Source Code Similarities Between NSA Malware and 'Regin' Trojan - <AUTHOR> http://www.spiegel.de/international/world/regin-malware-unmasked-as-nsa-tool-after-spiegel-publishes-source-code-a-1015255.html#ref=rss <comment><USER3> It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK attribution based on the similarity of code argument given by the US -- pointing out that the code base was in the wild for a long time, could be purchased on black market or reverse/reengineered after picking up the malware from a vulnerable machine.

Shouldn't we also assume that this malware, having been in the wild for "10 years", could have simply been modified and thrown into the NSA tool chest? When applying the same level of scepticism from the Sony hack, nothing in this article represents real proof to counter relevant arguments against US attribution.

Regardless, the Spiegel assumptions or slant is worthy if for nothing else than to teach everyone the issues with attribution, whether applied to greater or lesser evils.

<comment> k-mcgrady >> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack."

Just playing devils advocate here.

The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?

<comment><USER4> If your goal is to understand who is doing what, then you want to be smart about how you draw conclusions.

If, on the other hand, your goal is to flame people who have done bad stuff when the opportunity arises, then yeah, go for it.

</comment></comment></comment><comment><USER5> _There are also additional clues pointing to Regin being a Five Eyes tool: In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth._

Given the relative popularity of cricket in the US vs. the rest of the world, it's more likely that this was written outside the NSA.

<comment><USER6> I don't think it's the sport. I think it's cricket = bug = spy tool.

<comment><USER7> A spy tool that chirps every few seconds to announce its presence? There are better insects to reference.

<comment><USER8> maybe because it jumps as malware usually does

</comment></comment></comment></comment><comment><USER9> Seeing that this is a keylogger, how complex would it be to enable a sort of SSL protocol between the keyboard and a specific application? The computational overhead should be manageable, the connector (USB) wouldn't need to change and there should be a fallback for any applications which doesn't support it. But if crucial applications like mail and the browser programs could use it, it might deliver another blow to security companies.

The way I would implement it is that the keyboard has a switch to enable this SSL type communication. Then the keyboard can perform a Diffie–Hellman key exchange with the current process. As a result any other interaction with the OS would become impossible until that process is terminated - <USER2> disabling all OS related shortcuts etc. This would allow true end to end encryption - even on compromised systems (as long as the kernel code isn't modified to allow accessing the memory of other processes).

<comment><USER10> If the OS is compromised, then you can't work around that to secure a program inside the OS. You can run the program somewhere else, like on the keyboard itself. Some secure crypto devices have displays, so you can see what you're signing.

The only similar thing I've heard of is the "Secure Attention Sequence" in Windows. That is, pressing CtrlAltDel before entering credentials lets you be sure an _application_ is not mimicking the logon prompt. But of course if the OS is compromised (like by loading a driver that intercepts such keystrokes, like VMware Enhanced Keyboard) all bets are off.

Think about it, the OS is executing all the code for the app, and storing all the memory.

This is also why there is a push for trusted computing. Being able to have your processor, OS, etc be able to verify they are running a trusted configuration is a powerful thing. It makes the owner of the computer in control. (The downside is when the user is not the owner, but would like to be, then they get upset at restrictions.)

<comment><USER11> "Trusted computing" puts the controller of the trusted infrastructure in control - the owner of the computer should expect that any NSA-approved malware will be considered properly trusted, and being in control of a secure OS doesn't help against attacks coming from the hardware (malware or backdoors on firmware) with direct memory access.

</comment></comment></comment><comment><USER12> "Regin Malware Unmasked as NSA Tool" or NSA Tool found to contain part of Regin malware?

</comment><comment><USER13> Published it where? The only link I can find is [http://www.spiegel.de/media/media-35668.pdf](http://www.spiegel.de/media/media-35668.pdf), and calling that source code is a bit generous to say the least.

<comment><USER14> Seriously. Did nobody else here actually come because they were interested in seeing Regin's source code? I feel like I'm in crazy land.

</comment></comment><comment><USER15> As a lazy person and Devil's advocate, why does anyone not think that the various intelligence agencies copied the malware? Surely they would have access to some of the best in all their various honeypots be it that they are attacked by everyone and everything. "Good artists copy, great artists steal."-PP

</comment><comment><USER16> US spying on allies, what else is new? Wasn't most of this already known? From wikipedia [https://en.wikipedia.org/wiki/Regin_(malware)#Known_attacks_...](https://en.wikipedia.org/wiki/Regin_\(malware\)#Known_attacks_and_originator_of_malware) :

`Der Spiegel reported in November 2014.......`

`Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the NSA ANT catalog under the names "Straitbizarre" and "Unitedrake".`

<comment><USER17> Has Speigel reported on the ubiquitous US spy stations peppered throughout Europe? Have they speculated on why Europe does not close them?

<comment><USER18> Because the US shares intelligence with those governments. In some EU countries it is illegal for the government to spy on its citizens (also see the US pre-9/11), so the US spies on those countries and then relays the info back.

Pre-9/11 this is also how the US worked. The UK spied on the US and the US spied on the UK, thus both subverting national laws, they then shared intelligence with one another (which is legal) and thus the loophole was born.

This is actually the system the US is going back to, it is becoming politically unpopular for the NSA to spy on American Citizens, so GCHQ will likely take over the majority again, the reasons they couldn't after 9/11 was that the workload increase too much in too short a period, and the systems didn't yet exist.

<comment><USER19> In my mind that's conspiracy-theory level claims. Got sources?

<comment><USER20> There's nothing conspiratorial about that one. Look up the echelon network and the UKUSA Agreement (both on Wikipedia). It has also been talked about in several books on the topic and discussed openly in the press. It is almost an "open secret" at this point.

Heck you can almost read the above claims verbatim here:

[https://en.wikipedia.org/wiki/UKUSA_Agreement#Controversy](https://en.wikipedia.org/wiki/UKUSA_Agreement#Controversy)

> During the 2013 NSA leaks Internet spying scandal, the surveillance agencies > of the "Five Eyes" have been accused of intentionally spying on one > another's citizens and willingly sharing the collected information with each > other, allegedly circumventing laws preventing each agency from spying on > its own citizens

<comment><USER21> What would you call it when governments conspire against their populations to subvert constitutional limits? It's literally conspiratorial.

<comment><USER20> Maybe, but I'm 99.99% sure that wasn't the person above's implication by suggesting it was "just" a conspiracy theory. If it had have been their entire point would be redundant, instead it is likely they were trying to suggest it was a fiction or born out of paranoia.

I wouldn't go so far as to call it a "fact" but based on several leaks, books, and news sources it is likely more fact than fiction.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Many espionage tools are designed by organizations that then sell or license their tools to 3rd parties. Just because the NSA used it doesn't mean they wrote it.

 _' Some reporters were surprised to learn that the University of Maryland had a "covert" NSA facility operating somewhere on or near the school grounds. [..] "Which facility and exactly where it was Snowden worked is unknown, but the NSA has connections to several university facilities, including the Laboratory for Physical Sciences, the Office of Technology Commercialization and the Lab for Telecommunication Science."'_

[http://www.motherjones.com/mojo/2013/06/university- maryland-...](http://www.motherjones.com/mojo/2013/06/university-maryland- edward-snowden-nsa)

Oh, and the University's college hacking team got 1st at the Major League Hacking Championship in 2013, winning over MIT, Carnegie Mellon and Rutgers. [https://www.umdrightnow.umd.edu/news/umd-students-win- major-...](https://www.umdrightnow.umd.edu/news/umd-students-win-major-league- hacking-championship)

There are probably hundreds of other organizations which work 'in partnership' with the intelligence community to develop programs which are essentially used to better their espionage and analysis capabilities. Almost all the Virginia/DC/Maryland area's tech companies are employed in one way or another by the federal government, usually for the military or an intelligence agency.

</comment><comment><USER23> OK, if you believe that there is actually such a thing as "Cyberwar" then this means that the USA has attacked Belgium. Does this give Belgium the right to physically blow up some important American infrastructure? ... or is Cyberwar a type of cold war which would limit the response to some sort of hacking of important American infrastructure?

<comment><USER24> I don't know. We'll find out when the attacker will be Belgium and the _victim_ the US.

</comment></comment><comment><USER25> Assuming all of this is true, and the TPP leaks are indeed what they seem to be - wouldn't the TPP let every corporation outside $COUNTRY sue the government of $COUNTRY for malware? (e.g. for $COUNTRY in Five Eyes)?

