Paypal's fraud prevention routine does it again - <AUTHOR> http://scottishrubyconference.com/posts/149 Once again Paypal suspends an account for suspicious activity and asks for clarification.  Except this time it's a repeat of the same "suspicious" activity that has happened for the past four years, asking for the same documentation that has been sent through previously. <comment><USER2> I love the fact that people with no authority and no respect for privacy whatsoever arbitrarily just ask for bank statements from their customers. I have had estate agents ask for 6 months of bank statements for no apparent reason and when I declined they got furious with my insubordination. This was on top of a written / signed letter from my direct boss with regards to my salary and job status.

My bank statements = none of your business

<comment><USER3> Just to clarify, they don't want to see your bank statement, they want to see the covering sheet that verifies who you are and the address you're at. I had to provide my "bank statement" to Paypal a year or so ago and all I provided was the sheet that states my account # (they have this already) my address (they have this too) and then my banks information (sort code etc) which I don't think is private?

Your bank statement = covering sheet that proves the account is associated with you and your address, not x months of payments made and taken.

<comment><USER4> Maybe so, but since they didn't in any conceivable reading of the phrase "bank statement" make that clear, I think ffffruit's point stands.

</comment></comment></comment><comment><USER5> I have no sympathy for Paypal -- every time I've dealt with them it's been like talking to a robot -- but in all fairness they do something that's really hard. Can you imagine the number of people who are either trying to rip Paypal off or are using Paypal to rip other people off? I'm left thinking the only reason Paypal works is because the founders were too stupid to realize what they were getting into. (Although if you've never read it, they have a great startup story)

The thing that's especially onerous here is the fact that they keep screwing with the same customer the same way _over and over again_. I agree with the author of the post -- that's just too much crap for too little return.

<comment><USER6> Yes, just look at Western Union for a service that has a long history whose reputation has been practically destroyed by scammers.

<comment><USER7> I used WU's online service for a while. Then for no apparent reason it locked me out, and I've been able to figure out who to kick to get back in.

Possibly ironically, this has resulted in me falling back to my backup payment sending approach - paypal.

</comment></comment></comment><comment><USER8> This has just happened to me with my new business that saw exponential growth from the previous month. They asked me for all information within 2 days, from Friday, so basically they wanted me to work over my weekend.

Which I sent to them, and then they say that they'll follow up and it's been like 4 days. What pisses me off, is that they don't return the same courtesy / haste that they expect from us.

<comment><USER9> I have found the only real solution to this is to make merry hell for a couple of days until it becomes easier for them to fix it than leave it.

I got down to half hourly emails to the customer services manager "in charge of my case", but was ultimately worth it.

<comment><USER8> I'll give them one more day ;)

<comment><USER8> Got a reply just then. They told me, and I quote:

"Stella is out of office recent days for holiday. She will follow up the investigation of your account when she comes back."

<comment><USER8> ^ Can't reply to your post, but I'll just do it here.

Of course, I told them that asking prompt replies, especially on non business days (with the threat of limitation) was unacceptable if the same courtesy was not going to be returned, and asked someone else take over.

<comment><USER10> > ^ Can't reply to your post, but I'll just do it here.

To prevent too much back and forth, the 'reply' button disappears, but if you click on 'link' to go to the page directly, you should still be able to reply anyway.

</comment></comment></comment></comment></comment></comment><comment><USER11> Four years and having the account frozen every time? Those organisers must either be very patient or desperate to use paypal. Why wouldn't other payment processors work; like Moneybookers, Wepay, or bank transfers, etc?

<comment><USER12> The short version? Accepting payments internationally is _effing hard_ and _effing expensive_ and the risk of fraud and other illegal activities is _astronomical_. Paypal does it _head and tails better_ than any other organization.

<comment><AUTHOR> I do agree. But I feel this complaint is different to the "I started making money and Paypal suspended my account" complaints that are normally posted.

It's the repeat nature - asking for the same documentation over and over again - that's so annoying here.

<comment><USER3> It's not _really_ repeat nature. It's the same account, but it's for a short period of time each year which would seem suspicious to me, when they claim it's a conference they say the following:

"4/ Our bank statements are none of your business. 5/ The details of our venue agreement and insurance are also none of your business."

So they're refusing to _prove_ it's a conference but requesting that Paypal are "reasonable"? Having your account verified once and then go dormant in payment receipt for the majority of the year then start again would seem suspicious to me... especially when their justification isn't something they're willing to prove.

<comment><AUTHOR> Well I can't speak for the organisers, I'm just someone who attends.

But they have proved that they are a conference for the same dates for the previous three years.

And the implication is that Paypal are asking for more documentation than previous years ("the documentation you are asking for _this year_...").

</comment></comment></comment></comment></comment><comment><USER13> Every time I read an article like this, I wonder again: Why is no one competing with PayPal? People talk about sites like Google Checkout or WePay, but they are not viable alternatives, either because of different fee structures, international availability or other issues. Is PayPal doing something _so hard_ that none of the incredibly talented and intelligent people in the startup world feel capable of challenging them? I feel like anyone who can replicate the right subset of their features (to start with) and guarantee good customer service would _instantly_ have tens of thousands of jilted PayPal customers signing up. "PayGuys: We're Not PayPal". From zero to hero. Am I crazy?

<comment><USER14> Why is no one competing with PayPal? Because these stories are the exception, not the rule. PayPal has posed absolutely no problems to our business since we adopted it early last year. I feel like a total idiot for drinking teh internet kool-aid and boycotting them for so long.

<comment><USER15> I do 6 figures a year through PayPal, and my account is now over 10 years old. It's never once been locked/frozen/restricted.

<comment><USER16> Mine has been locked for nearly 10years

I signed up when it was only available in the US now it's avialable in Scotland I tried to register for the UK version. You can't register for the UK cos you have a US account, you can't use the US account with a UK credit card. I asked them to delete the US account and it's now stuck in some sort of Limbo where I can't open a UK account cos I have the US one, and I can't log into the US one because it's been deleted. Once a year I spend a few days emailing them to try and sort it out.

</comment></comment></comment></comment><comment><USER17> And here I am about to launch a service on Thursday with PayPal as my payment processor. I didn't really want to, but for my customers it's basically a requirement.

I'm expecting to take about £2k in the first few days, so I'm almost certain the account will be limited; I've preemptively supplied most of the info listed in this article to try to mitigate that.

I'll be sure to update HN on what happens.

<comment><USER18> Note that when your account gets limited, your customers get an email which basically says that you are suspicious, and you can't accept any new payment until you get it fixed. I highly recommend that you DON'T launch with paypal unless you have all the documentation sorted out. And no, I don't know what you should do exactly.

<comment><USER19> >"DON'T launch with paypal unless you have all the documentation sorted out"

That is the problem. It appears to be impossible to know in advance whether your documentation is sorted out.

Even if PayPal had a 'how to not get locked out and look like a shady operator' HOWTO somewhere on their site the situation would be more acceptable but right now it seems people have to live their life with the (vain?) hope that their capricious payment-processing overlord will continue to smile upon them.

</comment></comment></comment><comment><USER20> But when I click to register for this conference, they're using Paypal as their sole processor.

So what's the point? Complain all you want, you're still using Paypal THIS YEAR, after being screwed over 4 years in a row. When push came to shove, you picked.... Paypal.... to process your payments. So by your own actions, you've shown you think Paypal is the best processor available.

<comment><USER21> They're using <http://www.stagehq.com/> this year for managing tickets. Currently the only payment gateway they support is Paypal.

</comment></comment><comment><USER22> It would be great for a bunch of small companies and 501c3s who have been affected by this to file a complaint with the FTC and state Attorneys General. At the very least, it could get some higher-profile media attention to this long-standing pattern of abuse. And with luck, somebody will decide to investigate ...

</comment><comment><USER23> I had someone sign up for a subscription, 1 payment each week for 6 weeks. After the 3rd it stopped charging the client. It was just frozen, saying the next payment was due to be taken out of their account on a date that past 6 days ago.

So contacted support and their reply was, well how do we know they actually subscribed.

Well I don't know, maybe they could have looked at their records and seen the IP address and paypal account associated with the subscription with their attached bank accounts and credit cards.

Paypal is great when it works but when something goes wrong it really goes wrong and support just doesn't help.

Anyway, I use a proper merchant now for CC payments. I will most likely implement PayPal once again but just as an option and right at the bottom of the list.

</comment><comment><USER24> That leading quote is great:

Sufficiently advanced incompetence is indistinguishable from malice.

