Yubico and Microsoft Introduce Passwordless Login - <AUTHOR> https://www.yubico.com/2018/04/yubico-and-microsoft-introduce-passwordless-login/ <comment><USER3> I'd like to try to answer some common questions I see here:

\- Q: Doesn't passwordless mean single factor? Isn't that insecure?

A: It could mean single- or two-factor. FIDO2 and the new YubiKeys support an on-device PIN that isn't shared with the server, like conventional smart cards. This allows the key to act as both "something you have" (the key itself) and "something you know" (the PIN for the key). The PIN is optional, though, so both the single factor and two factor use cases are possible.

\- Q: Is this Azure/Windows/AD only?

A: This post highlights the partnership with Microsoft and the integration with their products, but FIDO2 is not Microsoft-only (and Yubico will not be the only key vendor). CTAP2, once finished, will be published as an open standard like U2F, and the accompanying Web Authentication API [1] (WIP) is an OS-agnostic W3C standard enabling the same features in browsers.

[1]: [https://www.w3.org/TR/webauthn/](https://www.w3.org/TR/webauthn/)

\- Q: Will I need a new YubiKey?

A: For passwordless (PIN) login, yes. However, existing YubiKeys with U2F support will be usable as a 2nd factor in Web Authentication, and sites that currently use U2F can upgrade to using the Web Authentication API without needing their users to re-enroll their keys.

Full disclosure: I'm a Yubico engineer and one of the editors of the Web Authentication spec.

<comment><USER4> What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey?

P.S. just ordered a yubikey security key, excited to add this additional layer to my own personal byzantine security labyrinth. Or maybe simplify it, who knows!

<comment><USER3> It's still a largely unsolved problem, unfortunately. Enabling private key backup comes with a suite of nasty problems like what it means for device attestation and how to guarantee that a key hasn't been cloned in transit. Our best recommendation right now is to have a backup key, but it still means you have to register it everywhere in advance and then go to each site to revoke the lost key.

At least Web Authentication platform credentials should let you have multiple authenticators without having to buy an extra YubiKey.

</comment></comment></comment><comment><USER5> The conversation here is blowing my mind. People are actually worried that their yubikey might get lost or stolen when likely most of your passwords are already all over the internet. I got an email from Twitter just a few days ago stating that they'd leaked my password. Twitter! Not Joe's Auto-Body who's website is being run by a high-schooler, but one of the pioneers of internet companies. They messed up. Your password is not safer "in your head" than a private key because it is not only in your head (who keeps all passwords in their head anymore anyway?)

Private keys are way, way more secure than passwords for that reason alone. You don't have to give anything secret to a third party.

If that's the one problem this solves and revocation and recovery and 2-factor are all still as difficult and broken as they are now with passwords that's still a huge win.

EDIT: more thoughts. I also really hope that hardware tokens like a yubikey are not required for every site or app. I'd like to be able to keep private keys on my phone or laptop for some things (how many of us keep our ssh keys exclusively on hardware tokens?).

<comment><USER6> > I got an email from Twitter just a few days ago stating that they'd leaked > my password

Clearly you didn't read the email.

The password was potentially logged to twitter's servers in plaintext.

They have no evidence anyone collected those passwords, but various employees could, in theory, have seen those logs.

Presumably those logs are now all deleted.

Even if you didn't reset your twitter password, it's very likely you'd be fine since it's not "leaked" (to the wider internet), but could have been seen by some employees who, for fear of being fired, no doubt did not save it (and in all likelyhood didn't see it in the first place).

<comment><USER5> You obviously are more trusting than I am. Also, my point was that if Twitter messed up, so has every other website. Do you trust them all as much as you trust the Twitter employees?

<comment><USER7> You don't trust Twitter's story but you trust Twitter software engineers more than others?

I trust Twitter's story about the plain text logging but don't trust their software engineers more than others.

</comment></comment></comment></comment><comment><USER8> Did they improve the stories for recovery ("I lost my device") and revocation ("my device has been stolen")? As far as I knew you had to buy 2 devices to have a chance of recovery, and Fido 1 explicitly said "revocation is something that needs to be resolved by each website that authenticates users", which is just asking for trouble.

I would love to have a hardware (or even phone-based) alternative to passwords, with no third-party and better privacy, but I feel like this solution only handles the happy path.

For an example of a happy-path-only system that makes me nervous, look at Google Authenticator. Recovery is made with backup codes, but they are also "resolved by each website" ([https://security.stackexchange.com/questions/167563/where- to...](https://security.stackexchange.com/questions/167563/where-to-find- google-authenticator-backup-codes)), which often means no support at all. Not to mention having to create a new backup after creating a new account. I still use Google Authenticator myself, but I dread the day I lose my phone.

If the protocol doesn't handle recovery/authentication, the fallback is a trusted third party (e.g. email) or legal identity (e.g. scanned passport). Aside from being a huge hassle and creating a weak point, it weakens the user's privacy.

<comment><USER9> Every place that I use my key gives you a set of one-time-use recovery codes. To log into your account, you can use either the key or a code. (You still need your password.) Codes can be regenerated at any time. To revoke a key, you simply remove it from your account.

<comment><USER10> Can you give a list of all these places?

Gandi doesn't even have a non-human method of recovery.

<comment><USER11> Facebook, Google, Dropbox, and github, at least.

<comment><USER12> Fastmail also.

</comment></comment></comment></comment></comment><comment><USER13> More specifically, they're introducing passwordless login with FIDO2, as Windows had had passwordless logins with certs and CAC cards for ages.

</comment><comment><USER14> Correct me if I am wrong, but passwordless login is a single-factor authentication and less secure than MFA. Depending on whenever hardware key is more or less secure than the password, the mass adoption of this could make things LESS secure.

<comment><USER15> I would expect things to be more secure in many cases. People are pretty good at keeping physical items somewhat safe and notice when they're gone. Yubikeys cannot easily be cloned. The password cannot be attacked remotely. 2FA is certainly safer, though.

<comment><USER16> The standard in high-assurance applications is to present a PIN to the hardware token before it can be used, ideally through an out-of-band keypad.

In this context, it would be reasonable to have the Yubikey require a PIN entry from the computer. You could use the same PIN for all sites because it stays local; the relying party never handles it, only the Yubikey.

<comment><USER3> That's exactly how FIDO2 PIN on the new YubiKeys works.

</comment></comment></comment></comment><comment><USER17> It's too bad sshd never got support for U2F. Seems like the discussions just petered out.

Maybe the introduction of FIDO2 will spark some interest in that again? [https://bugzilla.mindrot.org/show_bug.cgi?id=2319](https://bugzilla.mindrot.org/show_bug.cgi?id=2319)

Yes, sure, you could use pam-u2f, but that will never be as seamless as having it supported upstream in ssh.

Or you could use the OTP mode instead, but that has other disadvantages (you have to depend on yubico's servers or run your own KSM+validation servers).

</comment><comment><USER18> Would be interesting if this would become popular one downside I see to this is that if law enforcement get their hands on your token they can unlock the device. Also as the token can be regarded as a key rather than a password a court would be able to legally compel you to surrender it without invoking much debate regarding laws against self incrimination (e.g. the fifth).

<comment><USER5> Can't law enforcement now just ask Google or Facebook or whoever for the information they need without needing your password (or future token)?

<comment><USER18> It's not that simple, firstly some Google and Facebook services are E2E encrypted which means that they cannot comply.

This also goes well beyond just Facebook and Google and if you use it to lock a physical device like a phone or a laptop that isn't something Google or Facebook would be able to help law enforcement with.

Also while I don't want to make a statement or start a debate on the level of compliance and attitude that Google and the rest have towards search warrants (because it's not relevant and I don't have sufficient knowledge to actually form an informed opinion on the matter). Google and Facebook's legal departments have more funding than most state attorneys yet alone local DA's if they want to fight on your behalf (or on the behalf of their business model) in court they would be able to do so much more effectively than you ever could.

Google and Facebook also require a full and lengthy process with FIDO tokens they can do it on the spot, heck they are legally able to do so if you either agree to a search or law enforcement has an alternative sufficient basis to invoke a lawful warrantless search:

[https://en.wikipedia.org/wiki/Warrantless_searches_in_the_Un...](https://en.wikipedia.org/wiki/Warrantless_searches_in_the_United_States#Exceptions_to_the_search_warrant_requirement)

TLDR; Officer: May I search your vehicle You: Yes

At that point they are legally are allowed to take the FIDO token from your keychain and unlock your laptop.

</comment></comment></comment><comment><USER19> So my biggest question here is: Is this Azure only? Each announcement about it seems to indicate that I might _not_ be able to use this key with my local account PC.

Specifically, I have one use case computer where I have no screen, and getting through Windows login without it can be troublesome. I'd love to use this key to unlock it instead, but it's an offline machine.

