The lure of exclusivity - <AUTHOR> http://11kclub.com/journey.aspx

<comment><USER4> I've built a number of private online communities over the years and have experimented with language around exclusivity and scarcity enough to know that it works well to draw interest where it was previously difficult to get people to pay attention.

I've often wondered why more startups don't try to build some sense of exclusivity to the sign-up process. Everyone is so focused on removing the barriers to sign-up and getting the user to improve their vanity metrics. Getting quality users by creating barriers to entry can be a tactic as well...

<comment><USER5> But wasn't there like a beta "craze" up until a few years ago? Like when Gmail launched, Google Buzz and a many other sites and services that are long forgotten by now.

It certainly can work if the product is really attractive. But my suspicion is, that standing in line for an underwhelming experience might even amplify negative effects as the personal investment to gain that knowledge was substantially higher.

</comment></comment><comment><USER6> Such a simple idea but I'm looking forward to see how it goes ( I have signed up ).

One feedback though. You brand this as something exclusive ( only 11K people ) but in the "Welcome mail" after I signed up you ask me to share it with my friends... Isn't that counter intuitive? If I want to be "selected" the less competition there is, the better so I shouldn't share it.

<comment><AUTHOR> Thanks, and thanks for signing up. I appreciate it.

I can see how that may be confusing. And yes you are right - but we are hoping that as much as you want to get in, you will also want to join the club with your wife/husband/brother/sister/friend - a lot of clubs, no matter what they are, are more fun if the experience is shared (in my opinion).

thanks again..

<comment><USER7> You could limit the number of invites that a new customer could offer to be 1 or 2. It might even make them more likely to invite somebody because an invite appears to have greater value. Worth an A/B test at least imho.

</comment></comment></comment><comment><USER8> Perhaps topically relevant:

\- <https://en.wikipedia.org/wiki/Veblen_good>

\- <https://en.wikipedia.org/wiki/Positional_good>

</comment><comment><USER9> <http://en.wikipedia.org/wiki/Scarcity_value>

"Tom said to himself that it was not such a hollow world, after all. He had discovered a great law of human action, without knowing it -- namely, that in order to make a man or a boy covet a thing, it is only necessary to make the thing difficult to attain."

</comment><comment><USER10> Would be interested to hear some product insight on how you guys think the 11kclub product compares with "Lily Cole's Impossible".

<comment><AUTHOR> I hadn't heard of this story. Just looking at it now and will get back to you. At a first glance it seems we place more emphasis on bartering and exclusivity but looks like she's done a great thing. Thanks for sharing this - <USER2> forward to reading up on her project.

</comment></comment><comment><USER11> I tried signing up but I got this error: "a general error has occurred"

<comment><AUTHOR> Sorry about this - we'll take a look. Can I ask What browser you are using?

<comment><USER11> Firefox

</comment></comment></comment><comment><USER12> Interesting - anyone got the link to the original HN discussion?

<comment><AUTHOR> I can share that with you (co-founder) - <http://news.ycombinator.com/item?id=4323459> \- as I say, we wanted to create the illusion that we'd stumbled across it so that we got genuine sign up's. Alas, people found out who we were so we apoligised and held our hands up. Our intentions were always good and we felt it important to include that experience in our journey because we learnt a lot that day.

<comment><USER12> Thanks sw007 - well done for keeping calm and not rising to some of the comments in the thread. Good luck!

<comment><AUTHOR> Thanks :) They were right I guess in that maybe we were not honest enough but at least our intentions have proved to be good. As I say, it was a good lesson. A sad night - we felt like the experiment was over a little bit - <USER3> ultimately it did us good.

</comment></comment></comment></comment><comment><USER13> The whole reason this is stupid is you are just trying to prove a point that has been well established. Facebook has proven exclusivity works already, we don't need clones just to prove the same well known thing over and over. Why don't I start the 5,20,100k club to see if this effect works at different levels! Because who cares! Solve a problem, build something useful, not just because.

</comment><comment><USER13> This is such a dumb idea it blows my mind. Create something useful.

<comment><AUTHOR> Thanks for the constructive feedback...

<comment><USER13> Meant to be honest not constructive, constructive is do something else.

<comment><AUTHOR> I just don't see how that comment can possibly be worthwhile. If you don't like it, if you think it is rubbish, then fair enough. But we have spent a lot of time building a product we are proud of, building a community of great people and have aims that we think are worthwhile. I am not asking you to sign up - if you hate it, you hate it - don't sign up, it's pretty simple. Whilst I am on my soapbox - go build a product that doesn't suck and then come back to us and then I may care what you have to say..</comment></comment></comment></comment>


How to permanently delete Facebook account - <AUTHOR> http://www.wikihow.com/Permanently-Delete-a-Facebook-Account <comment><USER2> Thank you for posting this. In light of the recent stuff that Facebook has done, I'm deleting my account. I'm glad I'm not alone in seeking the information on how to do that exactly.

<comment><USER3> Out of curiosity, what stuff that facebook has done recently makes you want to delete your account?

<comment><USER4> Why would it have to be recent?

<comment><USER5> Because that's what he said.

>>>In light of the _recent_ stuff that Facebook has done, I'm deleting my account.

</comment></comment></comment></comment><comment><USER6> How to delete your HN account:

      1. You can't.
      2. ???
      3. HN is evil!

<comment><USER7> Your HN account is not linked to your real identity, unless you want it to be. Many people think that's a big difference.

<comment><USER8> Your facebook account is not linked to your real identity, either, unless you want it to be.

<comment><USER9> If it's not then it's closed as soon as it's discovered though.

<comment><USER8> Why, is there some reason I can't just post vague messages which don't link me to any particular, identifiable human? How would they know?

<comment><USER9> I'm just saying that _if_ they do find out you're not who you pretend to be then your account will be closed. A primary reason for this would be to prevent identity theft (e.g. accounts that appear to be a real person and add a group of people who all work together/study together/went to the same school).

</comment></comment></comment></comment></comment></comment><comment><USER10> This should really be as simple as a single button. It wouldn't even significantly reduce their membership since the average person doesn't care. It would however improve their image.

<comment><USER11> Can this really be implemented? No system in that size can invalidate any information in every CDN center instantly (or even in bounded time). The fact is, once your information is online, it will never go.

<comment><USER10> It can be implemented for facebook but not for facebooks apps or for scraped and cached information. However the article wasn't about removing your content from the web completely. It was about removing your content from facebook.