First upside to the TPP that I've seen, if true.

<comment><USER26> If you or I wrote it we'd go to jail for a very, very long time.

When a government writes it, nothing happens.

<comment><USER10> Really? Apart from France, do most countries prosecute the author of computer/hacking tools? I was under the impression that the use of the tools is what mattered. Just like BitTorrent itself has been fine, but any hints of using it for copyright infringement get fire.

After all, you could use this malware to spy on your child's use of your PC, which is legal, right?

<comment><USER27> See Dmitry Sklyarov, among others.

</comment></comment></comment></comment><comment><USER28> Nothing like waking up to a story that makes you feel embarrassed by your citizenship. Good job Canada, you're making a Maple Leaf a dangerous symbol all around the world.

When I was a youngster, being Canadian meant that Incould travel anywhere and be fine. Granted, there was a > 50% probability that the other Canadians I would meet were really Americans, but that was nothing. My country had a solid international reputation. Now???

<comment><USER29> Just imagine being American and being full of false pride...

<comment><USER30> How about being an American that has lived in the States, Aussie, and New Zealand over the past five years - I can't escape the Five Eyes shame :(

</comment></comment></comment><comment><USER31> My current opinion on government hacking is, that I actually want democratic government to be the biggest meanest hackers of them all.

The alternative, unfortunately, is that either organized crime or non- democratic governments (or a combination of both) would be the biggest meanest hackers.

And hacking doesn't really scale. Mass surveillance just through attacking individuals with malware isn't possible, because of limited "talent" and a fear for exposing the tools, like just happened.

Building backdoors into systems or encryption schemes, on the other hand, isn't exactly hacking but does scale well to undiscriminate spying on millions of people.

The main issue is that intelligence and law enforcement agencies in the western world aren't bound to judicial control as tightly as they should. It also seems that a majority of voters either consent to these powers, or don't care. When politicians want to appear "acting decisively" after terrorist attacks, or foreign hacking incidents, it's not just because they like to do so. They know that, if they don't, voters will disapprove.

<comment><USER32> Not sure why people vote you down for sharing your opinion. Having said that, your logic is fundamentally flawed. Governments have to either focus on attacking or defending. Focusing on attacking means keeping a lid on vulnerabilities, which weakens the security of citizens and corporations inside their own country. Focusing on defending means disclosing those vulnerabilities in order to protect everybody, which also means those vulnerabilities can't be used in attacks anymore. You can't really have both.

<comment><USER31> Not disclosing vulnerabilities is not a question of attacking or defending, it's just stupid to keep vulnerabilities open.

I also didn't propose to uncompromisingly favor attack capabilities. I still don't think effective cyber defense is possible on a national level without leading the edge on offensive abilities as well.

<comment><USER32> I really don't want to explain it a third time, so let me just ask you a question instead: How do you _lead the edge on offensive abilities_ without keeping vulnerabilities/bugs secret? Let me rephrase that: How do you _lead the edge on offensive abilities_ without weakening the security of the people who are paying your salary; the very same people you swore an oath to protect? Please explain to me how that is possible on a technical level. If you can't, or you still don't really understand what I'm talking about, that's fine. Just ask.

\---

I'm gonna explain it a third time. (Looks like you don't want to talk to me.)

Having offensive abilities means having one or more remote exploits ready to use. Having remote exploits ready to use means sitting on undisclosed vulnerabilities. Sitting on undisclosed vulnerabilities means weakening the security of the people you're supposed to protect.

It's quite simple, really. You can't _remotely_ attack a computer without remote exploits. I only count remote attacks as "cyber warfare".

<comment><USER31> Remote exploits work surprisingly well on unpatched systems, stupid users, malconfigured hardware/software and if that doesn't work, maybe it's time for a bit of oldfashioned humint.

</comment></comment></comment></comment></comment><comment><USER33> Right on the GCHQ website it states: "In addition, we are also pleased to announce that GCHQ and MI5 are working with their US partners to further strengthen UK-US collaboration on cyber security ..."

I think it is fair to say they all use the same tools!

</comment><comment><USER34> What's the feeling on the morality aspect of this? In a way it seems like the same situation as if US designed and manufactured weaponry were used against a US friendly power by some third party - is it analogous though?

</comment><comment><USER35> If so, can the people and companies that were affected file a class action?

<comment><USER32> Class action might be a solution for US citizens. The problem with malware though is that you end up infecting a whole lot of innocent civilians all over the place, which the people in Den Haag have slightly mixed feelings about. To be honest, I'm a bit disappointed that these cases never end up in international courts. The rules we have in place seem pretty clear to me.

<comment><USER36> Unlikely, you can't sue the Federal Government without its permission. In any case the NSA would simply say "national security" and boom you are done.

<comment><USER37> Then sue Alexander and Clapper for their roles, and lay the case that their actions were not in the scope of the office they held.

Then the government says nothing, and bad people get prosecuted.

</comment></comment></comment></comment><comment><USER38> The NSA is tasked with doing signals intelligence so I get why they would develop some hacking abilities but you have to wonder where the break over point is with the money they are spending...at some point they are spending enough money that they could actually make a difference in improving our software and infrastructure. I mean, one of the reasons they say that they need these capabilities is because we are so vulnerable...how about actually helping out?

<comment><USER39> They do. They have lots of documents and guidance on best practice for security. As for code, they started the SELinux project. [http://en.m.wikipedia.org/wiki/Security- Enhanced_Linux](http://en.m.wikipedia.org/wiki/Security-Enhanced_Linux)

</comment></comment><comment><USER3> down voting on HN has become absurd. Also noticing this on other comments in this thread.

<comment><USER37> I've been tracking the new downvoting trend for the last week or so. Seems there's a lot of accounts downvoting everything that doesn't coincide with Western Government sensibilities. The recent North Korea and LSD threads (not just my replies, but you can get to the threads from my comment history) are really interesting examples to trudge through and see how many valid replies are sitting at -1 or worse.

<comment><USER40> I've experienced a couple of really bad downvotes as well lately, and they had definitely no intention of editorial feedback, but it was quite obviously mindless prejudice, almost on the level of /r/politics or /r/worldnews. I wished HN would replace downvotes with a system for short and private annotations, so that people could receive concrete feedback, not something that is vaguely implied by a number. That would also remove the problem that people mindlessly jump on the downvote bandwagon.

<comment><USER41> Even better would be to turn on an option for a user to show/hide political posts from the site all together

<comment><USER42> That would be nice, but in practice, there's no commonly accepted clear criteria for what is "political" and what is not, and any attempts to enforce some such criteria would likely bring arbitrary and unfair results.

</comment></comment></comment></comment></comment><comment><USER43> Uh, wasn't Regin apparently used in the Sony hack?

<comment><USER40> No?

<comment><USER43> No, you're right, belgacom - it was all just reported at about the same time.

<comment><USER44> There is more than a year difference between the two

<comment><USER45> Agreed - more than a year between the two. Here is the full rundown if you're interested:

Regin details: [http://en.wikipedia.org/wiki/Regin_(malware)](http://en.wikipedia.org/wiki/Regin_\(malware\))

Sony hack details: [http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hac...](http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hack)

</comment></comment></comment></comment></comment><comment><USER46> Tinfoil hat: Hypothetically, if the Russian government were angry with the US government and wanted to give them a black eye, wouldn't having a Russian security firm announce to the world that the NSA was responsible for Reign be a good tactic?

Not saying NSA wasn't involved as I don't really trust my government, but when I read the article and saw Kaspersky mentioned, that was the first thing that popped into my head.

<comment><USER47> I see your point.

In this specific case Fox-IT (Netherlands) said the same thing. They based the claim not on the "source code" but on the fact that Regin was part of programs/processes of the NSA department ANT and mentioned in some leaked presentation slide of them (Source: [http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin- is...](http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-ist-ein- werkzeug-von-nsa-und-gchq-a-1004950.html) (German)).

Thinking about infosec companies that publish impactful findings from time to time there is F-Secure from Finland, Fox-IT from the Netherlands, Symantec from the US and Kaspersky from Russia. Does anyone know about important Chinese/Japanese information security companies?</comment></comment>


60% of companies still use IE6 as their default browser (plus poll) - <AUTHOR> http://lifehacker.com/5236121/whats-the-default-web-browser-at-your-workplace

<comment><USER2>
        IE 6 has 60 percent of the enterprise market, with IE 7 clocking in at 39 percent;
        Firefox has 18.2 percent of the enterprise market;

I'm not sure how they measure that share, but it's not what I expected. I'd expected the total to be ~100%.

