auto-opt-in on linkedin to using your face in adds)

2) Detects all the online accounts you register for, or have ever registered for in the past. It (optimally) does this by connecting to your gmail and running lots of regular expressions against subject lines, sort of like tripit.com.

3) Provides video tutorials and a checklist of what you should do to lockdown your privacy online for all the account types you have + how to opt out of data brokers and other spammers.

It would be great to hear your thoughts and feedback.

EDIT: We are aware we haven't posted up a privacy policy or an about page - trying to get some feedback on the concept and technology at this point. For the privacy policy, we expect to use one similar to our other site's <http://www.privacyparrot.com/privacy>.

<comment><USER3> It looks good so far. It seems it found quite a few of my accounts, but when it stopped scanning Gmail, it said it found 2 accounts. Going to the dashboard shows it found 23.

I don't know if it's possible (or if it already does), but it'd be nice to see why it thinks I have an account with a place. It says I have a Bank of America account, but I use a local credit union.

Will this recognize if I've installed Ghostery? I have it installed, but have only installed it just a few days ago, before I joined this site. How does it know if you need to install it, or does it just say that for everyone? I also have Adblock installed and have since 2007, but it's telling me to install it.

I like that I can add multiple email addresses, but it did seem like it hung when I added new addresses, and no accounts showed up when I added my other gmail accounts and it didn't ask me for authentication for them. I'm not sure they got added properly. I'll check again when I get home.

Also, this:

>In August of 2011, professional social network Linkedin quietly introduced a new feature called social ads. It allowed companies to use photos of any of your contacts, with whom they, had a connection, in their adverts, effectively allowing your contact's to endorse their products.

Excessive number of commas, I think.

Overall, though, it's given me a list of things I would never have known about. I have not followed any of the suggestions yet but I'll run through them when I get home from work. Very nice design, it works quick, and it found a good number of accounts. Are there plans to add more sites to the list or more sources for scanning accounts?

*edit - <USER2>

<comment><AUTHOR> Thanks for this.

We are likely saying you have a BoA account because of an email which they sent you. Showing "how we know" is a good suggestion but would involve us storing some info from your email (which I imagine people who care about privacy are against)

no, it doesn't know if you have ghostery or adblock installed, just tells everyone to do this

multiple addresses: we thought we had this bug squashed, apparently not. Shouldn't be an issue in the future

Glad you find the suggestions useful. If there is pickup, we'll add more account types (currently we scan for about 250) and tutorials.

</comment></comment></comment><comment><USER4> You may want to check your front page links. Having most of them direct to <http://www.identity.io/comingsoon> while your virtualhosts file is out of whack (so prompt to download a httpd/unix-directory) doesn't inspire confidence that you will protect my identity.

<comment><USER5> Personally, I think it's a huge problem that a service that claims to help protect my online privacy _does not have a working privacy policy on its site_.

</comment></comment><comment><USER6> Looks good. Always wondered about all the sites that I have signed up for.

Signed up for it and added an email. The discovering part takes a lot of time and I couldn't do much during this time. How about doing the discovery in the background and let the user explore or do other stuff on the site?

</comment><comment><USER7> I applaud the effort but the one thing that really irks me about things like this is the same think that irks me about the no-call list, i have to put my name on a list to prevent my name from going on a list.

</comment><comment><USER8> Interesting in principle, but I couldn't open the About Me or FAQ, so hard to tell. Won't give up credentials to who knows who the people are.

<comment><AUTHOR> Not sure why the FAQs didn't load for you =/ <http://www.identity.io/faqs/>

This one (is a start) to answer your Q

Who's behind Identity.io?

Identity.io is by run by computer security and privacy experts who are serious about putting you in control of your information. We work out of the NYU-Poly Bloomberg Technology Incubator in New York City.

<comment><USER9> My browser is not seeing that the content at that link is an html page, so it downloads it instead of displaying it. This is a symptom of a MIME-type misconfiguration on your webserver.

<comment><AUTHOR> Thanks - we must have done something wrong with apache - number of concurrent users we are having right now isn't something we've tested before...

<comment><USER10> Neither the Register nor Login links work for me in Chrome stable, view- source: shows no bytes in the response from the server.

<comment><USER11> Same; I get a blank page in Chrome, IE and Firefox.

<comment><AUTHOR> Should be back in business if you'd like to try again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Clearly inspired by MelonCard.com

<comment><AUTHOR> Thanks for the heads up, I actually haven't seen this site until now. We haven't gone after the "search for your data out on the internet and send opt- outs" piece of puzzle. Some of them require you to submit a copy of your driver's license. Also, it seemed like the reputation.com service is on top of this currently.</comment></comment>


Airbnb holds meeting with bankers to extend $1 bln debt facility - <AUTHOR> https://www.reuters.com/article/airbnb-debt/airbnb-holds-meeting-with-bankers-to-extend-1-bln-debt-facility-source-idUSL1N2BI2X7 <comment><USER2> Tangent. How would a rental owner sanitize a unit after occupancy, relative to Covid-19? And how could a renter be confident that such sanitization had been done?</comment>


Ask HN: What was the longest period you had to continuously code? - <AUTHOR> What was the longest period you had to continuously code & what was the result?<p>edit: + to <comment><USER2> About 20 hours solid, in a very high pressure deadline, with a lot of money on the table.

1 day beforehand was spent doing research, reading source code, devising strategy.

Next day (+ well into the following day) 20 hours solid development in Python and C++

After that it was deployed to 530 servers worldwide and went live immediatly.

Functioned perfectly. No bugs.

I was exhausted after that, it took me 3-4 days to recover.

<comment><USER3> Was it worth it?

<comment><USER2> Yes, I made a large sum of cash, and made connections which are still valuable today, some 3 years later

</comment></comment></comment><comment><USER4> Why do people bother with this like it's some kind of badge of honour just to reward C-level bonuses and pick up a few scraps they'll pitifully throw down to you... it's bizarrely masochistic.

<comment><USER5> yeh FT! only kids in their 20s believe this kind of bs

</comment></comment><comment><USER6> Forty hours from bed to bed. Maybe an hour nap. So about 38 hours including throwing up before I went to sleep. I was nineteen. All for a stupid video game that 'had' to ship.

<comment><USER7> That's inhumane.

</comment></comment><comment><USER8> Probably 7 hours straight. It was for an optimized C++ class that I took in my grad program and the particle system project was due. I had bad time management but I was also not t hat familiar with C++ (I knew the basics but not things like SIMD or bit-shifting) so it took longer than others. At the end of the day, I was able to get the particle system working and optimized but it wasn't as up to par as some of the other people in the class and I got a C

</comment><comment><USER9> 15 hours solving a minor HTTP request on a pet project.I had t sleep at 5 AM because I was feeling guilty because of morning brightness.It happens a lot of times to me and it's annoying because I abandon many things.

</comment><comment><USER10> 30 hours (6 chemexes of coffee, half a bottle of Jameson, a metric tonne of general tsos chicken, and a cat nap about 10 hours before the deadline). Grad school, paper deadline, complete overhaul of our core algorithm. Paper got in a few months later, slept for 16 hours the next day. Woke up at 7 and walked to the coffee shop at the corner, the employees thought I was weird for buying a coffee. It was 7pm not 7am!

