Show HN: Poll – Voting done simply in real time - <AUTHOR> http://poll.lab.io

<comment><USER2> Shameless plug: I recently needed a super simple, clean and fast way to create a poll. Since I didn't find anything to fulfill my requirements, I built my own - [http://tally.tl/](http://tally.tl/)

And that's the poll question I wanted to ask: [http://tally.tl/GQDy3](http://tally.tl/GQDy3)

<comment><USER3> What about [http://strawpoll.me/](http://strawpoll.me/) ? Is there something that your site does differently than that one? Heres the same poll at strawpoll: [http://strawpoll.me/2716564](http://strawpoll.me/2716564) so you can compare. This site is commonly used at twitch.tv so that the streamer can ask the viewers a question, all results update in real-time. I have seen thousands of people use it simultaneously with no problem.

<comment><USER4> It's not perfect if you're worried about people voting more than once. We tried doing an office poll about something people held strong opinions about -- what video game to bring in for an office tournament -- and within twenty minutes, coworkers had rewritten ballot stuffing scripts in bash, PHP, and Python.

Not to mention that you can submit multiple votes by opening the page in an incognito window in Chrome.

</comment></comment></comment><comment><USER5> Seems the Pusher quota has been exceeded for the frameworks demo.

        Error : {"type":"WebSocketError","error":{"type":"PusherError","data":{"code":4004,"message":"Account over quota"}}}

<comment><USER6> Sylvain from Pusher here. I just up the app quota for the time being since it currently using our free plan.

The app should work fine now.

<comment><USER7> Good PR. Didn't knew Pusher yet. Am i the only one?

<comment><USER8> Pusher's been around for some years. In fact they were one of the pioneers of "realtime-push-as-a-service".

That said, the space is still relatively new (yes, there is a whole space! [http://leanstack.io/realtime-backend-api](http://leanstack.io/realtime- backend-api) ). Most developers of realtime apps use their own hosting but are gradually warming up to the cloud.

</comment></comment></comment></comment><comment><USER9> Looks really good but I found a _visual_ bug — the graph overflows (on small resolutions?) [http://d.pr/i/mQFV](http://d.pr/i/mQFV)

Also, are the polls embeddable? I couldn't find any information about it on your page.

<comment><AUTHOR> Not yet... it was built very quickly just yesterday... I will be fixing and adding (a limited amount) features over the coming weeks.

</comment></comment><comment><USER10> How does this compare to strawpoll.me

At first impressions, seems much the same.

</comment><comment><USER11> I like it, I made a similar one when playing with the javascript frameworks. However, outside of play, is Angular really the right choice here? 14kloc, for a poll? Seems rather excessive to me.

<comment><USER12> Thats a good point - looks like it's built on Rails too. Switch this to Node and React and it'll smoke. With Node it would also be super easy to use websockets and remove the need for Pusher too.

Not a big deal though - this is a really nice app. I just like talking about different frameworks and tools.

<comment><USER11> I agree, it's pretty slick. But the size would prevent me from using it on any mobile focused site.

</comment></comment></comment><comment><USER13> The interesting part is that a couple of similar services popped up in this thread and most of them are great but not well-known, so should we have a Hacker News Toolbox?

Discussion: [https://news.ycombinator.com/item?id=8413016](https://news.ycombinator.com/item?id=8413016) Poll: [http://poll.lab.io/dcla2GhYRr0lDLV7icEDMw](http://poll.lab.io/dcla2GhYRr0lDLV7icEDMw)

</comment><comment><USER14> Chart on my mba 11 is broken. [http://cl.ly/XsvS/Image%202014-10-05%20at%207.47.52%20pm.png](http://cl.ly/XsvS/Image%202014-10-05%20at%207.47.52%20pm.png)

[http://poll.lab.io/NxUvq0yzAL6zd_Dh7G1XGQ/results](http://poll.lab.io/NxUvq0yzAL6zd_Dh7G1XGQ/results)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0

</comment><comment><USER15> Shameless plug: I made a real time poller myself, in despair for the status quo a year ago (I'm a teacher student). You may try it here: [http://feedba.ch/](http://feedba.ch/)

Source code: [https://github.com/arve0/feedbach](https://github.com/arve0/feedbach)

</comment><comment><USER16> I am really missing the copy link feature for my results and poll. When I was on the poll voting page I was just looking for this button to copy it and was suprised there wasn't any, you just get to used to that type of thing. But that's just small detail. I like how simple the ui is. Good work!

</comment><comment><USER17> Looks nice, but the pie chart is really not a good choice. It's not clear at all which choice is the winner when some are close (among other things). Add an option to change to a bar chart or something else, or change the default please.

</comment><comment><USER18> Awesome!

There are currently no good "poll as a service" solutions out there. Not long ago, I searched pretty hard and tried all I could find.

For a MVP I only miss one feature in your solution: The ability to add options later on.

<comment><AUTHOR> That is a priority for me to be able to modify options... as I have said in other comments I just built this (very quickly in just one day) as I couldn't find anything that was elegant, free and required no registration.

I expect to get modifying options in hopefully by Wednesday if I can find the time.

</comment></comment><comment><USER19> Looks cool. Only issue I had was the graph size.

[https://db.tt/1RqhMsk2](https://db.tt/1RqhMsk2)

</comment><comment><USER20> I'm seeing the same bug as everyone else: the pie covers the bottom edge.

Win 8.1, Chrome (latest), 1366x768

</comment><comment><USER21> _Poll is a soon to be open-sourced project by Adam Butler_

Very cool. What's the stack?

<comment><AUTHOR> Yep... simple RoR app with Angular.js will be swapping out pusher soon for private_pub.

I will open source it just as soon as I can do an audit of any major flaws :)

</comment></comment><comment><USER22> It let me create a poll without typing a question or option. Might want to fix that :)

</comment><comment><USER23> It would have been nicer if there would be comments or chat on the results page

<comment><AUTHOR> I will be adding other features, but this will not be one of them. I built Poll because everything else made what should be simple far more complicated than it should be.

</comment></comment><comment><USER24> Very simply done. What were the lessons? What was the design process like?