I had this plan with Yubikey for Windows Hello, which has been out a while, and I bought a Yubikey, and discovered it could only unlock my Windows machine if it was locked (not logged out), which defeated the purpose entirely.

<comment><USER20> Unfortunately it only works with Azure (at the minimum AD federation with Azure if you have some on-prem)

<comment><USER21> You can use other identity providers for Azure AD. Shibboleth is supported, F5 and Ping are certified, there are others. If you use a different LDAP system than AD you can also sync your identities to Azure AD. OpenLDAP or one of the commercial vendors. It might be a little more elbow grease, but it works.

</comment></comment></comment><comment><USER22> Two things - is there really need for them to be this large? They also look vulnerable? Maybe its just the look, but the blue one looks like it won't survive proper stress test...

And second thing - is exposing connector safe against mechanical damage? Will it withstand constantly being scratched by keys?

<comment><USER23> There is the "nano" version available which is a lot smaller than the one advertised. The ones that I own have held up just fine for the past year on my keychain.

[https://www.yubico.com/product/yubikey-4-series/#yubikey-4-n...](https://www.yubico.com/product/yubikey-4-series/#yubikey-4-nano)

<comment><USER22> This size is much better, but I assume it lacks the "touch" protection against remote attacks, like the other ones?

I still wonder about the exposed connector - what its durability. After all, I would like for such a tool to serve me for years fault-free.

<comment><USER24> I personally have the nano version.

> but I assume it lacks the "touch" protection against remote attacks

It has the touch protection. There is a small strip of metal that protrudes beyond the USB port that you touch.

> what its durability

I've used it daily for about a year. Granted this is not "years" but so far it still feels very solid.

<comment><USER22> Sounds good then. I am ready to test one of them. Thanks!

</comment></comment></comment></comment></comment><comment><USER25> Okay, so I have two Yubico U2F keys and two other U2F keys so far. I don't think I'll buy a fifth and sixth anytime soon.

But hopefully U2F will actually work in non-Chrome browsers in the near future.

<comment><USER26> It already works in Firefox (behind a flag), but sadly some websites explicitly target Chrome...

<comment><AUTHOR> FF traditionally required a plugin, I think native support is recent?

<comment><USER27> It was added in Firefox 57.

Works fine for me.

</comment></comment></comment></comment><comment><USER28> Can someone remind me why we don't use public key cryptography for authentication on websites?

<comment><USER29> It looks like there's a W3C draft "in the works" but I'm concerned since almost half the editors work for the two companies trying to pass this proprietary Azure/AD vendor lock-in nonsense.

[https://www.w3.org/TR/2018/CR- webauthn-20180320](https://www.w3.org/TR/2018/CR-webauthn-20180320)

<comment><USER12> You may be comforted by the fact that the top three people on the Github contributor graph[1] are not from those two companies. I've skimmed some of the published meeting minutes[2], and JCJ (Mozilla) and JeffH (Paypal) seem to be highly involved.

[1]: [https://github.com/w3c/webauthn/graphs/contributors](https://github.com/w3c/webauthn/graphs/contributors)

[2]: [https://www.w3.org/blog/webauthn/2018/01/11/meeting- minutes-...](https://www.w3.org/blog/webauthn/2018/01/11/meeting- minutes-2018/)

EDIT: add forgotten link

</comment></comment></comment><comment><USER23> Glad to see greater adoption of Yubikeys, however there is still a long way to go. Speaking from experience writing a u2f_auth client library, browser support is still nascent and hacky. Edge, safari, and AWS would need to adopt it before I would truly consider it mainstream.

If anyone is considering adopting Yubikeys in their organization using a language that is not supported by one of their client libraries my email is in my profile and I would glad to help out to the best of my ability.

</comment><comment><USER30> I wonder if these Hardware key really make things better for the end-user.

When using it even for login, people connect it to their laptops - that's what most people work with after all - and they must make sure they don't forget it there. As well they need to worry nobody steals it, whether it's on your laptop or you become a theft victim on the street. In the latter case the thieves might know what a Yubikey is and ask you for the pin.

Not sure what problem this solves. But I have the impression we're converting a virtual problem into a physical problem. To be honest I prefer to save keys on laptop drives, that's more difficult to steal, especially when using an encrypted disk.

</comment><comment><USER31> No USB-C version and no way to upgrade my other 4+ YubiKeys I've got for more than $50 each! I think YubiKey has been abusing its monopoly recently! They've been working on this for quite some time and clearly new they're not going to make their old premium keys support it so that people can waste time and money to upgrade! Is there an alternative more conscious company - I'd pay even $200 for the piece of mind that I won't have to change this key 1-2 times per year!

P.S. Obviously, no. Neither Nitrokey [0] supports it, nor it's a sturdy one!

[0]: [https://www.nitrokey.com/](https://www.nitrokey.com/)

<comment><USER32> YubiKeys are non-upgradable by design. This is occasionally annoying when new standards come out and you need to go buy new keys (which is not something that's gonna happen a lot), but it significantly reduces the attack surface of these devices. They've been pretty good about giving out free replacement keys whenever major flaws have been found, and webauthn is pretty good about remaining backwards-compatible with U2F keys, so I don't think it's something they handled particularly badly.

<comment><USER31> I get that, but my point was that they just released expensive new products knowing they'd be obsolete in just a couple of months and people will have to throw old ones in the garbage and buy new even more expensive ones. I do not doubt that a product with an immutable core and mutable interfaces is both possible and even more secure as when flaws are discovered (like last year), some may decide not to replace them - even with free replacement. I spent over $100 just last year, and I think this is a bit too much. I give my old keys to my kids, but, still, I'd appreciate some form of subscription service, which both reduces my recurring cost and possibly improves Yubico's bottom line, too, primarily by building loyalty instead of pissing customers off.

</comment></comment></comment><comment><USER33> Anyone think that Apple is likely to add support for FIDO anytime soon?

</comment><comment><USER34> My problem is that Microsoft doesn't allow swapping in and out of authentication plugins like PAM.

I work primarily in a Windows shop, and I got the other co-workers in Linux because PAM supports seamless multi-factor auth. I would have went Windows, but its too obfuscated or hard to do that.

LinOTP works very well. And LinOTP works with a wide variety of tokens. Don't be locked to a single vendor.

<comment><USER35> > Microsoft doesn't allow swapping in and out of authentication plugins like > PAM.

FWIW, that's not strictly true. See: [https://msdn.microsoft.com/en- us/library/windows/desktop/mt1...](https://msdn.microsoft.com/en- us/library/windows/desktop/mt158211\(v=vs.85\).aspx)

I don't have enough experience to comment one way or the other about its difficulty.

<comment><USER34> Well, this certainly surprises me. I know last I looked, there was some discussion about MFA and requiring Azure.

In the environment I work in, I'm not able to use services outside a very limited list, or I have to roll my own using established technologies (FedRAMP). So Azure is right out. So was using Amazon Directory Services.

I know my colleagues are much more familiar with Windows, whereas I.. (look at username, relevant!). My solution, after assessing that Windows couldn't do 2 (or 3) factor, and it was stuck at login/password and some firewall blocking IP's, I knew what I had to do. And that meant Linux for the bastions, and LinOTP and appropriate config options to make it work.

I was kind, and didn't inflict a AAA stack of "kerb, ldap, radius, and shib" on the Windows admins :) Well, that and I didn't want to be the sole maintainer of that system.

<comment><USER35> To be fair, the only reason I knew of this at all is because of a brief patronage of a library in Belgium during a trip I took in the summer of '99\. The computer systems of said library used a bizarre system of time-limited authentication tokens stored on floppy disks that were used during the Windows log-on process. I was curious how it might have worked.

</comment></comment></comment></comment><comment><USER36> What I'd find interesting is using U2F (or FIDO2, which seems to be an evolution of this) as a second factor for SSH logins. But that doesn't seem possible without changes to SSH itself.

And I hope that this might trigger more widespread support for U2F and similar mechanisms in browsers and websites.

<comment><USER37> No need to touch SSH itself, PAM is a thing (unless you're on OpenBSD). Here's an example of pam-u2f with OpenSSH:

[https://aprilmacdonald.com/two-factor-ssh-authentication- wit...](https://aprilmacdonald.com/two-factor-ssh-authentication- with-u2f-hardware-security-key/)

I actually use a Yubikey for SSH in a different way: with gpg-agent. E.g. [https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey- NEO....](https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO.html)

<comment><USER38> > _PAM is a thing (unless you 're on OpenBSD)_

And if you are on OpenBSD, there's login_yubikey [0] (although it uses OTP instead of U2F).