\-- Clark's law

</comment><comment><USER25> Not to white knight Paypal, but selling tickets is a highly fraud risky payment event (opposed to just selling stuff). It has a high number of chargebacks due to possible event cancellation, people not showing up, or people just not liking the event. You would most likely be required to send this paperwork for each event to most any credit processor.

Typically I've found that with Paypal there's no immediate cost of entry (just start accepting payments) but paperwork is required over a certain threashold. But try to use any regular credit processor, they'll require your paperwork done in advance, and since you're doing an event with tickets, it might take a few applications until you find one with decent rates who will accept your risk.

</comment><comment><USER26> So when's the next PayPal going to take over? This is a company that had a great idea a long time ago and a whole bunch of terrible ones since. It needs to go away now, and we need a company that does what they do better.

</comment><comment><USER27> Paypal is horrible (We had this happen so many times...) and there are many cases where they simply _stole_ money without giving reasons or ability to dispute without going to court against a giant, but it's just not possible to go for a competitor, because that would cost you too much sales from clients who don't have/want to use a competitor. And a lot of Europeans at least don't want to use their CC online.

We tried AlertPay which works fine, but the fees are too high, still, they seem a good alternative if you want something that just works for now.

</comment><comment><USER28> So, does someone have a solution for setting up a US merchant account from a foreign country for the best choice of merchant fees and service providers to bill through?

I hate all these "don't use PayPal" comments but even for first-world countries like Australia, setting up a merchant facility that can accept foreign currencies is really, really hard and very expensive.

</comment><comment><USER29> They should really use <http://WePay.com>.

<comment><USER12> Somebody has to mention it so I might as well: WePay is not available in Scotland.

<https://www.wepay.com/about/faq#thirteen>

<comment><USER29> _Touché_

</comment></comment></comment><comment><USER30> _This is the fourth year that we have run this conference, and every year PayPal have restricted our account._

"I keep hitting myself with this hammer, but it keeps hurting! What am I doing wrong!?"

</comment><comment><USER31> Forget Paypal! I'd be MORE inclined to support an organization/product if I saw that they'd opted out of using their service.

At least until they change their policies. They seem so arbitrary sometimes.

<comment><USER8> That's not feasible in most situations.

<comment><USER31> Maybe not, but it would be nice to see.

</comment></comment></comment><comment><USER32> For me, Paypal is simply a no go. If Paypal is the only way to pay, then there is no way to pay. (But there are still bank accounts and credit cards).

</comment><comment><USER33> These fuckers do this to us every year as well. Seasonal business also. They seriously asked us to fax them our URL. Assholes.

</comment><comment><USER34> Here's waiting anxiously for Bitcoin to put these guys out of business.

</comment><comment><USER35> Trick me once, shame on you. Trick me twice, shame on me.</comment>


How Big Tech uses GitHub - <AUTHOR> https://jmduke.com/blog/2013/11/23/how-big-tech-uses-github

<comment><USER2> I'm not sure if you're aware; Chrome gives a security warning when going to the site.

You attempted to reach jmduke.com, but instead you actually reached a server identifying itself as *.squarespace.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of jmduke.com.

<comment><USER3> that should only be if you're using a plugin/extension like https everywhere? but yeah

</comment></comment><comment><USER4> Please fix the SSL cert problem; I want to visit the site!

<comment><AUTHOR> Oof, that's embarrassing for me -- thanks for pointing this out.

</comment></comment><comment><USER5> Silly me, I thought "Big Tech" was a single company name due to being capitalized. Guess I won't learn about a new GH usage today...</comment>


Why This Recession Seems Worse Than '70s and '80s - <AUTHOR> http://finance.yahoo.com/news/Why-This-Recession-Seems-cnbc-14354968.html

<comment><USER2> This is wrong. This current recession is the worst economic crisis since the Great Depression. Unlike 1973-75 and 1981-82, we now have a recession in the real economy and a banking crisis. This is a disastrous combination. The last time we had such a confluence was, in fact, during the Great Depression.

Taken individually, a recession or a financial/market panic can be quite painful, but rather easy to remedy. The 1981-82 recession, for instance, was brought on by the Fed raising interest rates to draconian levels to rid the economy of inflationary expectations. This produced a sharp downturn. But the Fed was able to engineer a rather quick turnaround by simply lowering rates. Likewise, a financial crisis can be quickly contained with little spillover into the real economy. LTCM in 1998 is a prime example: LTCM's failure produced a mini-crisis in the credit markets, but a bailout by Wall St firms contained the crisis before it could have many negative effects on the real economy.

But a recession in conjunction with a banking crisis creates a self- perpetuating downward spiral. As banks face losses on their balance sheets, they hold back credit, and hoard cash. When interest rates reach the zero bound this problem becomes more acute, because the potential gain from lending to people in a bad economy does not outweigh simply holding cash. This is a liquidity trap. Additionally, consumers not only lower spending because of less access to credit, but also because they're scared, so they save more. But because banks are hoarding cash, rather than savings being reintroduced to the economy through bank loans, this money is kept within the banks. The money supply shrinks and deflation makes debt burdens larger in real terms. And the cycle of forced selling and lower values feeds on itself.

The experience of the Great Depression was that there seem to be multiple equilibrium points within an economy. Economies can contract much more than classical economics tells us they "should", as the cycle of debt-deflation pushes the economy downwards. This is true of the money supply as well. Creating inflation seems rather straightforward: have the Fed print money. Indeed, as the Fed has injected unprecedented amounts of liquidity into the system the last few months, many commentators have begun to worry about inflation in the midst of near deflation. But we don't understand money creation as well as we think we do. We have more of a credit system, and less of a fiat one, than we acknowledge. So with a liquidity trap, creating inflation can in fact be a challenge - hence Bernanke's idea of dropping money from helicopters. So what makes this crisis scarier than past nasty recessions is that conventional policy is out the door. We're trying to fix a system we really don't quite as much about as we thought we did.

<comment><USER3> Well, I don't know how a "recession in the real economy" differs from any other recession so I can't really address that point.

But as for the banks you're simply wrong. The problem with your argument, and many like it, is that you hide the actual facts by focusing on the macro. That produces a lot of analytical fear mongering with no real basis in fact (to even claim our 7.6% unemployment rate compares to the 25-to-30% rate of the Great depression is ridiculous).

The fact is I still get credit offers in the mail daily. The banks that are going out of business are having their assets bought by bigger banks that are seemingly doing just fine. So I don't see any banks "hoarding cash"

More importantly you still have 92.4% of the population gainfully employed (and probably another 4% on top of that who are housewives, students or otherwise not looking for a job). That means there's still a huge market of credit worthy people who want to buy stuff on credit.

The great, great, great, great majority of people are not in danger of losing their jobs. That makes them as credit worthy now as they were a year ago. On the other end of things banks still have shareholders and shareholders still expect profits. So in the end you have a supply and demand system that is still up and running just as it always has (it's just slowing down).

P.S. To give you one example of the fear mongering going on a lot of people are quoting Japan's "lost decade" but very few of them are pointing out that Japan still had positive GDP growth throughout that decade..

<comment><USER2> A few things. First, this is a global recession. I would not expect unemployment in the US to be as bad now as it was during the Great Depression simply because the US occupies a different place in the global economy today. In 1929, the US was the manufacturer and creditor of the world - a position China occupies today. I would expect the urban unemployment rate in China to reach the high teens, maybe higher. China is likely already technically in a recession (their 6.8% 4th quarter GDP growth is a mirage. It is calculated year-on-year, rather than annualized, seasonally adjusted quarter-on-quarter. Hence, their 4th quarter was more likely zero or negative, and the first quarter of this year will be worse). Japan's economy is falling off a cliff at -13%. And Europe is in awful shape too; Germany's exports have died, and Eastern Europe is already in a depression scenario with 10% contraction nearly across the board. The question is where is the demand going to come from? No one can export their way out of this mess. Many sovereign states could default as well - small European countries with large banking sectors relative to GDP are at huge risk - and social unrest will likely only get worse. This is bad.

Second, Japan achieved roughly 1% growth annually during its lost decade, and that was with spending hundreds of billions on stimulus programs. Without that spending, Japan likely would have had years of negative growth. That is not a hopeful model of where our economy is headed.

<comment><USER3> You're changing your whole point here. In your first post you said...

"we now have a recession in the real economy and a banking crisis. This is a disastrous combination."

So what you were saying (in response to the original article) is that those factors made this the worst recession since the great depression. I didn't understand what you meant by your first point so I couldn't address it but I addressed your second point. So to have a discussion you should either (a) concede the point to me or (b) provide a counter point.

What you've done here was to clarify my Japan point and then move on to making a third point. The problem with that third point is that you're just saying the world is in a recession. But that wasn't the point of disagreement. No one disputes that.