</comment><comment><USER25> Nice.</comment>


The Xi Text Engine CRDT - <AUTHOR> https://github.com/google/xi-editor/blob/e8065a3993b80af0aadbca0e50602125d60e4e38/doc/crdt-details.md <comment><USER2> If anyone's interested, I wrote a long article a few months ago on (what I believe to be) the ultimate string CRDT, among other things: [http://archagon.net/blog/2018/03/24/data-laced-with- history/](http://archagon.net/blog/2018/03/24/data-laced-with-history/)

I really, really love the work that Levien and Hume have put into the Xi CRDT, and how open they've been with their research. IMHO, though, it's a bit too "academic" and clever for any sort of general purpose use, though it may well be ideally suited for its stated purpose. There even appears to be a limit to the amount of rewinding you can do, which points to O(n^2) complexity for conflict resolution: a huge problem for offline-first development, where concurrent timelines don't really have any limit on the length of their diverging histories. (I might be mistaken about this—please correct me if I'm wrong.)

Still a very satisfying algorithm, though! You can see more of Raph Levien's thinking here: [https://medium.com/@raphlinus/towards-a-unified-theory-of- op...](https://medium.com/@raphlinus/towards-a-unified-theory-of-operational- transformation-and-crdt-70485876f72f)

<comment><USER3> > offline-first development, where concurrent timelines don't really have any > limit on the length of their diverging histories

Is there really great utility in automatically merging wildly divergent documents? Being able to send your queued changes and agree on a new state of the world is lovely, but for most of the circumstances I can imagine the ideal new "state of the world" is "please fix this merge conflict", not "here's my best guess at a reasonable state based on the semantics of some data structure."

Maybe it's domain specific. Maybe in code you want merge conflicts and in some kinds of rich text docs you just want a best-guess auto-merge. Even then, though, I think it would depend a lot on what the document is for. Maybe blog posts and company culture docs should get auto-merge and legal contracts should get merge conflicts.

<comment><USER2> Yes, there is great utility in this approach! For one, most concurrent text editing, rich or not, is actually quite easy to merge in 99% of cases. But even that aside, when you have data structures or document formats that don't ever have to resolve conflicts—or, more accurately, when conflict resolution becomes something that's naturally done in app-space, on the edges, and not as part of the network layer—then you open up the possibility of offline-capable, collaborative apps that require zero coordination between nodes. A node with changes only has to _deliver_ their content to interested servers and peers, not engage in lengthy conversations about who has the definitive version, whether somebody has to revert, etc. You could build a Google Docs clone that synced entirely over Dropbox!

And in any case, the "merge" part would still be up to the app. The data structures will always be able to merge, sure, but the app could still throw up a dialog box on wildly divergent changes saying, "Hey, some crazy stuff happened here—want to look it over and commit manually?" (Where "commit" means generating new changes to overwrite any undesired changes, since it's not possible to literally undo.) You could argue that we've simply implemented ad- hoc coordination protocols in the app layer at that point, but IMO, that's exactly where they belong in cases where there's no authoritative store for your data. (Which is really the case with mobile, offline-first development.)

</comment></comment></comment><comment><USER4> Previous discussions about the Xi editor and rope science:

[https://news.ycombinator.com/item?id=17109930](https://news.ycombinator.com/item?id=17109930) (3 months ago, 47 comments)

[https://news.ycombinator.com/item?id=16267202](https://news.ycombinator.com/item?id=16267202) (6 months ago, 295 comments)

[https://news.ycombinator.com/item?id=14129543](https://news.ycombinator.com/item?id=14129543) (a year ago, 60 comments)

[https://news.ycombinator.com/item?id=11576527](https://news.ycombinator.com/item?id=11576527) (2 years ago, 177 comments)

</comment><comment><USER5> Also in this space, some Atom devs are working on a new editor/engine in Rust and have recently shifted focus to CRDT as a way to get collaborative editing and advanced SCM-like scenarios.

The editor is called 'xray' and the CRDT tech is Eon. They have some info here and you can find more in the repo/branches. [https://github.com/atom/xray/blob/master/docs/updates/2018_0...](https://github.com/atom/xray/blob/master/docs/updates/2018_05_28.md)

If you're into the client/server model of Xi, xray is targetting the same, including an in-browser experience connecting to a remote backed. Similarly, there is Theia-IDE which actually seems the most advanced in terms of a functional in-browser editor with a client/server model.

I think these tools are going to enable entire new generations of programmers on super low end hardware where their editor services and toolchains are running in a remote DC.

There are others in this space with similar tech, but most seem focused on very specific niches and use cases. If there are other softwares that hit the collaborative editing, CRDT, and in-browser experience points, I'd love to hear about them.

<comment><USER6> Hmm, what does low-end hardware have to do with it? I can't think of any challenge in text editing that requires beefy hardware.

Coordinating multiple editors is tricky, yes, but it doesn't need fast hardware, just good software and ideally a reliable network.

Editing text on a phone is hard, but that's a UI problem -- it's the small screen and lack of a keyboard. Most phones these days have very capable CPUs and plenty of memory.

(I agree that this technology is very cool, though! I'm just curious why you pick out that low-end use case.)

<comment><USER5> The point is that the frontend is a "thin" JavaScript UI rendered in the browser while the entire real dev environment is remote -- LSP (language sever protocol plugins aka autocomplete, semanic highlighting, nav to reference/definition, etc), other plugins, the project's toolchain, etc, are running in a container/pod on a beefy machine.

Theia (and GitPod.io) will give you this today and it is compelling. GitPod gives you a single button on PRs/Issues that drops you in a dev environment, ready to build and test at the click of a button. No cloning, no installing a toolchain, etc.

If Rust and Rust Language Server are running in a container with Theia, this means I can use a Chromebook-style device for serious, real development without having to enable dev mode or even Linux apps. Every machine in the world becomes a real potential development environment.

Theia even has (or is about to have) debug protocol support too. A real, full IDE running on a remote DC, accessible from your browser. ( If you follow what the Theia and Che devs are doing, they're trying to support the full VS Code API... Which is SUPER exciting!)

(Note, with the level I'm speaking about here, the CRDT is a bit of an implementation detail, but it's useful for collaborative editing and in xrays case, syncing state b/w the browser client and the backend and the underlying SCM system.)