[0]: [https://man.openbsd.org/login_yubikey.8](https://man.openbsd.org/login_yubikey.8)

</comment></comment></comment><comment><USER39> Good. After all the roundabout bullshit of "factors" ("2FA") and password managers, people have finally come to their senses that physical tokens are a very natural evolution of analog keys and the only real security, and should have been used from the get-go.

<comment><USER40> Keys are not the only real security... real security includes something you are, something you have, and something you know.

Having something like this combined with the something you know (passphrase) would be real closer security. Now anyone with your token can access everything that key gets access to, without you needing to be there, or sharing a passphrase. That's less secure imho.

<comment><USER41> A lot of these devices allow you to configure a pin code that is required to unlock the device before use, which effectively provides a second factor. Also, stealing a fido device requires physical theft and can't be duplicated, so the owner would likely know if it was stolen.

</comment></comment></comment><comment><USER42> So this needs a new yubikey? I can have passwordless login on linux right now with my old yubikey.

<comment><USER3> Depends on what features you want. The old U2F YubiKeys are compatible as 2nd factor keys, but they don't support the passwordless (PIN) or username-less (user ID stored on device) use cases.

</comment></comment><comment><USER43> Why can't I secure login with a fingerprint?

Microsoft could have team up with Logitech like Sony with Erricson, and come up with a standard and put (mildly cheap) finger print reader on each sold keyboard and popularize open source standard for software implementation.

<comment><USER44> Your fingerprint is not a key, it's an identity. So your design tells every place you sign in this way "I'm joering2". And if course if any of them want to log in somewhere else, they now know to say the same thing, "I'm joering2".

I guess this is slightly easier than typing your email address? But it's not a security feature.

The FIDO/U2F design is a cryptographic key enshrined as a physical key, so rather than "I'm joering2" it says: "I can prove I'm this particular key talking to your site again using mathematics".

Which key? No way to know, but it's the same one as before. Google can't use the credentials it presents to them to get into Facebook and vice versa, the proof from yesterday is worthless today and so on.

<comment><USER3> This.

Though I'd like to add that FIDO2 does support fingerprints and other biometrics as an additional authentication factor - it all goes under the same abstract "user verification" umbrella as PIN does. The important distinction is that the PIN or fingerprint is never shared with the server - it's only used to unlock the private key - so it's much more difficult to steal.

</comment></comment></comment><comment><USER45> I wonder if we'll get to the point of having two-factor passwordless authentication. Like you need two of the following methods to access a website (u2f/fido2, TOTP, SMS, Recovery codes, tls client certificate, etc.) and forego passwords altogether.

</comment><comment><USER46> Here is a completely standalone (no server required) and self-contained (no dependencies) FIDO U2F test:

[https://github.com/rongarret/u2f-test](https://github.com/rongarret/u2f-test)

</comment><comment><USER37> Can someone explain why CTAP was created? What exactly was wrong / not enough about the original U2F protocol?

<comment><USER3> Some differences:

\- CTAP2 supports "user verification", such as PIN or biometric authentication locally on the hardware key. This enables using the key as both 1st and 2nd factor without need for a server-side password.

\- CTAP2 supports storing the private key along with some metadata on the device, whereas U2F instead encrypts the private key and stores the ciphertext on the server. While the encryption approach allows for simpler hardware and an unlimited number of registrations, the local storage approach allows login without even having to type (or even have) a username. CTAP2 supports both.

\- CTAP2 has an extensions framework in which an authentication vendor and server can cooperate to implement custom features without the browser having to understand them.

\- CTAP2 - or at least the companion web API, Web Authentication - <USER2> compatible with more existing TPMs and such hardware. For example, it's theoretically possible that some Android phones could receive software upgrades that turn their fingerprint sensors into WebAuthn authenticators.

</comment></comment><comment><USER47> why isn't a phone with a secure enclave (or similar) the focus, instead of something that doesn't work on mobile?

</comment><comment><USER48> Ad companies that specialize in re-targeting are going to have an absolute blast with this!

<comment><USER15> How? Login is not automatic, you need to tap the key. So unless you tap the key each time you view an ad, the ad company gets nothing.</comment></comment>


Exhaled 'aerosols' spread Covid-19 up to 13ft, shoes carry it, too - <AUTHOR> https://medicalxpress.com/news/2020-04-exhaled-aerosols-coronavirus-feetand-virus.html <comment><AUTHOR> > "The truth is this: We don't know what it truly takes to get infected with > the virus, including the amount of virus necessary to actually initiate an > infection," [Dr. Robert] Glatter [emergency medicine physician, Lenox Hill > Hospital, New York City] said. "In fact, it may not require infected > surfaces or droplets after all, just aerosols. We just don't know.</comment>


Ask YC: Employee stock options - <AUTHOR>

I received a job offer this afternoon from a startup. The startup has about 15 employees, has $6.1 million in seed and Series A funding, and has gotten good press coverage.
They offered me 30,000 stock options. The problem is, they won't tell me the total number of outstanding or authorized shares. Without that information, I can't even begin to estimate whether the stock options could possibly ever be worth anything.
Is it unreasonable for the company not to tell me the number of outstanding shares? Does anyone else have any experience with this?
Thanks! <comment><USER2> _Is it unreasonable for the company not to tell me the number of outstanding shares?_

Yes. Your logic is absolutely correct -- they're refusing to tell you something which is essential to you being able to evaluate their offer. You (hopefully) wouldn't accept a job offer without being told what the salary / hourly wage is; you should treat this situation no differently.

<comment><AUTHOR> I told them I was going to take the night to think it over. I guess tomorrow I will ask again for the number of outstanding or authorized shares. I feel like if they continue to be sketchy about it, it might be an indicator of how they will act in the future.

<comment><USER2> There are two possibilities here, really: 1. They're trying to dupe you; 2. They don't realize that this is an essential number for you to know.

In my books, dishonesty and incompetence both mean exactly the same thing: Run away.

<comment><USER3> Depends a bit on who is doing the hiring - it may tend towards ignorance rather than incompetence. Ask for a conversation with the CFO or equiv.

<comment><USER4> Never attribute to malice that which can be adequately explained by stupidity. (Hanlon's Razor)

<comment><USER5> Sufficiently advanced incompetence is indistinguishable from malice.

<comment><USER6> ... and sufficiently clever malice is indistinguishable from incompetence.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> That's a bad sign. Did they specifically refuse to tell you? Did they offer any explanation?

It's important to be able trust the people you are working with.

At FriendFeed, we'll share just about any number with the people we've made offers to.

</comment><comment> daniel-cussen If they won't tell you what percentage you're getting, just ignore that part of the equation and base your estimate on everything else, like salary and health benefits.

Most companies issue about 10 million shares, or more, so 30,000 would come at about .3%. If they sold the company for 20 million dollars, you'd gross about $60,000 in options, and probably net around $10,000 after capital gains and stuff. Give or take an order of magnitude. Just a very rough back of the napkin.

<comment><USER8> 10 million was my initial thought as well.

</comment></comment><comment><USER9> _Is it unreasonable for the company not to tell me the number of outstanding shares?_

In California, I believe it is a legal requirement for a company offering stock options to disclose the number of outstanding shares.

A quick Googling found this web page <http://www.jonesday.com/pubs/pubs_detail.aspx?pubID=S4587> , which states: _The plan must specify the total number of securities that may be issued and the class of individuals eligible to receive options and purchase securities under the plan._

<comment><AUTHOR> Very interesting. I don't think I'll bring up the law, but it's nice to know!

</comment></comment><comment><USER10> I founded four companies, and have always made them 'transparent' to prospective employees. In fact, I show them a projected cap table that tells them what they can expect -- 2 more financings to liquidity, the opportunity to pick up an another ~30k options, $10/share exit = $600k and growing -- IF we all work hard and pull together. If they're not forthcoming with you at this point, they won't be down the line.

</comment><comment><AUTHOR> I went to the website for the California Department of Corporations (<http://22.214.171.124/caleasi/pub/exsearch.htm>) and found out that they issued 3,000,000 in shares after their seed funding ($1 million) last year. I can't find the latest filing because it was so recent.

Would it be reasonable to assume that the number of shares is now 6x that (6 x 3 million = 18 million) since they have around $6 million in funding now?

Of course, now that I know that the information is in the public records, I am going to run away if they tell me I can't have that information after I talk to them again today.

Thanks for all the helpful comments.

<comment><AUTHOR> A little more research on Delaware's Department of Corporations website (which is where they are incorporated) allowed me to find out the total number of authorized shares: 52,503,000

30,000 / 52,503,000 =~ 0.06%

With the package they're currently offering (a little below market and not very good benefits), I'm probably going to pass.

Thanks again everyone.