The question is whether this recession is worse and the numbers you provided don't answer that question

</comment></comment></comment></comment><comment><USER3> I responded to the other comment but I wanted to make one point on the article itself. I think a lot of the fear right now is based on the negative tone of the Obama administration and I think they're doing the exact right thing. Mr. Resler (from the article) makes the same point by saying...

"It's not surprising that politicians exaggerate this," says Resler, who predicts "The tone of the message is going to start changing immediately; now that we have the stimulus in hand, you enhance it by saying positive things."

As someone who was too young to have a vested interest in the Reagan presidency it seems to me the reason for his success was largely that he made people feel good about themselves and their country. That made them feel good about life which in turn made them go out and buy things.

The Obama administration needs to create as terrible looking a crisis as possible right now because then the recovery is all the more euphoric which in turn makes people want to go out and buy all the more stuff.

<comment><USER2> Obama talking about the economy did not make Lehman brothers fail. It did not make Bear Stearns fail. It did not make our entire financial sector load up on risky loans. It did not make mortgage originators and bankers give out mortgages and loans to people who shouldn't have gotten them. There are real structural problems in our economy. People are worried for good reason. This is not merely in people's heads.

<comment><USER3> When asking "what is in people's heads" the question is the scope of the disaster not whether there is a disaster at all. No one questions there's an economic crisis the question is it's scope which is where the Obama administration's stance becomes an issue.</comment></comment></comment>


Pessimism Porn - <AUTHOR> https://en.wikipedia.org/wiki/Pessimism_porn <comment><USER2> Outrage porn does better on social media.

 _" Anger is a high-arousal emotion, which drives people to take action...It makes you feel fired up, which makes you more likely to pass things on._ [https://en.wikipedia.org/wiki/Outrage_porn](https://en.wikipedia.org/wiki/Outrage_porn)</comment>


Launching a Startup in One Week - <AUTHOR> http://www.simplifyingsoftware.com/2009/04/launching-startup-in-one-week.html

<comment><USER2> A startup is a business and a business makes money (or at least attempts to). So this is more like a "Webapp in One Week".

Nitpicking aside, best of luck.

<comment><USER3> Kind of an interesting point to ponder over, is it fair to use 'startup' and 'webapp' synonymously-especially if there are signs of monetizing the system?

</comment></comment><comment><USER4> I've been working on a "side-project-hopefully-a-business-too" now for 8 months and I was seriously getting bogged down in it. I decided this past Friday to put everything else aside and take a week to do something new. I decided to make a bare minimum version of the same product with a completely different brand.

I'm still in the thick of it, but the biggest payout is how refreshing the experience has been. I could end up without a viable product at the end of it, but at least I've renewed my vigor and passion for the idea. That alone has made it invaluable.

<comment><AUTHOR> teej... I've had a very similar experience... I spent 6 months working on a new product, but allowed it to get too complex and the project lagged. I am going to revisit it this year, start with a very simple feature set, and MAKE SURE TO RELEASE A PRODUCT!! :-) All the best man... I'll look forward to seeing your work!

</comment></comment><comment><USER5> Good luck on your week of work.. I have suddenly found myself with extra time on my hands, and will maybe follow your lead.

I do think that the hardest part of something like this is getting a following to use the site.

Best of luck. Jer

</comment><comment><AUTHOR> hopeless... you are right... but "Hacking a little code in 1 week" makes such a lame headline! :-) I am going to try to make it as much of a polished application as possible and after the launch start the long journey of marketing it!

JeremyChase... if you have some free time _build something!_ :-) Part of the goal with what I am doing is to demonstrate what can be done in a week and discuss that at BarcampBirmingham this Saturday.</comment>


Using two-factor authentication for SSH - <AUTHOR> http://www.arm-blog.com/using-2-factor-authentication-for-ssh/ <comment><USER2> There is already a standard solution for this imo. Get a GPG smartcard like a Yubikey and put an Authentication subkey on it.

Now to ssh to anything, clone from Github, etc you insert your Yubikey, and enter your pin to unlock it. A gpg-agent process is created that acts as a standard ssh agent.

No server modifications required and you get strong hardware backed 2FA. The ssh private key never enters system memory and could not be stolen even by an untrusted machine.

If the smartcard itself is stolen, it will brick itself on 3 incorrect pin attempts.

The same device can also store all your OTP tokens or behave as U2F depending on what a service supports so the end game is secrets no longer live on disk or in memory on your systems.

This also integrates well on Android devices via the Yubikey Neo with apps like Yubico Authenticator and Open Keychain,

<comment><USER3> Sure, SmartCards are two-factor, unless the token has a hardware/software bug.

This has happened in the past[1]. I'm a huge fan of the CCID/GPG capabilities of the YubiKey, but I'm not sure they should be used in isolation in high- security environments.

[1]: [https://developers.yubico.com/ykneo- openpgp/SecurityAdvisory...](https://developers.yubico.com/ykneo- openpgp/SecurityAdvisory%202015-04-14.html)

<comment><USER2> Facebook, Google, and the DOD all rely on yubikeys now to mitigate a lot of remote attack vectors. It is not perfect, but it is well audited by some of the best in the industry and as good as it gets atm. There has never been a situation where a yubikey (or other GPG smartcard) has allowed read access to private keys. The secure elements do their job.

As for this vuln, it was a flaw in pin validation, the secrets were never exposed. An attacker that has physical access to the system using the yubikey could simply wait and intercept the pin without this flaw. Any active agent no matter how it was initiated is subject to hijacking like this.

The pin protects against use when physically stolen, not when in active use by the owner. You get assurances your secrets are never copied, but no assurances they are not being used right in front of you by a third party on a machine you think is trustworthy.

The only way I know to mitigate an attacker hijacking keys like this without significantly inhibiting workflow is configuring automatic ejection and re- enumerate the device on touch. Then ssh talks to gpg agent which blocks and waits on key insertion. You touch it and it completes the ssh handshakes then it auto ejects the moment the operation is over.

<comment><USER3> > Facebook, Google, and the DOD all rely on yubikeys now to mitigate a lot of > remote attack vectors.

Yes, but not as the _sole factor_. I've overseen a rather large deployment of Yubikeys, and I believe they provide a huge security improvement compared to other second-factor alternatives.

> The only way I know to mitigate an attacker hijacking keys like this without > significantly inhibiting workflow is configuring automatic ejection and re- > enumerate the device on touch.

Agreed. I was very happy when this was added in the YubiKey IV.

</comment></comment></comment></comment><comment><USER4> The biggest problem with using google authenticator as a two factor mechanism is if you are managing many servers, is that each server needs to have its own setup. If they share keys, and one server gets compromised, they can generate keys for your other servers. As a result, you also cannot automated the process of deploying two factor on your servers.

A simpler and more robust method is SSH Keys + Passwords. I should write a blog post on this...

<comment><USER5> Isn't that problem solved by using centralized authentication server instead of distributing the authentication material on individual servers? I imagine that would be best practice regardless of authentication method.

<comment><USER6> Personally I find a yubikey to be the best middle ground. Your private key is stored in the secure element and can never be removed from the hardware. You protect that also with a password, and the key must be physically touched to be activated.

</comment></comment></comment><comment><USER7> Very Happy to see 2FA on SSH becoming more and more popular. One of the primary reasons my team has seen smart phones being used as the soft token is the ease of deployment argument, people already have the phone with them. With Yubikeys (not that they are cumbersome) but for some IT groups the "perceived" hassle involved (if a key breaks and have to reissue a new one) is a concern. You can lose your phone too, but some customers think that a phone has more chances of not being forgotten. We've also seen IT groups being quite comfortable using soft tokens because they have been using them for SaaS apps - whether its authy/GA or anything else, I guess familiarity kind of desenstizes the analysis of a risk vector.

</comment><comment><USER8> Not sure if to use SSH keys? Or Yubikey? Or Google Authenticator? On a whole bunch of machines?

Why not have it all?

Using privacyIDEA [1] you can

* manage SSH Pub keys for several servers * manage your Google Authenticator centrally * manage Yubikeys centrally or whichever OTP token.

In addition you can combine it to use the Google Authenticator or any other OTP ++PLUS++ SSH keys [2].

[1] [http://privacyidea.org](http://privacyidea.org) [2] [https://www.privacyidea.org/ssh-keys-and-otp-really- strong-t...](https://www.privacyidea.org/ssh-keys-and-otp-really-strong-two- factor-authentication/)

</comment><comment><USER9> If you have public-facing SSH daemons running, adding 2FA seems sensible. Google Authenticator essentially turns another computing device (the smartphone) into an ersatz hardware token. While this does increase security, I don't like the trend of turning the smartphone into a universal second factor.