</comment></comment></comment><comment><USER7> Does anyone know if there has been any work to apply CRDTs for collaborative editing of source code _AST_ , especially for something more complex than sexprs? I imagine that could be neat, but also have some pitfalls.

<comment><USER8> Yes definitely. I'm currently doing research in this field. And there are others doing research in this too ([http://www.expressionsofchange.org](http://www.expressionsofchange.org))

</comment></comment><comment><USER9> I enjoyed the post, but there's something that bothers me about using the name CRDT.

A CRDT is just what mathematicians (and functional programmers) call a Semilattice[1], right? In general, I find it frustrating when people make up new names for existing mathematical concepts because it deprives others from learning and seeing the big picture. Does this resonate with anyone here?

<comment><USER10> CRDTs and semilattices are definitely connected, but they're not quite the same thing. A CRDT is a data structure that can be merged across the network in a way that's commutative, associative, and idempotent. That much is exactly the same as a semilattice.

But when people talk about "string CRDTs", the underlying semilattice, the data structure that gets merged, isn't a string; it's usually something rather more complicated. Then there's a _function_ which interprets that more complex data structure as the string that the user or application really cares about.

So a CRDT is a semilattice equipped with an interpretation function.

But it gets even more complicated, because there are many ways to do CRDTs in practice. Rather than gossiping your _entire_ complex data structure across the network ("state-based CRDTs"), usually CRDTs try to only send what's necessary. This leads to optimisations like delta-based and operation-based CRDTs. These optimisations are crucial for real-world use of CRDTs, but their connection to semilattice theory is not immediately clear to me. (That doesn't mean there isn't one, though!)

In any case, the story is a little more complicated than "CRDTS are just a semilattice". I do wish more people knew about the connection, though.

</comment></comment><comment><USER11> While JSON isn't perfect, I hope they base this around the JSON CRDT[0] so it can handle nested structures well.

Also they might not need tombstones[1].

[0]: [https://news.ycombinator.com/item?id=12303100](https://news.ycombinator.com/item?id=12303100)

[1]: [https://news.ycombinator.com/item?id=12303467](https://news.ycombinator.com/item?id=12303467)

</comment><comment><USER12> This is an old link, but I could find [https://github.com/google/xi- editor/blob/master/docs/docs/cr...](https://github.com/google/xi- editor/blob/master/docs/docs/crdt.md) on master.

</comment><comment><USER13> I wonder when the Xi editor will be ready to use. I can't wait.

</comment><comment><USER14> Why's it under google's namespace in github? Was it there always?

<comment><USER15> Google allows it's employees to put their 20% projects on the google github, provided they a disclaimer in the README. It doesn't mean much but perhaps it's good for publicity. Xi has always been in there.

</comment></comment><comment><USER16> How does Xi editor compares to Vi and Emacs?

<comment><USER17> Vi and Emacs are older projects with a larger community, and thus there's a ton of plugins out there even for niche applications. Xi is much newer, and attempts to solve many of the problems that Vi and Emacs face (examples: in Vi's case the difficulty of writing extensions, and in Emacs' the difficulty in maintaining and extending the core of the editor written in C). Xi also focuses in areas that weren't considered that important when Emacs/Vim were first developed, such as asynchronous operations and collaborative editing.

</comment></comment><comment><USER18> This editor is probably gonna be banned in China if it got noticed by the government. Hell they banned Winnie the Pooh</comment>


Photography - 24 hour shot - <AUTHOR> http://greeksky.gr/GreekSkyForum/index.php?topic=2.0

<comment><AUTHOR> Hires image: [http://www.greeksky.gr/files/photos/landscapes/20101230Souni...](http://www.greeksky.gr/files/photos/landscapes/20101230Sounio24Big.jpg)

</comment><comment><USER2> It looks really cool!, but I don't understand how it is a 24 hour shot. It just looks like a tiny planet with a house on top. Could somebody please explain the image?

(The description by the author in the post is complicated)

<comment><USER3> Think of it as a wide 360 degree panorama picture stitched from images taken at different times of the day. This would yield a wide, non-distorted rectangular image.

This one combined image was then rolled around itself in such a way that its whole bottom edge is now in the center of this "planetary" image, and its top edge is now the outer circumference of the image (the border with black).

If you're wondering why the center point of the image is not heavily distorted it's because it was overlaid with a simple top-down photo of the place the tripod was standing on.

</comment></comment><comment><USER4> This reminds me of some of my friend Ethan's (completely analog) work: <http://ethanturpin.squarespace.com/photography/> (The round ones at the bottom.)

</comment><comment><USER5> Some excellent technical info lower down in the thread: <http://greeksky.gr/GreekSkyForum/index.php?topic=2.msg9#msg9>

</comment><comment><USER6> This is amazing, I wonder if most of the process could be automated and sold as a kit.

<comment><USER7> This is breathtaking.. An automated tool would definitely be useful and welcomed, but half the challenge and reward is also staying the 30+ hours to capture the image.

</comment></comment><comment><USER8> this is ridiculously cool. congratulations on the beautifully executing your plan.

</comment><comment><USER9> I've never heard of the "Polaris Circle" before. That is unbelievably cool.

<comment><USER10> The "Polaris semicircle" is an informal description of the arc that the star Polaris made due to the 11 hour exposure. Had it been a 6 hour exposure and he wanted to point out a different star, he might have labeled it as the "HR2742 quarter circle".

<comment><USER9> Ah, makes much more sense now! What I really meant then is that I've never seen any star in the "circular" shape shown in the pic

</comment></comment></comment><comment><USER11> beautiful

</comment><comment><USER12> I hate to be _that guy_ but does this really need to exist here instead of on Digg/Reddit/Fark/etc?

Flagged for now.

<comment><USER13> Wow. Let's take a look again at the guidelines, shall we?

 _On-Topic: Anything that good hackers would find interesting._

Check. I don't know about you, but I found this to be a very creative hack.

 _That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity._

Check. Definitely satisfied _my_ intellectual curiosity.

 _Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon._

Check. Nowhere to be found here.

 _Videos of pratfalls or disasters, or cute animal pictures._

Check. Likewise, none of the above.

 _If they'd cover it on TV news, it's probably off-topic._

Check. Definitely not a story for TV news.

Summary: Looks like a perfect fit to me.