</comment><comment><USER11> I did a small (6-8 teams) 48 hour game jam that I wrote code almost continuously throughout. I had about 4 hours of sleep in the middle of it, and an hour or two for eating. The rest was writing code. The code was game jam quality (that is to say not very high), but the game itself was pretty fun and we ended up placing second overall.

</comment><comment><USER12> 16 hours. It was a hackathon, I built a mobile app with mocked interactions and flashy UI.

9 hours. Just last weekend, had to build a system to migrate production database data to another db with different schema, right before a very-short- notice-yet-important QA.

</comment><comment><USER13> I did a solid 24 hour session yesterday. Writing an integration with a British bank for my startup ([https://twitter.com/stevegraham/status/831501656734982145](https://twitter.com/stevegraham/status/831501656734982145)). I had no external pressure to do so, I just didn't want to finish until I got it done. I could have carried on afterwards but I thought it was probably best to sleep at that point.

</comment><comment><USER14> 72 hours, I literally passed out 2-3 times for 15 minutes or so.

My boss had me working on every project except the one that the whole foundation of the business was being built upon, until 3 days before our opening trade show. I paid the price and learned a very valuable lesson about the employee/employer relationship. I now refuse to work more than 40 hours per week.

<comment><USER15> what happened?

</comment></comment><comment><USER16> 26 hours. We took 30 minutes to eat dinner and watch 30 Rock.

We were up against a deadline from the Defense Department. One we didn't know about until the day before it was due. The product owner dropped the ball on this one.

We did complete it. Sadly (and not really a surprise) there were other problems with the contract we had with them and the deal/partnership was dissolved.

</comment><comment><USER17> 16 hours, multiple times. Sometimes no bugs/clean deployment, other times a lot of re-work.</comment>


Rather than just being used for business, data can help save the planet - <AUTHOR> https://channels.theinnovationenterprise.com/articles/data-for-sustainability <comment><USER2> You know this is from a hum-drum conference producer, right? The last thing they care about is saving the planet. Unless that gets more people to attend their conferences.

Which by the way are terrible.</comment>


The NSA's elite hackers can hijack your Wi-Fi from 8 miles away - <AUTHOR> http://www.theverge.com/2013/12/30/5256636/nsa-tailored-access-jacob-appelbaum-speech-30c3 <comment><USER2> "The brochure in question dates from 2007, suggesting capabilities may have advanced even further since then ..."

Naaah. I'm sure they have been sitting around patting each other on the back.

On a side note, here's bone. Ever hear of Black VPN? ;)</comment>


Docbook - <AUTHOR> https://docbook.org/ <comment><USER2> I tried DocBook a long time ago. Back then the tooling was so terrible that I gave up. However, the XML syntax made sense to me, but was not fun to write.

Today I'm using AsciiDoc with AsciiDoctor. The AsciiDoc syntax is as pleasant as MarkDown, but much more powerful and more consistent. AsciiDoc can be converted to DocBook if needed, but I've never needed this possibility, because all I need is PDF and HTML output.

<comment><USER3> DocBook is originally an SGML-based vocabulary (I believe DocBook 5 is XML only, with only marginal changes from DocBook 4), so you can always use SGML short references to create your own own little custom Wiki or casual math syntax. Or you can use pandoc to write markdown syntax and convert to DocBook or PDF or whatever. I guess DocBook is mostly for whole books, but the one conference paper I did using DocBook was a pleasant experience; the workflow and results, apart from the PDF produced by LaTex which of course was fantastic-looking, were much better than using LaTeX, publisher-specific LaTeX templates, and in particular latex2html if you want to publish your paper on your home page. Even when using LaTeX for an ACM-published paper (not a math- heavy one, though), I ended up using pandoc for converting LaTeX to HTML because the result of latex2html was unusable, attempting to exactly match two-column layouts, screwing up semantic text order, biblio formatting etc.

</comment></comment><comment><USER4> When I was at O'Reilly Media, we worked on an HTML replacement to Docbook called HTMLBook.

[https://oreillymedia.github.io/HTMLBook/](https://oreillymedia.github.io/HTMLBook/)

As far as I know, O'Reilly Media still uses this for all book production.

<comment><USER5> I don't think so anymore. I wrote a book for O'Reilly in 2016 ([http://flyingsquirrelbook.com/](http://flyingsquirrelbook.com/)) and it was done in ASCIIDoc, which is a variant of Markdown (or perhaps vice-versa) with some custom extensions and structures.

<comment><USER6> > which is a variant of Markdown (or perhaps vice-versa)

Neither, AsciiDoc has similar design goals to Markdown but it's a completely separate markup language. I like to explain AsciiDoc as a markup language that sits somewhere between Markdown and LaTeX, it handles far more things than Markdown (and is therefore more complex) but isn't nearly as complex as LaTeX (but also doesn't handle nearly as many things).

</comment></comment></comment><comment><USER7> _takes a long drag_ … now that's a name I haven't heard in a long time.

<comment><USER8> I know meme comments are generally downvoted on HN, but this comment helped to immediately confirm for me that "Docbook" referred to what I thought it did.

</comment></comment><comment> 08-15 Does anyone else have the feeling that Docbook was killed by XML?

20 years ago, there was Docbook, an SGML application. There was also Linuxdoc SGML, another, simpler SGML application for us common people. You had to write the SGML in an ordinary text editor, but the markup isn't too obtrusive. Stylesheets were written in DSSSL (essentially Scheme) and processed with Jade. Output was either HTML or flow objects, which could be processed by TeX to get nice postscript. There were also some shortcuts to produce Unix man pages.

And then the whole world apparently decided that SGML is bad and XML is good, and started over. Markup became annoying, DSSSL was replaced with XSLT, which should not be looked at with unprotected eyes, instead of Jade we got Apache Xalan(?), which needed a supercomputer to run (thank you, Java) and was generally a pain to use (again, thank you, Java), and it produced either HTML or XSL:FO, and there was no working processor for the latter, so there was no longer a good way to produce PS or PDF.

It took a few years until xsltproc finally made XSLT usable (but still not pretty to look at), and Apache FOP could format to PDF (when running on a supercomputer, just like Xalan). But nobody wrote their documentation in Docbook or Linuxdoc anymore. Because markdown and asciidoc and a bazillion similar ad-hoc languages may not have been as theoretically clean, but at least the tools worked, even on a cheap workstation.

<comment><USER9> Oh my yes. "XML all the things" was very much a hot trend in the early 00s. I'm even guilty of getting caught up in it. I hand-coded a handful of docbook docs for no good reason, and then even bemoaned not having XSLT tooling. In retrospect DSSSL was the better formatting thing, and XML docbook was horrendously complicated.

I'm prone to Stockholm syndrome relationships with technology, but XML Docbook / XSLT eventually popped my self delusion bubble.

</comment></comment><comment> mike-cardwell I redesigned the exim.org site about 10 years ago (I know it's not very pretty, but you should have seen the previous version). Anyway, the site is entirely static, and they wanted to keep it that way, and they also had a system for generating documentation at build time into a docbook file.