Alternatively, you could go for a dedicated hardware token such as Yubico's FIDO U2F [1] keys [2]. Hardware tokens that use the fledgling FIDO U2F standard can also be used with PAM and SSH as well [3].

Two U2F keys (one backup) will cost around $40, and can be used with a growing number of webservices, including GitHub, DropBox, and GMail as well. The small form factor means you can put the key on your (physical, real world) keychain.

1: [https://fidoalliance.org/specifications/overview/](https://fidoalliance.org/specifications/overview/)

2: [https://www.yubico.com/products/yubikey- hardware/fido-u2f-se...](https://www.yubico.com/products/yubikey- hardware/fido-u2f-security-key/)

3: [https://developers.yubico.com/pam-u2f/](https://developers.yubico.com/pam-u2f/)

<comment><USER10> Aside from situations where high security is needed (which would necessitate a dedicated piece of hardware to be the 2nd factor), Why are you adverse to using a smartphone as the 2nd factor?

<comment><USER9> I don't own a smartphone, for one, but I could purchase one if it would benefit me. As it is though, I cannot justify the cost and the increased monthly expenses. But for the sake of argument; if I did own a smartphone, I wouldn't want to turn it into a sort of virtual keychain. I can buy three U2F keys for under €60, and have spares. Smartphones are a single point of failure — unless you are in the habit of collecting spare smartphones.

There is also the matter of control. At the moment there are only a handful of smartphones that run an OS that is not under the control of Apple, Microsoft, or Google (Ubuntu smartphones come to mind as an alternative). On the other hand, on a normal computer I can run a full free software stack. To me this seems odd. If I own a piece of hardware, I want to run an OS and applications I can legally modify and tinker with, especially if I use it as a security device. By using tools such as Google Authenticator I get sucked into this walled garden.

The behaviour of hardware tokens such as Yubico's U2F keys on the other hand is completely verifiable — mostly because they are quite simple compared to a smartphone.

(Aside from these personal views on software, I do have high security requirements as well for some services, where a dedicated hardware token is preferable, as you point out.)

<comment><USER11> Hardware tokens _are_ general purpose computers that have been locked down to the vendor's walled gardens. Yubikey is a JavaCard (in USB stick form factor) running some closed-source applets. There is a key that would allow you to load your own applets onto it but Yubico won't tell you what it is.

From a software freedom perspective, hardware tokens/smart cards are no better than smartphones.

<comment><USER9> There is a crucial difference here. With FIDO U2F I am not limited to Yubico's offerings; there are other vendors. FIDO U2F devices can be manufactured by any company (and are).

I agree that the ideal situation would be a device that is completely under the control of the user, but compared to IOS or Android, a hardware token that only does what it is supposed to do (in the case of the U2F tokens; register and sign authentication requests), and cannot be modified by the manufacturer after sale is very much preferable.

<comment><USER11> That's not a difference. You are also free to choose among many different smartphone manufacturers and OSes, all of which are capable of running a TOTP app.

</comment></comment></comment></comment></comment></comment><comment><USER12> I am using smart card authentication for SSH, I documented it here: [http://codebazaar.blogspot.com/2014/07/how-to-ssh-with- your-...](http://codebazaar.blogspot.com/2014/07/how-to-ssh-with-your-smart- card.html)

<comment><USER13> Which vendor do you use and do they support openSC? I was having a heck of a time finding a vendor for a cards and readers.

<comment><USER12> I work for Gemalto as a Sales Engineer... Smart cards and readers is what I talk about every day! May I recommend our smart cards? :D Please reach out to me by email.

</comment></comment></comment><comment><USER14> A far more simple solution is to require both SSH key _and_ password. Something you have (a key) and something you know. You can even store your ssh key on a Yubikey, if you'd like.

</comment><comment><USER15> I've been using Duo Security to add 2FA on SSH and other services on my SmartOS instances. It's really easy and the price is pretty low compared to the amount of work it would take to manage the keys and manual implementations.

In theory I could worry about Duo going down, but I also rely on other critical cloud services and do have other ways to access an instance in an emergency (and Duo supports fallbacks).

Simplicity can be deceiving. In this case I think leaving security to the pros is worth the tradeoff. I've previously relied on cloud services for secure user management and wasn't let down.

</comment><comment><USER16> Authy provides something similar, I wonder if one is better than the other.

[https://github.com/authy/authy-ssh](https://github.com/authy/authy-ssh)

<comment><USER17> I don't really understand authy: does it not keep your 2FA tokens in "the cloud" behind a password? Therefore, does this not make them equivalent to a password, and negate the whole point of 2FA?

<comment><USER18> I believe that functionality is opt-in (or a very prominent opt-out process), but yes I would say you no longer "have" the key, but are turning it into "knowing" a password required to retrieve the key.

Still Zero-Knowledge, but no longer really 2FA.

I still us Authy for a lot of my keys because (1) I have that cloud function off and (2) the UI is better than GA IMHO.

</comment></comment></comment><comment><USER19> Using 2FA is all well and good but what I haven't found is a good solution for managing ssh keys for an organization/group. Would love to get some recommendations here.

<comment><USER2> I tend to store authorized ssh public keys in a database then configure all servers with the appropriate AuthorizedKeysCommand in sshd_config to fetch them on the fly.

I also tend to include some form of caching in case the connection to the database is broken.

With this I can maintain keys for an entire cluster centrally.

This is all in place with open source configuration and tooling on [https://hashbang.sh](https://hashbang.sh) ([https://github.com/hashbang](https://github.com/hashbang)). It is implemented with LDAP+sssd there. Feel free to pop in as we love discussing this stuff.

We have done similar with etcd as the backing database at my employer.

<comment><USER2> Worth noting: In both cases all keys with admin access are in fact GPG Authentication subkeys stored in smartcards each admin carries on their person.

</comment></comment></comment><comment><USER20> I prefer SSH keys with passwords + knocking for the ssh port (!= 22).

<comment><USER2> What about when someone steals your key from memory and observes your knocking sequence?</comment></comment>


Well-Kept Gardens Die by Pacifism (2009) - <AUTHOR> http://lesswrong.com/lw/c1/wellkept_gardens_die_by_pacifism/ <comment><USER2> I failed to get through the entire article. It repeats memes I have seen before that I see as an incomplete grasp of the situation at best.

I have been a moderator. I also was a full time parent for a long time. These two things have a lot in common.

It isn't true that your choices are either censorship or just letting some fool ruin everything. You can engage fools, welcome them, be kind, educate them and help them start fitting into the culture.

It helps to assume they are intelligent, but don't know everything. This is a rubric I learned by raising kids. Children aren't stupid, but they have a great deal to learn. A lot of the eye roll worthy stuff they do is just naivete, not intentionally bad behavior.

You can just explain stuff to people without being ugly, angry or condescending. You can just assume they haven't yet learned all the rules, they were distracted, their dog just died.

It helps to give people the benefit of the doubt the first several times and give them time to learn the ropes. People need to be clued that, hey, that doesn't work around here. If you don't tell them this isn't something we welcome here, don't be shocked when they keep doing it, oblivious to the fact that other people aren't cool with it. But you can tell them without being ugly about it.

A healthy community needs some tolerance for friction, mistakes and dust ups. No one should be expected to be perfect and occasionally defending yourself should be acceptable.

At the same time, it needs mechanisms to lubricate the social friction. An expectation of baseline respect is the best lubricant.

Respect is distinct from polite catch phrases and learning all the rules. Some of the most awful people are good at using polite catch phrases and memorizing the rules so they can politely shit all over everyone else. This is toxic behavior.

Yes, it's work to keep a community healthy. But, no, evaporative cooling is not inevitable.

<comment><USER3> Exactly.

Speaking of "censorship" I posted twice for advice on r/diy and twice I was unceremoniously deleted by a moderator with some copypasta message.

Sure, before posting I should have bothered reading the group EULA and realize there's another "what's this" sub (god knows what rules they have over there) but boy ain't I genuinely bitter about the treatment. It alone makes me want to troll them just out of spite... couldn't they just have been more polite and _gasp_ ask me to move the post to this-and-that sub?! Politeness, assuming goodwill in the counterpart... generally being civil, oh i miss that!

<comment><USER4> I mod a medium-size (250k subscribers) subreddit.

And... no, we do not have time to give personalized individual hand-holding attention to every single person who can't be bothered to read a simple set of rules linked from our sidebar. We use AutoModerator for a lot, and will be using it even more in the future. It's a very impersonal tool, but in any but the smallest subreddits it's simply not possible to scale up personalized moderation like what you're asking for. At some point you have to show some initiative and read subreddit rules or linked wiki pages/guides/FAQs for yourself rather than relying on the goodwill of volunteer moderators to do it for you.