<comment><USER12> This is the problem with a blacklist. This has nothing to do with intellectual curiosity, it's eye candy.

This is pretty typical blogspam material, your over-literal misunderstanding of what constitutes off-topic notwithstanding.

I bite my tongue every time I get the urge to remark upon the trajectory of HN, and instead I take the high-road.

I mark each case-by-case and I _never_ flag without explanation unless it's patently spam.

In return, I get people bickering with me over the letter of the law of what constitutes off-topic in defense of pictorial blogspam and downvotes.

Between this and the torrent of personality-blog mountebanks (who are defended by their sycophants), I'm tempted to just go back to being a code hermit.

You should know better, you've been a member as long as I have. Albeit unnecessary to see how specious the value of this post is.

Edit: On reflection, I'll stop bothering to explain my flags in future since the culture has shifted to downvoting in dissent.

<comment><USER13> I don't care much for these meta-discussions, but I think there's an interesting issue here, possibly worth pursuing a bit.

First, let's separate the wheat from the chaff. We're not talking, in this case, about personality-blog mountebanks, or sycophants. Nor are we talking about blogspam (under any definition I can imagine.) Nor, finally, are we discussing any "over-literal misunderstanding of what constitutes off-topic" or "the letter of the law".

What is at stake here is "what satisfies one's intellectual curiosity?" Because that is the guiding principle at play.

For me, this article definitely fit the bill. The idea of taking a 360 degree panoramic photo is nothing new, but to take it over a period of 24 hours was (in my estimation) a brilliant masterstroke. To me, it showed the kind of "hacker" approach that we tend to admire around these parts.

Now, as you say, you and I have both been around here for quite a while, so it surprised me a bit that we have such different estimation about what makes for a good HN submission.

I think that explaining flags is a good thing. But saying _"does this really need to exist here instead of on Digg/Reddit/Fark/etc?"_ isn't really enough for me to understand the nature of your objection. I get that it might not satisfy your intellectual curiosity as it does mine, but is that really worth a flag?</comment></comment></comment></comment>


American corporate profits are too high - <AUTHOR> http://www.economist.com/news/briefing/21695385-profits-are-too-high-america-needs-giant-dose-competition-too-much-good-thing <comment><USER2> > Last year America's airlines made $24 billion—more than Alphabet

As long as we're comparing entire industries to one company, I'm sure there are more vivid examples.</comment>


Show HN: Electronic Paper Display + Bluetooth LE + Lithium Battery - <AUTHOR> https://www.indiegogo.com/projects/pixsso-the-smart-display

<comment><USER2> Why so small? I want a large eink display for text editing for long periods of time</comment>


An Unusual Subway Stop in New York - <AUTHOR> http://www.nytimes.com/2015/09/16/opinion/a-very-unusual-subway-stop-in-new-york.html?mabReward=CTM&action=click&pgtype=Homepage&region=CColumn&module=Recommendation&src=rechp&WT.nav=RecEngine&_r=0 <comment><USER2> This article is a bit clueless. The state has more than adequately provided the MTA with money. The place where the state failed is providing sufficient oversight to make sure the MTA isn't wasting it.

Paris spent 1.3B euro on the 14 line, which has 9 stations. The MTA spent 2.4B on a single stop on the 7 line. MTA construction costs drastically exceed worldwide norms - the MTA spends $1B/kilometer.

[http://www.systra.com/IMG/pdf/metro_meteor_en.pdf](http://www.systra.com/IMG/pdf/metro_meteor_en.pdf)

[https://pedestrianobservations.wordpress.com/2013/06/03/comp...](https://pedestrianobservations.wordpress.com/2013/06/03/comparative- subway-construction-costs-revised/)

Apparently the only project outside NYC to cost more than $1B/KM is London's Crossrail. Even the Jubilee line extension is only $0.45B/km, and that's pretty pricey.

[https://pedestrianobservations.wordpress.com/2011/05/16/us-r...](https://pedestrianobservations.wordpress.com/2011/05/16/us- rail-construction-costs/)

tl;dr; Funding is adequate, costs are simply out of control.

<comment><USER3> Why are costs so much higher in NY though?

<comment><USER4> Costs are higher throughout the entire US for infrastructure projects. The US routinely pays an order of magnitude more per mile for similarly scoped projects compared to countries like Spain.

The root cause appears to be in the unique way projects are bid on in the US, where details need to be laid out in excruciating detail ahead of time and then any unplanned changes are cause for cost padding.

<comment><USER5> Sincerely curious: What's an alternative to the bidding process you mention?

<comment><USER6> Historically, most projects in the United States performed by public agencies have been of the "Design-Bid-Build" variety, but there are a number of other styles. Most of which involve the owner/agency contracting to _fewer_ entities who do _more_ of the various types of work that need to be done (design, constructing, managing, operating, financing etc.). Traditionally, in Design- Bid-Build the owner contracts with one company to design, they perform the bidding process, and a separate entity does the building, with financing also coming from their own operating/capital budget. The alternatives shown here [1] spice up that process. DBB isn't completely evil, the wiki page does a good breakdown of it's pros and cons. [2]

[1] [https://en.wikipedia.org/wiki/Project_delivery_method](https://en.wikipedia.org/wiki/Project_delivery_method)

[2] [https://en.wikipedia.org/wiki/Design%E2%80%93bid%E2%80%93bui...](https://en.wikipedia.org/wiki/Design%E2%80%93bid%E2%80%93build#Potential_problems_of_design.E2.80.93bid.E2.80.93build)

</comment></comment></comment></comment></comment><comment><USER7> 10 years to build a rail station! For comparison, 10 years ago the metro system in Shanghai was barely useful and now it is one of the worlds largest.

[https://en.wikipedia.org/wiki/Shanghai_Metro#/media/File:SHM...](https://en.wikipedia.org/wiki/Shanghai_Metro#/media/File:SHM_evolution_mid.gif)

We don't build like that in America anymore. Partly because it is more expensive (safety standards and such). Partly because population growth hasn't demanded it. But those things not withstanding, 10 years and a billion dollars for a one station extension is unambitious to say the least. And don't even get me started on the cluster-fudge that is BART / muni / AC / whatever.

<comment><USER8> That is a very impressing thing about China.