<comment><USER3> Yeah, bad wording, maybe it's the % of machines with it installed?

</comment></comment><comment><USER4> Does anyone have any thoughts to offer on when this will change? Will the shift to Vista or Windows 7 change this?

<comment><USER5> It won't change until a whole new generation of IT managers is promoted. I encounter far too many IT employees who are terrified of change and just want to have a job. And, I see almost complete trust in contracting companies and their "solutions". It will take someone who's grown up with better applications and hardware, to come in and say "WTF?" and wipe it all clean.</comment></comment>


USA: January 20 Is Officially "National Day of Patriotic Devotion" - <AUTHOR> https://www.washingtonpost.com/news/post-politics/wp/2017/01/23/trump-names-his-inauguration-day-a-national-day-of-patriotic-devotion/?utm_term=.eb665a684f6b&hpid=hp_hp-top-table-main_trumpturmoil-0902pm%3Ahomepage%2Fstory <comment><USER2> We're turning into North Korea.

<comment><USER3> We've officially had "Loyalty Day" for 60+ years and George Washington was posthumously promoted in 1976.

<comment><USER4> Honestly,I'd never heard of "Loyalty Day", and I've worked for companies that gave me "UN Day" and "NATO Day" off. That was McDonnell Douglas Aerospace, R.I.P.

From the wikipedia entry: "The holiday was first observed in 1921, during the First Red Scare. It was originally called "Americanization Day," and it was intended to replace the May 1 ("May Day") celebration of the International Workers' Day,..."

"Loyalty Day" is a lot like "Freedom Fries" \- just another attempt to co-opt some word deemed good, instead of some word deemed bad at the moment. The US Feds are totally weird.</comment></comment></comment>


Dropbox deployment for front-end devs - <AUTHOR> https://blog.backlift.com/entry/dropbox-integration

<comment><USER2> This might be premature, but I think what you're doing here is brilliant. I know so many designers-come-web-developers who struggle with the back-end portion of web development. Many use cases simply don't need the full flexibility of a web app framework, but do need more than what you can cobble together with outside tools like the various embeddable form tools and widgets.

IMO, the authentication & authorization portion of your app is going to make or break the result. I'd like to make a suggestion. There is an authorization library for Rails named CanCan. It uses a declarative definition for authorization that is similar (loosely) to what you've got going right now. There is also an extension for CanCan called Cantango, which builds out the concept of roles as packages of permissions.

Again, I'm speaking really loosely here, but it looks like you're still working on this portion of the product, and these libraries work in a way that I think makes sense to your target market. The declarative style is a good fit for font end developers. You simply describe how you'd like users to interact with the API, and you're done. If you incorporated some of the ideas from these two libraries, I'd be really thrilled :)

Can't wait to recommend this.

<https://github.com/ryanb/cancan>

<https://github.com/kristianmandrup/cantango>

<comment><AUTHOR> Thanks a ton for the kind words!

I'm not familiar with CanCan-- it looks very expressive. A role based system is a pretty significant departure from our current ACL per model approach. I think I need some more input, in the form of practical use cases where ACLs can't do the trick. I'm sure they exist, but we'd need to consider the added complexity of role based access and weigh that against the kinds of apps it would unlock.

Regardless I'll spend some more time looking into these libraries.

</comment></comment><comment><USER3> Awesome! Took about 60 seconds to get an app running with live updating.

</comment><comment><USER4> The dropbox deployment is fantastically easy and I can see myself using this for quick front-end mockups. As for the backend portion of your service, it'd be nice to see an example or a link to an example on the front page. It wasn't immediately clear to me that you were a backend-as-a-service and I thought this was just a Dropbox deploy service, even after looking at the homepage. Good luck!

</comment><comment><USER5> Small typo on the "What's next?" page after you create a new app:

``They will be in your Dropbox folder under the followng path:``

Should be "following", not "followng".

</comment><comment><USER6> How is this done atomically? e.g. a scattering of html/js/css coming down in random order is going to cause issues, for sure.

<comment><AUTHOR> With Backlift, you explicitly set the order that the files should be linked or concatenated in the config.yml file.

When assets are sent over via dropbox, backlift compiles each source file into a separate js or css product. Then all files are concatenated and minified using the order from config.yml.

Does that answer the question, or am I missing something?

<comment><USER7> I think newobj is referring to the non-atomic nature of dropbox sync: there is no "commit" or singular upload, but rather a continuous sequence of changes. The question then is: how does this affect deployment? For example you might see markup changes deployed without the corresponding css changes.

I would guess the answer is that the "deployment" is so lightweight and fast (minify a few text files and copy them somewhere) that it's ok to re-run the deployment step at every single new file change.

I'm a big fan of this workflow. Good job Cole!

<comment><AUTHOR> Yes. The worst you might see is a few seconds of mismatched styling, or an occasional error that would resolve when the next dropbox cycle pushes a refresh. The only deployment operations that involve inter-file dependencies at this time are the minification and concatenation that occur during optimization. And we don't recommend turning on optimization during development-- it does slow things down, and we haven't implemented source mapping yet so you'd have to debug obfuscated code.

</comment></comment></comment></comment><comment><USER8> Man the live updating is pretty sweet.</comment>


LTEFuzz: Dynamic Security Analysis of LTE Control Plane - <AUTHOR> https://sites.google.com/view/ltefuzz <comment><AUTHOR> Link to the research paper: [https://syssec.kaist.ac.kr/pub/2019/kim_sp_2019.pdf](https://syssec.kaist.ac.kr/pub/2019/kim_sp_2019.pdf)

</comment><comment><USER2> Is there any source code for this. I would like to reproduce the findings.</comment>


Thank You DHH (and others) - <AUTHOR> http://differential.io/blog/thank-you-dhh-and-others <comment><USER2> Meteor is so great that your blog post seems to load only 25% of the time on my 3G connection, freezing for no apparent reason on a useless "We work at Cintrifuse" page the rest of the time (without any indicator that it's loading anything - and leaving it untouched for 5min does not help).

Scaling is good, having your website actually work is IMO better.

<comment><USER3> > on a useless "We work at Cintrifuse" page the rest of the time

Looks like it's the header and footer joint together waiting for content to appear in between delivered via websockets.

Never tried Meteor but I don't get the point of using websockets for blog posts unless it's purely for learning. Does Meteor encourage such use of websockets? If yes, why? (Genuinely curious)

<comment><USER4> We are tracking realtime readers in the sidebar and plan to start doing inline commenting and passage favoriting.

I also think it is cool that I can fix typos realtime while people are reading.

<comment><USER4> Google appends a ?_escaped_fragment_= onto the url and the spiderable package serves up a copy of the article from phantomjs. See [http://differential.io/blog/thank-you-dhh-and- others?_escape...](http://differential.io/blog/thank-you-dhh-and- others?_escaped_fragment_=)

</comment></comment></comment></comment><comment><USER5> Meteor is great, in that it's a really interesting look at what the future of web app development could look like - we've got ubiquitous JS runtimes on servers and clients, always-available internet connections, that kind of thing, and we need to be looking and playing with other approaches. And I think Meteor's is interesting.

But it's not going to 'kill' Rails any more than Rails killed PHP. I've seen loads of frameworks and indeed developers pop up who have taken the great ideas that frameworks like Rails had, and incorporated them into PHP projects. No doubt we'll see the same over time as new frameworks and tools arise elsewhere. And ultimately what we want is a better, more diverse selection of tools which are competing with and learning from each other.

Would I build a production app in Meteor? Almost certainly not. I'll probably have a crack at a prototype sometime soon (last time I tried, it was too underdeveloped to use) and no doubt I'll learn a bit on the way. But Differential's site is not an encouraging example - it requires JS, feels pretty slow and broken in places, and offers nothing that couldn't be executed as well (or better!) using any other toolset or framework.

<comment><USER4> What are you finding is broken in places?

<comment><USER5> So I noticed a few things as I looked around:

\- When I first hit the linked blog post, I saw a blank page for four or five seconds. Not so bad, because I know what's happening, but jarring.

\- Then I see a footer for five or six more seconds, with no page content. Again, I know what's happening, but I can see that looking sketchy for people who aren't developers: [https://www.dropbox.com/s/d1mezohgixlneeu/Screenshot%202013-...](https://www.dropbox.com/s/d1mezohgixlneeu/Screenshot%202013-11-16%2014.21.19.png) \- and it's going to be worse on a slower connection.