<comment><USER3> The set of rules isn't always "simple & obvious" particularly to those new or only tangentially interested in the sub. Not everyone is OCD about a particular topic but it's handy to toss a genuine question and perhaps catalogue it more appropriately at a later stage.

Most of these draconian rules reek of tribal fallout from some earlier - totally unrelated - war.

"And no, we do not have the time to..." then dude, you're investing waaay more effort than you can afford, you're burning out, take a step back, chill and let other people shoulder the community. You're not paid to do it, neither in monetary nor in "gratitude" so chill and keep it best effort

<comment><USER5> So first you complain that mods don't give enough effort in their messages, and now you say "chill and keep it best effort"?

"Just get more moderators" isn't easy in many communities.

<comment><USER3> No, I complain that mods are too eager establishing excessively draconian - and rather elaborate, probably subjective - rules on a general and broad topic sub. Keep it to the minimum (behave, be civil) and that's that.

Not this:

1 try. No direct images, only Imgur links (first auto-delete)

2 try. No request for advice. (Second delete)

3 try. No what's this (we have decided that it goes to another sub, there it's documented in article nn of our faq)

4... (whatever, take your meds, I've wasted enough time...)

</comment></comment></comment></comment></comment></comment><comment><USER6> The "Pacificm" as described here is exactly Geek Social Fallacy #1: "Ostracizers Are Evil":

[http://www.plausiblydeniable.com/opinion/gsf.html](http://www.plausiblydeniable.com/opinion/gsf.html)

(Written in 2003, or about five years prior to the "Pacificm" post.)

</comment><comment><USER7> Yudkowsky flirts with tautology in the title - "well-kept garden" has keep right there explicitly and "garden" implies a caretaker. So almost by definition a well-kept garden won't persist without intervention.

But also of course not all ecosystems are gardens; not all ecosystems rely on keepers who are external to the ecosystem. A normal forest is sustained by natural forces and the normal actions of its inhabitants. As much as possible I'd like a community that sustains itself rather than one that is gardened.

<comment><USER8> I think these "well-kept gardens" are basically the HOA's of the internet world. The property values may be high, but that doesn't mean they're good or healthy places to live.

</comment></comment><comment><USER9> If anything, my experience is the opposite. The initially best communites soon develop some kind of clique identity, and set up arbitrary rules about what is allowed and what is off topic. I'm not talking about trolling or abusive behavior, but just content that is not aligned with what the clique considers "fun" or "on topic". In the case of Wikipedia or Stackoverflow, this takes the shape of deletionism.

In addition, if you give anybody power in an online community, it seems to go to their heads. They develop a hall monitor mentality. It is even worse in the mentioned sites since almost everybody can perform moderational tasks and thus feel like they should hold up the rules.

Rather than "censoring" or "curating" (depending on your viewpoint), I would much prefer a good search function and separate categories. Disk space is cheap and the internet is infinite. Reddit does this pretty well, despite constant moans about the quality. There is an area for almost everybody and every topic, whether you want a clean garden or 4chan or something inbetween.

</comment><comment><USER10> I've always been fond of the system SomethingAwful uses[0] where there's a public list of user, type of ban (probation, ban, perma-ban), offense, and which mod banned them. It gave both the mods and the users accountability.

This was a well-kept garden with no pacifism at all. While SA sure isn't what it was at it's height, it's still going and still retains a fairly high quality to crap ratio.

The only real downside is that by culling users so frequently, the site isn't very profitable and isn't as big as 4chan or reddit. They don't have the userbase needed to make as much advertising money.

[0][https://forums.somethingawful.com/banlist.php](https://forums.somethingawful.com/banlist.php)

</comment><comment><USER11> One big prior discussion: [https://news.ycombinator.com/item?id=4058818](https://news.ycombinator.com/item?id=4058818)

</comment><comment><USER12> Here's a much better written, more substantive, and more definitive post on the matter:

[http://www.shirky.com/writings/herecomeseverybody/group_enem...](http://www.shirky.com/writings/herecomeseverybody/group_enemy.html)

</comment><comment><USER13> I agree. The reason that the SpaceX subreddit ( reddit.com/r/spacex ) is so amazing is because it is rigorously moderated (some may call it censored).

</comment><comment><USER14> A look at the Moderator - Censorship spectrum [0].

> Imagine a forum / Reddit-style social site that has no owners, no > administrators, no entrenched authoritarian moderators. Imagine if the power > was shifted back to the individual users, who could hire and fire personal > "moderators" (content curators) to best guide discussions in the way that > the user found to be valuable.

Personally I still think the StackOverflow notion of moderator elections is the most transparent way of doing it.

It's still not perfect, but I think as far as transparency goes it's the best that I've found.

[0]: [https://medium.com/@lopp/moderation-methods-vs-censorship- cl...](https://medium.com/@lopp/moderation-methods-vs-censorship- claims-f6baeb3c7392)

</comment><comment><USER15> Perhaps censorship-- or just vigoruous moderation-- makes more sense in a context where a person can just go elsewhere and start their own if they don't care for the current places.

I'll also observe that the value many of us cherish is to listen with respect to _responsible_ differing opinions. I don't have to listen with respect to a troll. And yes, it is a judgement which is which, but I'm OK with that.

</comment><comment><USER16> I can't find a reference, but I believe this is sometimes called the "evaporative cooling effect".

<comment><USER17> That's from another article by Yudkowsky!

[https://www.lesswrong.com/posts/ZQG9cwKbct2LtmL3p/evaporativ...](https://www.lesswrong.com/posts/ZQG9cwKbct2LtmL3p/evaporative- cooling-of-group-beliefs)

<comment><USER18> It's a concept from Thomas Schelling (and maybe someone else earlier), worded differently like the one from plausiblydeniable mentioned above.

<comment><USER17> So what's the Schelling reference?

<comment><USER18> I can't remember exactly, but it is in here: [https://www.amazon.com/Micromotives-Macrobehavior- Lectures-P...](https://www.amazon.com/Micromotives-Macrobehavior-Lectures- Public-Analysis/dp/0393329461/)

</comment></comment></comment></comment></comment><comment><USER19> Note the website he founded and posted this on kind of died itself.

</comment><comment><USER20> I find this article disturbing. Why not just give people the power to ignore those they deem 'foolish'. That is how free speech works... I do not like what you have to say... I do not walk within eat shot. Stop trying to give power to large powerful entities that are not altruistic. When they have that power they take that power from you. Anybody can be deemed foolish for one thing it another.

<comment><USER21> So when you come in to a new community and you don't have your personal ban list set up to keep out the most egregious fools in that community, what do you see? Chaos. So you turn around and leave to seek out a nicer, better kept garden.

Everyone ends up with different, overlapping ban lists. Conversations become fragmented when you can't see some of the replies. It turns into a mess, so you leave to seek out a better-kept garden where people still talk to each other.

You already have this power in a moderated community. You can _leave_ and find a new one. This works pretty well for online communities because the switching costs are very low.

And who says that moderators from within an online community, who are unpaid volunteers who want to see the garden remain well-kept, are "large powerful entities"? I think you are confusing the idea of a commumity moderator with institutional censorship, which is an entirely different beast.

</comment></comment><comment><USER22> So this is a bit in conflict with a Scott Alexander piece that has been upvoted here on several occasions:

[http://slatestarcodex.com/2014/09/30/i-can-tolerate- anything...](http://slatestarcodex.com/2014/09/30/i-can-tolerate-anything- except-the-outgroup/)

The idea that censorship and norms are useful isn't novel. In general, American society is well beyond that, with censorship and stigmatization levels reaching a new high, a recent example being the public shaming of political figures associated with the NRA. But more broadly, pro-Trump and anti-Trump people have been very busy finding virtue signals to use to categorize people into one of the camps.

As someone with major objections to both camps, I find the whole process perplexing and frustrating.

But there _are_ valid uses of these mechanisms. I think, when the evidence is there, the recent expulsion of sexual abusers out of positions of power and privilege are generally on the right track.

How do we combine the concerns? How do we expel and exclude people in a healthy way? It seems to me that America, at least, is not very good at this at the moment. Important things like improving the mental healthcare system in the U.S. really hinge on the answers to these questions.

<comment><USER23> I think what you are observing here is that human (animal) behavior is controlled by patterns, instincts, biases, hueristics that are universal. A classic example is reflected in the aphorism "just because you're paranoid doesn't mean they aren't out to get you."