I wrote a perl script which converted their docbook into html by applying XSLT to it. Worked pretty well. They just run a script to generate the new version of the website each time they do a release.

</comment><comment><USER10> Over 10 years ago I wrote a tool to transform Open Office files (with proper styles applied) to Docbook using XSLT and Schematron. It was fun to do. Now all these techs seem to have almost completely disappeared, which is kind of sad. It was fun.

<comment><USER11> Did XSL FO ever become used somewhere serious? That seemed an incredibly powerful tool but so complicated and it didn't ever seem to be fully implemented.

<comment><USER12> There's AntennaHouse and PrinceXML, but both are pretty pricey ($3-5K / server), and both of these do now support CSS as well.

Apache FOP / Batik is okay for generating nice looking PDFs, but its SVG rasterization is much worse than that of Chrome's PDF renderer (Skia).

As I didn't get the memo about XML being dead, I'm still using Docbook and XSLT/XInclude to structure and filter content written in markdown/rst.

But I will be switching over from XSL-FO to CSS paged media for layout as soon as Chrome supports bookmarks in PDF output, or either WeasyPrint or wkhtmltopdf improve their CSS3 column support.

<comment><USER13> Biased cause I work there, but DocRaptor offers a saas API version of the Prince library with a much lower usage-based monthly fee.

</comment></comment></comment></comment><comment><USER14> I wonder now and then as to what's the format and tech to use for docs that need to include same chapters in different pages, to be published in several formats, etc. Afaik Docbook was used for this in the unixlands, but I guess the key word is 'was.'

Should I just go for Tex once I get the irresistible itch to do this sort of stuff? What's the web-first solution that would still permit to also support the godsend Epub and the pathetic PDF? I'm also up for sacrificing some of my life on the altar of Lisp―is there anything like Butterick's 'Pollen' with any popularity?

<comment><USER15> Don't use Tex if you're aiming for web formats. There's technically ways to do it but I've never found it effective.

There's a few high cost options used by technical writers that are likely overkill for what you need (Madcap Flare is one I relatively enjoy).

Sphinx is probably the best for what you're looking for though: [http://www.sphinx-doc.org](http://www.sphinx-doc.org)

<comment><USER14> I thought Tex could be used to publish to pretty much anything that's in use out there? HTML should certainly be easier than PDF.

<comment><USER16> TeX is a document typesetting language, not a file format. It's really, really awesome for making documents that are typeset in a very specific way. LaTeX gives you a set of macros on top of TeX that allows you to abstract some of that stuff to a certain degree, but the underlying engine is for typesetting.

HTML does not have the fidelity of TeX. You just can't do the same things in HTML that you can do in TeX. Just to make it clear, TeX is a real programming language, though with a truly bizarre syntax and grammar (I still love it, though ;-) ). Trying to execute TeX and output HTML is incredibly difficult to do with any kind of quality. You could take LaTeX documents and then write a completely different formatting system that output HTML, but at that point, you would be better off using a system that is intended to output HTML: like docbook :-)

<comment><USER14> Hmmm. This convinces me that I should look into Tex and Latex soonish, as I can't comprehend why anyone would want exact typesetting for electronic-first documents in the age of varying screen sizes.

I dream of the day when PDF is as dead as Flash, for I have dozens of PDFs in my reading pile—which I can't reasonably get to, because I don't have a 14" tablet or a printer and can't spend days on end propped in front of the laptop just to read through them. Meanwhile, practically all of those docs are two- column walls of text alternating with rectangular pictures, nothing more complicated than Markdown, and they won't be printed in a paper journal. But the authors felt for some reason that they have to employ PDF.

I've been sermonizing for years that it'd be better to publish in HTML and, if the author feels like it, build PDF from the same source—and now it turns out that Tex is a one-track thing and I could just as well 'print' HTML to PDF! I gotta see what's so special about Tex that HTML doesn't look serious enough to the big boys.

<comment><USER16> TeX was written in the 70's ;-) The main reason for using TeX is if you want to typeset a document that will be "photo-ready" for a print publication. Quite frequently it is for typesetting scientific papers (which is why it is popular with academics).

Like I said, TeX is a typesetting language. It is literally a programming language that takes typesetting programs (including the data) and outputs an exact photo-ready output. It's very easy to convert the photo-ready output to a PDF, or a PNG, or GIF, SVG, etc. Because TeX is a programming language, you can write macros (there are no functions in TeX). These macros work on input you give it. In the old, old days, someone would create a set of macros for typesetting documents for each of the major journals and publications you might want to publish to. Eventually, a guy name Leslie Lamport wrote a whole set of really good macros called LaTeX that would allow you to write documents in a consistent way for a whole bunch of different types of publications. That way you could minimally change the document and resubmit it to a different publisher.

So why do people still you TeX? There are two main reasons: First because there is still a need for very high quality print output. TeX is special in that it has _perfect_ algorithms for doing things like line breaking, kerning, etc, etc, etc. The output of TeX is dramatically better than just about any other piece of software. It's insanely better than any word processor will output and there are probably only a handful of desktop publishing packages that are even close. If you need absolutely perfect print output, then TeX (and LaTeX) are a really good fit.

The other reason for using LaTeX (not so much TeX, because typesetting documents in TeX is almost insane: I used to do it for fun, but I have never, ever in my career met another person who has done this) is for typesetting mathematics. The LaTeX macros for math are extremely convenient and the pictorial output from TeX are perfect. This allows you to typeset your mathematics in LaTeX, generate a picture and then paste that picture into an HTML document, or Word document, or whatever.

There is one notable file format that is built on top of TeX that also is meant for digital use: Texinfo. This is the original documentation format for GNU. You can write hyperlink documents in Texinfo and it will generate TeX output for high quality print documents, and HTML (as well as a few other formats). It is _very_ limited in its features, though and the HTML output is so-so, IMHO.

There are a couple of other document formatting systems that output TeX as well (and in fact, I'm pretty sure there is one that will allow you to build some rudimentary TeX documents with docbook), but I'll let you look for those if you are interested.

<comment><USER17> > Texinfo

Note that Texinfo was originally meant to generate output for the info file format (viewed by the GNU info viewer as well as GNU emacs and a few other less used viewers) alongside TeX, which is probably where it got its name (tex+info output). The info format is essentially a primitive hypertext format with support for hierarchical nodes and keyword indices packaged in a single file (essentially a primitive text-only form of CHM, though later versions of info also support external image references). The HTML and other output formats were added much later.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I still find this format useful. Suppose your docstrings are scattered across the code base or some sort of data model, and you need to assemble them into large document. XML-based formats will work reliably. pandoc does decent job of transforming DocBook into all kinds of outputs.

</comment><comment><USER19> We used DITA extensively for many years. DITA was largely awesome in terms of authoring, we could and did produce HTML and PDF with one click, but the tools were awful and expensive. Maybe that's changed now.

My company is now moving to putting their docs in confluence, which I hate.

<comment> ainar-g > My company is now moving to putting their docs in confluence, which I hate.

The only good thing I've found so far about Confluence is that you can kind- of-sort-of escape its WYSIWYGness by pressing the small "<>" ("Edit Source") button at the top and just paste your XHTML, that you've written like a normal human being, in there. But of course it only supports a subset of XHTML, doesn't support anything CSS beyond very basic styling, and it makes it very hard to work with tables of contents and other extensions.