\- I see that same view on several different pages when I initially navigate to them.

\- Hitting the home page occasionally freaks the browser out. I don't know what it's doing, but I get multiple animations of the main banner and some flickering etc.

I may have been a bit dismissive - sorry about that. I do get that "dogfooding" a tech stack as it were is pretty important. What Meteor's going to be good for though is highly-interactive, collaborative apps, and it'll be really nice to see some demos of that, rather than yet-another-could-be-static site.

<comment><USER4> No, I love the insight! Thanks for replying with all this, we will take a look at these things. We've built 15 production apps and we are still learning every day.

</comment></comment></comment></comment><comment><USER6> This really hits the nail on the head for me. I discovered meteor when I was just beginning to seriously code web applications, and regardless of the downsides it has, it was truly, truly fun. The ability to rapidly go from idea to implementation is extremely fast, ridiculously simple to pick up, and it's all in a simple to learn language, even for an absolute beginner.

Would i build my production app in meteor right now? For a prototype, yes. Would I transition from an established web application with a large userbase to meteor? Almost definitely no, at the current stage. But what we glorify here in this startup culture is to get an idea out and see if it works, and Meteor is absolutely amazing for exactly that. The simple deployment, the ease of use, and the freedom to build the structure as you choose (for better or for worse) truly opens many, many more doors than it closes at the early stage.

I'm no fanboy but I'm very excited to see where Meteor heads in the future and am extremely glad that it continues to gain traction and attention, be it positive or negative.

</comment><comment><USER7> If you're intrigued by Meteor and real-time apps but are turned off by the need to live in the Meteor ecosystem and the magicness of it all, I highly recommend checking out Feathers[1]. Feathers is built on top of Express and Socket.IO so there is no magic, all Express middleware works, and you can use whatever client-side framework you prefer, it just gives you the real-time benefits for free without the commitment you have to make by switching to a big framework like Meteor. (I'm not affiliated with Feathers, just a fan).

[1][http://feathersjs.com/](http://feathersjs.com/)

<comment><USER4> Meteor.js is built on top of node, connect, and socket.io... Not really much magic here either, once you dig into it - just like any framework.

</comment></comment><comment><USER8> I really like coding in Meteor. When deciding instead of thinking as to whether I should use meteor I thought on why I shouldn't.

The main reason to not use it was scaling but It's evident the meteor guys are working on that for the 1.0 release. (See [https://trello.com/board/meteor- roadmap/508721606e02bb9d5700...](https://trello.com/board/meteor- roadmap/508721606e02bb9d570016ae))

Hopefully they do this well but I feel from their work before they will. I've been using Meteor since it was sub v0.2 and its just improved each iteration.

First it was the license, then authentication, then it was routing, then its ability to play well with JQuery. Slowly all of the issues with it are disappearing.

One thing I like is in meteor code is isomorphic. And on the server I'm not in the callback hell I was having with node. So there are evented fibers that do all this stuff and the code remains clean! Best of both worlds.

<comment><USER9> Growing pains, that's all.

They've really done a lot of work. The jump from 0.6.4 to 0.6.5 was 775 commits. Wow. We're seeing concepts being fleshed out, they'll be refactored and strengthen in time. The team seems to be fully focused on 1.0.

Scalability is still a big concern, but it's only a problem you can be so lucky too have.

Meteor still needs to improve code structure, there's no common architectural pattern yet (just some lose guide lines). In my opinion, it would be a benefit. Meteor is still in its infancy and a developer is left to their own devices, rather then common sharable patterns. Rails does this well with the plethora of use-case strengthened API design, a benefit of it's maturity. Meteor will get there.

<comment><USER4> Yes, I remember rails going through this same "growing pains" of leaving a lot of stuff up to the developers. I look forward to the ride Meteor will provide and see where it gets.

</comment></comment></comment><comment><USER3> Heads up - On every blog post it seems to be showing the same figure for "x other readers are here" which is misleading.

<comment><USER4> Yeah, we implemented it naively in a few hours one night this week, we plan to go back and do a deeper sidebar listing our urls.

</comment></comment><comment><USER10> Just a heads up- your headshot flashes white every time a new reader loads or leaves your page and the XXX readers are here line updates. Its quite distracting now, since you're on the front page of HN and a lot of people are going to the article.

<comment><USER4> Thanks, I hadn't seen that, I will look into it. I know the new Meteor UI release that is forth coming actually solves the very issue of rerendering too much of the page when you update one thing.

</comment></comment><comment><USER11> The future of the web isn't "everything in JavaScript" \- it's everything in whatever damn language you like.

The JS runtime is nearly, or is now perhaps, perfectly capable of being what your own language "compiles" to - for instance, I love Ruby so I'm betting on Opal (execute REAL client-side Ruby). Others like JS variants such as CoffeeScript or TypeScript.

So...Rails isn't going to get killed - it's simply going to evolve to support rich real-time client + server apps written in Ruby, period. That's my take on it, anyway, and that's what I'm planning on.

</comment><comment><USER12> I have a vague feeling of excitement about the future of JS development in general. Whether or not Meteor is going to be the bringer of that bright future is something I'm not so sure of.

On the topic of constructive criticism, differential.io could really do with ditching that "We work at Cintrifuse" interstitial before the blog post is displayed. In the spirit of being constructive, I will simply say that my experience as a reader would have been vastly better without it.

<comment><USER4> We are actually lacking a loading screen, so you are just seeing the header and footer mashing together while the content loads.

<comment><USER12> It's funny, my gut reaction to your explanation is one of technological conservatism. "This is a problem that shouldn't exist! Don't use JavaScript for that!", I want to exclaim.

But I remember thinking similar things years ago when Slashdot introduced a bunch of JavaScript enhancements on top of what had been a very spartan HTML- based comment UI. The technologically conservative point of view was wrong then, and I think it'd be equally wrong now.

<comment><USER4> Yeah,

My mind initially had trouble accepting the changes in how to think about data and reactivity, but I think it has been worth it in the end. Very much a "there is no spoon" type of moment.

</comment></comment></comment></comment><comment><USER4> Thanks for all the great conversation guys and gals! I didn't post this, but I am glad it made it to HN for sure!

If you are looking to get into Meteor, check out [http://yauh.de/articles/376/best-learning-resources-for- mete...](http://yauh.de/articles/376/best-learning-resources-for-meteorjs) and be sure to join [http://crater.io](http://crater.io) to keep up on the latest news.

</comment><comment><USER13> What do you use for the counter showing how many current users there are? GA API?

<comment><USER8> It looks like they're using a publish function (Meteor) to send down the number of users reactively.

<comment><USER4> You are correct, we are tracking open DDP connections to the server inside the node.js backend meteor gives us.</comment></comment></comment>


How do you sell a web business? - <AUTHOR>

<comment><AUTHOR> Some months ago, I put together a web site to service the school and college market.. it is a messaging system that can broadcast messages to hundreds of phones via voice (a pleasant robot female voice!) or by text messages and also email. Ideal for schools, colleges to alert students or parents in case of weather related closings, or other emergencies. The plan was to sell it as a subscription service to schools and colleges on a per student basis (in the range of $ 3 -5 per student per year). Since building the site, my personal situation has changed... more day job responsibilities/priorities and no time to market this to customers (a full time job).

I was looking around to see if I could sell and the landscape is depressing. Options available: a) Sell it on Ebay: Looked at this, but there is so much crud floating around on this site in the business section that I seriously doubt anyone would actually bid. b) Advertise with web business brokers: Most of these are scams that promise to put an ad on their site for hundreds of dollars.

Do any of you have any suggestions? I'm NOT looking for a big payout... would like to recoup some costs, and hopefully find a home for this site with an entrepreneur who has the time and the energy to go after this market. The web site is at www.quinalert.com.

Thanks M

</comment><comment><USER2> <http://www.sitepoint.com/marketplace/></comment>


Ask HN: Why don't more startups adopt Flextime work schedules? - <AUTHOR> http://en.wikipedia.org/wiki/Flextime

<comment><USER2> Why don't you think they do? Are you asking about any particular company, market, or region of the world?

I'd guess most startups already have flextime. You can come in real early or stay real late, but either way, you're going to work more than just 9 to 5. Getting things started is hard. Keeping a bigger business rolling along is easier.</comment>


Google Shutting Down Translate API - Alternatives - <AUTHOR> http://mygengo.com/talk/blog/translation-apis-google-shutting-down-but-are-there-alternatives/

<comment><USER2> Alternative, you mean. Singular.