Public shaming is such an archetypal behavior. My contention is that critical thinking is required to examine the content of the belief system that is the implicit subtext of the behavior.

All humans have a "belief system" which helps them function by providing a simplified, more manageable model of reality to conduct themselves in. Having a "belief system" is not some mere crutch, it's an inherent part of ourselves, essential for our survival.

Challenging an individual's belief system will provoke an anxiety response, and compensating defense responses.

I "believe" that not all belief systems are "created equal." Some map reality more closely, some are kinder to the members of the society who create them. Some lead to violent conflict, some are conducive to cooperation.

The "content" of a belief system can be examined with cognitive tools that attempt to transcend one's own belief system. (This is admittedly very hard, and imperfectly undertaken, at best.) Science is one such tool. Logic is another. An adoption of an empathetic stance towards an individual holding a belief system is another.

However, because belief system have universal characteristics, identifying something as a belief system does not provid much insight into the content of the belief system, and does not provide a basis for evaluating it.

I think that self-identified conservatives, and fellow travelers in the pro NRA crowd, have pulled off quite the disengenous trick, by deliberately exploiting a kind of category confusion: they have managed, at least in their own minds, to equate attacks, or shaming, of individuals based on their belief system, with historical oppression of categories of people, that were a whole different thing.

The worst type of oppression and discrimination in our US history is the racial oppression built into the fabric of our society. This oppression was not based on the "belief system" of black Americans. It was based on amplifying and exploiting a perhaps natural affinity for others like ourselves to systematically exploit, oppress, and persecute a whole category of people, based on an aspect of themselves (race) that a) they had no choice in and b) was irrelevant to the question of whether an individual had rights to live with even a modicum of dignity, health, wealth, and justice.

So we have "conservatives" appropriating the mantle of the oppressed, because they can demonstrate aspects of treatment that resemble what African Americans have had to deal with.

It's ludicrous. The argument seems to be: historically blacks were treated with extreme deprivation. For example, they were not allowed to participate in the institutions of higher education. Part of this would of course means they would not have been permitted to speak publicly on a college campus, were it not for the efforts of many advocates of racial equality and fairness.

So simply the act of being restricted from speaking on a public campus, because they are (self identified) members of a group, in their minds equals unfair discrimination. It would be comical, if it didn't serve to confuse and warp the civic discourse around this already difficult subject.

As part of that social rejection, the humans in the groups doing the rejection are likely engaged in some of the same intense, sometimes disturbing, behaviors, like "public shaming" that groups oppressing blacks engaged in. That's human nature. The fact that two courses of conduct share a common motivation is not enough to evaluate the conduct.

Anecdotally, if you peruse the comment of social media/forum/comment sections of "liberal" and "conservative" sites, you will see the same patterns of smug self righteousness, and certainty that the "other side" are depraved, delusional cretins, who can't see beyond their own hypocrisy. (If you havent tried this, do, it's quite surreal...the archetypal patterns of social behavior and biases, of emotional tone, are strikingly similar on Fox News and Huffington Post.) Their are liberal trolls and conservative trolls.

Getting back to the subject of the OP, I suspect that similar category errors are at work when the subject of "censorship" on a website comes up in response to moderation actions. The simple act of suppressing speech in a public forum is not enough to label it "censorship."

</comment></comment><comment><USER24> Hence why HN wins over slashdot.

</comment><comment><USER25> Well Kept Gardens always die eventually, yet actively promoting chaos like 4chan just keeps rolling along.

I personally prefer chaos. It's far more interesting than Groupthink.

<comment><USER26> I've never seen interesting conversations on topics I care about on 4chan. It appeals to a certain demographic that I was never a part of, not even when I was a teenager.

So you can give it as an example of a surviving community, but to someone like me it might as well not exist.

Also note that you've just left a comment on Hacker News, one of the most moderated communities on the web.

<comment><USER12> > _I 've never seen interesting conversations on topics I care about on > 4chan._

That, as you said, might depend on the demographic.

But you can certainly find interesting conversations on Reddit.

</comment></comment></comment><comment><USER27> As a thesis, could this article have replaced 'online community' with 'Chinese public' to argue for current censorship policies in China?

<comment><USER28> Yes it absolutely could. That's the problem with supporters of censorship. Such people rarely see themselves as tyrants, just people who want a better society that will come about once the toxic "others" have been silenced.</comment></comment>


I made a distributed, anonymous network for online discussion - <AUTHOR> It's called Aether: it's a distributed, anonymous and decentralized public space where you can discuss without revealing your identity or being eavesdropped. It has no servers, and it's unblockable.
I wanted to see what HN thought of it—sorry to take your time if out of topic.
Download it here: http://www.getaether.net
A speakerdeck slide introducing Aether:
https://speakerdeck.com/nehbit/aether-a-decentralised-online-public-space
Check out the bitcoin topic! I posted it on reddit earlier today, and there's been some discussion starting up there.
Source code is here: https://github.com/nehbit/aether-public/
What do you think? <comment><USER3> * You need to describe how it actually works. Describe the network protocol well enough that someone can re-implement it in their own favorite language.

* Your license sucks. Restricting modified code from connecting to the network tells me that your network protocol is fragile and exploitable

* How is your system better than Tor and a hidden service?

<comment><AUTHOR> 1) On its way. I'll be launching a protocol spec for anyone to implement their own client.

2) The license is _very_ temporary. I'll switch to an OSS certified license soon.

3) Hidden services still need server resources. This is closer to Bittorrent than Tor.

<comment><USER4> _cough_ [http://labs.bittorrent.com/experiments/bittorrent- chat.html](http://labs.bittorrent.com/experiments/bittorrent-chat.html)

<comment><USER5> Neither open source nor a documented protocol, which makes it entirely unsuitable for many users.

</comment></comment></comment></comment><comment><USER6> how does it know who else to talk to?

it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you are joining the forum you expect?

another way of saying the above - despite the encryption there's no protection against mitm, right?

it uses tls so it's just direct connections? so you're identified by your ip?

you say (iirc) that keys are automatically regenerated and not verified. so it's really anonymous (not pseudonymous). so there's no way to be sure two comments are by the same person? even in the same discussion?

since the encryption is useless (mitm) yet you're not actually anonymous to an attacker (ip) it seems to combine the worst parts of insecure software with the worst parts of forums (no reliable identities).

[edit: sorry, updated the above slightly. ok, so there's some forwarding of messages which makes people more anonymous if an attacker doesn't see all the network. pre-snowden that might have seemed worth something.]

<comment><AUTHOR> > how does it know who else to talk to?

There is a bootstrap node, which you connect to at the beginning of your first boot. Connecting to that node gets you a list of posts and a a list of nodes, like every other sync with any other node. You can opt out of connecting to boostrap node if you have a friend you know to be currently online, and putting his / her ip:port at the settings page of the onboarding.

>it seems that by saying things are anonymous you punt on all questions of identity? so there's no way to know that you are joining the forum you expect?

The forums only exist as names, there is no way to have two forums with the same name, they will automatically be merged. (There is two bitcoin topics currently, that's a corner case I'm fixing now)

But there is no way to know who you are actually talking to, yes. I'm planning to add public key authentication in the future at the point I am reasonably confident the core stack is working reliably and there is sufficient interest.

> it uses tls so it's just direct connections? so you're identified by your > ip?

Yes, it's only direct connections, but when you connect to someone, it also gives you posts from other people the guy you connected to have upvoted. You're identified by your node id, which can hold multiple users. It's probably more correct to say it identifies computers, rather than people. But it's easy to change, just delete the userprofile.json and you'll automatically produce a new one.

</comment></comment><comment><USER7> I like it - it installed easily enough on Mac. I started browsing around.

I really do not have a quibble with the application itself - nor the intended use. Thank you for it I am enjoying playing around with it and am following the project on github.

Echoing others I would definately fix the license issue - and do that sooner than later.

I have a tangental interest - forgive me if the following is off topic.

The last line from the deck: "It requires zero infrastructure" and similar statements in the website got me thinking along a theme.

I get that this is a distributed application with encrypted transmission - <USER2> it does imply an infrastructure. Once you need an IP; you need a network.

I can see lots of applications for this - beyond the reddit/bittorrent model, this would be really useful \- aftermath of a hurricane / natural disaster \- Occupy wallstreet style demonstrations \- Cory Doctorow "Little brother" scenario \- etc - any situation where you want ad hoc, encrypted community

the problem with those situations is exactly that there is no infrastructure (or not a trusted infrastructure).

Locally (for me) there are projects like [http://www.milemesh.com/](http://www.milemesh.com/) to try and make sure there are networks for emergency situations. But what if you don't wnat to use an official or semi-official network? Are there distibuted, ad hoc network projects that would work well with this?