</comment></comment><comment><USER9> One of the things that makes this station more interesting:

[http://www.nytimes.com/2014/05/30/nyregion/trouble-with- diag...](http://www.nytimes.com/2014/05/30/nyregion/trouble-with-diagonal- elevator-held-up-no-7-subway-expansion.html)

</comment><comment><USER10> A little more background on the funding arrangement: [http://www.wsj.com/articles/new-subway-station-opens-on- nycs...](http://www.wsj.com/articles/new-subway-station-opens-on-nycs-far- west-side-1442171470)

</comment><comment><USER11> Got to ride this yesterday, and I've seen a lot of NYC Subway stops. This one is amazing. Comes at a price though for sure.</comment>


Education without loans: How income-share agreements can reshape education - <AUTHOR> https://www.richmondfed.org/publications/research/econ_focus/2020/q1/feature1 <comment><USER2> Another way for University-Finance complex to dupe students and extract more wealth from young people before they have the experience to make these calls sufficiently well (on average) ?

<comment><USER3> While it is a compromise and probably some progress, I think you're right that it would disincentivize any pressure to radically transform education and more importantly high-education to better serve folks.

<comment><USER2> I think the change we need is to move back towards a mentorship model. Maybe with the move towards automation, we can have more people available for teaching

</comment></comment></comment><comment><USER4> I love this idea. It completely removes the downside risk for students. The example in the article was a pilot who used an ISA to fund $21,000. He has to pay it back with 7.5% of his salary with a cap at $42,000 repaid or 104 payments.

He might ultimately end up paying a bit more than if he had a typical student loan but he could also end up paying substantially less. He is an entry level pilot during Covid-19, after all.</comment>


Meta casual gaming startup - PlayCrafter Teaser - <AUTHOR> http://www.youtube.com/watch?v=UjBTU02cCVY <comment><USER2> Looks pretty cool, and the physics are a nice touch. Honestly though, I'm pretty skeptical about people being able to create much of a variety of games unless they can do basic scripting. Still, there's a lot of 'remix this game' possibilities.

<comment><AUTHOR> I think they have a basic event framework. Think about all those side scrollers out there, working with the same physics and layout - with almost unlimited possibilities.

It's like myspace layouts + flash gaming. I think people will love it.

<comment><USER2> I hate to be the naysayer on this, but I disagree. An ugly MySpace page is interesting because your friends are on it. A bad game your friend made is still just a bad game.

People who are talented enough to make good web games already have a tool to do it with - Flash (typically a pirated version). It's not a perfect tool, but it's very flexible.

I agree that the physics in this thing look great though.

<comment><AUTHOR> You can't tell from the video, but the social aspects are really big. It's about making, sharing, and playing games with friends.

This isn't for people who know flash. This is drag and drop game creation. They might have solved a really hard problem here.

<comment><USER2> This could do for games what Dreamweaver and FrontPage did for web authoring - sweet!

</comment></comment></comment></comment></comment><comment><USER3> Sounds vaguely like Nostrademons' GameClay idea... I wonder what they are doing differently?

<http://news.ycombinator.com/item?id=225209>

</comment><comment><USER4> <http://www.playcrafter.com/></comment>


Find new friends in a new city - <AUTHOR> Is there an app or website set up to help people find friends in new cities? Connects through Facebook to find mutual friends and people with similar interests? <comment><USER2> Recent transplant to Phoenix here. Came for our startup, honestly some of the best luck I've had from an app is actually Tinder.

Just specify that you are new to the area and are mostly looking for new friends. Add everyone's Snapchat you can find too, it will give you a real lay of the land and what people enjoy doing / local culture etc.

<comment><AUTHOR> Yeah I was thinking Tinder, good to see its been done before!</comment></comment>


University of Reddit - <AUTHOR> http://universityofreddit.com/v2/ <comment><USER2> _It's a god damn miracle. Calculus is pretty fucking important and it's also easy if you're not a moron. So I'll teach you some of that shit._

Oh dear god.

<comment><USER3> I'd sign up purely for the entertainment value.

<comment><USER4> You can count on that.

</comment></comment></comment><comment><USER5> Many of these I'm sure where spurred on by CarlH's C++ Course <http://www.highercomputingforeveryone.com/> (used to be on reddit) which is a great resource for learning C++. The interactive forum style of reddit makes teaching and mentoring easy.

This is a great idea.

<comment><USER6> I'm not seeing any C++ there, both lessons focus on C. Am I missing something?

<comment><USER5> Excellent point I was wrong he focuses on C as someone higher up in the threat pointed out. My bad.

</comment></comment></comment><comment><USER7> This is great. If the teachers turn out to be good this will become a pretty nifty resource for learning. I hope it turn out to be like Khan Academy but with a lot more teachers.

<comment><USER8> I love the idea, seems terrific.

This has gotten me pretty motivated to learn some new stuff. I plan on taking the span 101 class and the game theory class. I only wish someone would open a Russian class, I'm getting a bit rusty...

<comment><USER9> Here you go:

[http://www.reddit.com/r/UniversityofReddit/comments/cma7t/cl...](http://www.reddit.com/r/UniversityofReddit/comments/cma7t/class_russian_101/)

</comment></comment></comment><comment><USER10> How are the teachers motivated?

<comment><USER11> karma points

<comment><USER12> if only one could buy food and shelter with those...

<comment><USER13> I be dammed if I can remember his name now, but there was a famous mathematician, who used to travel around to different universities, sleeping there and working on papers with the other professors.

So yeah, it is possible.

<comment><USER14> Paul Erdos, the peripatetic mathematician.

</comment></comment></comment></comment></comment><comment><USER15> i still don't get the redditness, someone care to explain

</comment><comment><USER16> It does remind me of south harmon institute of technology in the movie "Accepted". But I can't understand how this will work, anyone care to explain?

</comment><comment><USER12> coming next: 3 words that should terrify...

 _University of 4chan_</comment>


I broke Git :( - <AUTHOR> http://ibrokegit.com/

<comment><USER2> Perhaps instead of "how to correctly do what I did wrong", you should do "how to fix what I just did wrong". Knowing how to properly pull files is worthless when the entire setup is borked without the user knowing what they did wrong.

<comment><USER3> I do think that the correct instructions should be there, but it should also include how to fix it in the event that you didn't.