I don't think MyGengo is a replacement for how most people used Translate, either. At 5 cents per word, you have to have a real use for the service, instead of just willy-nilly translating anything you think of.

Don't get me wrong, I'm sure they provide a good service. It's just that the service Google was providing had a different audience.

Edit: Removed my comment about spam.

<comment><USER3> Disclosure: I'm the CEO of myGengo

We offer machine translation for free, and we'll continue to do so... I don't really see how this is spam.

<comment><USER2> You should probably make that more prominent, then. I quit reading at this part:

"If you spent the $25 at Standard level, which is $.05 per word, you could translate up to 500 words - that's almost two full pages of text."

I see the next line says that you can use the service without credits, now. But by that point, I was sick of reading about a pay service that was claiming to replace a free one. That's the only spot on the page that says it, and it doesn't outright say you can get translations for free... It just says you can 'use the service without credits'. Too many people give you a 'free account' that you can't actually do anything with, and then you have to pay to do anything.

In short: You are losing potential customers by not making your hook clear enough.</comment></comment></comment>


What does this url do? - <AUTHOR>

I found this url in a what looks like malware link on thepiratebay.sx
> http://1phads.com/%C3%B2%C3%9ANI%15%C2%B5%C2%81y%1E?%82%98%AA*P%FF%CC%E4\%A3%A4%D7%E4%B4%F6%C0%87%A4%BC%85TF
i clicking on it seems to do nothing in chrome. Didn't try in other browser, since it looks like an exploit. I would recommend you don't click on it.
Does anyone have any thoughts on what this might do? <comment><USER2>
      $ HEAD http://1phads.com/%C3%B2%C3%9ANI%15%C2%B5%C2%81y%1E?%82%98%AA*P%FF%CC%E4\%A3%A4%D7%E4%B4%F6%C0%87%A4%BC%85TF
      404 Not Found
      Connection: close
      Date: Tue, 25 Jun 2013 12:52:46 GMT
      Server: nginx
      Content-Length: 162
      Content-Type: text/html
      Client-Date: Tue, 25 Jun 2013 12:52:46 GMT
      Client-Peer: 188.8.131.52:80
      Client-Response-Num: 1

Perhaps it is paying attention to the User-Agent header, and only provides content if it has an exploit for that browser. Or perhaps the url was only active for a short time. I'm not interested enough to investigate further.</comment>


Crowdfunded businesses may owe taxes, too - <AUTHOR> http://www.reuters.com/article/2012/08/13/us-column-feldman-crowdfunding-taxes-idUSBRE87C0F120120813

<comment><USER2> This whole article reads kind of bullshit from US GAAP perspective.

In case people who pledge will receive tangible goods in exchange, of course it is a sale. But these pledges will be accounted for as as prepayments in the start-up's books.

The sale most probably will be recognized when the goods will be shipped|delivered and will be offset with cost of goods sold.

R&D expenses are completely different matter, and will be expenses or expensed/capitalized based on applicable accounting/tax policies.

<comment><USER3> Yeah. Additionally any article you'd get there will oversimplify to the point of mostly offering an admonishment to check with an accountant.

As a business typically you are going to pay for net income. Calculating net income is going to be difficult in this case because it depends on what you are raising money to do.

Raising $500k to pay some experts to go develop the world's best pizza recipe in a year? Do this the same year as the fundraising? If you can spend all of the money you raise on bona fide business expenses (but see amortization below!) then it isn't going to raise your tax liability at all.

Similarly suppose it is for a pizza oven. Now we get into the complications. Do the tax laws (we are talking tax accounting not GAAP or financial accounting here) allow you to take the whole thing off the first year? or are you required to amortize the cost at a specific schedule? Irrespective of the ability to do so, would you prefer to amortize over a specific schedule with the idea that you save up for a replacement? Now you get all the questions that matter and the answer as to whether it raises your taxes or not are not at all straightforward.

The real lesson should be "talk with your accountant but also learn the basics yourself."

<comment><USER4> You're confusing the issue.

Capital is never taxed as income under the U.S. income tax code. Ergo, the money raised in your example would never subject the business to income taxes.

 _Prepayments_ of revenue, i.e., for goods or services that will be provided in the future, are income and are taxed as income. Ergo, if you collect prepayments of $500,000 from pizza-lovers to sell them the pizza that you will develop using their money, the net would be taxed.

<comment><USER3> Capital (equity) and net income (income - expense) are separate. It is possible, as you point out, for for taxes to be affected and this is what I am getting at. Something can affect equity and assets without affecting net income but net income _always_ affects equity and assets.

As for prepayments, assuming you aren't one of the rare cash-basis filers, it will be deemed income at the time goods are delivered (and is technically a loan before that point since you have a debt (the goods to deliver) to the customer and if you have to refund the money you may yet have to do so.

</comment></comment></comment></comment><comment><USER5> This seems pretty obvious. If you're raising money and you're not a non- profit, then you're going to owe taxes.

<comment><USER6> As I read the article, it's _not_ about raising money---it's about the exchange/the transaction. By offering "rewards" on KS, you're making a sale.

<comment><USER3> The point has to do with what you are exchanging. In general you are going to only gain money in these cases in one of three ways:

1) Sale of a good or service (direct or indirect). This is income and if income exceeds expense, will increase taxable income. If income does not exceed expense then as a fundraising effort it is a failure.

2) Sale of equity. This is not income. It's a straight asset/equity swap. This can be done crowdsourcing too due to recent regulatory changes.

3) Sale of promissory notes. This is not income. It's a straight asset/liability swap. I would be surprised if you could go out and sell bonds on street corners but if you could it too would not be income unless you were paying back less than what you sold it as which isn't usually the way these things world.

<comment><USER4> Actually, you just provided 3 taxable transactions.

The sale of equity is taxable as income to the seller. I believe you actually mean the issuance of stock by the corporation in exchange for contributions of cash or other property to the corporation. This is not a sale, nor is it taxable. See Sec. 351.

The sale of debt is income to the seller. I believe you mean the issuance of debt by the corporation in exchange for a loan of cash or liquidable assets. This is not a sale.

Note that income is not a matter of gain or loss. You can sell something for a loss and still have income. However, gain or loss is relevant to the determination of how much in taxes you pay for the year. That discussion could fill entire hard drives.

</comment></comment></comment></comment><comment><USER7> "It it's a sale, it's taxable". Where does the money go? Wait... I already pay 1000 different taxes every day.

We should just blindly accept whatever politicians tell us to do.

<comment><USER8> In what world is _selling something_ not going to incur a tax liability?

<comment><USER9> In the world before 1913 when the unconstitutional tax mandate became "law". People are blind

<comment><USER10> A Constitutional amendment _specifically_ authorizes income taxes, so it's pretty impossible for them to be unconstitutional. Or are are you referencing one of the theories [1] that the 16th amendment was never ratified?

[1] [http://en.wikipedia.org/wiki/Tax_protester_Sixteenth_Amendme...](http://en.wikipedia.org/wiki/Tax_protester_Sixteenth_Amendment_arguments)

<comment><USER9> _delirium read the amendment. either way it states clearly that no tax from income should be collected

<comment><USER10> The amendment reads in full, as follows:

 _The Congress shall have power to lay and collect taxes on incomes, from whatever source derived, without apportionment among the several States, and without regard to any census or enumeration._

It quite clearly states exactly the opposite of what you claim.

</comment></comment></comment></comment></comment></comment><comment><USER4> It depends. This is how the US federal income tax code would probably treat the issue:

\- If the business is an S-Corp or a Pass-through (i.e., LLC or partnership), then it reports income when funds are received. Individuals and pass-through entities are cash method taxpayers, so they report income when received, not when earned.

\- However, if the business is a C-Corporation, they report income when the transaction is completed. C-corps are "accrual" method taxpayers, so they report income when actually earned regardless of when actually received.

This does not mean the business actually owes taxes on the income, since businesses are taxed on net income, i.e., profits remaining after expenses, credits, and various deductions are deducted from revenues.</comment>


Fast, easy deep dreaming with Dreamscope - <AUTHOR> https://dreamscopeapp.com/

<comment><USER2> How much does the sophistication of the neural network have to increase to for this sort of application become a case of cruelty to machines? (not too sure if this is a serious question .... yet).

</comment><comment><USER3> im impressed with it's speed. thanks for sharing.