<comment><USER11> So, with a $30 Million exit, you'll probably get enough out of the deal for a nice latte at Starbucks. Or, if you do the math: 30000000*.0006=18000. Or, after the dollar devalues a bit more and the price of coffee goes up, about enough for a nice latte at Starbucks.

For my time and money, I'd look for a different gig that paid more. That is unless you really want the startup experience and the company is really cool.

<comment><AUTHOR> You must be really down on the dollar. But, yeah, I've figured that the options are basically worthless. However, I really like the product and I got them to up the salary significantly, so I said yes in the end.

</comment></comment></comment></comment><comment><USER12> Let them know that not knowing the total number of outstanding shares is like getting paid in a currency whose value is not pegged, and hence you can't gauge your total compensation correctly, and hence you can't take the offer.

Remember, interviews are a two way street, the company is looking for the right candidate, and you are looking for the right company. And, if a company can't be upfront with you at the beginning, that sort of tells you what you are in for once you start working there.

</comment><comment><USER13> I've heard a similar BS line before "Oh, here's 100,000 shares, but we can't tell you the total number of outstanding shares because _________" (fill in the blank excuse: it's confidential, Mr Rogers likes chocolate, I'm constipated, whatever).

If you don't know the total number of shares and the percentage stake of that you've been offered, and the price of your options, the number of shares is worthless.

I think in this situation, a startup will usually say this when they're trying to screw you, but that's just my opinion. Keep in mind they will likely fail and your 30k options will be nothing but a piece of paper.

My advice? Find another company to work for that is less shady.

<comment><AUTHOR> It turns out the hiring manager was under the impression it was confidential since no one had ever asked him before. He's an engineer, so I can forgive him for not knowing.

While the stock options aren't great, I was able to get them to up the salary by a lot, so I ended up accepting the job. If they didn't have such a good track record I probably would have run the other way. Either way, the comments on this board helped me negotiate a much better salary even if my options are mostly worthless.

<comment><USER13> well thats good then. you'll certainly learn a lot from this experience whether the company is boom or bust.

good luck!

</comment></comment></comment><comment><USER14> <http://blog.guykawasaki.com/2006/03/nine_questions_.html>

1\. How many outstanding shares of stock are there?

<comment><AUTHOR> Thanks for the link.

This stinks because otherwise I really like the company. I just don't want to deal with anyone who isn't completely upfront with me.

</comment></comment><comment><USER15> In Virginia, I've used the website for the Office of the Clerk to look up the number of shares in a particular private company. I assume that companies in all states have to register the total number of shares, and that this information is public if you know who to ask. For CA, you might try something like <http://kepler.sos.ca.gov/list.html> . That said, if they really won't tell you the total number outstanding, you might want to be concerned :)

</comment><comment><USER16> If they won't tell you the number of authorized shares, they're either inexperienced or dishonest. And if they've raised $6.1m, they're not inexperienced. So...

</comment><comment><USER17> Actually, not only do you want to know the number of outstanding shares, you also want to find out what kind of liquidation preferences exist for the VC's. Depending on the liquidation preferences you could end up making $0 even if the company sells for 2-3X their series A funding.

It is absolutely unreasonable for the company to not specify the number of outstanding shares.

</comment><comment><USER18> You can't evaluate the offer without the number of outstanding shares.

The last offer I received I was told that it wasn't their usual practice to tell. I talked to their HR director and she told me right away — in other words, you might have talked to the wrong person.

</comment><comment><USER19> That's _very_ fishy. They should give you all of the information in the plan because the details do matter when push comes to shove. I.e., you want to know not just the currently outstanding shares but all of the authorized shares as well. This is important in judging whether or not they've boxed themselves in w.r.t. funding and valuation. I've been seeing more startups lately getting themselves into needlessly tough positions by not raising enough money early and so their pattern is set at too low a range for future rounds unless everything goes hockey stick.

If they give you any BS about you not needing that information then you should run away (and tell everybody about them).

</comment><comment><USER20> I think the company should be honest with you about the outstanding stock options. I had a similar tale, but when I asked the management about the outstanding stock option, they did reveal the numbers. That kind of says a lot. I have worked for many startups, so based on my experience; you need to be careful dealing with the startup founders/management. Its no big deal, if they really want u, then they should address Ur concern. Don't fall into trap; let them be honest with the employees. Regardless of the idea or product, if the founders/management are crooks, mark my words, those startups don't make it.

</comment><comment><USER21> 30,000 is probably not much; after the lawyers got done arranging their financing, there are probably tens of millions of shares outstanding.

Just bear in mind, you can't really evaluate the deal even knowing the number of shares outstanding; the shares will be valued as a percentage of a multiple of forward revenue (unknowable) less liquidation preferences (which they won't tell you, but will be skimmed off the top of any liquidity event by the VCs), presuming no further dilution.

</comment><comment><USER22> You can find out the number of authorized shares from the Secretary of State of whatever state the company is incorporated in.

That won't tell you much (most companies never issue anywhere close to the number they have authorized), but it least it will narrow it down. If they have 1,000,000 authorized, 30,000 is pretty OK. But I'm guessing, given the money they've raised, that they have >10,000,000 authorized. In that case, 30,000 is probably nearly worthless at this point.

<comment><USER4> But if you initially got the 30k before they raised money, and now raise the 6 million, you probably get diluted to the same situation.

Or is this not the common scenario?

Also: do most people's options vest immediately and never expire or have conditions on them?

</comment></comment><comment><USER23> You really should consider your options. I could probably find you a job that pays a million dollars per month - Zimbabwe dollars, that is...

</comment><comment> ten-seven You're not an employee, and they're a private company. It's a catch-22 situation. They'd probably tell you if you were an employee and option holder. Such information might be held as company proprietary information, and as a non-employee, you're not entitled to know. I know how this sounds, but they apparently have a tight disclosure policy.

</comment><comment><USER24> Let us know how many outstanding shares there are, I'm curious what percentage they are offering. I'm trying to get a general sense what a company like that would give % wise.

<comment><USER25> There are pretty standard numbers for post series A equity compensation - these numbers are typically shared by VCs with their portfolio companies so they're not going to be too different from company to company.

For a mid level engineer that number is around .1 to .3% of shares outstanding.

</comment></comment><comment><USER26> No startup I've ever worked for has told me the number of outstanding shares. They generally gave me dirty looks whenever I asked. I figure it didn't matter...the 30,000 options were take it or leave it and I've never been in a position to haggle.

Thinking about it, it might be a matter of public record. Maybe you can look up their articles of incorporation filed with whatever state they are in.

btw, 30,0000 shares sounds pretty standard in line with what I've been offered at previous jobs.

</comment><comment><USER27> That sounds fishy.

</comment><comment><USER28> you haven't mentioned what salary ($) they have offered you or whether is it only stock options ... if salary is fair and good then dont bother about stock options - if salary is below par then RUN !!</comment>


An Amazon Order Might Lock You Out of Trusted Traveler Programs - <AUTHOR> https://lifehacker.com/your-amazon-order-might-lock-you-out-of-trusted-travele-1821964978 <comment><USER2> Its interesting how most of the commentary here is about Amazon, not about being denied status under a public program for "having a violation of customs laws on your record" when not only were you never convicted or found civilly liable for any such violation, and not only were you never actually even _charged_ with such a violation, but you also never had any notice or knowledge of a customs violation having occurred, and the actual violation was a hostile party attempting to defraud you.

Amazon is certainly at fault for the process which enable their platform to be used for fraud, but the core of this story is the government punishing people for offenses they not only didn't commit, but didn't know about _and_ of which they were the intended victim.

<comment><USER3> Exactly right. The constitution declares that due process is a right, and in my (IANAL) mind, this is a violation: "you can't travel because you bought an off-brand bag" (a trademark issue!). The reality is that the real harm to this individual is small, and the normal individual has an outsized cost to fight this injustice.

The unfortunate consequence: more erosion of rights at the margin. Not to be hyperbolic, but it really is just one more microstep along the slope toward fascism.

We laugh at them when online videos surface, but the people who are willing to inconvenience themselves in order to peacefully oppose these kinds of actions are everyday heroes.

<comment><USER4> > "you can't travel because you bought an off-brand bag"

Denial of Global Entry status is not a prohibition against air travel. It means you don't get expedited screening.

<comment><USER5> Making things excessively difficult/painful without technically banning them has been found unconstitutional plenty of times as well:

[https://www.nytimes.com/2016/06/28/us/supreme-court-texas- ab...](https://www.nytimes.com/2016/06/28/us/supreme-court-texas- abortion.html)

We may not be quite at that point with air travel yet, but each year the TSA finds new and innovative ways to slow down the process and increase all-around misery.

<comment><USER6> Ok, but that would apply to any traveller, not just ones that have been flagged.