</comment></comment><comment><USER4> That "abandon your DVCS" article from the other day should reference this as yet another example of problems people just accept that they have to deal with.

</comment><comment><USER5> This should be called "I didn't use git correctly, and it did precisely what it was designed to do."</comment>


Using jQuery, Plugins and UI Controls With Backbone - <AUTHOR> http://lostechies.com/derickbailey/2012/02/20/using-jquery-plugins-and-ui-controls-with-backbone/ <comment><USER2> The biggest issue I run into with plugins and backbone is ones that rely on jquery position. The position api needs to be called after the element is attached to the dom and is not hidden. I like to encapsulate all the view logic within the view, but nothing alerts you to when the element has been attached and is no longer hidden. Typically I'll fire off an event in the router or parent view to then enable the plugin.

<comment><USER3> This is a big issue that I've hit up against as well.

For example, trying to tie a Backbone View (el, events) to a Twitter Bootstrap "Popover"(<http://twitter.github.com/bootstrap/javascript.html#popovers>) doesn't work in the "Backbone way" (we are talking about the same thing, correct?).

<comment><USER2> quickly looking at the bootstrap javascript they are making calls to $().offset which also doesn't work for hidden elements, so yes were talking about the same thing.</comment></comment></comment>


Six Hopeful Sci-Fi Stories of a Post Covid-19 World - <AUTHOR> https://sudowriters.com/anthology/fever-dreams/ <comment><USER2> I don't want to post a spoiler, so I will just abstractly say that I like the concept that children will remember this completely differently than adults do. For my little children, it's interesting and different to be sheltering in place. It's annoying they can't go to the local park, but they don't have anything near the stress and worry that adults do.

<comment><USER3> I'm with the other poster. Child experience and their memories will vary greatly (mainly around socioeconomic status).

I can't help but be afraid this will only bake in the inequality already present.

For my kids, this means more enrichment time, more time spent outside exploring the woods and streams around our home, and generally more quality creative time.

For the family down the street, this means more time in an abusive/shitty situation, less food, and more instability in the present and near future.

I feel like this is going to have a real, lasting impact on inequality, and not in a good way.

As an example; my grandfather talks about the great depression. He always says it wasn't that bad. But his family were already dirt-poor subsistence farmers. So for them, it was just less noise from other people. They had food, they had water, they had livestock.

But for my grandmother, who lived in town and was the daughter of a banker, the experience was very, very different.

And you could tell by the way they acted. Grandpa was free to give out food/money to anyone who he thought had a need. Grandma hid silver and various other valuables in floorboards and in wall-slats.

I can't help but feel like this is going to have a similar outcome for many people.

<comment><USER4> Society-wide, though, the Great Depression led to the New Deal, which radically reduced inequality, created our first social safety net, and set the stage for decades of public policy whose net effect was to reduce inequality. Hopefully we will see another silver lining with such lasting impact on society.

[edit: typo s/last/lasting/]

<comment><USER3> I don't know enough about it to infer anything. Is there anyone reading this thread that can speak to political leadership and social will today compared to immediately before the New Deal?

My take is that we're at a place in politics where any positive change is very unlikely. Maybe I'm wrong.

</comment></comment></comment></comment><comment><USER5> There's this really brutal and obscure documentary I watch about the Congo War in the late 90s whenever I need to appreciate life. It's called "Kisangani Diary." It's far more terrifying than any horror movie because it's real.

It's a documentary about a relief mission that goes out into the Congo using disused railway tracks in order to feed 10s of thousands of Hutu refugees wandering around in the forest fleeing reprisals for the earlier genocide in Rawanda. They are starving to death and being chased by militia who are shooting at them from time to time from the forest. Absolutely no one except for the people in this relief mission cares about what happens to them.

The movie begins with the narrator saying that almost everyone you see in this film will be dead by the end of the movie. When I rewatched it lately, I wondered about those lines and what the future holds for us. What kind of documentary are we in? What if ending shelter in place fails. What if a deadlier strain shows up? What if this is the early days of WW III? All things to contemplate in my opinion, because I've been watching this since January and every week I expected things to get better and they've just been getting worse.

<comment><USER6> > What if ending shelter in place fails.

98% of people who contract corona virus recover just fine, So lockdown is unnecessary.

The original reason for it was to not run out of ventilators, but we know now that ventilators have a mortality rate of 66% to 90%, so use a cannula instead as long as possible.

We should let corona run its course like every other flu year.

> What if a deadlier strain shows up?

Ebola is deadlier than corona. So's obesity.

But the flu we're dealing with is only about 2% fatal.

<comment><USER7> _" 98% of people who contract corona virus recover just fine"_

I don't know where you get that number from, but there's still not nearly enough testing to know what percentage of infected people recover, and not enough tracking of recovered individuals to know if they're doing "just fine" afterward, suffer debilitating health issues, or something in between.

 _" lockdown is unnecessary. The original reason for it was to not run out of ventilators"_

This is not true either. There are multiple reasons for the lockdown.

One of the primary reasons is to buy us more time to develop treatments and vaccines, and for more testing to be rolled out.

Another major reason is not to overwhelm the health care system. This has failed to some degree, but it would be way, way, way worse if there was no lcokdown at all and exponentially more people got sick all at once.

Yet another reason is to buy those people who haven't yet gotten sick more time and more life. If these people could hold out for a year or two, or even some months, that could mean more months or years of life for them. The importance of this can not be understated, and even if they do get infected eventually there'll hopefully be treatments available by then, and they'll stand more of a chance of survival.

Yet another benefit of a lockdown is to keep the disease from spreading further. The outbreak can be managed if we test enough people and quarantine them as infected people are detected. This is the main hope that increased testing give us, and that testing just wasn't even available in the US a month ago, and even now we're just beginning to get that capacity, though we still need way more tests.

 _" ventilators have a mortality rate of 66% to 90%"_

According to Daniel Griffin of the infectious disease department at Columbia University, and chief of infectious disease at ProHealth Care Associates (the largest physician-owned multi-specialty practice in the country, with about 1000 physicians and 3 million patients in the Tri-State Area, with 240 practices, 24 urgent care centers) and on the COVID-19 response team and his boots on the ground in NY hospitals, the survival rate for people on ventilators is about 50%.[1]

 _" We should let corona run its course like every other flu year."_

This is an invitation to let millions of people die.