</comment></comment></comment><comment><USER12> I too wonder why Facebook makes it so difficult for users to permanently delete their accounts? It should be a straight forward and simple process, yet Facebook doesn't even make this option easily locatable through their service. They should at least openly explain to their users why the deletion process is in its current form (user experience, security, spam reasons, etc). However, making the deletion process so isolated and obscure, without an official explanation, only makes me more skeptical of Facebook's agenda.

<comment><USER13> The value of a network increases as the square of its nodes.

<http://en.wikipedia.org/wiki/Metcalfs_Law>

The value of a network to a user is in the number of people he can communicate with. The value of a network to Facebook is in the number of accounts it can claim; the more accounts, the more attractive is the network to advertisers.

If Facebook reports number of users to advertisers and investors, it would never want to be in a situation where they have to show a loss of users. So they make it obscure to delete your account.

/speculation

<comment><USER14> It's probably more like _n log( n )_ (see: [http://spectrum.ieee.org/computing/networks/metcalfes-law- is...](http://spectrum.ieee.org/computing/networks/metcalfes-law-is-wrong/)) and your point is valid either way.

</comment></comment></comment><comment><USER15> _"It should be noted that quite how deep your deletion goes is highly questionable: does facebook still store your information even though you've destroyed your way of accessing it?"_

<comment><USER8> I have no doubt that they keep your info. If nothing else, it may be helpful if law enforcement or a court came looking for info. Soft delete is generally a best practice anyway, as far as I know, and also, it is convenient for referential integrity.

</comment></comment><comment><USER16> Method number 3: Violate Facebook's TOS. One instance would be to upload a nude photo of someone or for the brave souls, one of yourself.

<comment><USER17> Don't you think that Facebook would keep all of your information in its files, even if not publicly viewable, for its own legal protection if you tried something like that?

</comment></comment><comment><USER8> I'm proud to say that I mistrusted and hated facebook from the very beginning, and don't have to delete my account because I do not have one I've used for anything other than to sign in and look at pages that require one to be signed in.

That's right: I'm so hip, I knew Facebook was a horrible, horrible company which I hate before it was cool to think Facebook was evil.

</comment><comment><USER18> I'll tell you what happened in 14 days.

<comment><USER19> I did it ages ago. Worked for me.

</comment></comment><comment><USER20> _Thanks to all authors for creating a page that has been read 542,011 times._

I would like to see how Facebook's recent developments are affecting their member count.

</comment><comment><USER21> One day you may really regret this

<comment><USER22> I didn't. Deleted my account a few months ago, and have not looked back. My reasons were probably 40% privacy issues (I felt at the time that facebook was going the wrong direction) and 60% just to avoid the massive time sink.</comment></comment>


Ask HN: How do you currently solve authentication? - <AUTHOR> There are a lot of different ways to do authentication these days. How do you currently solve for it?<p>Any tools you swear by? Anything you recommend? Anything you hate? Do you recommend writing it from scratch or using a framework or service? <comment><USER3> Depends on the project:

Firebase Authentication[1] is an excellent easy add on for apps (both Web and Mobile) that I want to get running quickly. It's free, scales, supports lots of social auth providers and can take care of email verification etc.

When I'm building a website it really depends. Wordpress and Django have excellent inbuilt authentication and authorization systems. Djangos can be quickly expanded to support social providers with `django-allauth`[2]

For everything else I use KeyCloak[3] - Red Hats open source Identity Provider/Single Sign On which supports oAuth2.0, OpenID Connect, SAML, themes etc. Documentation and support is relatively good but can be quite overwhelming especially if you're not used to the relevant standards (knowing the different flows in oAuth2.0 and which one you want to use).

[Self plug]: I'm building a KeyCloak-as-a-Service for those who don't want control of their authentication without the hassle of setting up their own cluster. We're in closed Beta at the moment but if you're interested you can search for "Tromsso keycloak"[4] and leave an email to be invited in.

[1] [https://firebase.google.com/docs/auth/](https://firebase.google.com/docs/auth/)

[2] [https://github.com/pennersr/django- allauth](https://github.com/pennersr/django-allauth)

[3] [https://keycloak.org/](https://keycloak.org/)

[4] [https://tromsso.com/](https://tromsso.com/)

</comment><comment><USER4> Firebase Authentication.

I can't say enough good things about this service as it has been a game changer for me productivity wise.

-Supports most of the popular OAuth providers natively or you can add any custom OAuth system via custom tokens.

-SMS Auth, passwordless login (aka magic links)

-Excellent and well maintained client/server SDKs for most of the languages. Makes user management very convenient, including neat things like revoking tokens, cookie session management, linking accounts of users with multiple providers, RBAC via web tokens.

-Tight integration with Firestore. Can have fine grained security controls on which users can read/write what documents etc.

What takes the cake is Custom Tokens [1]. This is really useful for seamlessly integrating with another authentication system. Would recommend anyone to take a look if they're exploring an auth service.

[1] [https://firebase.google.com/docs/auth/admin/create-custom- to...](https://firebase.google.com/docs/auth/admin/create-custom-tokens)

</comment><comment><USER5> I'm storing hashed password in the database. I'm writing POST http handler and storing user info in the session information. I don't know why would I use framework or even service, it's just few dozens of simple lines of code. I don't use frameworks for simple things. I guess it might make sense when one need to support login via Google, Facebook, etc, I'm working on enterprise websites which don't need that.

<comment><USER6> Presumably checking user passwords for security is out of scope?

How do you mitigate credential stuffing attacks? Throttling per account? Globally? By source IP?

A user leaves their company. How do you automatically deactivate their account?

You're using password hashes. Cool. A secure password hash function, right? Scrypt, argon2, maybe bcrypt? (MD5, SHA1, and SHA2 are not password hashes.)

You're comparing them in constant time, right? Are you sure? The compiler hasn't "optimized" you into problems here?

You're working with enterprise websites. You obviously support 2FA; and you're probably going to want to support SSO with SAML2, and definitely integrate with Active Directory over LDAP.

And your password reset flow- just send an email with a magic link? do you generate the magic link's token with a CSPRNG? Is it long enough? When does it expire? And admins probably have to be able to reset anybody's password, but with strong auditing and accountability features...

You store user info in the session information- basically caching it out of the database? How do you invalidate sessions after a user changes their password or has their account disabled?

Can somebody put Unicode in their password?

You're writing a POST handler. You protect against CSRF, right? (yes, tricking somebody into logging in as another user can be very useful!)

Doesn't seem so simple to me...

<comment><USER7> I think most people don't realise how many attack surfaces there are.

Good TLS and salt + strong hash solve the simple cases of DB theft and network MITM... But that's the bare minimum amount of protection.

As it does nothing for tokens being stolen, sessions, password reset hacks and emails being compromised.