<comment><USER7> Exactly, Personally I believe the "Trusted Traveler" program should be unconstitutional on is face, every citizen should be a "trust traveler" until such time the government as a clear and articulable reason to consider them a safety risk, at which point it should enter into some kind of Administrative or Court process where I person can defend themselves against set accusations

Treating everyone as a Terrorist, then "clearing" some people that choose to pay the government money, and go through their privacy invading process should be Unconstitutional and abhorrent to all free people

<comment><USER8> The typical screening does not treat everyone as a terrorist. After all, the US has a no-fly list. That list, of course, comes with its own host of issues, but let's be more precise.

Airport screening sucks and is theater. Global Entry is extortion. No doubt. But current screening measures are not unconstitutional.

<comment><USER9> >But current screening measures are not unconstitutional.

That really depends on what nine partisans in fancy robes think, a group whose makeup changes over time and who can change their minds.

I think what GP was getting at is that it seems so fundamentally unjust that it _should_ be unconstitutional (which is what anyone who is not a constitutional law scholar means when they say unconstitutional), not a claim about legal opinions of powerful judges.

<comment><USER10> There isn't much of an articulable case for these rules to be unconstitutional. It's not analogous to freedoms people have in their personal life.

They're using the Federal aviation system, public property airports, being routed by the FAA, and so on. It's much more analogous to requirements for auto safety and licensing.

The government can't mandate the color of your shirt in your own home, but they can mandate the exact shade of your turn signals when you're on public roads.

I'm not a fan of our current security state, it's insane. But air travel isn't a private act, it's important to calibrate the conversation to the issue actually at hand.

<comment><USER11> I'll jump in here. I believe the constitution does provide a right to travel both domestically and internationally.

When I choose flight as my mode of transport, and I choose to do business with a private company, (entering into a private contract with that company to convey my body from one location to another), I believe the government demanding that I be searched and inspected and scanned in order to allow the private company and I to conduct our private business of providing me with transportation is unconstitutional. The federal government does not have an affirmative grant of power over my right to travel, and two because I have the right to travel. All powers not granted to the federal government are reserved for the states or the people.

I feel like this fallacy that travel is a privilege comes from the whole "driving is a privilege" concept. But keep in mind, while driving is a privilege (under STATE law), riding isn't a privilege, it's a right. I may need the blessing of a STATE government to drive a car across state lines, but I don't need the blessing of state or federal government to ride as a passenger in a vehicle across state lines. In the case of the flight, I'm not engaged in a regulated activity of flying a plane, I'm merely a citizen exercising their right to travel.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Amazon has become an extremely unpleasant place to shop in the past two years. The proliferation of garbage sellers makes it hard to find anything.

It used to be that you could avoid most of them by just ignoring anything with less than 10 reviews, but with Amazon's latest change to factor in number of reviews for their "sort by average review" list has let the genie out of the bottle. Now you'll see literally THOUSANDS of 5-star reviews on their garbage, completely drowning out the real stuff :/

It's to the point now where I'll only purchase known brand-name items from the manufacturer, and hope to god it's not a scammer using their name, or some typosquatter, or their supply chain hasn't been polluted by counterfeits.

And it's only getting worse. Now I try to buy direct from individual websites like it's 1999.

<comment><USER13> I went into a Decathlon for the first time the other day, after long assuming Amazon would always be cheaper for outdoor+active wear...so wrong. Totally surprised at a high street store having a huge range of better quality merchandise, at lower prices, and no need to shop around amongst all the clones with very similar appearance, but varying quality. My faith in the bricks-and-mortar stores has been partially restored.

And for safety-critical purchases...no way am I risking buying something like angle grinder discs or fire extinguishers off Amazon. Fake headphones mean a bit of distortion, fake discs might mean a lost eye.

So now its just low-cost, low-risk purchases where I don't care too much if the item is junk.

On that note, where do people buy electronic hardware if not Amazon/PC World? E.g. for SD cards - Amazon carries the risk of counterfeits, and PC World carries the high street premium.

<comment><USER14> I still buy on Amazon, but only what they sell directly. Nothing 3rd party.

<comment><USER15> Isn't there still a danger of co-mingling fake stuff with what looks like a genuine item sold by Amazon?

<comment><USER16> If you inspect the account/brand listed as the seller, it is much harder to get fooled by a counterfeit. Amazon-brand items sold by Amazon are pretty hard to mistake, in my experience.

<comment><USER17> Co-mingling breaks that. What happens is even though you buy from seller 1, they will send you seller 2s item if its in a warehouse closer to you.

The only way to avoid this is to by things only sold by 1 seller.

</comment></comment></comment></comment></comment></comment><comment><USER18> I'm sorry but this is utter stupidity.

Punishing consumers for ordering a product for which the supplier/supply chain sent a counterfeit which was flagged by customs is just dumb.

Importing and selling counterfeit products is already illegal. If the person has a 20' shipping container full of counterfeit product, maybe investigate it and level penalties.

But to disqualify someone from an entry program because of one counterfeit product, when clearly no one from Amazon, CBP, or the manufacturer put in any effort whatsoever to investigate, is just wrong IMHO. The article states the manufacturer took the lazy route and punished the innocent customer because going after Amazon and someone in China would be more effort/expense.

Guilty until proven innocent. Ridiculous.

<comment><USER19> As far as I understand, in the USA it's not actually illegal to buy counterfeit goods, only to sell them.

<comment><USER20> If you purchase counterfeit goods via mail-order from an overseas seller then you're technically an importer, which is very much illegal.

<comment><USER21> No, you bought it from "Amazon".

Amazon is incorporated in the US.

Amazon's distribution centers reside in many states.

In Indiana, since they have a presence, they are legally obligated in collecting sales tax.

My bank statement shows "AMAZON", not 3rd party importer.

I find your claim of "technically an importer" to be completely bunkum. The importer here is Amazon, and full blame on import fraud should be levied against them. I have no issue in giving a grace period to get "shit in order", but they've known about this for quite some time. Enough's enough. (Claiming that I buy stuff from Amazon makes me an importer would __also __make me an importer buying crap from Walmart.... And yet we don 't see that, do we?)

<comment><USER22> > I find your claim of "technically an importer" to be completely bunkum

You may well find his claim to be bunkum, but he's correct. If you purchase something from a third party seller in a different country on Amazon's platform, and the seller ships it from their country to your country and it passes through customs, you are the importer.

Walmart imports goods from China and gets them through customs and then sells them, so you are not importing things when you buy them from Walmart, unless you purchase something from a foreign country from a third party seller on their marketplace platform, just like Amazon.

<comment><USER21> If:

The sale is made to Amazon, The product goes through Amazon's warehouses, and Taxes are paid to Amazon...It's an Amazon Sale and they are acting as the importer for these goods.

Now, Alibaba/Aliexpress on the other hand, I do agree wholeheartedly with you. Because you are ordering from a Chinese company, ordering Chinese goods with no regard to US copyright/patent/trademark law.

<comment><USER23> I've purchased stuff from Chinese sellers on Amazon, and it's been sent directly to me from China. Actually, I didn't even realize that the seller was Chinese, until I saw the three-week delivery estimate. And there was no indication that Amazon was involved after I ordered the stuff.

<comment><USER24> On the Amazon product page, you'll usually see a "Ships from and sold by" line for products not fulfilled by Amazon. If it's fulfilled by Amazon, the line is usually "Sold by [seller name] and Fulfilled By Amazon".

While not in huge text, it's pretty visible.

<comment><USER23> I get that. Maybe this was before "Ships from and sold by". So it just showed "Sold by". This was several years ago.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> If I understood correctly, this was actually Rimowa who flagged him? Ie not Amazon, not the US customs? Hell if I'd ever purchase anything from them again if I was affected by something like this; the news should really be "Beware when purchasing Rimowa products, you're exposing yourself to unnecessary risk".

<comment><USER26> I was also surprised, and then read again more carefully. The article says: "Rimowa likely had an opportunity to take some kind of action [...] they chose the easier target: Reed" which for me sounds like this conclusion is only speculation.

I bet it was rather CBP directly who flagged him.

<comment><USER27> It was almost certainly CBP who flagged him.

They have his address in a database for a trusted traveler program.

They were the ones who intercepted the shipment.

They checked the destination address on the shipment and cross-referenced it.

I'm not sure how Rimowa would be involved, frankly.

<comment><USER28> Typically, the company will get involved when they know who is importing or exporting the product and they will notify CBP so the shipment can be seized.

We don't know if they were involved, but it's possible Rimowa knew who the exporter was (from seeing the fakes online and ordering one themselves) and CBP then seized the package when it was imported. The article says, "Reed never received the suitcase" which indicates that the shipment could have been seized upon entry (because they were tipped off by Rimowa to look for packages from that exporter). Now they knew who the importer was (Reed) and they added his name to a database of illegal importers.