</comment><comment><USER4> A lot like deepdreamer.io</comment>


Ask HN: Waking up to the app age. Now what? - <AUTHOR>

I have a popular website - you might call it webapp these days. Been a hobby so far. Its been running for years now. It makes me some adsense money and thats it.
I closed down my last startup lately. Now Im tinkering with ideas what to do next. I will probably build this webapp into a business.
It has a fancy short name. Today I checked the ios and android appstores and to my surprise no apps with this name are out there.
Should I wait until I have apps ready (in 6 to 12 months I would guess) or somehow register/block the name with a quickly built app or something? <comment><USER2> Best to wait. why register the name now cheaply when you can pay an exorbitant amount for it later. :p

<comment><AUTHOR> "register"?</comment></comment>


What Google Engineers Are Building in Seattle - <AUTHOR> http://www.xconomy.com/seattle/2009/08/28/google-seattle-is-hiring-making-bid-to-be-transparent-to-local-engineers/

<comment><USER2> I especially enjoyed Stephen Adams' talk. The other two were very interesting, but much broader overviews of Google technologies. Adams really drilled down into the nitty gritty tricks he used to decrease the size of Chrome updates.

In contrast, a large portion of Chee Chew's talk was basically a Google engineer walking through how to attach documents and use video chat in Gmail.

I really hope they do more of these talks. As a UW student, it's thrilling to be able to hop on a bus and go rub shoulders with Googlers.

<comment><USER3> This is totally off topic, but you don't have an email address in your profile. So I'll ask it here:

How easy is it for a non-student to "unofficially" drop into a CS class in UW? Will the professors find out and call the security/cops?

[Edit:mongoose has answered me by email. Thanks!]

</comment></comment><comment><USER4> Google Irvine had an open house two years ago, before the troubles. Similar feel as this one, it seems, and worthwhile for anyone interested.

</comment><comment><USER5> Anyone else notice the spam hack in the comments?</comment>


Twitter's New Two-Factor Solution Kicks SMS to the Curb - <AUTHOR> http://www.wired.com/threatlevel/2013/08/twitter-new-two-facto/?mbid=social10522764

<comment><USER2> > The new two-factor system works like this. A user enrolls using the mobile > app, which generates a 2048-bit RSA keypair. The private key lives on the > phone itself, and the public key is uploaded to Twitter's server.

> When Twitter receives a new login request with a username and password, the > server sends a challenge based on a 190-bit, 32 character random nonce, to > the mobile app — along with a notification that gives the user the time, > location, and browser information associated with the login request. The > user can then opt to approve or deny this login request. If approved, the > app replies to a challenge with its private key, relays that information > back to the server. The server compares that challenge with a request ID, > and if it authenticates, the user is automatically logged in.

Basically it has a public/private key pair on your phone. Twitter only has the public half of the pair. When a login request comes in it asks you to verify it by confirming it on your phone. Your phone then signs a "Allow" response using your private key that Twitter verifies by checking it against their copy of your public key.

What's cool about this is that it can deal with any login system in existing apps[1], whether written by Twitter or a third party. The two-factor login confirmation is completely out of band from the original login request. If anything the requesting app would just get a login delay.

Would be cool to have a more generalized version of this approach, similar to how TOTP exists. I like the idea of signing login requests using a physical device (eg. your phone) and like how it would be possible to integrate it with existing systems quite easily. What sucks is if each app has to have it's own app installed for something like this. I like how I have a single TOTP app on my phone. If something like this was standardized you could have a single app handling multiple sites.

[1]: _If Twitter allows them. It might just reject third party login requests rather then hanging waiting for an "Allow" confirmation from the user. This would actually be an interesting way for them to crack down on third party clients._

<comment><USER3> The cool generalized version does exist :). Check out [https://www.mepin.com/](https://www.mepin.com/)

We've got RSA 2048 keys on iOS, Android and a separate smartcard USB key, and do 2-factor login and transaction authorization with a simple tap in an app + optional direct login without a password + trusted messaging. Available as an app or an app SDK.

What I'm wondering is whether Twitter is actually protecting the private keys? That's the real tricky part.

<comment><USER4> Yeah, if the device is unencrypted, which it likely is, and the key isn't passphrase protected, which also seems unlikely, then it should be trivial to access the private key.

</comment></comment></comment><comment><USER5> What happens if I lose my phone? I have human ways of authenticating myself to my wireless provider and getting a new phone with same phone number back. Do I need to backup the RSA private key?

If my phone is compromised physically or with malware, this does nothing to protect my twitter account. Both proverbial eggs are in the same phone.

<comment><USER6> Rule #1 of security: There is no such thing as perfect security.

Of course there are still problems with two factor authentication, but it's better than the alternative.

If you lose your phone with two factor auth the provider should give you several temporary keys that you can use, or a way to contact their support line and confirm your identity.

<comment><USER5> Agree on rule #1.

> " or a way to contact their support line and confirm your identity"

That is one of the nice things about SMS 2-factor auth, the backup authentication method (lost phone) is on the wireless company instead of you. I suppose twitter can handle the extra responsibility though. They have ways of verifying accounts, so now it is just a question of scaling that for support.

<comment><USER2> > That is one of the nice things about SMS 2-factor auth, the backup > authentication method (lost phone) is on the wireless company instead of > you.

This is one of the _terrible_ things about SMS 2-factor auth! In exchange for having them be able to replace your phone (so your 2FA works again) you're giving them the ability to spoof you at any given time. From a company's perspective it might be better (don't have to deal with " _I lost my ... "_) but it's a terrible trade off for users.

</comment></comment></comment></comment><comment> brown9-2 This is an interesting way to get people who use non-official Twitter mobile clients to install the official client again.

On a serious note, it sounds like they are seriously engineering this so that even someone who has gained access to Twitter's servers cannot access the user secrets:

 _We chose a design that is resilient to a compromise of the server-side data's confidentiality: Twitter doesn't persistently store secrets, and the private key material needed for approving login requests never leaves your phone._

But if someone has gained access to Twitter's servers, isn't this nuance a bit moot? Presumably if I've gained access to their servers then I can also find a way to tweet as someone else or approve their OAuth requests somehow.

<comment><USER2> If you have live server access yes (you can do whatever you want at that point). But if you just have a data breach then no. A data breach of the public keys wouldn't require them to reset two-factor auth for the impacted users. An attacker would need each user's private keys to authorize login attempts and Twitter doesn't store that anywhere so it can't be breached en masse from them.

</comment></comment><comment><USER7> I wish everyone would just use HOTP or TOTP, similar to how PayPal does it.

With my 2FA-enabled PayPal account, I can use either my Yubikey USB token or an application on my phone (from Symantec) to authenticate to my PayPal account.

On that site, it "just works" and is painless and doesn't get in the way. I don't want to have to use yet another app or yet another physical device. If you want to "do it right", implement the standards and let the user use whatever they want as long as it conforms to that/those standard(s).

<comment><USER2> I used to think that TOTP was the way to go too but it can be improved. I _really_ like having a public/private key pair vs a static shared secret. It's just objectively better. With this setup a rogue agent working at company X can't leak your 2FA secret. Data breaches don't compromise 2FA (this is really important).

The main advantage I see with TOTP is that it's standardized. I can use any TOTP client with any TOTP server. I can implement TOTP 2FA to my app and it'll work on any compliant TOTP client. A standardized 2FA approach using public/private key pairs would be superior though. You'd get a common approach but with all the advantages I list out in the first paragraph.

<comment><USER7> Oh I would love to have a single SSL certificate for the client-side that I could use to authenticate everywhere I want to... but until we move towards some sort of global ID system (which, of course, has its own ramifications) I don't see that happening.

<comment><USER8> you CAN have multiple IDs, and the ID does not need to be associated with any personal information.

<comment><USER7> Yes, you're absolutely correct. I'm also capable of managing several different client SSL clients (I do it everyday).

Can the average user keep track of just a few different SSL certificates and remember which one to use for which site? No, they can't, and that's why having "multiple IDs" won't work and we'll need some single centralized issuer of certificates in order for it to work "at scale".

</comment></comment></comment></comment></comment><comment><USER9> Why the hell is Twitter more secure than my bank? I don't actually give a crap if someone steals my twitter account, and I can't imagine why anyone would

<comment><USER10> Remember that Twitter is a tool for freedom fighters to overthrow governments.

<comment><USER11> As is cash.

</comment></comment></comment><comment><USER12> It is very interesting to see Twitter has the similar idea with ours.