COVID-19 is not "like every other flu". First, it's not a flu at all. Second, we don't know what the mortality rate of it is as there's not enough testing, and also many deaths from it seem to be happening but not being counted as COVID-19 deaths due to lack of testing and an overwhelmed health care system. Even morgues are getting overwhelmed. Gigantic convention centers and Central Park in NY are being converted in to makeshift hospitals. I've also read that death from COVID-19 is the leading cause of death now in the US.

This does not happen with "every other flu".

[1] - From about 13 minutes in to episode 595 of _This Week in Virology_ : [http://traffic.libsyn.com/twiv/TWiV595.mp3](http://traffic.libsyn.com/twiv/TWiV595.mp3)

<comment><USER8> On your last point, you do know that even a very low-lethality virus, spreading through a completely virgin population with no established immunity, will easily overwhelm a healthcare system used to working on tight margins, in very scary looking ways. This however doesn't speak of the virus's actual threat level in an absolute sense, and it leaves us far from the terrifying end-of-the-world hyperbole im seeing in this HN post so far.

Even at overwhelming healthcare, Covid has been far from nightmarish. In most of the world so far, things like what happened in New York, Italy, Spain, haven't been the case. Furthermore, even in Italy, New York, Spain and other places, evidence is clearly indicating a notable downward curve of saturation, already.

I can't speak for the near future and other potential changes, especially on the economic front (caused more than partly by a great deal of new rules that might actually be artificially making worse things that could have been handled much more calmly) but We are not in the apocalypse so far people, get over yourselves.

There are even several countries that haven't even applied quarantine models or lockdowns and they're doing okay so far despite being well into the general curve of the spread.

</comment></comment></comment></comment><comment><USER9> I haven't read all of them, but so far, I've enjoyed "Sheltering Notebook" the most. Nice work!

<comment><AUTHOR> Thanks! Glad you enjoyed it :)

</comment></comment><comment><USER10> [https://en.wikipedia.org/wiki/The_Eyes_of_Darkness](https://en.wikipedia.org/wiki/The_Eyes_of_Darkness) definitely which tells the story of Wuhan-400 virus.</comment>


Hackers Have Stolen Millions of Dollars in Bitcoin Using Only Phone Numbers - <AUTHOR> http://www.forbes.com/sites/laurashin/2016/12/20/hackers-have-stolen-millions-of-dollars-in-bitcoin-using-only-phone-numbers/#603fd1ab22db <comment><USER2> It's completely ridiculous for a service to offer 2FA with SMS and also password recovery via SMS to the same phone number. It sounds like that's how this guy got hacked. He was effectively using more like half-a-factor authentication. He probably didn't realize because his email service didn't clearly show him how it will grant access.

It would be great if online services showed a clear matrix of authentication methods so you can see which combinations are sufficient and necessary to access your account. Simply adding a 2nd factor is a bad idea because it means if you lose either one, you're locked out of your account, so you also need a 3rd factor to protect you from yourself. I personally have 4 factors for my gmail account - regular SMS 2FA, a friend's phone number for password recovery and paper backup codes. This way, I can lose almost any two factors and still have access. If I forget my password and also lose access to my friend's phone for password recovery, then perhaps I'll be in trouble but Google doesn't make it clear if they'll let you in using only your backup codes and 2nd factor phone number.

<comment><USER3> It's even more ridiculous for a telco CSR to transfer his number to another provider without doing any sort of proper validation beforehand. A simple callback to ensure that the person calling was indeed the owner of the number would have prevented all of this.

<comment><USER4> In the process of transferring a phone number now and it seems to be universally insecure. Sign a paper and you're done.

A simple automated SMS from your current provider that requires a "YES" response would be a lot securer and shouldn't be hard to implement.

<comment><USER5> Don't forget number porting is recently new. The FCC started requiring carriers do it in 2003. Since the telco's were forced to do it, you think they are going to put any effort into it unless legally required to do so? They don't care.

<comment><USER6> Nearly every carrier has a customer provided pin attached to the customer account that is used to verify porting requests.

Stop commenting on things you know nothing about.

<comment> nommm-nommm There has literally been hundreds of cases reported in the media in the last few years where the phone company ported a phone number either without verification or with "verification" (easily found information) and the victim had their accounts stolen. This has been a documented problem.

Phone companies seem to be starting to take the issue more seriously as of the last few months due to the aforementioned bad press. Verizon just forced me to create a PIN by Jan 24th, 2017. So I didn't have a PIN until less than a month ago.

<comment><USER6> The practice has been in place so long, even a lumbering giant like Verizon requires it... Hahaha

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This happened to me about a year and a half ago, luckily I only lost a couple bitcoins that I had in coinbase, it could have been a lot worse.

The major crux of this article is the paragraph where it talks about how regulations essentially allow phone carriers to do whatever they want, with no guarantees of security, no indemnity, and if anything goes wrong there's no repercussions whatsoever.

There is literally nothing you can do to prevent this, any kind of "flags" or "extra security" you request are entirely enforced at the whim of individual call center personnel, and it only takes one person to ignore them. My case was similar to the article, I had some basic security flags enabled on the account but they were buried in notes from calls years ago and obviously no CS rep is going to read through years of notes on every call.

In my case the attackers called Sprint customer service over 100 times over a 5 day span. On the day I was breached they called 12 times within 3 hours before a weak link allowed them to transfer my number. No alerts to myself or the account holder, no notifications, nothing. The first rep I called after this occurred gave me great detail into the calls and what they had asked, apparently some of the numbers even came from different European countries. I immediately tried to escalate to their fraud department and was stonewalled hard. The fraud people denied any pattern of calling into their support lines, denied any transfer of my number (even though reps later happily helped transfer it back from Google Voice), and denied any action on the part of Sprint that caused this to happen.

Lawyers essentially told me I was out of luck, there was no recourse unless I was willing to go to war in the courtroom and unfortunately I don't have _that_ many old BTC.

It is absurd that such telecommunications backbones have such lax policies, much less no repercussions when they screw up. This will continue to be an attack vector until we force some sort of regulation that requires extraordinary damages to be paid per case... something tells me even low fines and slaps on the wrist won't incentivize the telecoms to provide _actual_ customer service.