Since it was just one suitcase, it probably wasn't worthwhile going after him, but now his name was in the database (likely because they think it will help them catch more illegal imports). The tricky problem arises because there is likely no distinction in the database between one guy who didn't know he was ordering one counterfeit product for himself versus someone who imports container after container of counterfeits for resale. CBP enforces the law by seizing the product and it's up to the company to sue the importer. It's clearly a broken system with nasty ramifications for the people who got scammed.

</comment></comment></comment></comment><comment><USER29> >... making every trip you take during that time a frustrating experience.

Well, actually the "normal" experience that everyone but the ones that were granted the "privilege" have.

I mean, the decision (provided that the reason is actually the counterfeit suitcase) seems silly, but it is not like they took away his driving license or passport, or however limited his freedom.

I have no data, how many people are in the "Global Entry" thing?

And how many international travels per year would justify applying (and the background check and the in-person interview)?

[https://www.cbp.gov/travel/trusted-traveler- programs/global-...](https://www.cbp.gov/travel/trusted-traveler- programs/global-entry)

What is the actual difference in practice? Like half an hour to pass customs on average?

<comment><USER30> WARNING: ANECDOTE

From my experience entering the country from LAX and BOS, passing through security at many airports around the country, Global entry is extremely convenient if the airport is large and busy (LAX) but not that much more convenient if there isn't a large crowd. (BOS)

TSA-Precheck on the other hand is a godsend for almost any average-large city airport.

<comment><USER31> i was most scared to lose precheck tbh

</comment></comment></comment><comment><USER32> This is worrying.

So, some time ago, I was looking to buy lemongrass seeds. The lemongrass that is sold on either supermarkets or farmers markets usually has the leaves cut. And that's precisely the leaves my wife looks for, to make tea.

Okay fine, let's grow our own. We had little success growing from existing lemongrass, so why not try from seeds them.

Couldn't find seeds on Home Depot. Found a seller on, guess what, Amazon.

There was no indication that the seller wasn't in the US (but in retrospect, no indication he was) so I ordered without thinking much about it.

Fast forward a couple of months, I received the open packet (sans seeds) and a document indicating that import was not allowed. They also had lab test results attached, which indicated lemongrass seeds (by their scientific name) and some other seeds I can't remember mixed in.

Now, all of this was legal, it's just a customs rule violation(given the right paperwork, one should be able to import seeds, as I undestand it). Imagine what would have happened if the seller also had planted pot in the field, and got some of those mixed in...

<comment><USER33> >Imagine what would have happened if the seller also had planted pot in the field, and got some of those mixed in...

Your story would be completely unchanged. Customs would seize the package and you would receive a letter saying that they seized contraband and that would be the end of it.

People have packages of drugs seized at customs without any consequences. Unless it's a massive amount or it happens frequently, nothing would happen to you.

</comment></comment><comment><USER28> I sometimes buy things on amazon assuming it is coming from amazon directly and only later realize it was being drop shipped from overseas.

I used to think that wasn't a big deal since I really only check the estimated arrival date if I need something in a hurry. But, as of this article, it is a big deal no matter what because it changes who the importer is...

If something ships from Amazon then it was Amazon or a third party who imported the goods. If it ships directly to me from another country then I am the importer and I am on the hook for customs issues that I am not in control of (ex. is it OEM or is it counterfeit).

Amazon needs to make it very clear who and where each item is being imported from when it's not shipping from a warehouse in the same country as the delivery address. They have to stop pretending they are walmart or target in the cloud and that every purchase is a safe purchase.

</comment><comment><USER34> _> So what happened? It's impossible to say for sure (CBP doesn't release specifics)_

I wonder how they know it was the suitcase that's causing this when... CBP doesn't release specifics.

<comment><USER35> I re-read the article. It's unclear to me that CBP explicitly told him that he was being denied renewal because he had tried to import a counterfeit good. It may be the case but he doesn't come right out and say "they told me..." As opposed to him just assuming that this must have been the issue.

</comment></comment><comment><USER36> IMHO, amazon is guilty. Amazon has imported a counterfeit merchandise without checks on the seller. Putting the blame on the final client is unacceptable. We have a similar issue when banks are stolen and call it identity theft. The bank is guilty of not checking correctly the identity before giving money.

The client should never have to endure bad consequences because of bad behavior of Amazon or banks.

<comment><USER37> Amazon didn't handle any of the merchandise. It's Amazon Marketplace so it works like ebay, they just host the listing and process payments while the seller does all the shipment and the buyer is the one actually importing the counterfeit goods (this is what is illegal in the US). I don't think Amazon is the one at fault for the crime necessarily but they should be proactive in taking down counterfeit listings to prevent this. I've bought things on ebay before for what seemed like a fair price and it turned out to be counterfeit. I don't blame ebay for that but I wouldn't be happy if the same post was still up after I reported it for counterfeiting.

<comment><USER2> > I don't think Amazon is the one at fault for the crime

Responsibility for a wrongdoing is not always restricted to one party; in this case there is one party active trying to commit a fraud involving counterfeit goods, and one profiting from a system which is structured so as to enable that fraud and make it difficult for the target to detect or avoid (which may initially have been innocent, but has been maintained that way long after the operator had information on which they reasonably should have known that was a recurring and significant issue.)

<comment><USER38> So you are saying any marketplace (e.g. Ebay) is actually responsible for a merchant using them to facilitate fraud? Why stop there? Let's find the merchant processor complicit and the shipping company and the ISPs. Heck, I'm sure we could extend the net further if we wanted. Point being, unless the marketplace is actively courting merchants they _know_ are perpetuating fraud, then how are they at fault? If they get a report of a seller that is selling counterfeit goods, they take them down. What more do you expect of them?

<comment><USER2> > So you are saying any marketplace (e.g. Ebay) is actually responsible for a > merchant using them to facilitate fraud?

No, I'm saying a marketplace that knows, or reasonably should know of an ongoing pattern of fraud enabled and protected by features of its marketplace that does not take reasonable steps to mitigate that fraud but instead chooses to continue to allow and profit from it bears responsibility for it.

</comment></comment></comment></comment></comment><comment><USER39> > so it's more important than ever for you to pay close attention to the items > you're buying—especially if they're being shipped to you from overseas. > Watch out for massive discounts, learn how to spot fake reviews, double > check who you're buying from, and don't hesitate to reach out to Amazon > customer service if something seems amiss.

So it's _my_ responsibility now to go into the minute details of these things? Why isn't CBP doing its job? Shouldn't _they_ be looking carefully before denying TT status? Shouldn't _they_ be paying attention to what _they_ are doing?

I feel like more and more these government agencies just shrug and do the most expedient thing possible, even if it means screwing others over.

</comment><comment><USER40> Also, remember to never search for pressure cookers and backpacks led if you want to save yourself some troubles and prevent being listed on the watchlist another time (you're already there, yes you, you Linux user!)

[https://www.theguardian.com/world/2013/aug/01/new-york- polic...](https://www.theguardian.com/world/2013/aug/01/new-york-police- terrorism-pressure-cooker)

<comment><USER41> Was 2013 before all Google searches were secure? Unless your workspace is doing MITM they wouldn't see the search now. Though, obviously you'd have to trust that Google wouldn't dob you in either.

<comment><USER42> I thought it's standard practice to MITM at the workplace. How else can you flag exfiltration of sensitive information and stop incoming malware? Add a certificate to browsers on employee's computers, encrypt on proxy after inspection.

<comment><USER43> This still breaks TLS, since it will fail with client-supplied certificates and so can't be used if you need to support TLS.

<comment><USER44> Computers owned by the firm have extra CAs installed. All browsers allow admins to add CAs. Unsophisticated users will never know that e.g. BlueCoat shitboxes (and everyone who has pwned those shitboxes) are reading all their TLS traffic.

<comment><USER43> But the web servers on the other side of the TLS connection are not managed by those same system administrators and therefore they will not accept certificates provided by such proxies, breaking TLS.

<comment><USER44> To the external server, the shitbox is the user. To the user, the shitbox is the external server. Talk to IT/Networking people at any large firm; this is how it has worked for years.

Client certs are a different thing entirely, and unrelated to this discussion.

<comment><USER43> How are client certificates, a mandatory feature of TLS and specifically what I mentioned, and what you are replying to, unrelated to this discussion ?

<comment><USER44> What is this "mandatory feature" stuff? We're talking [0] about employees on websites "protected" by TLS, and expecting privacy while doing so. If they order hemorrhoid cream on Amazon, their browser talks to the shitbox, the shitbox talks to Amazon, and client certs have nothing to do with that. The browser verifies that it trusts the shitbox, and nobody else verifies anything.

One supposes there might be some banks or B2B sites that might use client certs, but they're such a minority that no one ever heard of them.