We just submitted a research paper 2 weeks ago to SPSM'13 ([http://www.spsm- workshop.org/2013/](http://www.spsm-workshop.org/2013/)). We proposed _a password-free login system_ , of which Twitter's new 2-factor auth solution is a special case. We also discussed about the solutions to vender lock-in and 2-factor auth in the paper.

I put the paper in public for interested readers. You can download it from [http://about.bozhu.me/paper/loxin.pdf](http://about.bozhu.me/paper/loxin.pdf)

PS. We did a conceptual Android app about password-free mobile payment, under the same idea, in last year when we participating in the MintChipChallenge by the Royal Canadian Mint. The source code is available at [https://github.com/Xecurity/EasyChip](https://github.com/Xecurity/EasyChip)

</comment><comment><USER11> So I tried it and my first login request was flagged as coming from N. VA (I'm in CA) which really made me nervous for a good 5 minutes. Next I turned on my private proxy which is also located in CA and the login request was then marked as coming from Amsterdam. Is their location info intended to be accurate?

<comment><USER13> You should check the GeoIP information for your ip addresses. That is most likely where they are pulling it from.

</comment></comment><comment><USER14> Sounds like a clean solution, and very similar to smartcard authentication[1]. It improves on smartcards by showing which application is attempting to authenticate. It improves on Google Authenticator by allowing faster authentication in the common case that you have Internet access, and removing the shared secret so they can safely deploy the verification to commodity servers.

One thing that isn't clear from the blog post is whether you can have one set of S/KEY backup codes to put in your drawer for when you lose your phone, and another set of backup codes for when the phone is offline (to use just like you use Google Authenticator). Both use cases are important.

Another question is whether Twitter intends to open the protocol and app for third parties to use, as Google did with Google Authenticator[2]. A potential sticking point is that the app probably trusts the Twitter servers to not lie when it tells the app that a particular URL in your browser wants to authenticate, and opening the app probably means depending on X.509 certificate chains in order to trust a server request.

[1]: [http://msdn.microsoft.com/en- us/library/ms953432.aspx](http://msdn.microsoft.com/en- us/library/ms953432.aspx)

[2]: [https://code.google.com/p/google- authenticator/](https://code.google.com/p/google-authenticator/)

</comment><comment><USER15> Forgive my ignorance, but I always thought the point of using SMS was to avoid using the same data channel for transmission, kind of like having Fiber with a backup DSL/Cable line for a small business.

This innovation sounds awesome, but is Twitter exposing their clients to additional risk by returning to a single communication channel? I suppose that Two-Factor isn't designed to withstand a carrier-based MITM attack, and that such an attack would probably apply equally well to data as well as SMS, but I think it's interesting to model the attack surfaces.

All in all I think this is the right direction for Two-Factor, but I wonder if there's a way to use something other than the carrier data channel to deliver the second-factor. There's something to be said for using a diversity of transmission mediums.

Something to think about.

EDIT: For the sake of clarity, I'm referring to a single data channel in that you transmit your password using your cellular data connection and you would also be providing your two-factor challenge over the same data connection, whereas previously the SMS portion represented two discrete networks for authentication.

<comment><USER2> With this new setup the carrier channel is irrelevant. It could even be done in plain text (eg. no SSL). Since the request is being signed using a pre shared public/private key pair it can't be man in the middled or spoofed. At best someone interfering with your network connection (between you and Twitter) could prevent you from logging in if they mess with your network packets. They wouldn't be able to fake the authorization of a login attempt though.

</comment></comment><comment><USER16> If only used at twitter, this is useless. They went through the effort and security risk to develop a custom protocol that doesn't involve shared secrets. Good for them. But if your shared secret only allows access to Twitter and is only stored on Twitters servers, its compromise probably entails their severs getting owned. In which case, the authentication schemes don't matter.

Where this is somewhat more useful, however, is if you want to provide third party systems with two factor auth and not store a secret per user/service pair. Then twitter's severs being compromised and revealing the shared secret might expose other services. Of course, given how small HTOP/TTOP secrets are, I don't think thats much of a problem.

Note, the usability issue is orthogonal to the protocol. You could easily make an app that does TTOP/HTOP but has the response codes sent by the app with confirmation instead of being entered into login prompt manually, just as you could manually have people enter response for the twitter auth challenge.

<comment><USER17> The next step, IMO, should be for Twitter to extend this to let third party websites and apps authenticate using Twitter's new protocol. Ultimately could be worth more than Twitter's core business. Essentially Facebook Connect done right, in a privacy-protecting way, with higher security.

<comment><USER18> That _has_ to be the next step for this. You don't go through all this work just for posting 140 characters of text at a time.

<comment><USER19> do you remember only about 4 months ago a fake tweet on associated press twitter account about the whitehouse being bombed caused a stock market flash crash of nearly 1% which is over 100 billion dollars in the matter of 10 seconds or so???

thats why twitter HAS to provide robust security for the high credibility accounts or watch those accounts be closed down. anything else is great but thats the REAL driving force is to secure the 140 characters

Read more: [http://business.time.com/2013/04/24/how-does-one-fake- tweet-...](http://business.time.com/2013/04/24/how-does-one-fake-tweet-cause- a-stock-market-crash/#ixzz2bE8VZn2J)

<comment><USER18> That's an excellent point, but they could have implemented something generic and gotten the same order of magnitude of protection for a _lot_ cheaper.

</comment></comment></comment></comment></comment><comment><USER20> Sounds like there might still be some process stuff to figure out but overall this is the least annoying version of two factor auth i've ever heard of. Unfortunately all it can protect is my twitter account.

<comment><USER21> Isn't this exactly what Duo Security does?

<comment><USER22> Very similar, and funny enough: [https://blog.duosecurity.com/2013/02/modern- two-factor-authe...](https://blog.duosecurity.com/2013/02/modern-two-factor- authentication-for-twitter/)

<comment><USER23> I'm glad they patented something that should be used by every service, helping keep all of us secure :) /s

<comment><USER22> Holding a patent doesn't mean you have to enforce it. [https://blog.duosecurity.com/2013/08/welcome-to-the-push- clu...](https://blog.duosecurity.com/2013/08/welcome-to-the-push-club- twitter/)

<comment><USER24> Pointing a loaded weapon at you doesn't mean I'll shoot you.

</comment></comment></comment></comment></comment></comment><comment><USER25> I'm curious as to how this will handle multiple devices with the a single twitter login ? I have a phone , a tablet and I'm rom a lot so I may have to install the app several times in a say a month. For each device and install wouldn't that generate a new public key ? How would they re verify that ?

<comment><USER26> It's the same as using your private SSH key to sign in to your servers from different devices, you can choose to generate a new pair of private/public key or just copy your private key from old device to new ones. But reuse private keys have it disadvantages:

* You have to copy the key manually * When a device is compromised, you have to replace the key on all of your other devices

<comment><USER25> I wonder how would twitter implement this safely for the lamen

</comment></comment></comment><comment><USER27> Will this work with Google Authenticator or are they making a proprietary app that you have to use?

<comment> brown9-2 The blog post makes no mention of it. Since it's not HOTP or TOTP, I don't think it's possible. [https://blog.twitter.com/2013/login-verification-on- twitter-...](https://blog.twitter.com/2013/login-verification-on-twitter-for- iphone-and-android)

</comment></comment><comment><USER28> Not a crypto expert so tell me if I'm wrong but isn't the one downside of this the risk that a user will click "Allow" when he should not? I.e. a phishing site stating "if your Twitter mobile app prompts you to Allow, click Yes to receive your free pr0ng/game/claim your inheritance?"

The benefit of sending up the user a code to enter ala Google Authenticator is that we understand secret keys as digitally valuable. The social context of Allow, meanwhile, is that computer users are sometimes trained to click it constantly, e.g. by a desktop app installer or location based app.

<comment><USER29> That's only in regard to a phishing attack, but two factor authentication protects you in the case that you lose your password to an adversary who tries to log in themselves.

If said adversary can steal your password through other means (for example, you use the same password over multiple sites, and the adversary happens to run one of them), they still would have to coerce you into giving the Allow on your phone.

</comment></comment><comment><USER30> Regardless of the technical merits of the approach, are there that many people who care about protecting their Twitter account that badly?

I would understand a bank thinking very hard about this problem, or an email service (most bank account thefts happen not from breaking passwords but resetting them via email, so email inboxes are extremely sensitive).

But a Twitter account? Aren't they over estimating the importance of their data a bit?

I think the real reason is that they are trying to kill whatever third party Twitter clients are left.