<comment><USER19> That's a good idea. I found confluence's UI to be almost unusable. I was constantly fighting style changes, like spending 5 minutes trying to un-bold something when I should have been getting my brain dumped.

</comment></comment></comment><comment><USER20> Is this still used ?

<comment><USER21> It's not used directly in a lot of places. However, it's still used in a lot of publishing toolchains as an intermediate format, usually compiled from asciidoc via asciidoctor[1]. O'Reilly books, for example, are all written in asciidoc and then run through a publishing toolchain that goes through asciidoctor to docbook, to eventually get rendered into printable formats as well as PDFs.

[1] [https://asciidoctor.org/](https://asciidoctor.org/)

<comment><USER22> Docbook is an "ok" filter to acquire competent tech-doc-folk who are capable of both content improvements (prose), and asset delivery (books). It's also a well-known check-box for good programmer-typographers.</comment></comment></comment>


Mailvelope - PGP for webmails - gets safer with latest update and security audit - <AUTHOR> http://www.mailvelope.com/blog/security-audit-and-v0.6-release

<comment><AUTHOR> I will add that the author addressed most of the complains - you can write, encrypt and decrypt mails in a window completely separate from the window, that appears with a click in the webmail window.

It is protected from clickjacking by secret token that the user can set up in settings that will appear in the new window. See <http://www.mailvelope.com/help#security></comment>


Introducing GitHub Sudo Mode - <AUTHOR> https://github.com/blog/1513-introducing-github-sudo-mode <comment><USER2> Whilst yes, GitHub Sudo Mode will certainly help if you leave your machine unattended or someone snipes just your session, but it won't help if someone gets your password. GitHub should have two-factor authentication by now.

We've already seen the Github SSL replaced by a self-signed certificate in China[1] and I'm sure other similar situations have occurred, so stealing the password via man-in-the-middle or a similar attack is feasible. GitHub uses HSTS[2] but something like SSLStrip[3] only needs to work once for your account and repositories to be compromised.

GitHub, like it or not, is the key to a lot of valuable resources. From private repositories for start-ups or large companies to public open source repositories used by millions, they're all potentially vulnerable.

I should clarify that I do love GitHub, they've improved collaboration in the open source scene substantially, but when something like homakov's GitHub exploit occurs, you realise how important GitHub's security is.

[1]: <https://news.ycombinator.com/item?id=5124784>

[2]: <http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security>

[3]: <http://www.thoughtcrime.org/software/sslstrip/>

<comment><USER3> I already have 4 different fobs on my keychain (not counting my YubiKey for LastPass). I'm not quite sure what I'll do when every website has one and I'll need 20 of them. It also doesn't help that they're all unlabeled.

Edit: I just realized I actually have 6 fobs, but I only keep 4 on my keychain.

<comment><USER4> Lots of sites use RFC 6238 -- Github probably would too. Then you can just use Google Authenticator (or similar) to manage them.

<comment><USER5> I was so disappointed that Twitter's TFA didn't choose to go with the mechanism you mentioned. Is there a compelling reason not to use it?

<comment><USER6> Because they wanted to annoy Kim Dotcom.

<comment><USER5> I'm sorry, I don't get the joke. Does he break into people's Twitter accounts?

</comment></comment></comment></comment></comment></comment><comment> B-Con This is becoming common practice. A base level of common features are available to a normal login session with particularly sensitive operations requiring re-authentication.

It seems that this really only defends against idle session hijacking, though. If the attacker is in a position to ride on whatever session they want, they'll just wait for an "elevated" session.

The classic sudo-esque escalation model can be configured to only allow sudo sessions within terminals, so doing one sudo doesn't suddenly allow the entire system "sudo" access. If it did, a malicious program could just sit and hit the priviledged operation with "sudo" until they got let in. The web's "sudo" is essentially this, because all authentication sessions go over HTTP and you can't really sandbox the source as nicely.

[edit] (HN had a funny hiccup there. Anyway...)

It would be interesting if we could get the same thing on the web. Perhaps some new type of cookie is considered "temporary, ultra-safe" by the browser and never written to disk, auto-cleared after X time, only transfered over HTTPS, etc.

<comment><USER7> You are right. I think they should issue a new session id when you escalate. That way someone can't ride your session.

I checked, and it appears they don't regenerate the session id when escalating.

I am not an expert, but I think this is a case where you want to regenerate the session id.

<comment><USER8> We use Rails CookieStore. The cookie does change when you enter sudo mode, so a session would have to be compromised _while_ you are in sudo mode.

<comment><USER7> Ah, you are correct. It changes in the tail position, and I was only looking at the first bit. Sorry about that.

It seems impossible to ride a session in this case, as the GP suggests.

</comment></comment></comment></comment><comment><USER9> I'd love if those additional checks, not only on GitHub but in general, asked you to re-login via the regular login form so that it could be auto-filled by the browser (or other passwords managers) with the same reliability as the the regular login form is.

Now, it requires you to fish out and paste the password from the manager into this, yet another, special field.

EDIT: I know that some managers can guess when to use the password in a different context on the same site. But not all of them and not all the time.

Mozilla's manager (built into Firefox) doesn't do it properly on Google accounts page, or on GitHub. At least it didn't yesterday.

<comment><USER10> 1password, and I'm sure keepas and those of its ilk handle them just fine.

<comment><USER11> LastPass handles it fine.

</comment></comment></comment><comment><USER12> We implemented something similar for our own internal admin accounts recently on <http://lanyrd.com/>

We have a bunch of admin tools that are only available to our team members, for all kinds of minor administrative tasks. These show up with a nasty pink background to remind us that they are admin-only, which gets in the way of doing demos and taking screenshots.

We also support federated login via Twitter and LinkedIn, and were unhappy with the idea that someone might break the security on one of those services and use that to hijack a privileged admin account on our own site (sure, they likely have better account security than us in general, but they are a much more tempting target for attackers).

So... we added the concept of an "admin upgrade" - a link site admins can click to enter an account password and temporarily elevate their privileges. This improves the security of our admin accounts and has the pleasant side- effect of making it much easier for us to take screenshots and give demos without exposing our admin functions.

<comment><USER13> I use something very similar to your system, but people who know better will tell you that your admin functions should be at a distinct app at admin.example.com, which you'd make only accessible to people VPNing into a gateway box which does nothing but VPN. You can secure them normally after that, independently of the service proper.

This prevents a variety of attacks, such as leaving as XSS anywhere in your application, from causing you to lose th le admin console.

<comment><USER12> We have a seperate set of (more harmful) admin tools that are on an entirely different login system, but yes, going VPN only is definitely a sensible next step.

</comment></comment></comment><comment><USER14> I think Amazon.com has a similar authentication scheme, where lots of stuff is accessible while logged in, but destructive stuff, like making a purchase, requires another log-in. It's a great model, especially when you think of it more like keeping safe things easy rather than making dangerous things hard.

<comment><USER15> Amazon's been so far ahead of the game on this.

I'd like to see more authentication frameworks take this use case into account. "Logged-in" should actually be a spectrum of at least 3 states, not binary.