It does nothing for stopping users trying to brute force. Password strength, loads of things mentioned.

I think the point is not really needing to know what good libraries mitigate against, but that you probably (as an individual) don't know all the ways that things can be compromised, and can't easily remember to implement them all, so you want a system that has been created, tested and improved by many security conscious people and out in the wild.

You probably wouldn't build your own lock for your front door either. The risks simply outweigh the benefits.

<comment><USER8> The most common front door locks sold are the ones people who pick can open the fastest, perhaps a bad analogy?

<comment><USER7> I can see what you mean, but that's not to say a normal person would be likely to do it better themselves though. Lock levels are selected (perhaps naïvely sometimes), based on a certain tolerable level of inconvenience and cost factor.

Luckily software is cheaper to implement strongly, but still email + password is usually selected as the method in spite of being the easiest thing to crack (as far as getting into individual accounts is concerned).

We could get users to all use ubikeys or more complex forms of multiple factor auth.

We could make it so that if you compromise an email account, you can't just reset all the external account passwords using it.

Plenty of sites allow insecure passwords that are in rainbow tables and cannot defend against targeted attacks (unless a user actually selects a strong password themselves).

Also just as houses often have big windows that can be smashed, perfect crypto / secure auth practices fail to work with the presence of an exploit somewhere else in the stack are frequent sources of compromise too.

It's not a perfect analogy of course, but actually I don't think locks / houses is a bad one. Users don't value security enough to want the most secure locks on their accounts and frequently get annoyed if asked to use 2-factor Auth, multiple passwords for single sites etc.

</comment></comment></comment></comment></comment><comment><USER9> Last time AWS Cognito, and at least initially, Amplify.

I'd never write it from scratch. It's always a PITA, there's always significant compromises - do you make people sign up, do you let them use Google/every other available federated login provider, what 2FA options, will it work on a locked down network, etc.

<comment><USER10> I want to use cognito but the documentation is not good. For example, how do I use cognito to authorize against an api I wrote? It's not clear from the documentation.

<comment><USER11> You'd probably use a custom workflow backed by lambda functions that interact with your api: [https://docs.aws.amazon.com/cognito/latest/developerguide/co...](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito- user-identity-pools-working-with-aws-lambda-triggers.html)

</comment></comment></comment><comment><USER12> Warning: this post is about a speculative design unproven in production. Definitely use the de facto standard framework in any production code you write!

I get so depressed with authentication complexity. Seems to me there are two ways to avoid it: first, write a service that doesn't care about user identity (it is a fun exercise to think of such a thing!), and second, secure _messages_ , not connections or sessions.

Securing messages with public/private key encryption, I believe, is the best possible general approach. _Thinking in messages_ yields the programmer great benefits, not just inside code (it is the cornerstone of the OOP paradigm, after all), but outside of code (message passing is also the cornerstone of distributed programming). Even if you are building a webapp it helps to think in terms of something more general. HTTP becomes just another channel over which messages move. Your app can (and probably will) become sensitive to other channels: email, SMS, webhooks, etc. If you embrace message-level security then you can _ignore the channel and deal with the message_. Channels may change, but your application code doesn't need to.

For an SPA, the key problem (no pun intended) is that a users private key is on the users browser, in the simplest implementation, accessible by everything on the page. If you're not end-to-end encrypted and don't use 3rd party resources at all (its possible!) then the naive solution is fine. The most robust solution is to use a browser extension to isolate the private key. The site requests encryption services from the extension.

Another fun and interesting problem is the multi-device user. Do we allow copying the private key, and if not, how do we associate private keys together? I think this is a fun problem from lots of angles, particularly the prospect of your own devices inviting each other to share an identity.

<comment><AUTHOR> Novel and I like the mental model. It seems like this pushes more of the management to the user - to manage the key. Or providing the user nice consumer tools to manage the key - adjacent to your core product. The hard part here is probably getting consumers to use/download/install that tool.

<comment><USER12> _> The hard part here is probably getting consumers to use/download/install that tool._

I agree. I think there are ways to mitigate this, though. If the extension is open source, and very small then at least the digerati would be more open to it, and then it might become a standard extension, like ublock origin.

</comment></comment></comment><comment><USER13> I use bcrypt to hash the user password and then store it in a database. When the user wants to log in I use the compare function of the bcrypt library. If the hashes match I set a session cookie.

I suppose if I worked on projects that wanted to support OAuth I would use Passport.js, but I don't know how much I would trust the any but the largest packages for that.

</comment><comment><USER14> I use Auth0. Works well enough

<comment><USER15> Auth0 for complex stuff is pretty outstanding in my experience! It's nice to get sane and reliable OAUTH as a service...

I've rolled a lot of different custom authentication solutions for small apps with a handful of users all the way up to millions of users and thousands of concurrent sessions... having an "out-of-box" service saves a TON of time and headache =)

Not affiliated with Auth0, just love it to all heck. The free-tier offering is very fully-featured - try it out!

</comment></comment><comment><USER16> I use [https://www.pomerium.io/](https://www.pomerium.io/) for my internal services with Google oauth. I like it because unlike oauth-proxy I can define which users are allowed to which (sub)domains. I run this in Kubernetes and it supports forward authentication, so adding a new service is editing a configmap to let pomerium know about the domain and its allowed users (support for defining this in the ingress is coming), and adding a few ingress annotations.

</comment><comment><USER17> In some Rails projects i use Device gem, or simpler version made by my own (salted passwords in database, and user_id as jwt in session store).

<comment><USER18> For Ruby, There is also Rodauth [1]

[1] [http://rodauth.jeremyevans.net/why.html](http://rodauth.jeremyevans.net/why.html)

<comment><USER17> Thanks for the link, Rodoauth looks interesting. Especially that all JWT things is already included.

</comment></comment></comment><comment><USER19> I use keycloak. It's just like auth0 except it's self hosted and I run it alongside all my other instances.

</comment><comment><USER20> I'm not currently solving it that way but my next side project definitely is going to try out metamask as the mean of authenticating the user.

A friend of mine showed me some "dapps"(decentralized apps) that he uses (uniswap.io, axieinfinity.com and some other i forgot). They all used metamask as the "login platform". The point is that you have your key in this metamask plugin that is stored in your browser and you can sign things. That means you get a challenge from the server and metamask then asks you if you want to sign that challenge. The hole onboarding experience was super easy and you theoretically could use that to pay for some premium features of a service.

I thought that is really cool because you don't need to enter email, username, password and whatnot. You just click authorize and you're in.

<comment><USER21> It works if your app is only used by crypto crowd.. I'd never use it though, I don't want to have to have metamask installed in my browser.