<comment><USER31> Given that companies, individuals, dissidents, and sitting government officials use Twitter as both public & private communication streams in many cases the security of the account is more valuable than a checking account with a couple of thousand dollars in it.

</comment></comment><comment><USER32> When will Github get 2-factor authentication? I emailed them about it a few months back and they acted surprised.

</comment><comment><USER33> I'm not sure I'm a fan of this scheme. While it seems to solve Twitter's problems for the time being, it gives an incredible amount of power to the person who has your phone — which may not be you. Being able to authorize a new login _without any kind of authentication on the administrative side_ (as managed by the Twitter client on your phone) means that anyone in possession of your phone is in charge of your account.

You leave your phone sitting around and someone else grabs it? That person can easily authorize a new, permanent login, and you probably won't even realize it.

If you're going to go as far as a second factor like this, why not authenticate the approval?

 _edit: verbiage and clarity_

<comment><USER34> That person grabbing your phone would also need to know your password, so it's not any worse than not having two factor authentication.

</comment></comment><comment><USER35> It does sound like the public-key crypto is one of the best ideas for internet-enabled 2-factor so far, though I haven't quite wrapped my head around the implications of the weird "hash it one less time" backup code method. Based on the description on the skey page here[1], here's some pseudocode of how the challenge works without your phone:

      # Create password
      client ->  hashit 64-bits-of-random-data 10000 > backup.crypt
                 hashit 64-bits-of-random-data 9999 > backup.code
                 tell-user "Write this down!" + backup.code
                 remote-copy user@server backup.crypt
      server ->  store backup.crypt
                 counter = 9999

      # Log into the server
      client ->  request-challenge-from user@server
      server ->  send-reply "send me hash 9999"
      client ->  read-value "Tell me the backup code you wrote down" backup.code
                 try-login user@server backup.code
      server ->  hashit backup.code 1 > trypw.crypt
                 if trypw.crypt != backup.crypt
                     fail "Error! wrong backup code"
                 else
                     success "Code good!"
                     counter = 9998
                 done
      client ->  hashit the-same-old-64-bits-of-random-data 9998 > backup.code
                 tell-user "Write down the new backup code!" + backup.code

Edit: so every time you attempt to use a backup code, if it works, you write down a new backup code. Depending on how they implement this, there's a couple fun attacks based on things like the randomness of the pad, if we can force it to reduce the rounds used over a pad (which might not even matter if it's something fast like SHA1), etc. The [remote] security of the second factor now depends on whether or not you can guess a 60-bit "random" hash. Fun stuff.

If I were them, i'd just do e-mailed password resets and leave it up to the user to secure their e-mail. This complicated scheme is way more likely to be exploited somewhere in implementation, considering how rare and custom it is.

[1] [http://www.ece.northwestern.edu/CSEL/skey/skey_eecs.html](http://www.ece.northwestern.edu/CSEL/skey/skey_eecs.html)

</comment><comment><USER36> > When Twitter receives a new login request with a username and password, the > server sends a challenge based on a 190-bit, 32 character random nonce, to > the mobile app — along with a notification that gives the user the time, > location, and browser information associated with the login request.

Presumably the user must sign not only the nonce, but also the request notification details displayed in the app, so Twitter can verify that the user approved the request it actually sent.

</comment><comment><USER37> It's broken. Instead of sending web login requests to the app "login requests" area, they're still sending SMS messages. The SMS messages used to include a 6-character token to login but it's been replaced by the 256-character signature. This can't be used to login with and nothing shows up in the app "login request" area. It looks like the old SMS system and the new 2-factor auth system are conflicting with each other.

<comment><USER38> Same for me. Super weird. I can't wait for the blog post that explains what code blew up for this to happen.

</comment></comment><comment><USER39> I turned it on and it's broken. Nice launch Twitter.

<comment><USER40> yeah, same here. all i'm getting is a "new login request" notification on the phone when trying to login on the desktop browser. but when opening the notification it says "no new login requests", and the website on the desktop jumps to "We're sorry, there were was an error. Please try logging in again.".

<comment><USER41> Having problems here. I get a notification on iOS but when I go there it says "No new login requests"

And seems we're not the only ones: [https://twitter.com/search?q=No%20new%20login%20requests&src...](https://twitter.com/search?q=No%20new%20login%20requests&src=typd)

</comment></comment></comment><comment><USER42> > based on a 190-bit, 32 character random nonce What am I missing? Shouldn't a > "character" be 1 byte (or more)? -> 32*8=256 != 190

Even with another encoding, with 190 bits for 32 characters, that would be 5.9375 bits/character which seems a bit strange to me.

<comment><USER43> It's base-62, just using the 52 alphabetics and 10 digits. Using just those characters ensures it can be typed and won't be mangled by international, HTML, or URL encodings.

>>> log(62)/log(2) * 32

190.53428193238003

<comment><USER44> Please provide an example of base62 encoding. With base64, it is trivial to break 192 bits in a group of 6 bits each and assign one of the 64 characters to each (A-Z, a-z, 0-9, /, +). With 190 bits, how is the encoding done?

I'm sorry if I'm missing something trivial here.

<comment><USER45> Here's a hint: base10 encoding those 192 bits just means "write the number in decimal". Since 2^192 is about 6E57, that can be done in at most 58 digits.

However, it is not possible to break 192 bits into 58 groups so that each group can be coded in one of those digits. Clearly, some of the bits must end up in more than one of those digits.

base62 is similar to the base10 case, but uses 62 different digits.

If this explanation is insufficient, check [http://en.wikipedia.org/wiki/Ascii85](http://en.wikipedia.org/wiki/Ascii85). That's for base 85, but the approach is the same.

<comment><USER44> Thanks very much. I understand the generic method now. Base64 with 192 bits is just a special case where both 192 and 64 are powers of 2, which allows simple encoding by grouping the bits.

</comment></comment></comment></comment></comment><comment><USER17> Finally. I still don't understand why 1) they took so long to do anything and 2) they did the crappy SMS-only form earlier, but this actually looks like what a reasonable person would implement, given the Twitter user model (mostly moving to mobile clients, crossplatform, etc.)

</comment><comment><USER46> Biggest problem with SMS is that it cost and its not cheap at high volumes. Twitter pays a lot money to secure short-codes and delivery of SMS into countries around the world. Slowly they'll phase out the SMS auth and save money.

</comment><comment><USER47> Is there an open-source version of this or does anyone want to create one? I need something like this for my next project, but this doesn't add any value to my product.

</comment><comment><USER48> This is pretty neat. I will definitely share this idea with my company. We might be able to overcome some of our security issues with this!

</comment><comment><USER49> Any idea how this works with managing multiple Twitter accounts?

</comment><comment><USER50> Which service/API do they use to send SMS?

<comment><USER51> They have their own via Cloudhopper: [https://blog.twitter.com/2010/cloudhopping](https://blog.twitter.com/2010/cloudhopping)

</comment></comment><comment><USER52> [https://www.duosecurity.com/authentication- methods](https://www.duosecurity.com/authentication-methods) What? This exists...

</comment><comment><USER53> What I read: "Blah blah blah...Twitter developed a novel authentication system...blah blah blah." Anyone else think that trusting Twitter (or any other company without vast mathematical and security chops) to securely deploy an existing authentication system, much less develop a new one, is likely to end in tears?

<comment><USER10> Maybe you didn't see this: [http://www.forbes.com/sites/andygreenberg/2011/11/28/twitter...](http://www.forbes.com/sites/andygreenberg/2011/11/28/twitter- acquires-moxie-marlinspikes-encryption-startup-whisper-systems/)

</comment></comment><comment><USER54> No major advantage over SMS. It just sounds great, but that's about it. If someone has your phone you are compromised be it via SMS or their app. Disadvantage is numerous, (1) if you lose your phone, you are in for a world of hurt trying to reauthenticate, (2) all users without smart phone are out i.e, users in 3rd world countries where data is readily not available but SMS is. I personally think they should have done both.

<comment><USER35> SMS is a huge security hole; it's not secure at all. Literally child's play to circumvent, intercept and spoof. (Also, unfortunately, they still have an SMS option for when you lose your device, which doesn't make much sense, but whatever)

<comment><USER55> To add to this, SMS may seem like an unrealistic security hole but you have to consider that there are some very high profile twitter accounts. Intercepting SMS messages may not seem like something your pain in the ass neighbor is likely to do to you, but there are far more interesting targets with twitter accounts than you.</comment></comment></comment>