<comment><USER16> The really secure version of this is a method used by some banks (eg, all German banks) where your normal login is basically read-only, and any action requires the use of a one-time code.

It can be a bit of a hassle, but it makes a lot of sense when dealing with money.

<comment><USER17> This requirement of extra security has forced thieves to develop more advanced methods. The easy stuff is malware that intercepts the PIN when you submit it on your desktop, and malware that intercepts SMS PINs can be found in many european mobile apps. The only practical use of 2-factor is to fight password reuse.

So really, they should just ask for a PIN once instead of for every action. But I bet it makes people feel more safe to keep entering it.

<comment><USER18> Not true. My bank in Switzerland uses the following scheme:

\- For logging in, I enter a 6 digit code to the dongle. It spits out a 8 letter pass-phrase, which I then enter to the website.

\- For authorizing payments, I need to enter the last 5 digits from the account number to the dongle. Again it produces a passphrase.

\- The authorization is only required the first time you make a payment to an account. So it's not even particularly annoying.

This is basically malware-safe, assuming a user who understands how the scheme works. The result from a 6-digit input code is useless to an attacker, and no amount of malware on the computer can make me enter a 5-digit code (since I'd read those numbers from the paper invoice). Likewise highjacking form submission and changing the account number when I enter a payment would do the attacker no good.

<comment><USER17> _This is basically malware-safe_

The malware only needs to monitor your session until you enter whatever credentials were prompted of you by the real-live site, upon which it captures the connection, prevents your post, and does an automatic drive-by withdrawl from your account.

Phishing is a different discussion. For users who don't know better (which is 99% of them) they will just ask you for whatever they want, with a carbon copy of the content of the real site, and once provided with it, will do whatever one-time transaction you would have done on the real site. The only difference is they don't need malware to do this.

Combine the two (perhaps with some slight-of-hand using your own browser's UI) and they can challenge and authorize a payment to an account you don't realize is incorrect. If you double-checked the account number you might realize the switch.

For most American banks none of what you described is offered to the consumer or business owner. In Europe there's just an extra step in the way for the fraud. (Swiss bank accounts would, I assume, require more stringent security procedures than most other banks)

<comment><USER18> I wasn't talking about phishing, and you must be misunderstanding the protocol that I described. It's safe from malware that highjacks the browser.

<comment><USER17> How?

<comment><USER18> I don't understand where you think the attack surface is, and thus can't address the problem you think exists. So unfortunately the best I can do is describe the thing again, using different words. Sorry.

The posited malware can't initiate an automatic transaction, since an OTP from the bank dongle is needed. The dongle needs to be seeded with a specific part of the receiver's account number, so just any OTP generated by the dongle won't do. The account number has been passed out of band (generally on a paper invoice), so taking control of my browser doesn't give the attacker a way of fooling me into generating an OTP suitable for use with their account either.

<comment><USER17> _The posited malware can't initiate an automatic transaction, since an OTP from the bank dongle is needed._

This attack hinges on intercepting a human entering in authentication information by hand into what they think is a secure, valid site. The human will be doing manual stuff, but the code is automated.

 _The account number has been passed out of band_

If it was not passed out of band, or a phishing or mitm attack changes the account number and the user doesn't notice, this attack will work. It's a difficult but rewarding targeted attack similar to those used by the chinese, eastern europeans, etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> I really like how gitHub explains this feature in a way most geeks (i.e. its customer base) would understand instantly. "Ah! just like sudo".

</comment><comment><USER20> Still no option to make me a sandwich :(

</comment><comment><USER21> I thought this was around for a while. I guess they just finally got some time to have a blog post on it.

<comment><USER8> Just shipped it a couple minutes ago. Previously, we only had password confirmations for adding Public Keys.

<comment><USER19> This is nice. Last time I checked, it also emails you when a public key is added, which is a really great feature IMO.

However, it doesn't (didn't?) email you when you change your email address. So if you want to silently add a public key, you can temporarily change the email address, add the key, and then change the email back. Of course it's not a huge concern, since you need the password anyway, but it just makes relying on this email alert slightly less reliable.

Apologies if this has been changed/fixed already. I haven't tested it recently.

<comment><USER8> Adding a new email address is _now_ behind "Sudo Mode"...

<comment><USER19> I was talking about the email alerts though, not the password re-check part of it (or are they basically the same feature?)

</comment></comment></comment></comment></comment><comment><USER22> Frankly, I dislike this kind of thing. My passwords are typically 32-character random strings, stored via a secure mechanism; having to re-enter them means retrieving them from the secure password store and re-entering them.

My computer is under my physical control at all times while I'm authenticated; I don't need a website to ask me to reprove it over and over.

</comment><comment><USER23> Judging from the title I thought I would be reading about force push from the web UI.

That'd be a lot of fun.

</comment><comment><USER24> I find this measure ill conceived. It only protects from unlocked computers and sniffed session cookies. The right way to handle these two problems is to religiously lock your computer when you step away and to serve nothing on port 80 but a permanent redirect to port 443.

As spindritf pointed out, it merely serves to annoy (or worse, forces passwords to be transported via system clipboards which tends to increase the security risk).

<comment><USER25> How would serving everything through SSL and "enforcing" workstation locks on people mitigate XSS and CSRF attack vectors? Requiring additional privilege elevation drastically reduces this.

<comment><USER24> Those are already solved by using CSRF tokens and escaping all the things. Still no reason to bother users with additional password prompts, which come with a number of risks of their own, not least of all causing users to use weaker or shared passwords because they have to enter them all the bloody time.

</comment></comment></comment><comment><USER26> This is cool! I wish more websites would do things like this.

Side note: would it be possible to add user customization to this? As in, make this the default level, but have an option for requiring the password on all "dangerous actions" regardless of the elapsed time?

</comment><comment><USER27> I think that it introduces a (minor) security risk : if you have access to an idle session, and you can force a user authenticate through another means, then you can exploit the idle session to change password.

</comment><comment><USER28> I want to see 2 factor authentication. Not sure about everyone, but I see my github @SEJeff account as more of a resume than LinkedIn ever was. I hate that there aren't more ways to secure it

</comment><comment><USER29> The real question though... Is it su-doo mode or su-doh mode?

</comment><comment><USER30> "Ouh Github made a trivial change, to the front page!"

</comment><comment><USER31> Sudo Mode ™</comment>


Remember Truemors? NowPublic has bought it. - <AUTHOR> http://blog.guykawasaki.com/2008/07/nowpublic-buys.html

<comment><USER2> Seems like truemors site isn't working. But 5 to 10 employees? You gotta be kidding me. This is probably a deal for them to get Kawasaki on their board to be able to get venture capital.

"Hey guys buy my crappy start up for 10-20 grand, so I can get back my investment of $12,000 that I paid to register those 500 domains, and I'll join your board so you can tell VCs you have the great Kawasaki on your board and get money!"

<comment><USER3> Sounds like a great strategy to me

</comment></comment><comment><USER4> Guy Kawasaki's biography should be titled "Falling Ass-Backwards Into Money."