<comment><AUTHOR> Thanks for the interest.

> Echoing others I would definately fix the license issue - and do that sooner > than later.

Agreed.

> The last line from the deck: "It requires zero infrastructure" and similar > statements in the website got me thinking along a theme.

Zero infrastructure except a working internet connection. But far as I know those mesh networks also work over IP (at least they seem to) so Aether should have no problems working over a mesh network.

The infrastructure need not be trusted— the current Internet infrastructure is not trusted, and it works fine for most applications if used with HTTPS. Aether isn't too different, I'm literally encrypting with the same encryption suite (TLSv1) even.

</comment></comment><comment><USER8> I wish the slides were more descriptive of how it functioned.

Although I use mac, the lack of linux seems to be something that should be worked on.

<comment><AUTHOR> I tried to produce Debian and Ubuntu builds, it's mostly working. But the GUI framework I'm using (Qt) has serious problems with tray icons on Debian arch (on Debian, a black line appears instead of icon at tray bar, on Ubuntu, the tray icon appears on the _left_ of the top bar, above Ubuntu's main menu) so I am waiting for them to fix their bugs. Otherwise, it's working out of the box.

For more information, here's a totally non-polished, detailed text about how it works.

[https://dl.dropboxusercontent.com/u/5815330/aether.spec.v0.2...](https://dl.dropboxusercontent.com/u/5815330/aether.spec.v0.2.html)

<comment><USER9> So the only problem is with tray icons? I'd like to test this, but I only have a Linux OS at the moment. Can we get a .deb if we promise to not complain about anything wrong? :)

<comment><AUTHOR> Hey there, I could certainly get you linux binaries if you agree to be my linux beta tester :). The issue with tray icon is that it's pretty critical to application's existence, in that the app needs to stay in the background as long as the computer is open. It's a daemon, essentially. Without a functioning tray icon, it's impossible to shut down the application other than via kill [pid] or another way via shell. If you are interested, please email me (in my HN profile). I'm definitely interested in maintaining Linux binaries or help people maintain them.

</comment></comment></comment></comment><comment><USER10> Definitely an interesting project.

>> The basic idea is quite simple: if Alice likes a post written by Bob, Alice will upvote it, and thus will start to distribute that post, too, increasing Carol's chances of coming across Bob's post.

If i get it correctly , your protocol leaks votes data. Assume i'm an attacker connected to Alice. I now know what she voted for. I gather all her voted posts, and can build pretty decent profile of her and probably uncover some of her messages with some more complexity.

<comment><AUTHOR> Vote data is public. That's the only way I can determine what to distribute. I don't get how you can guess what Alice wrote out of her votes, though?

<comment><USER10> Ok. Vote data is public.

People usually vote their stuff. You gather all the posts that been voted by alice. You use text analysis software to group those posts into buckets with the same author.

If you can do this across a large span of the network you get buckets of anonymous authors and voting patterns. Alice's bucket is the one where everything is upvoted(most likely).

That's one way. It's hard to counteract. Even if your software just counteracted this while using something like TOR to supply the rest of the anonimity, it would be pretty cool.

Another way:

Tap the internet. Gather a list of nodes connected to alice. Connect your nodes to all those nodes.

Watch whether message X is first delivered to your nodes from alice or from someone else. If it's first from alice, you got her. Statistically this will catch her at least some times.

Anyway,don't get discouraged. anonimity is hard. really hard.

<comment><AUTHOR> Two very good points. As you said, Tor can handle the first, but the second is much like the 51% attack on Bitcoin. In any case, if you have a possible solution to the second, I would be glad to have a coffee with you.

<comment><USER10> Thanks for the coffee :).

The field of detecting authorship is called stylometry, and preventing that is called adversarial stylometry. Here's a java open source software that you could use :

[http://www.hacker10.com/other-computing/deceiving- authorship...](http://www.hacker10.com/other-computing/deceiving-authorship- detection-with-jstylo-anonymouauth/)

BTW , another issue. If you really want to achieve strong anonimity you have to have large number of users, and large number of researchers trying to break your system.

The best way to build anonymous forums in this context , is to build popular anonymous email(currently there's none. only 2 we might see in the future "the dark mail alliance" and "pinchon gate") , and use it for forums.

<comment><AUTHOR> Looking at it, seems interesting. I'll take a deeper look onto this.

2#, I agree. I'm trying to get as many users as I can, posting to HN, reddit and all :).

</comment></comment></comment></comment></comment></comment><comment><USER11> I think it's cool that you're making usable security software.

I do worry that "usable" has gotten more thought than "security", and providing a system that doesn't deliver the security it promises could be worse than not having the software at all. It may end up conveniently serving up those at most risk to their adversaries.

As others have noted, anonymity is hard to get right, and the approach here has some serious flaws:

1\. It seems that the pseudonymous author of posts can easily be determined by connecting a bunch of Sybils (i.e. multiple clients) to as many other peers as possible and observing who is the first to send new posts by the target pseudonym. And you really can't have a forum without pseudonyms. Users will create them on their own (by including a nickname in their posts) even if you don't build it in.

2\. There is an easy so-called "intersection attack" in which the sets of users that are connected at any given time a pseudonymous entity posts are intersected. The actual author will always be present, and the other participants won't be static, and so eventually only the author will remain in the intersection.

3\. There is no apparent protocol obfuscation. Despite the use of TLS, the protocol traffic patterns of this new protocol are likely to be highly identifying. They can then be easily confirmed by an active attacker directly connecting to the suspected participant. In addition, it doesn't seem that the list of participants is protected, and so an adversary can just connect to the network to discover who to block or punish. Tor will not solve the problem here if users have to be able to receive incoming connections. And if you're using Tor, then you are relying on an external system that has censorship issues of its own (e.g. access from China is currently extremely limited) and _does_ rely on servers.

4\. The bootstrap IPs can obviously be easily blocked.

5\. The votes are not anonymous, which is unlikely to be clear to users and which are nearly as sensitive as authorship itself.

6\. Denial-of-service here is as simple as flooding the network with "forwarded" posts and votes.

Here are some suggestions for designing a system that is secure and that people can _trust_ as being secure:

1\. Write a white paper describing the design! This is not a detailed protocol spec - it's a description of how the protocol works at a higher level along with arguments establishing its security properties. This allows others to understand and critique the design.

2\. Check out some of the related system designs [0-6]. They have had to deal with the same issues, and you can learn from them. You can get all these papers and more at <[http://freehaven.net/anonbib/>](http://freehaven.net/anonbib/>). As you can see at that site, people have been thinking about these issues for a while and have figured out a lot!

3\. Submit your white paper to a computer security conference. Even if it doesn't get in, you will get feedback from experts.

As it is currently, I wouldn't trust my communication to this system. You really need a large and diverse user base to provide anonymity, and so you will have to work at convincing people that this is something they can trust. Good luck!

[0] "Membership-concealing overlay networks" by Vasserman et al. CCS09

[1] "Crowds: anonymity for Web transactions" by Reiter and Rubin. TISSEC 1998.

[2] "Freenet: A Distributed Anonymous Information Storage and Retrieval System" by Clarke et al. PET 2000.

[3] "Traffic Analysis: Protocols, Attacks, Design Issues and Open Problems" by Jean-François Raymond. PET 2000.

[4] "ScrambleSuit: A Polymorphic Network Protocol to Circumvent Censorship" by Winter et al. WPES 2013.

[5] "Drac: An Architecture for Anonymous Low-Volume Communications" by Danezis et al. PETS 2010.

[6] "Tor: The Second-Generation Onion Router" by Dingledine et al. USENIX Security 2004.

<comment><AUTHOR> Now, _this_ is the comment I came to HN for. Thanks for this, I have a few readings to do.

For your points, While I don't have a full–scale refutation, here's a few addendums in order. All of this is wrapped in a giant 'If I understand you correctly'.

> And you really can't have a forum without pseudonyms. Users will create them > on their own (by including a nickname in their posts) even if you don't > build it in.

That's human self–incrimination. As long as this is safe for an one–time user that opens the app on an internet cafe, posts something and goes away, I have some basic semblance of security I can build upon. That does not mean it is secure, it just means it's secure for _something_ —and that's a start. (It might not be actually secure for even that, let me know if you know it not to be so)

> There is an easy so-called "intersection attack" in which the sets of users > that are connected at any given time a pseudonymous entity posts are > intersected. The actual author will always be present, and the other > participants won't be static, and so eventually only the author will remain > in the intersection.