</comment></comment><comment><USER22> I use Django's included authentication.

<comment><USER23> For Django projects I prefer to start with django-allauth. Saves lots of time later.

<comment><USER24> Can you elaborate on why? I've used Django a lot and have yet to find auth a problem after running things for quite a while, so I'm curious what the issues might be that django-allauth helps with.

<comment><USER22> Django-allauth provides templates, the ability to login with email, and other functionality that drastically improves the UX over what is included with Django auth. Django auth is still used on the backend.

</comment></comment></comment></comment><comment><USER25> Simple: Don't. Developing a secure authentication service is actually more difficult than it would seem on the surface. I've come to rely on an external authentication service (or, if necessary, a reputable library/framework specifically designed for it). These days my go-to is Keycloak ([https://keycloak.org](https://keycloak.org)). It supports pretty much everything: standard username/password, MFA, SAML, OIDC, etc. Plus, it's easily deployable within a Docker container so standing it up is a breeze.

<comment><USER26> I'm certainly going to trust an authentication service with a bad certificate.

<comment><USER27> Well, the URL is missing www so you see the bad certificate error; Although, I agree that they should have handled automatic redirection from non-www to www.

</comment></comment></comment><comment><USER28> I have been implementing different methods for oauth: \- building my own handling with hashed passwords stored in the database \- using the fantastic sorcery [0] gem for Rails. It's a light-weight auth solution that allows me to customize many different aspects of auth while providing a solid structure. It also has many sub modules that can be added for oauth, resetting password or stronger application security.

[0] [https://github.com/sorcery/sorcery/](https://github.com/sorcery/sorcery/)

</comment><comment><USER29> My users send their password over TLS. I check the password using bcrypt. I assume further communication over the same connection comes from the user.

<comment><USER30> Do you use a salt?

Also how do you determine what is the same connection and what mechanisms do you have in place to prevent someone stealing that session?

<comment><USER29> bcrypt does not allow me to not use a salt. A connection is the same if it's the same file descriptor and it's been open continually. My client uses public key pinning to ensure it is talking to my actual server. I don't have any mechanism to prevent someone who can break TLS and take over TCP connections from impersonating users in my online game.

<comment><USER30> Re salt, presumably you're storing that bcrypt as a hashed string though?

Re TCP connections, I was thinking HTTP proxies. Sounds like this isn't HTTP traffic though so that's not an issue.

Also why was my previous comment negative karma'ed? All I was doing was asking a couple of questions on a post that's quite vague. The amount of abuse HNs rep system gets is pretty absurd.

<comment><USER31> You're getting negative karma'ed because your comment shows a lack of understanding of what bcrypt is and what it does. Here's a short explanation: bcrypt is a hash function that you should use for storing hashed passwords. When calculating the bcrypt hash of a string, a salt is automatically added. The result you get looks something like this: `$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy` The 2a specifies which version of bcrypt was used, the 10 is the number of rounds, N9qo8uLOickgx2ZMRZoMye is the salt and the remaining characters are the hash. When checking this hash against a password you have to call a second function and pass in the password as well as the hash. This second function will automatically parse the passed in hash and calculate the hash of the password with the same number of rounds and the same salt.

<comment><USER30> Nar, I'm familiar with bcrypt. I was just getting bcrypt mixed up with scrypt. Doh.

Even so, that's still not a good enough reason to -rep without feedback.

</comment></comment></comment></comment></comment></comment><comment><USER32> Laravel built in auth, Socialite for social logins.

</comment><comment><USER33> I am working on a hyper-open, hyper-compatible, and hyper-accessible forum system with accessibility by historic browser included in the spec.

I use a multi-layer authentication system with various levels of compatibility, security, and accessibility.

* The default mode is unauthenticated, which allows the user to post plaintext. Optionally, this can be backed by a device fingerprint, which would group all of this user's posts together. This is supported by all post-Mosaic browsers, except perhaps Mosaic 1.0, which does not support HTML forms. (For Mosaic, there is a fallback writing mode, of the form [http://example.com/your+message+here](http://example.com/your+message+here))

* There is also a cookie-based authentication system, in which the user asks for a new ID, and the server sets cookies for user id and checksum. The checksum is checked against a server secret via hashing, so no storage of account data is needed on the server. This works with all cookie-supporting browsers.

* The other authentication system is based on PGP, and allows the user to either use in-browser PGP (insecure) or client-based PGP (less insecure) to sign their messages. These messages can be both client verified and grouped together into a profile on the server.

</comment><comment><USER34> If I use a an external framework or library to let me users login via Google or say outlook, do I need to have my own outlook or Google account? Do I need some authorization to do this if say my company uses outlook for their emails and I want to let my co-workers use their account info to sign in through outlook?

<comment><USER35> Typically to integrate OAuth2 based authentication flows, you need an OAuth Client ID and Client Secret that identifies and authenticates your application with the provider. Generally this requires an account of some kind, though it may not always be identical to a normal user account on all systems. For Google you would need a Google account, its managed in Cloud console (though any kind of account will work.)

I actually don't know if you need this if you just want to identify the used, off hand; I know there is a separate flow for that when using OIDC, but I suspect it still would have at least a Client ID. (This would be used for the provider to display your application name and possibly some other info.)

</comment></comment><comment><USER36> Spring Security for the logic and password storage. I usually build my own pages for password resets and logins

</comment><comment><USER37> Django user authentication:

[https://docs.djangoproject.com/en/3.0/topics/auth/](https://docs.djangoproject.com/en/3.0/topics/auth/)

</comment><comment><USER38> Does anyone know if there's a decent, comprehensive library that handles all authentication / login for .Net Core apps? Bonus points if there's a SSO addition (even if that part is commercial).

<comment><USER39> Identity.NET for embedding a library, Identity Server for hosting a service.

They're not the simplest, and unfortunately the scaffolding story with Identity.NET is a bit of a nightmare for MVC apps (if you're not careful, you can end up with a ton of hidden-but-accessible razor page endpoints), but the code is robust and most cases are covered.

Identity.NET will also need you to write your own implementations of a couple of database access classes if you don't want to drag a dependency on Entity Framework Core along for the ride.

Documentation is fairly dry and mostly complete (Microsoft style) but be careful with versioning because dotnet core moves fast.

<comment><USER38> Fantastic. Thanks very much for that.

</comment></comment></comment><comment><USER40> Rails + devise even if my application is in another language than Ruby. Laravel could also do the job. Every time I have looked, authentication tools in Javascript are paid or overengineered.

</comment><comment><USER41> Keycloak. Open source IDP.