</comment><comment><USER5> I think the most interesting thing is the huge press push around such a tiny acquisition. If nothing else Kawasaki is really good at getting publicity for really mediocre sites

</comment><comment><USER6> "remember truemors?" "no"

none the less - quick turnaround and maybe a 2-3x return for Guy and crew, not bad at all.

</comment><comment><USER7> Isn't this his first successful startup?

<comment><USER8> Successful - that's cute.</comment></comment>


Apple Mapsgate - a Perfect Example of an MVP - <AUTHOR> http://dicebag.com/blog/2012/09/29/apple-mapsgate/

<comment><USER3> There's nothing remotely MVP about Apple Maps. If it was an MVP, it would at least get the basics right - that would be the MINIMUM aspect of MVP - <USER2> of shipping a clearly subpar software that tarnishes the Apple brand. Also, I'm pretty sure that Apple doesn't do MVPs at all; their design philosophy differs too much and they can actually afford messing up royally considering the size of their war chest.

<comment><AUTHOR> "As time progressed, we wanted to provide our customers with even better Maps including features such as turn-by-turn directions, voice integration, Flyover and vector-based maps."

There's the MVP for Apple Maps. Doesn't mean it's the must useful for everyone, but it's the feature-set that Apple set it's sights on with the new Maps app.

I do think it was stupid to punt on business listings and use Yelp, but I haven't heard of any better options.

<comment><USER4> Actually the Yelp move is very, very smart but a little premature.

Yelp is building relationships around the world with the key "business listings" companies in each country. For example in Australia they have a relationship with Yellow Pages. The problem is that Yelp isn't in every country but they will be now that they are flush with cash.

So Apple can leverage the work they are doing rather than duplicate efforts.</comment></comment></comment>


Writing ten articles a week for the last three years - <AUTHOR> https://medium.com/better-marketing/13-things-i-learned-about-writing-10-articles-a-week-for-the-last-3-years-e3d532b59396 <comment><USER2> "Or How to Put out Garbage Spam for Self-Promotion".

A quality article that benefits anyone takes at least a week to write, at the very very least.

The author admits "80% of What You Write Will Be Bullsh*t" \- so you are basically wasting a lot of people's time in hopes of scoring big via luck.

<comment><USER3> Indeed. I also think research is important, and research, sources, and cross references to actual studies and data is important, and you can't research 10 things deeply in a week and write about them.

I feel that a lot of articles generated at such prodigious speed are mainly about the feelings of the author that happen to resonate with the reader, as opposed to some kind of deeper truth, insight, or understanding.

</comment></comment><comment> happy-go-lucky I can't stand writing that is slipshod at best. Writing so many articles a week may be self-fulfilling for the author, but what about those who can't decide for themselves and spend time reading them?</comment>


Washington to sue over 3D printed gun plans - <AUTHOR> https://www.king5.com/article/news/local/washington-to-sue-over-3d-printed-gun-plans/281-578608817 <comment> polski-g The problem is that there was no way to ban them without violating the first amendment. So what precisely do you plan to sue for?

</comment><comment><USER2> Too many "news" outlets and too many lawyers.

Last I checked, gunsmithing--actual gunsmithing, with steel and wood resulting in an object of stopping-power and beauty that _does not_ blow up in your face --was a fairly low-tech and wide-spread art.</comment>


Posterous gives up on Slinkset (hosted HN clone service) - <AUTHOR> http://help.posterous.com/slinkset-shutting-down <comment><USER2> Uhm... what was it? First I've heard of it, and the site is currently almost entirely empty (shut-down header, name, colored bar, and login link).

<comment><USER3> A service to make your own social bookmarking site. Like create your own sub- reddit without the reddit umbrella.

</comment></comment><comment><USER4> Did it actually run a clone of the open sourced Arc HN?</comment>


Ask: Which US state is best for starting a LLC? - <AUTHOR>

Which US state is the best one for starting LLC for a non citizen, not resident?
The most popular choices are DE, NV and WY.
Are there any hidden things to be careful about? Is there a good online summary with explanation in ordinary non-lawyer terms? <comment><USER2> Best states for businesses: [http://www.usatoday.com/money/companies/2011-06-28-cnbc- virg...](http://www.usatoday.com/money/companies/2011-06-28-cnbc-virginia-top- state_n.htm)

</comment><comment><USER3> Make sure you look into what it will cost you to run an LLC incorporated in another state in the state you're actually doing business in. It can be a problem in some cases.

For example, say you live in Texas. You incorporate in Delaware. Texas will charge you $750 for the privilege last I checked - and you will wind up paying (and filing paperwork for) franchise taxes in _both_ states.

<comment><AUTHOR> As I said, I'm not a US resident, don't live in USA, and don't plan to.

I just want to be able to sell Android games and have paid for website service.

</comment></comment><comment><USER4> I don't believe those states are popular for forming LLC's. They are popular for incorporating (forming a corporation) in. While some don't realize it, there is a significant difference between the two types of entities.

<comment><AUTHOR> FWIU with LLC one can avoid double taxation, at least in DE. Thatn option is not available for non-residents when forming Inc.

What other good options are there?

</comment></comment><comment><USER5> I am not a lawyer or accountant, but what I recall from my accountant telling me, it's probably easiest to do it in whatever state you live in for an LLC.</comment>


What happened to www.NewMogul.com? - <AUTHOR>

I've been really enjoying newmogul.com.  What happened to it?  When I tried to go there today, I get "This page has been parked for FREE by GoDaddy." <comment><USER2> Somebody ignored his godaddy renewal emails, it seems.</comment>


Crew Blames Google Maps for Demolishing the Wrong House - <AUTHOR> http://fortune.com/2016/03/26/crew-blames-google-maps-for-demolishing-the-wrong-house/?iid=rightrail-more <comment><USER2> if they think that google is going to accept responsibility then hes fooling himself.</comment>


Technology-Enabled Blitzscaling: Class Notes - <AUTHOR> https://medium.com/@mccannatron/reid-hoffman-john-lilly-and-allen-blue-s-cs183c-technology-enabled-blitzscaling-class-1-notes-a93b119a51b9?_hsenc=p2ANqtz-8nyrEcSDZCukzJdFyRaj66H15G2XQcD9g27oGT4oGyaMBSFus6YW3bwLehCOSSMOMhSV89dh2pKTrom4L93RZkrVCRCg&_hsmi=22290608 <comment><USER2> Thanks for this! PayPal growth numbers are fascinating. Wondering if anyone pressed Reid on the point: was merely scaling customer service (adding more employees) adequate or were the problems with PayPal usability more systemic?</comment>


Where should I start to get into game developing? - <AUTHOR>

Hi, everyone. I want to get into game developing but I don't know where to start. Can anyone give me some suggestions, like which programs should I start one by one? <comment><USER2> [http://www.gamedev.net/page/resources/_/technical/game- progr...](http://www.gamedev.net/page/resources/_/technical/game- programming/your-first-step-to-game-development-starts-here-r2976) gives a fairly reasonable progression, and in general gamedev.net has a lot of useful tutorials and articles.</comment>


Google Promises Again to Swear Off Binge Hiring - <AUTHOR> http://bits.blogs.nytimes.com/2007/10/18/google-promises-again-to-swear-off-binge-hiring/ MySpace Needs Internal Not External Developers <comment><USER2> I remember an article about Japan's premier pro baseball team hiring the 2nd best and sitting them on the bench just so that they don't play for the other team.