The actual author won't always be present. The posts start at a point, but they do not need the author to be present to continue distribution. When Alice posts something and Bob gets the post, from then on Alice can disappear forever. If a post is below a threshold of availability on nodes Bob is connected to, Bob will flag it as neutral post (to make that distribution not count as an upvote) and start distributing it on his own to prevent post extinction. That said, this doesn't prevent intersection attacks, it just makes them less viable.

> Tor will not solve the problem here if users have to be able to receive > incoming connections.

The users do not need to accept incoming connections. There are some very restrictive routers that refuse to be UPNP port mapped, and Aether works fine on them.

> and so an adversary can just connect to the network to discover who to block > or punish.

For this, the roadmap is to have a 'protected' node which refuses all connections from nodes except those who are explicitly marked as trusted.

> The bootstrap IPs can obviously be easily blocked.

It does not rely on the bootstrap IP. If you have installed the application, it asked you in the onboarding process IP and port of a friend that you know to be online. If you give it that, it'll use it. In fact, I'm planning to turn the bootstrap node off or just make it a redirect to some other random node in the future.

> The votes are not anonymous, which is unlikely to be clear to users and > which are nearly as sensitive as authorship itself.

They point to node id's, which are not users, but machines. This is an inherent tradeoff, in that I have to have some data to gauge the popularity of a post. As far as I know, there is no way out of this without implicit trust in a third party.

> Denial-of-service here is as simple as flooding the network with "forwarded" > posts and votes.

Well, those posts won't get upvoted, and will get stuck in spam filters and upvote thresholds of users. None of those are implemented yet, of course, but this doesn't seem to be a structural problem.

> As it is currently, I wouldn't trust my communication to this system.

Please, for the love of god, don't trust Aether (yet). This is barely alpha level code.

For the rest, thank you. Much appreciated. I'll be reading.

<comment><USER11> > > And you really can't have a forum without pseudonyms. Users will create > them on their own (by including a nickname in their posts) even if you don't > build it in.

> That's human self–incrimination. As long as this is safe for an one–time > user... I have some basic semblance of security

So this is not anonymous reddit, then. That is much less useful, and it had better be extremely clear to users that they should only use it in that way.

> > There is an easy so-called "intersection attack"... The actual author will > always be present,... and so eventually only the author will remain in the > intersection.

> The actual author won't always be present. The posts start at a point, but > they do not need the author to be present to continue distribution.

In this attack, the adversary would need to be one of Alice's peers most of the time. If he isn't, though, because Alice only connects to a few peers consistently, then he can at least identify one of those consistent peers. That serves as a focus for attack, say by denial of service.

> > Tor will not solve the problem here if users have to be able to receive > incoming connections.

> The users do not need to accept incoming connections. There are some very > restrictive routers that refuse to be UPNP port mapped, and Aether works > fine on them.

So to actually be undetectable as using Aether, you can't accept connections. Then you have to hope that enough users are connecting for the anonymity and not the undetectability, or you'll have to provide some infrastructure nodes.

> > and so an adversary can just connect to the network to discover who to > block or punish.

> For this, the roadmap is to have a 'protected' node which refuses all > connections from nodes except those who are explicitly marked as trusted.

Great, if you promise undetectability, then this should be the default. Of course, that makes connectivity a challenge (what if everybody you trust doesn't accept connections because they also want to remain undetectable?).

> > The bootstrap IPs can obviously be easily blocked.

> It does not rely on the bootstrap IP. If you have installed the application, > it asked you in the onboarding process IP and port of a friend

Sounds good!

> > The votes are not anonymous, which is unlikely to be clear to users and > which are nearly as sensitive as authorship itself.

> They point to node id's, which are not users, but machines.

I don't understand the distinction being made here. In any case, the upvote is observed as coming directly from some IP. That is the identifier to worry about. As far as privately gauging the popularity of the post, I don't exactly understand what you need here, but they may be some crypto solutions that could work. Unfortunately, post popularity seems easily spoofed to me.

> > Denial-of-service here is as simple as flooding the network with > "forwarded" posts and votes.

> Well, those posts won't get upvoted, and will get stuck in spam filters and > upvote thresholds of users. None of those are implemented yet, of course, > but this doesn't seem to be a structural problem.

What about the mechanism to prevent extinction of a post? Doesn't that spread a post without upvotes? And why can't I create a network of Sybils to upvote my spam posts? Also, spam filters are a UI mechanism, if I understand what you mean. I am talking about consuming network and memory via protocol flooding.

<comment><AUTHOR> > So this is not anonymous reddit, then. That is much less useful, and it had > better be extremely clear to users that they should only use it in that way.

Depends on how you emphasize that sentence. It's reddit, but its anonymity is weaker on certain fronts and stronger on others. If used as one-shot device, it's pretty good. Otherwise, there are the issues you mentioned (which I plan to fix, to my best).

> So to actually be undetectable as using Aether, you can't accept > connections. Then you have to hope that enough users are connecting for the > anonymity and not the undetectability, or you'll have to provide some > infrastructure nodes.

Correct.

> Great, if you promise undetectability, then this should be the default.

I do not promise undetectability, but it exists under certain circumstances. I will explicitly note those circumstances and mark undetectability as a side benefit only under those conditions.

> I don't understand the distinction being made here. In any case, the upvote > is observed as coming directly from some IP. That is the identifier to worry > about.

The distinction is largely academic as you said. If you have a cryptographic solution to that, I'd love if you could point me to the right direction.

> And why can't I create a network of Sybils to upvote my spam posts?

You can, but users can also block your nodes, or (we're really going into the medium-term future here) your nodes would be placed in blocklists, whose users—people who accepted them— would deny you from connecting to them. (This is a half–baked idea as of now, who maintains those lists etc.) This is a thorny problem. Spam filters, I was meaning less of an actual after-the-fact spam filter, and more of a "block this guy out, refuse connections" kind of filter. Sorry for the wrong choice of words.

All in all, very fair points I need to work on. If you would be interested in taking a look once in a while to point out where the logic holes are, I'd really appreciate your voice in development. If you'd be interested in helping out, send a mail to me (email@example.com)— I would try to run more important things by you before implementing to see if there are any obvious holes.

</comment></comment></comment></comment><comment><USER12> I was unable to run the installer because I don't have administrative rights. It would be better without need for administrative rights.

<comment><AUTHOR> That's a prerequisite for the installer package I'm using (Inno Setup) unfortunately. I'll try to get around that.

</comment></comment><comment><USER13> Can't be opened because it's from an unidentified developer

[https://www.dropbox.com/s/7mnb2gng6a66b9y/Screenshot%202013-...](https://www.dropbox.com/s/7mnb2gng6a66b9y/Screenshot%202013-11-23%2020.57.48.png)

<comment><AUTHOR> Follow the instructions on the dmg. After you drag it to Applications, go to Applications and right click on Aether, then select open. It will then allow you to go through.

</comment></comment><comment><USER14> I don't personally believe that anything is unblockable or untraceable. If data can find its way back to you, then you can be found (although it might be very hard).

<comment><AUTHOR> You're correct. This just makes harder. These documents are written for laymen, it would be an asterisk-fest otherwise.

<comment><USER15> Hence the logo?

</comment></comment></comment><comment><USER16> I am no security expert but this sounds interesting. I'd love to know how I can compile it from source (Maybe add it to the github README?)

</comment><comment><USER17> Nicely done. Your demo at DemoDays was pretty cool ([http://demodays.co/](http://demodays.co/)).

<comment><USER7> Hmmm - I didn't see the talk on that page... Is there a link?

<comment><AUTHOR> It happened a few hours ago. It should turn up in a few days, I think? I'm also waiting for that.

</comment></comment></comment><comment><USER18> Is this like Freenet, but less general-purpose?

<comment><AUTHOR> Yes. I'm specifically trying to create a safe, secure and anonymous discussion platform, not a darknet.

<comment><USER19> Looks interesting. I see you build on webkit among other things -- what are the messages? json docouments? Any provision for attachments? Any range for size of messages (eg: a 700mb attachment -- would that make sense with this)?

<comment><AUTHOR> Messages are JSON, limited to 65536 characters. (This is a limitation of AMP protocol in Twisted I am using). There are no attachments. This is a text–only protocol. I'm trying to minimize the bandwidth requirements of running Aether.

</comment></comment></comment></comment><comment><USER20> How does this compare to bitmessage?

</comment><comment><USER21> Have you seen Retroshare?

<comment><USER22> I have. I was very disappointed with it because it was such an utterly massive application to be running in the background all the time.

It was 2007 and it was consuming 300MB of ram, that was just not acceptable. Maybe more tolerable now, but still bad.

</comment></comment><comment><USER23> No Linux version?</comment>