</comment><comment><USER42> I've been eyeing Firebase authentication for a Django project of mine, but haven't implemented it yet. Can anyone recommend it or advise against it?

<comment><USER43> I've used Firebase for authentication and it works pretty well and has good documentation. I haven't tried other options such as AWS Amplify though. I just keep a user reference in Firebase and then do everything else in my own app/db.

</comment></comment><comment><USER44> In .net world aspnet identity give you a basic login, can add social logins and identity server adds auth2 support. Both highly customizable

</comment><comment><USER45> For user authentication: Hosted (Auth0 or Okta), self-hosted: Hydra

For Service Identity: SPIRE/SPIFFE... (or Oauth CC flow if mTLS is not possible)

</comment><comment><USER46> keycloak is really awesome. This also makes sure when you move to any other oAuth2 authentication, we can simply switch the server details.

On the other hand firebase authentication is very scalable easy to set up and start.

Dont write it from scratch, if you are in JVM, Spring Security provides a robust implementation, we can just plug, configure and play

</comment><comment><USER47> In my services, I use a combination of:

\- hashed password or webauthn token \- palm vein or usb token or (less preferred, SMS)

</comment><comment><USER48> we've been plugging away at writing an open-source OAuth2 server: [https://github.com/curveball/a12n-server](https://github.com/curveball/a12n-server)

</comment><comment><USER49> Keycloak

</comment><comment><USER50> One very important aspect of authentication is session management. Doing this wrong (or naively), can have catastrophic effects for your app!!

Let me provide an example: It's common knowledge that JWTs are very common. A lot of people who use JWTs, implement them as access tokens for their APIs. JWTs also require a shared secret key - what if this is stolen? Then an attacker can use that to hijack any user's account very trivially, and you may not even realise that it's happened! This is far worse than anyone getting hold of hashed passwords from your database.

That being said, I use the following flow for session management: \- User logs in, the backend issues a short-lived (~1 hour) JWT and a long-lived refresh token and sends them to the frontend. \- The frontend sends the JWT for each API call while it's still valid \- In the event that the JWT has expired, the frontend should then use the refresh token to get a new JWT AND a new refresh token (rotating refresh token - <USER2> [https://tools.ietf.org/html/rfc6749#section-10.4](https://tools.ietf.org/html/rfc6749#section-10.4)) \- If the refresh token expires, then the user has to login again.

While this sounds quite straightforward, the key here is to use rotating refresh tokens - that's what actually makes it fare more secure than just using simple refresh tokens (i'd argue that it's almost the same level of security as just using a long lived access token)

Some of the benefits of this approach: \- You can detect token theft! If an attacker gets hold of the refresh / access token, because they keep changing, you can detect if an old token is used which is a strong singal of theft (see the RFC link above) \- You can change the JWT secret key without logging any users out: Once you change the key, all JWTs are instantly invalidated. But then your frontend client can simply use its refresh token to get a new access token signed with the new signing key (along with a new refresh token). \- Allow your users to be logged in for however long you want without compromising security.

Some implementation gotchas: \- When changing the refresh token, be sure to not invalidate the older token unless your backend is sure that the frontend has received the new token. This can be confirmed by the frontend using the new access / refresh token. This is important since if not done, and if the user is in a bad networked area, it can lead to them being logged out. \- See this blog and specifically this race condition: [https://medium.com/hackernoon/the-best-way-to-securely- manag...](https://medium.com/hackernoon/the-best-way-to-securely-manage-user- sessions-91f27eeef460#e81c)

If you do not want to implement this on your own, you can also check out [https://supertokens.io](https://supertokens.io) \- It provides an end-to-end implementation of the above taking care of all race conditions and network failure issues. It also prevents other common web attacks which are on the OWASP top 10 list.

\</comment><comment></comment><comment></comment><comment>-----

In terms of user authentication for the login part, I prefer using a no- password method - email or SMS OTP. The reason for this is that I do not have to care about managing user passwords (though that's not too difficult), I do not have to build forgot password flows, and most importantly, users don't have to remember yet another password.

I also only allow 3 attempts for OTPs per OTP. So after sending the OTP, if a user fails to input the correct one 3 times, then I revoke the old OTP and send a new one (this is so that someone can't simply brute force their way into an account). If the user login is successful, then I revoke all OTPs for that user. If the user clicks on sending the OTP again, then I send a different OTP (but the old one is still valid). This allows me to have a an OTP timeout of say 1 hour - which is more than enough!

According to me, this coupled with the above session management flow, is perfect!

</comment><comment><USER30> Another thing to bare in mind, for those who are rolling their own, is how you caress those passwords from the DB.

The common approach is a simple DB SQL select. But that then means if your web server gets exploited an attacker can dump the entire password database.

The safer option is to write a stored procedures to return or modify that table and set permissions on that table so even your web app creds can't directly query the password table. Then your web service only has access to check a single password, rather than downloading every hash on the DB.

If you can also offload the encryption/decryption and hashing then that is another step forward too.

<comment><USER30> Anyone care to elaborate how this post is wrong?

Hint: it isn't. But I've been penalised for it all the same

<comment><USER51> I'll bite. It doesn't seem obviously wrong to me. I would also love to know if I'm misunderstanding something.

I've never seen it done this way, but I think postgres pgcrypto could support this.

If I had to guess, I haven't seen it done this way because authentication frameworks are not normally in a position to lock down access to the database in this way (e.g. it couldn't create a password table that the web app credentials can't see, because it's integrated into the web app and uses the web app credentials to create the password table). The way they typically behave is: \- When updating password, run bcrypt in the web server and INSERT \- When testing password, SELECT the bcrypt hash down to the web server, and test on the web server.

Have you used this stored procedure strategy in production? I'm particularly interested if it's caused any challenges with resource usage in the database server?

The top answer in this stack overflow question makes the argument that you should bcrypt in the web server to lessen the time it's unhashed: > Use php bcrypt if you can, it'll lessen the time that the password remains unhashed. [https://stackoverflow.com/questions/2647158/how-can-i- hash-p...](https://stackoverflow.com/questions/2647158/how-can-i-hash- passwords-in-postgresql/18687445)

I'm not sure I agree with this argument, unless perhaps the database is hosted by a separate vendor (which would mean another party is receiving the unhashed password). Also note: the strategy proposed in that answer doesn't have the benefit of a stored procedure preventing a SELECT all, so maybe the less time argument makes sense in that case.

Perhaps there's a valid discussion around - is this going overboard? Is preparing for a leak of web app database credentials an attack vector we really need to prepare for? If we do, are password hashes the critical data we need to be securing in this manner? When hashes leak I've been asked to change my password as precautionary measure, but hashing algos are such that this event shouldn't be catastrophic. Unlike a credit card number leak, for example, which would cause a bigger headache.