Isn't this just what google is doing?

It is a win win situation for them.

</comment><comment><USER3> I think Google could enforce a company wide pair programming initiative and still be way overstaffed.

<comment><USER4> Did not see the earnings report today?

Google's revenues grew 56% year over year, they're not overstaffed until they're hiring people without growth.

<comment><USER3> Revenue is always lagging indicator. Besides, only Wall Street analysts make decisions based primarily on revenue. You can do a lot better than that. I think they're overstaffed when they hire people and they're bored, and I think that's been the case at Google for quite some time now.

<comment><USER5> Bored? So then it is the job of an employer to keep you entertained? hehe. Maybe.

<comment><USER3> The kinds of people Google likes to hire are "entertained" by stuff like really difficult technical problems and making useful stuff that people actually use. I'm not suggesting they need to take their staff to the movie theater.

<comment><USER5> So then you mean they are making a mistake when they hire people that _would_ be bored, instead of finding difficult technical problems and making cool useful stuff. I think you're right.</comment></comment></comment></comment></comment></comment>


Go Is Good Enough - <AUTHOR> https://medium.com/@preslavrachev/go-is-good-enough-5b88d7778bb <comment><USER2> Go's fast compile times, fast start, and growing packaging are what puts it past 'good enough' to be great. It's also quick to learn, which makes it a decent option for team projects where some folks need to ramp up on a new language.</comment>


Twitter replaces Rails front-end with Java server named Blender - <AUTHOR> http://www.adam-bien.com/roller/abien/entry/ruby_on_rails_was_supposed

<comment><USER2> Not all of their servers are moving away from RoR. This is just their search servers.

</comment><comment><USER3> no java love from HN. expected</comment>


Ask HN: What are some concrete ways in which VCs help startups? - <AUTHOR>

I'm new to the whole startup world, and from what I've been reading and hearing, in addition to the money that VCs/Angels/Seed funds give, they also provide a lot of help in the form of guidance, getting you in contact with "the right people", etc.
I can roughly see what the above means, but, for those of you who have gone through this experience, can you provide some concrete examples of how a VC/Angel/Seed fund helped your startup (besides giving money)?
For example, a site like Digg, when it gets started, besides having a functional and easy-to-use website, it needs to get the word out that it exists. Do VCs/Angels/Seed funds help more with getting the talent required to get the website up and running, or more with getting the word out (e.g. by having contacts in the media), or by some other way? <comment><USER2> Some of what VCs and earlier stage investors do is the same, but some is very different. For example, two of the biggest things we do are help people come up with and modify their ideas, and teach them how to raise money from VCs. Whereas VCs expect you already to have decided what you're working on, and by definition don't need to teach you how to convince VCs. But VCs can do stuff like help you hire senior executives or (should you be so lucky) arrange IPOs, which we know nothing about.

We spend our time mostly on early problems like the initial idea, the relationship between the cofounders, how to launch, who to get as your initial users, how to convince later stage investors to give you more money, and (for startups that want to) early stage acquisitions. VCs focus on how to take a promising little company and turn it into a big company, including growing revenues, growing the organization, and big acquisitions or IPOs.

Roughly speaking, the earliest stage of investors focus on helping the aircraft get off the runway, and VCs focus on helping it get to 35,000 feet.

It's harder to generalize about angels. Some invest $10k and some invest almost as much as VCs. Some are very active and others are completely hands off.</comment>


The Devil Is in the Details of Project Verify's Goal to Eliminate Passwords - <AUTHOR> https://www.eff.org/deeplinks/2018/10/project-verify <comment><USER2> Phone numbers are awful for authentication. I stopped using my Russian phone number once I moved to the US and mobile carrier just reassigned that phone number to some other customer.

I found out when I saw myself in my Telegram contact list having other person's avatar and I assume people who had my old phone number in contacts also saw a new account in their Telegram contact lists under my name.

<comment><USER3> In Australia it's outright common to have recycled numbers. I've had a few. My work phone had to be given a new number 3 times in the first 6 months until I had a useable one, because I kept getting random calls at all hours of the day/night looking for people who weren't me. It's mostly for work phones for some reason (I assume they have a higher rotation of useage as employees come and go, and nearly all companies use the same provider, Telstra), but my brother got a number that was someone else's before him too so it does happen privately.

The idea of phone numbers being the prime authenticator is laughable. I'll actively avoid any service who ever does this.

</comment></comment><comment><USER4> There's simply no way I trust AT&T, Sprint, T-Mobile, and Verizon to secure my private information.

<comment><USER5> There's not even a way I would trust anyone else with my most private data except me.

</comment></comment><comment><USER6> Why can't we use privatekeys as a way to log into websites? It's good enough for servers, and it's good enough for git access. I'd be way more comfortable about simply having my browser have access to a privatekey, and prompt me to use it to login when a webpage had a keyed login prompt. It seems like privatekey login would solve the problem of guessing & phishing passwords.

(Someone plz fork Chromium and build this in! And hit me up when you want me to make the Django/ExpressJS auth plugin for it.)

<comment><USER7> WebAuthn does this, and chrome/FF/edge support this. They're also adding CTAP2 support allowing the use of biometric, BTLE, and NFC devices to provide authentication keys.

Soon you'll be able to use TouchID to log in to your website, provided you've associated the pubkey from your fingerprint authn with your website.

[https://www.chromestatus.com/features#component%3A%20Blink%3...](https://www.chromestatus.com/features#component%3A%20Blink%3EWebAuthentication) (TouchID on MacOS: TBD)

[https://bugs.chromium.org/p/chromium/issues/detail?id=780078...](https://bugs.chromium.org/p/chromium/issues/detail?id=780078#c31) (CTAP2: merged)

[https://www.chromestatus.com/features/6288375388569600](https://www.chromestatus.com/features/6288375388569600).

We're integrating webauthn for our medical clinics as a way to support easy, secure authentication without 2FA to reduce sharing of ipads with a session logged in.

More reading: [https://duo.com/blog/developments-to-webauthn-and-the- fido2-...](https://duo.com/blog/developments-to-webauthn-and-the- fido2-framework)

<comment><USER8> So instead of password managers we'll have private key managers?

<comment><USER9> WebAuthn private keys don't exist at all outside of the physical token. So there's nothing to manage. If you rely on WebAuthn as an essential authentication step you'd have two or more tokens registered and treat those the same way you would house keys.

<comment><USER10> When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.

<comment><USER9> Good news. Like a house key, the FIDO keys are basically anonymous. So, as long as you didn't e.g. leave it with your wallet on a bus, or write on it with non-erasable marker "email@example.com" losing the key is not that scary.

In fact, unlike a house key, the Security Key works fine for its new owner, they can register it to sign into their Facebook, or whatever, that will work fine. Facebook will have no idea it's your key, now it's their key.

If they know you're firstname.lastname@example.com on Facebook then that's a problem, yes, as obviously they can sign in as you, but if it's so hard for you to remember what you signed up to, seems like it'll be pretty hard for a hypothetical finder to figure out too... "Hmm, I wonder if this random stranger was into Diaper Porn and Antique furniture?"