[0] [https://news.ycombinator.com/item?id=16186735](https://news.ycombinator.com/item?id=16186735)

<comment><USER43> Client certificates are a mandatory feature of TLS that any TLS server could request and the proxy would be unable to handle the request, as it (and ideally the client) has no access to the private key. Therefore, these types of proxies break TLS by being unable to support mandatory features.

Separate from that, client certificates are certainly common, being used for authentication, in the US Federal Government, which issues tens of millions of certificates for this purpose as well as smartcards, since George W. Bush banned passwords with HSPD-12.

<comment><USER44> The shitboxes _definitely_ "break" TLS. That's why firms buy them in the first place. A firm that was using smartcards with the characteristics you describe would presumably figure out something other way to pretend to prevent data exfil.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> Amazon allowed an influx of shoddy Indian/Chinese sellers that sell counterfeits like crazy, and then started treating honest 3rd parties as guilty-by-default, and being very nazi about it - you talk to ML bot all the time, they won't tell you what the problem is, you just have to figure it out on your own what got you banned for no reason. Now they are increasing Prime for fun...

</comment><comment><USER46> Making "legitimate" purchases on Amazon gets more difficult every day. The obvious solution is to buy directly from brands, but I keep using Amazon because it's less risky than spreading personal and credit card details across many sites. There's also Amazon prime... Hopefully better e-commerce solutions can eventually take over this trust, and more brands choose to sell direct. This would really help with the growing counterfeit problem.

One-time-use credit card numbers also help. I used this feature all the time when Discover offered it, but unfortunately they stopped. Now companies like privacy.com now offer it as a service, but adoption is probably slowed down by needing to trade-off rewards for privacy.

It's yet another reason why I hope cryptocurrencies succeed. In the future I want to pay for anything without the seller having access to my personal information. Even if you trust the merchant, it's too tempting for thieves.

Maybe someday someone will also solve the issue around shipping details. Like a DNS for shipping addresses. That would be awesome.

</comment><comment><USER47> I'm shocked there's 59 comments on this and almost nobody is saying the obvious, "what proof of any kind exists that this is the reason he was denied?". This is pure speculation and I'm predicting it's totally wrong.

<comment><USER31> FWIW the officer told me in the interview.

<comment><USER47> It must have been a market place order then because otherwise you wouldn't be listed on the customs form. That changes the story portrayed in the article and should've been noted (not your fault there of course unless you didn't mention it to the person writing it). The article still has a ton of conjecture otherwise (for example, that the baggage company had any involvement in your outcome) that is suspect at best.

</comment></comment></comment><comment><USER48> Surely this only applies to amazon market place? Any sold or fullfilled by amazon would have already cleared customs by the time your name appear on the package? Not that it protects against being sold counterfeit goods but at least you are not involved on the step where it crosses the border.

</comment><comment><USER49> Not germane to the matter at hand, but an interesting side-note is that Harper Reed was also CTO for Barack Obama's 2012 re-election campaign.

<comment><USER31> probably not related. probably. ;)

</comment></comment><comment><USER50> I've been offered free access to the 'Global Entry' program as part of my job, but I've been wary because don't want the side-effects of the "rigorous background check".

As a green-card holder I'm already pretty wary of them being able to search my devices or deny me entry, and I'd rather that the CBP hadn't enriched all my identifiers and got a fat-little-file on me beforehand.

Given an interest in debating politics online, I wouldn't be surprised if GE membership would increase the chances that I get stopped regularly.

Does anyone on HN have any knowledge or experiences about what kind of thing goes into the GE "rigorous background check"?

</comment><comment><USER51> We need to start sanctioning the people who come up with this stuff. Lock the people associated with the CBP out of flying on any US airline, or purchasing anything from an online merchant.

</comment><comment><USER52> Wouldn't this apply to Walmart, eBay or any 3rd-party marketplace?

<comment><USER53> Does Walmart allow 3rd party sellers?

<comment><USER54> Far more difficult to get into. It takes months to review applications, and they reject a lot of them.

<comment><USER55> Wish Amazon did this.

</comment></comment></comment></comment><comment><USER23> It's funny to see an inline Amazon Prime ad in an article that sheds such poor light on Amazon.

It's also troubling to see inline ads at all, but hey.

</comment><comment><USER56> This only reveals further the complete joke that is the TSA. Protecting us from small-time importers of counterfeit goods? Oh my!

</comment><comment><USER57> C-c-c-c-class action anyone?

This seems ripe for a class action lawsuit against either amazon or the USCBP (are you even able to sue them). Obviously suing each brand wouldn't work because there just wouldn't be enough litigants for a class action, but maybe we can hold amazon responsible for this and make them change somethings?

<comment><USER58> Of course you can sue CBP. [https://holdcbpaccountable.org/category/all- cases/](https://holdcbpaccountable.org/category/all-cases/)

</comment></comment><comment><USER59> > When in doubt, buy luxury and big brand name items directly from their > stores and websites.

Be scared, and prostitute yourself.

</comment><comment><USER60> Wow the government being inefficient and dumb, color me surprised. Sadly this is the world we live in though. I wish we could trust government agencies to be more competent but so far my experience has been really subpar.

</comment><comment> Paul-ish I wonder if you could order counterfeit goods in someone else's name (eg celebrity or politician) and get them disqualified from the trusted traveler program. It's not hard to get a CC with an arbitrary name.

</comment><comment><USER61> Alternatives to trusted traveler -- no-longer trusted travelers (no Global Entry) can now use Automated Passport Control, an App for your smart phone, which at Dulles last week, was faster than Global Entry.

<comment><USER62> I'm not sure if this is the same as "Mobile Passport", but Mobile Passport allows you to complete the kiosk information on your phone and in most airports (IAD/BWI tested) if you tell the usher (non-CBP employee with the airport) that you're doing Mobile Passport, they let you skip to the immigration counter bypassing several long lines.

<comment><USER61> They seem to be functionally the same, though CBP has different web pages for the two programs.

</comment></comment></comment><comment> zupa-hu Essentially, this brain-hack is motivating people to prefer buying from original manufacturers and big brands over cheap foreign imports.

Whether it's artificially designed or not is a different question.

</comment><comment><USER63> Did they simply take the name/address from the label or did they actually go to Amazon for billing information? You could just have all your packages shipped under a different name.

</comment><comment><USER64> Hm... So does that mean you have a good shot at barring someone else from using trusted traveler programs by just ordering some counterfeit goods for them?

</comment><comment><USER65> And yet people think that we need to use the same types of list for firearm ownership & purchases. That's frightening to me still.

</comment><comment><USER66> If the conterfit goods thing was really their excuse, they should just eliminate anyone that has travelled to China and bought anything.

</comment><comment><USER67> Oh god, I wonder if that's what's going on with a hard-to-find audio CD that I tried to order a while back...

</comment><comment><USER68> I love Global Entry, but the mysterious and varied ways you can be denied for the mildest of issues is really frustrating.

</comment><comment><USER69> Imagine what the MPAA will do if they find this as another means of disincenting piracy.

</comment><comment><USER70> I am astonished that the OP comes to his conclusion. Since when is it a good idea to:

\- skip due process

\- punish people on unverified accusations

<comment><USER71> He never says he _likes_ the way the system works, but realistically as an individual you can't change Amazon and you can't change Customs.

<comment><USER10> You could change Amazon. It seems to me that this person has an articulable case against Amazon for damages, and filing suit would certainly be a way to get higher level attention. Though if I were him I wouldn't do it either do the hassle.

</comment></comment></comment><comment><USER72> $700 for a suitcase. Good grief. Surely far more likely to draw the attention of an unscrupulous baggage person.

<comment><USER15> If you do a serious amount of travel each year there's no substitute for a good quality piece of luggage. I know this from personal experience from years back where cheap stuff just falls apart.

<comment><USER25> You can get a Samsonite piece of luggage for less than half that amount, though. And it's decent quality - definitely not the kind of cheap stuff that falls apart.

<comment><USER15> Sure, but some people are happy to pay extra, maybe it's the brand, or the style, or that one unique feature not available from another less expensive brand.

If you're on the move a lot then you and your luggage become engaged in a deeply personal relationship :)</comment></comment></comment></comment>


Google Censorship of Health Information - <AUTHOR> https://www.brighteon.com/d5f1c412-7bc9-4904-919c-5061eff324a9?mc_cid=e675310e80&mc_eid=9851493571 <comment><AUTHOR> This caught my eye because over the past few months I have felt finding information on Google has been more difficult. Don't know if recent algorithm change is the cause, but I am returned more useless results than I was previously. Frustrating.</comment>


Netflix Is Raising Prices. Here's Why - <AUTHOR> https://www.nytimes.com/2019/01/15/business/media/netflix-price-increase.html <comment><USER2> I don't see how this balkanization of content - Netflix only has Netflix, Disney has Disney, NBC has NBC, etc. - is going to do anything but hurt both companies and consumers.