<comment><USER30> I learned this technique when I worked on the blue team of a cyber security firm.

It's not about sending your passwords in clear text to your RDBMS. You'd still use bcrypt like you normally would but instead of querying the password table directly you'd have that prewritten as a stored procedure. That way you can have different permissions for the password table.

Some frameworks and/or other managed solutions might already be doing this but it's worth mentioning anyway since people are talking about hand rolling their own auth.

I don't know why I added the part about offloading encryption though. That doesn't make sense. I guess that will teach me talking security before my first coffee of the day

<comment><USER51> I can't really use bcrypt like I normally would, since bcrypt normally* concatenates the cost and salt into a single string with the hash that I store in my database: [https://en.wikipedia.org/wiki/Bcrypt](https://en.wikipedia.org/wiki/Bcrypt)

I believe I can split out the cost and salt. That would let me:

1\. SELECT the user's salt and cost from a table that is accessible with my web app credentials.

2\. Run bcrypt on the user-provided password with the selected salt and cost within my webapp.

3\. Ask my stored procedure if my resulting hash matches the hash in the database, even though I cannot SELECT the hash directly with my web app credentials.

Am I understanding this correctly? I imagine it would have been easier pre- bcrypt, when generating salts was less abstracted away from the developer.

I can't think of a reason this wouldn't work, and it adds a layer of security if implemented properly. But I say that hesitantly, as I would all things crypto, particularly since I wouldn't consider it common practice and I'm not sure if I'm overlooking something. I'm pretty sure I'd need to hack on bcrypt- ruby more than comfortable to actually implement.

* I say normally because that's what the wiki says and how bcrypt-ruby behaves, but I haven't done wider research.</comment></comment></comment></comment></comment>


The Evil Stepmother - the-enemy https://www.theparisreview.org/blog/2019/04/03/the-evil-stepmother/ <comment><AUTHOR> This is one CONFLICTED person.

<comment><USER2> Maybe so, but please don't post unsubstantive comments to HN. If you have something thoughtful to say about such conflicts, or experience of your own to share, that's great. Alternatively, it's fine to not post anything. But please don't do the shallow internet thing here.</comment></comment>


Ask HN: How often should you redesign your site? - <AUTHOR>

Every year? Every 2 years? What do you think is  the best combination of not being stale and not throwing money down the drain? <comment><USER2> Test _constantly_. Button placement, calls to action, colors of buttons, etc -- 5% increases to conversion compounded 20 times means big bucks.

As for total throw-it-out-and-start-over redesigns: I'd say "seldomly". I did one once, because I had the golden opportunity for it -- both a major tech change that was going to require a code rewrite, significant technical debt in keeping up the old templates, and major feature modifications which forced a rethink of my information architecture. As long as I was going that far I figured, eh, what the heck, get it a totally new look as well.

I was surprised that for all the extra work added and the professional design, conversion rates moved less than when I tweaked spacing on buttons a little bit. Ahh well, that's the way the cookie crumbles. The non-design aspects of the relaunch proved worth their weight in gold.

(I was also totally prepared to send the designer a check and a thank-you card and not use a single pixel of it if the conversion rates changed in a majorly negative direction after the switch. Thankfully the starting hiccups were not _that_ bad.)

[Edit: incidentally, sub-sections or mini-sites are a great way to beta a design against your visitors without having to put your existing relationships or numbers at risk. When I made sweeping changes to my site, the sweeping changes started out on a "brought to you by this other site" mini-site that I set up, and I did iterative improvement on things like button placement and calls to action over there before I integrated them with the oh-goodness-if-I- screw-up-this-will-cost-money site.]

</comment><comment><USER3> Depends - is the site mainly content or functional/transactional?

If it's mostly content then I'd say constant small revisions with the occasional overhaul. Tweak to whatever delivers the content best.

It's different for a functional site. Even if a tweak is an usability improvement, existing users will go "eh?" when you (say) move a button. If you did this too often it would actually reduce your net usability. I'd say changes to this kind of site would be better aligned with every major feature release... With a major overhaul probably being a rare event.

</comment><comment><USER4> I'd say 5-7 years would be time to start looking at an entire overhaul.

Here's the thing. Your site should be in constant state of flux with new features added and subtracted, moved etc. After a while you'll just end up with a bit of code "crud". Its almost worth it just to do a site wide front end rewrite once every 3 years or so. I think 5-7 years is about the amount of time that it takes for a styles to change enough where your site will start to get a bit stale.

</comment><comment><USER5> Only redesign when you have a measurable goal or set of goals in mind. It helps if they're quantifiable, but they don't necessarily have to be.

There are many dangers in redesigning prior to establishing a goal (particularly with commercial sites) -- principal of which is never knowing when and if you've succeeded.

</comment><comment><USER6> "One year" is a long time in internet years. Users won't notice the difference between yearly redesigns and bi-yearly redesigns. Good idea might be to change little at a time, all the time, with some A/B testing thrown in.

</comment><comment><USER7> I think that every time you have an idea for a redesign that's comprehensively better than your old layout, you should take it. Don't redesign for the heck of it. Wait until you've got a good idea.

</comment><comment><USER8> I redesign my blog once a year.

I need to redesign my commercial sites, but I'm not sure what the goals of the redesign would be. Seems like if you have something that works (like Drudge) what's the point in redesigning? I guess having new goals -- changing market demographic, desire to keep it fresh, improving click-through or sales, etc -- is the most important driver.</comment>


Something silly: Star Wars 1977 as "It's a Good Life" - <AUTHOR> http://mzlabs.com/MZLabsJM/page6/styled/

<comment><USER2> A funny post. I enjoyed it. I would have liked to have seen a little more interaction on the level of the critique of the Campbell influence and Jung.

Also, heads up: needs a spelling/grammar once over.

<comment><AUTHOR> Thanks, took a look.</comment></comment>


Is Apple's Cloud Key Vault a Crypto Backdoor? - <AUTHOR> http://blog.cryptographyengineering.com/2016/08/is-apples-cloud-key-vault-crypto.html <comment><USER2> TL;DR: No, it isn't. If that's all you wanted to know, you can stop reading.

...

<comment><USER3> If the title is a question, the answer "No" is pretty much guaranteed.

<comment><USER4> However, contrary to most articles titled with a question, this article is answering the question rather than posing it.