</comment></comment></comment></comment></comment></comment><comment><USER11> How many years have we been hearing username/password auth is outdated and difficult and stupid and insecure? Fifteen? Twenty? Something like that at least, and I'm headbangingly tired of it. As tired as of the two factor idiocy popping up everywhere these days. Latest offender I've run into is Digital Ocean, who might otherwise have lured me back with a recent promotional offer. But no, they had to go and ruin it by plastering me with emails and codes and whatnot every single time I tried logging in, presumably because I like to get rid of my cookies the instance I leave a site.

Listen, _passwords are not hard to use_. Mine are 256 bit and utterly random everywhere they are allowed to be. I manage them responsibly. It's not a hassle, anyone can do it, there are great tools for the job. I do not _want_ any centralised single sign-on solutions or other fancy hocus pocus, I do not _need_ them, and I feel - increasingly - penalised for the laziness of those who can't be bothered.

So, in short, whatever this is about, I can only hope it fails like so many other attempts before it. The _Log in with Google & Facebook_ buttons proliferating on every second site out there are plenty bad enough.

</comment><comment><USER12> I find it very troubling how small/nonexistent the outcry is over such an invasive concept.

The PR teams are already hard at work making Facebookian claims of user privacy control that were found to be grossly untrue.

I personally will need to be diligent in avoiding the firms that adopt this service at all costs.

Furthermore, you have to wonder why seemingly "competitive" entities(as far as an oligopoly goes) would collude to provide such as service. Their motives have already been demonstrated to be bad in the past.

Further reading (if you haven't already): [https://krebsonsecurity.com/2018/09/u-s-mobile-giants- want-t...](https://krebsonsecurity.com/2018/09/u-s-mobile-giants-want-to-be- your-online-identity/#more-45035)

</comment><comment><USER13> I am going to start suing everyone for negligence - or whatever applicable term my lawyers can think of - if they force me to use SMS authentication with no other OTP alternative.

</comment><comment><USER14> I move country every month or so at the moment. Since telecom providers choose to charge vast sums of money for roaming, I have to get a new sim card in each country. So this whole system is just not going to work for me.

It also means that my phone number is meaningless. I never answer it, as I only use messaging (or messaging calls) to talk to people. But this isn't unique to my situation. A lot of non-roaming friends are the same - they never use phone or even SMS any more. The only people who phone using your number are spammers, scammers and marketroids.

I'm an edge case, but what of someone going on holiday for two weeks? At the moment, they still get a local SIM, because it's massively cheaper than roaming. This would prevent that.

Maybe that's the point - the telecoms companies need a way to keep us locked to our SIMs so we can't switch providers at the drop of a hat.

<comment><USER15> Same here. Even if I am not a frequent roamer, I changed country every now and then.

Whatsapp already shows how painful is to use ephemeral phone numbers as identity: when you change your number, even with their migration procedure, you still have to notify all your contacts, because at most numbers are authentication, not identification. Doesn't strike me as unusual however that corporations with obsession on control and snooping are trying to conflate the two.

</comment></comment><comment><USER16> Anytime someone say password are not good I reply: can you change fingerprint? Can you change retinal imprint? How accessible are such data? => biometrics it's no good.

n-th factor auth: how can we trust a token? I mean at a hardware level? => if we can really control it's a nice ADDITION to password protection, but no more.

Other options like "granted third parties" (SSO solution by any kind, from Google to mobile phone auth) IMVHO can be trusted LESS than passwords. So in the end we only need to teach XKcd password strength vignette and teach developer how to care about security.

<comment><USER17> No one should ever be putting your biometrics in the cloud. Similar to a PIN, they are only used to secure a device locally once you've already authenticated. So eg you prove ownership of your email + phone number to authenticate, then save the token locally secured by a fingerprint.

For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first auth. To crack that you need to get sufficiently advanced malware onto the device so that it can break open the enclave.

These both are significantly more secure than a password than anyone can spray against the target from anywhere and are subject to reuse.

<comment><USER16> In the end what you say is really "I trust more my device and vendor then myself". Not really a concept I accept...

Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democracy.

A small classic example we all know "ok, you are authenticated because you have entered the correct username & password, now prove it a bit more typing an OTP I send to your mobile via SMS" can be easily read as: "I do not trust enough you because someone may have steal user & password BUT I consider enough unlikely that he/she/it steal also your mobile" and as a consequence it means that carriers/phones are considered more trusted than humans being. Not a good thing for me, not a thing I can accept despite, in limited case have some points.

Also I do not want my carrier know all the service I use and when I use them, it's a significant metadata leak that may be irrelevant in single case but may became relevant in other cases.

<comment><USER18> So write down the secret OTP key, do the crypto yourself with a pen and paper, or failing that with any device (laptop, hardware TOTP device) you own, using open source software, or build your own using the standard. It's nothing to do with your phone or carrier.

<comment><USER16> I simply do not need such kind of authentication for myself, at least I do the best to avoid such need.

Try to think of a Plan9-like world, which means user-centered not "modern mainframe centered". We still need services, but there is no need to have them like today.</comment></comment></comment></comment></comment>


Ask HN: How do I ask for more money as an intern - <AUTHOR> I was offered an internship opportunity that I would like to take. The only issue, it is in a foreign country and they are offering me 700$ while the norm/law says it should be 1200$<p>How could I talk to the company and ask for a fair pay without loosing the opportunity? <comment><USER2> If a company is offering less than is legal, that probably correlates with their willingness to engage in other activities in regard to your employment which are contrary to your interest. Travelling to a foreign country to work for an organization of questionable ethics is a substantial risk.

My advice, for what it's worth, is to pass and keep looking for something better.

Good luck.

</comment><comment><USER3> Get another internship opportunity that pays more and negotiate. That's capitalism for you.

<comment><AUTHOR> So I should risk this one by telling them I got another offer?

<comment><USER4> If you do have an offer, then yes. If you don't actually have an offer then don't chance it. You don't want to come across as money being the main motivating factor for this internship rather than the internship itself. So tread carefully.

</comment></comment></comment><comment><USER5> If the law says it's $1200, then call them on it if they are violating the law.</comment>


Joe Yannitell on the great depression and life born of an Italian Immigrant - <AUTHOR> https://www.youtube.com/watch?v=xW7N_-OwMsI <comment><AUTHOR> Joe was my Grandad, never got to meet him unfortunately. If you have any oral histories I'd love to hear them!</comment>


Hacking Team: Remote Access Trojan for Android - <AUTHOR> http://www.theregister.co.uk/2015/07/23/hacking_team_had_ratted_on_android_trend_micro/

<comment><AUTHOR> RCSAndroid capabilities include screen capture; clipboard monitoring; Wi-Fi password collection (including grabbing passwords sent over Wi-Fi for applications like Skype, Facebook, Twitter and so on); recording from the microphone; message collection; location collection; use the front and back cameras; and contact collection (again from a variety of services).

Wiretap wasn't forgotten. RCSAndroid, Trend Micro says, also has a hook into the mediaserver system service to get voice calls in real time.

Trend writes that the config file suggests RCSAndroid's been in the wild since 2012, with a now-defunct command and control server in the USA.</comment>