Suppose that right now I can watch 70-80% of the TV shows I'd like to see by using only Netflix and Amazon Prime (the only two services I actually subscribe to). If that's reduced by moves like this to 20-30%, then the price I need to pay (even disregarding individual services raising their prices) to see the same amount of content is going to shoot up.

Even if all these new streaming services are priced decently, uses will soon have to pay for two or three times as many of them to get the same content. That just seems like a great way to encourage us to stop paying at all, and to go back to either not watching as much, or (for some users, I'm sure) obtaining them illegally. One of the big issues in defeating piracy was that it was sometimes more convenient than obtaining the content legally; this change may resurrect that issue. (I'm not saying it's OK to pirate, but there are a lot of people who don't have a problem doing so; it seems reasonable consequence to infer here.)

<comment><USER3> You are forgetting 1 aspect. Advertisement. I gladly pay extra to not watch commercials.

I agree with most of your statement. Netflix a few years ago was the only service I needed. They had tons of content from multiple providers. Today it's very few shows outside of their own content. I'm about to cancel honestly, I don't want Netflix's 90% crap content. Amazon Prime is probably the worst of the services from a content perspective even though they are the richest company. Please do yourself a favor and swap to Hulu from Amazon, at least with it you can get some of the latest TV Shows and cartoons.

Per your pirate commentary: The problem I am having is finding a service that has the show or shows I want. Some of the content owners make it impossible to stream the content anywhere, even if you want to pay money! Thus, forcing us to have to go out of our way to find the products, probably illegally.

<comment><USER2> > You are forgetting 1 aspect. Advertisement. I gladly pay extra to not watch > commercials.

Yes, it's good to point that out. I think people _are_ willing to pay more to have no ads, and have on-demand access to content.

I would throw in another thing I could have thrown in originally as well, which I didn't really think of - the TV equivalent of "killer apps." The reason I stick with Amazon is because they picked up a couple of shows I really, really love - The Man in the High Castle and The Expanse. I don't want to lose access to those.

Similarly, I briefly subscribed to CBS All Access while the new Star Trek: Discovery season aired last year - and when Season 2 comes out, I'll likely do so again. I love Star Trek so much that I'm willing to pay the $7 per (call it $3 per episode) month just for that... but as soon as it stops coming out, I cancel.

<comment><USER4> Unfortunately, Amazon Prime now has ads. Not as much as cable TV, but still very annoying now that I am used to no ads.

I watched the Illusionist last night on Prime video, and not only was there a minute of unskippable ads at the start, but there were 30 seconds of ads in the middle of the movie as well.

<comment><USER5> I may have an extreme position on the subject, but to me unskippable advertising is violence plain and simple.

</comment></comment></comment></comment></comment><comment><USER6> I think it is very interesting to see all of this come down and the criticism it receives. Back in the day, it felt like many people (I have no hard numbers here nor would it be easy to find them) wanted their cable provider to offer channels a la carte. They wanted to select and choose what they watch and only pay for the things they need. Now these big services (Netflix, HBO, Disney...) which helped bring the downfall of cable are doing what everybody originally wanted by breaking up into a multitude of services for you to pick and choose what you want. People are once again upset but now for them having to subscribe to so many different services. I think it mostly has to do with price, but I still imagine paying less for a handful of services than the cable packages we were all forced into.

</comment><comment><USER7> Somewhat off-topic: If Netflix continues to resurrect and pick up shows from other providers that I like, then I don't mind paying an extra couple bucks per month.

Recently they picked up Lucifer [1] after Fox canceled it and millions of fans lit up twitter. I am looking forward to this, as Netflix typically allows darker and more adult friendly versions of a show.

[1] - [https://www.imdb.com/title/tt4052886/?ref_=fn_al_tt_1](https://www.imdb.com/title/tt4052886/?ref_=fn_al_tt_1)

</comment><comment><USER8> > is working on an ad-supported model streaming service that it plans to make > available in early 2020.

and hopefully fails by 2021.

I see an ad, I pirate instead. That simple.

<comment><USER9> _I see an ad, I pirate instead. That simple._

I recently wanted to view a few back episodes of some random TV show, to see if I would be interested in it. I found the back episodes on Hulu. After about 5 minutes of the first, the screen went to commercial and said something like "1 of 8".

No, I'm not going to sit thru 8 commercials in a row. So I just exited and totally forgot about that show.

I.e. it's not just pirating as an alternative. Many people simply say "fuck it, I have other things I can be doing".

</comment></comment><comment><USER10> I barely watch anything any more on Netflix streaming. When I do try something new -- especially one of their "Netflix originals" \-- I increasingly feel I am being fed the same set of tropes. (E.g. There's only so much dystopia I can take. Especially when it recycles the same plot and dialog points.)

This price bump may be it, for me. I'm too inclined to just keep on keeping on. I don't do "resolutions", but this year, one intention is to stop that.

Besides, I increasingly feel like I'm funding, with my subscriptions, the very people -- and their lawyers -- who keep making things worse and worse.

(Reading the recent reporting that Netflix software engineers average 300K a year hasn't really helped my attitude, either. So, THAT's what I'm paying for... (?) )

<comment><USER9> _(Reading the recent reporting that Netflix software engineers average 300K a year hasn 't really helped my attitude, either. So, THAT's what I'm paying for... (?) ) _

Business media has been saying that Netflix's content acquisition costs are or shortly will be in the neighborhood of $10 billion per year. You're paying a lot more for the content than for the software engineers.

</comment></comment><comment><USER11> " Netflix's most popular plan, which gives a customer two simultaneous streams, will get the largest increase, to $13 a month from $11. Still, it's cheaper than HBO, whose streaming service costs about $15 a month. The $8 a month plan will now cost $9, and the high-end version, which allows for four simultaneous streams, jumps to $16 from $14. (The new prices took effect Tuesday for new subscribers. For existing customers, the increases will start in about three months.) "

</comment><comment><USER12> Have licensing agreements changed at all in the past 10-15 years?

It seems like shifting to a model of [Base License Fee] + X Revenue/Hours Streamed would improve the situation and allow IP holders to commodify streaming services.

You would still have exceptional cases like HBO and Disney where it would be worth the effort to run their own streaming service to capture all the revenue, but I don't see the average consumer willing to subscribe to an endless number of streaming services (maybe 2-3 tops for an average US consumer).</comment>


Ask HN: A mass cardio exercise plan to reduce load on ventilators for Covid-19? - <AUTHOR> Those with poor pulmonary function are at greatest risk for serious covid-19 complications.
For most of us, who are healthy, we should be doing what we can to remove ourselves from the possible pool of people that might need ventilators. It seems likely we're all going get covid-19 at some point.
My question: would a large-scale cardio exercise plan reduce the load on the healthcare system and limited ventilators?
Given those that have serious complications, it seems like improving overall cardio fitness would help. I can't find good evidence on the question of cardio exercise preventing covid-19, or SARS like illnesses. <comment><USER2> Most people dying of COVID-19 die from pneumonia. Pneumonia risk can be reduced through exercise.

Try a Google search like:

 _exercise and pneumonia prevention "doi" after:2016-01-01_</comment>


The Echo Nest Joins Spotify - <AUTHOR> http://blog.echonest.com/post/78749300941/the-echo-nest-joins-spotify

<comment><USER2> I'm a little conflicted about this. The Echo Nest is _amazing_ and does the kinds of things with music analysis that I can only dream of doing, so I wish them every success in the world.

 _But_ up until now they've been a fantastic independent force, not attaching themselves to any single music provider. You could use their APIs with Rdio, GrooveShark, whatever you felt like. I'm concerned that will no longer be the case.

<comment><USER3> It's a venture funded business. There are only three outcomes: sell, go public or crash. What were you expecting?

They also said their API will stay up:

[http://blog.echonest.com/post/78749300941/the-echo-nest- join...](http://blog.echonest.com/post/78749300941/the-echo-nest-joins- spotify)

<comment><USER2> ...sell to someone that isn't Spotify?

<comment><USER4> Any company that has both the economic ability and incentive to acquire The Echo Nest would have the same potential to be one-sided in their acquisition as Spotify.

</comment></comment></comment></comment><comment><USER5> absolutely nothing on the future of the public api.

<comment><USER6> "The Echo Nest API will remain free and open to support its robust developer ecosystem."

[http://the.echonest.com/pressreleases/spotify-acquires- echo-...](http://the.echonest.com/pressreleases/spotify-acquires-echo-nest/)

<comment><USER7> Which means at least a year. Maybe two. Then there will be... changes. Little ones at first. Happens every time.</comment></comment></comment>