</comment></comment></comment><comment><USER5> Great explanation of Cloud Key Vault! I wonder if Apple's programmable HSMs are the same ones being used at Certificate Authorities? It seems that there are two types of HSMs: PKI environment's CA HSM and card payment system's bank HSM.[1]

[1]: [https://en.wikipedia.org/wiki/Hardware_security_module](https://en.wikipedia.org/wiki/Hardware_security_module)

</comment><comment><USER6> What operating systems and hardening are used in network-connected HSMs [1]? Have there been public evaluations of HSM security?

[1] HSM review, [https://www.opendnssec.org/wp- content/uploads/2011/01/A-Revi...](https://www.opendnssec.org/wp- content/uploads/2011/01/A-Review-of-Hardware-Security-Modules-Fall-2010.pdf)

</comment><comment><USER7> Little bit of an aside: Why do most infosec practitioners prefer conferences like BlackHat and RSA to Bsides and Def Con? The price differences are staggering.

<comment><USER8> BlackHat is run by the same people as DefCon. BlackHat is their (very success) attempt to monetize the infamy surrounding DefCon. Many of the talks you see at BlackHat will appear (usually watered down) at DefCon.

<comment><USER9> Black Hat _was_ run by Jeff Moss. He sold it to UBM several years ago. It is most definitely not run now the same way Jeff ran it.

</comment></comment></comment><comment><USER10> In case folks are curious how we do a similar thing with HSMs to store private keys for encrypted email, I wrote this up a week ago:

[https://medium.com/ink-different/how-inky-stores- encryption-...](https://medium.com/ink-different/how-inky-stores-encryption- keys-safely-c3715756b224#.8bktvrxce)

<comment><USER11> Nice write up. What HSM vendors do you recommend?

</comment></comment><comment><USER12> What happens if the HSM decays or malfunctions in some way? Sounds like it's not possible to backup, and no computer/tech will last forever.

<comment><USER13> The HSM is only the backup, it is not the primary copy. Losing the HSM means you are down to 1 copy (the vault on your device). That means there is only a small window of exposure where, if the HSM goes down _and_ you lose your device, your passwords are gone.

They could probably roll with duplicated HSMs to mitigate this somewhat.

</comment></comment><comment><USER14> I'm not sure whether to applaud the TL;DR or decry the clickbait title. I always appreciate a good opening statement, though.

</comment><comment><USER15> [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

Thankfully the author seems to have been doing it facetiously and confirms within the byline that the answer is no.</comment>


Killer Rabbits in Medieval Manuscripts - <AUTHOR> http://www.openculture.com/2019/03/killer-rabbits-in-medieval-manuscripts-why-so-many-drawings-in-the-margins-depict-bunnies-going-bad.html <comment><USER2> My great aunt wrote some of the original scholarship on this type of marginalia: [https://www.goodreads.com/book/show/5064937-images-in-the- ma...](https://www.goodreads.com/book/show/5064937-images-in-the-margins-of- gothic-manuscripts)

It's a shame that she is not mentioned. In answer to one of the other posters wondering about _Monty Python_ , the answer is yes. She told me that Eric Idle or possibly Terry Jones (?) at one point had a fascination with these illustrations and I believe they corresponded. In any case, it wasn't just the rabbit sketch - some of the interstitial animations between skits are taken directly from tropes in these drawings.

<comment><USER3> Terry Gilliam, most likely.

<comment><USER2> Indeed - I asked her yesterday and it was Terry Gilliam.

</comment></comment></comment><comment><USER4> > like a barber with a wooden leg (which, for reasons that escape me, was the > height of medieval comedy)

Surely this is no great mystery? Barbers acted as amateur surgeons across the mediaeval world. They'd typically be the ones amputating the limbs, not the ones having amputated...

<comment><USER5> Barbers acted as professional surgeons across the world until surgery became a formalized profession. Maybe 200 years ago at best?

<comment><USER6> Correct. No self-respecting "doctor" wanted anything to do with the messy business of surgery.

I found _The Devil 's Doctor_ by Philip Ball to be an interesting book on this sort of thing.

<comment><USER7> This is more of a ex-British empire thing, but at least some surgeons I have heard of in Australia insist, among medical company, of being called "Mister" not "Doctor", to set them apart from "mere doctors".

I think this is a formal distinction in the UK, but in Australia I think both groups _can_ be called Dr.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1119265/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1119265/)

<comment><USER8> In the UK the 'Dr' title is dropped for a doctor who has risen to become a consultant. Never heard of it working that way for surgeons

<comment><USER9> Are you sure? I've met lots of consultants who are titled Doctor.

<comment><USER8> You might be right - could be the consultants I've encountered gave all been surgeons.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Let us never forget the Jimmy Carter rabbit incident.

[https://en.m.wikipedia.org/wiki/Jimmy_Carter_rabbit_incident](https://en.m.wikipedia.org/wiki/Jimmy_Carter_rabbit_incident)

<comment><USER11> I think that article overestimates the number of people that saw "Monty Python and the Holy Grail" in the USA when it came out.

<comment><USER12> I don't know, it was a pretty big deal. A major film.

<comment><USER11> Not in the USA[1] in 1975[2]

1) [https://www.the-numbers.com/movie/Monty-Python-and-the- Holy-...](https://www.the-numbers.com/movie/Monty-Python-and-the-Holy- Grail-\(1975\)#tab=summary)

2) [https://www.the-numbers.com/box-office- records/domestic/all-...](https://www.the-numbers.com/box-office- records/domestic/all-movies/cumulative/released-in-1975)

<comment><USER13> But it was the CBS late night movie in 1977. Also, the wikipedia page just says "some people" \-- not sure that "overestimates" the number of people who would have been aware of killer bunnies.

<comment><USER11> Yeah, I'm thinking a movie that aired on CBS starting at 11:30 p.m (ET/PT) in 1977 probably wasn't well watched even in the 3 (or 4) channel era.

The Wikipedia writer wanted to put Monty Python in the article and ignored the actual history and provided no actual link or cited source of the link.

<comment><USER13> Where did you live in 1977 that only had 3 channels? I was in the greater LA media market and I think we received about 20 terrestrial channels counting all the UHF. About every other VHF channel picked something up.

Also, my recollection is that TV airing of movies that were a couple of years old was a bfd back then. My father worked 2pm to 10pm in 1977 and he and my mom were huge monty python fans, so I bet they watched it.

It also aired on PBS, the dates are not in the wikipedia article, but by the time the Carter incident became public it might have aired a few times.

And 1975 is when Monty Python started to show on public television in the US (vs 1969 on BBC). I was only 7 in 1979, but I know we as a family watched flying circus when it aired (I didn't control the TV during prime time, but flying circus, dr who, nova, macneil lehrer newshour, some business news show, and yoga are all shows I remember watching with my parents on PBS) [https://www.nytimes.com/1975/04/26/archives/monty-pythons- fl...](https://www.nytimes.com/1975/04/26/archives/monty-pythons-flying- circus-is-barnstorming-here.html?searchResultPosition=2)

A 1979 NYT article called it a "killer rabbit" [https://www.nytimes.com/1979/08/30/archives/a-tale-of- carter...](https://www.nytimes.com/1979/08/30/archives/a-tale-of-carter-and- the-killer-rabbit-president-orders-photograph.html)

I find it hard to believe there were not any people who made some humorous connections between the killer rabbit of caerbannog and the killer rabbit of a Plains, Georgia pond.

<comment><USER11> Cable wasn't much of a thing outside the big metros until the 80's. Most of the rural area in 75 had over the air. LA and NYC were there own world, and it showed from some of the writings of the time.

Someone might have, but it sure wasn't enough to justify the entry, and given the author didn't cite a source, I'm pretty sure it was just the author.

<comment><USER13> I didn't say anything about cable. From what I know of the history of cable, it started for places that were geographically isolated from receiving terrestrial broadcast (because of a valley of whatever). Terrestrial == over- the-air. [https://en.wikipedia.org/wiki/Terrestrial_television](https://en.wikipedia.org/wiki/Terrestrial_television)

Not sure why they NYT would have called it a "killer rabbit" if it was not a monty python reference.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> [https://en.wikipedia.org/wiki/Night_of_the_Lepus](https://en.wikipedia.org/wiki/Night_of_the_Lepus)

The killer rabbit _needs_ to be the next zombie fad. Hollywould can do nothing but remakes, let's have a modern CGI extravaganza remake of this please.

<comment><USER15> I am reminded of this: [https://en.wikipedia.org/wiki/Black_Sheep_(2006_New_Zealand_...](https://en.wikipedia.org/wiki/Black_Sheep_\(2006_New_Zealand_film\))

<comment><USER14> oh thank you for reminding me of that, Netflix has it now.

</comment></comment></comment><comment><USER16> Is it behind the rabbit?

<comment><USER17> _Run away!_

I never would have thought that the Pythons were inspired by medieval meme culture...

<comment><USER18> It's got fangs! Look at the bones!!

<comment><USER19> What's he do, nibble your bum?

</comment></comment></comment></comment><comment><USER20> Hare-raising stuff.

</comment><comment><USER21> "Drolleries sometimes also depicted comedic scenes, like a barber with a wooden leg (which, for reasons that escape me, was the height of medieval comedy) or a man sawing a branch out from under himself"

... because how could the barber amputate his own leg? Ahaha...

</comment><comment><USER22> I'm getting a "403 Forbidden" on this link.

Screen: [https://screenshots.firefox.com/iVgcEiymPOnHrmIX/www.opencul...](https://screenshots.firefox.com/iVgcEiymPOnHrmIX/www.openculture.com)

</comment><comment><USER23> I thought this was Inkulinati by Yaza Games for a second [https://mobile.twitter.com/YazaGames](https://mobile.twitter.com/YazaGames)

</comment><comment><USER24> The only defense was the Holy Handgranade.

<comment><USER25> Then it appeared in the Worms. [https://youtu.be/4dKnnUcNrwU](https://youtu.be/4dKnnUcNrwU)

<comment><USER26> Where it is the weapon with by far the biggest blast radius, but alas you only get one per game under the default settings.

</comment></comment></comment><comment><USER27> These look more like hares to me.</comment>


Doblet (YC S14) Plans to Be Everywhere Your Phone Charger Isn't - <AUTHOR> http://techcrunch.com/2014/08/18/y-combinators-doblet-plans-to-be-everywhere-your-phone-charger-isnt/

<comment><USER2> Wonderful idea that should gain traction at Bar/Clubs

</comment><comment><USER3> awesome</comment>


Ray Kurzweil: Humans will be hybrids by 2030 - <AUTHOR> http://money.cnn.com/2015/06/03/technology/ray-kurzweil-predictions/index.html <comment><USER2> Ray Kurzweil: I need to say anything that puts my name in the headlines again (2015)

<comment><USER3> True that. I also love the fact he gives himself a B grade in past predictions. Nostradamus would probably give himself an A grade and we know how useful his predications have been.

</comment></comment><comment><USER4> Ray Kurzweil: If someone hasn't invented brain uploading by 2030, I'm probably screwed

</comment><comment><USER5> Ray Kurzweil: I think that open source is irrelevant for the future of humankind. But keep an eye on Microsoft, my friend's company.</comment>


Will someone please buy hn.com and point it here? - <AUTHOR>

hackernews.com would be comparably appropriate <comment><USER2> A good suggestion but 2 letter domains are worth hundreds of thousands of dollars. They won't see the value in doing that.

</comment><comment><USER3> <http://hackerne.ws></comment>


Show HN: AidName.com - We'll Help Find Your Startup's Perfect .Com Name - <AUTHOR> http://www.aidname.com

<comment><AUTHOR> Hi HN,

AidName is a service which will help you find the best available .COM names for your startup or project. We noticed that naming projects was a problem a lot of people were experiencing and we wanted to help solve this problem. Any feedback is greatly appreciated.

<comment><USER2> Hi, AidName.

Your product seems really interesting, and I almost signed up... Then I noticed that "AidName" isn't a very inspired name.

I don't doubt the quality of your offering - by my advice would be that your own project needs a name (and branding) with more sex.

Just my $0.02. Good luck! Raj

<comment><AUTHOR> We do own NameMage.com, but feel AidName is more straight forward for regular folks. You can still try out our free offering to see if we meet your standards. We even offer a satisfaction or your money back Assurance Kit if you want to try that out too. We appreciate the feedback!

</comment></comment></comment><comment><USER3> I am confused between Customer Kit and Starter Kit. Your custom kit signup button does not show any price but the starter kit shows $99.

<comment><AUTHOR> The custom kit allows you to choose the number of available .COM names you want. You can select the amount you want in the Quantity drop down menu. Based on the amount it should show the Total Price. The Starter Kit is an introductory kit which offers a 20% discount for a set of 5 available .COM names. Hope this helps!</comment></comment>


SitesInCommon: Meet people near you who read the same sites as you do - <AUTHOR> http://alpha.sitesincommon.com/

<comment><AUTHOR> For anyone in the Bay Area, the Stanford Senior Project Fair (which this site was written for) is tomorrow, and it's open to the public.

<http://alpha.sitesincommon.com/meetups/1>

<http://www.stanford.edu/class/cs194/faire/index.html></comment>