<comment><USER8> > _The major crux of this article is the paragraph where it talks about how > regulations essentially allow phone carriers to do whatever they want_

So, in a word, phone carriers are actually _unregulated_ when it comes to the relevant facts in here.

Isn't that a paradox then? Using bitcoin in order to deregulate the financial system and then ask more regulation for phone carriers in order to protect your unregulated bitcoin?

<comment><USER9> "Real" bitcoining doesn't use services like coinbase; the coins are on your computer which you have to secure yourself. At least this is what you get told in cryptocurrency forums when one of the exchanges get hacked.

<comment><USER8> You didn't read TFA. There were no online exchanges involved, the bitcoin wallet was in his computer.

<comment><USER9> Oh ok, then it's the other way 'round. "Security is not easy, if you can't handle it better leave your btc on the exchanges." Either way, it's all by design, if you lose your money it's your fault.

</comment></comment></comment></comment></comment><comment><USER10> Another thing to keep in mind is that most phones will display the content of SMS messages on the lock screen, even if the phone is locked. That means that if your phone is stolen, hackers can easily take control of accounts such as PayPal that use SMS verification as the only way of establishing one's identity.

This exact scenario happened last week to a friend of mine, I wrote a little article about it: [http://gregschlom.com/misc/2017/01/29/hacking-paypal- account...](http://gregschlom.com/misc/2017/01/29/hacking-paypal- accounts.html)

<comment><USER11> That's one of the first things I setup on my Android phones. You can see that I have notifications, but not their content.

<comment><USER12> That really needs to be the default.

<comment><USER13> On Android _, it asks you when you set your passcode for the first time.

_ Super fragmented, but Nexus 5X had it.

<comment><USER14> My Sony Xperia also asked me at lock screen configuration. I could choose either way, but could not ignore the question.

</comment></comment></comment></comment></comment><comment><USER15> How was the hacker able to port the victim's number to another provider?

In the UK, the first step in porting a number is to request a 'Porting Authorisation Code' from your current provider. They don't give you that over the phone, but send you an SMS. So AFAIK you need to be able to receive SMS on the number already, in order to transfer the number to another provider.

So, was this hack enabled by a weakness in the US number porting process?

(In China, where I live, number porting isn't possible. Getting a new SIM requires you to physically present yourself and your passport or national ID card. If passport, the passport number must match the passport number they have on file, so a replacement passport wouldn't get around this requirement.)

<comment><USER16> These SocEng attacks are to retrieve that code from the old provider. It works the same way here

<comment><USER15> "It works the same way here"

here = UK?

</comment></comment></comment><comment><USER17> I thought the story sounded familiar - Jered Kenna - this story's lead, claimed to have lost 800 BTC in 2013 (1)

That story got him quite significant press at the time, I found thousands of deviations of the original Bloomberg story - people LOVE the "darwin award" story category.

I was going to crack a joke about this being a Paul Graham submarine strategy (2) but it's just too sad and I believe him, 2FA is a mess.

(1) [https://www.bloomberg.com/news/articles/2013-04-10/meet- the-...](https://www.bloomberg.com/news/articles/2013-04-10/meet-the-bitcoin- millionaires)

(2) [http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

<comment><USER18> It's a shame that 2FA is often implemented via unsecure SMS.

The apps are actually more secure.

<comment><USER19> I agree, but it's worse than that, with SMS widely used for account recovery.

> But 2FA via SMS is ubiquitous because of its ease of use. "Not everyone is > running around with a smartphone. Some people still have dumb phones," says > Android security researcher Jon Sawyer. "If Google cut off 2FA via SMS, then > everybody with a dumb phone would have no two-factor at all. So what's worse > — no two-factor or two-factor that is getting hacked?"

The thing is, SMS is worse than a reasonably good password. So it's a bit annoying that Google strongly encourages me to register my phone number with my gmail account for recovery.

And many services, including Google, make it difficult or impossible to enable TOTP without first registering a phone number. They really really push the SMS route. Brings up the average security level for the average person, I'm sure. Very annoying for me.

<comment><USER20> This is interesting to me, as I live in an area with no mobile reception.

So (for me) it's a real PITA when places _require_ a mobile phone number and there's no way to skip it. Obviously, can't use those services.

Does anyone know if Google Authenticator would run on a wifi iPad? As a potential workaround for the "no mobile network" situation.

<comment> joatmon-snoo No connectivity is required, it's TOTP on a 30-second interval. The tl;dr: is that you have a shared secret (so if this ever gets leaked to an attacker, yes, you're vulnerable) which is used in conjunction with current time (give or take a few seconds) to generate a code you can use to confirm authentication.

<comment><USER21> This may sound silly, but keep in mind that TOTP requires that both ends agree on the current time. I learned this the hard way when my authenticator stopped working consistently.

Apparently I had disabled my device's (the one with the authenticator app) "automatically set time from NTP" feature. Over time this resulted in my device's clock drifting X seconds away from the providers' clock(s), which in turn resulted in my occasionally using codes that were already X seconds expired.

<comment><USER18> The counter based OTP is actually more secure, but Google doesn't go for them with end-users, because they can go out of sync (eg if your kid is idly flicking through a lot of them on your phone) and then have to be reset.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Never attach a cold wallet to an online machine. Sign transactions offline and transfer them to an online machine for uploading.

<comment><USER23> Yes. The guy really got careless.

<comment><USER24> He had a 30 character password on his wallet. How the hell did they get past that??

How the hell did they even get on his him computer in the first place? I don't see how 2FA breaches could accomplish that.

edit: apparently you can have Microsoft make your online Microsoft cloud password be tied to your machine login. That's such a bad idea. One Microsoft customer support moron can effectively kill you computer. Also, even if they got this guy's computer password, how the hell did they get into it remotely? He made his computer visible for remote login on the Internet. I can't believe that.

</comment></comment></comment><comment><USER25> pretty insane he was making 50 btc for mining in a day....he must've had a sizable sum.

I really do not condone ripping people off or hacking but I have to admire the tenacity of these hackers, nothing is out of bounds, every opportunity to steal or rip people off is a naked call option where only their time is the currency that can be lost with a failed heist.

It's the new bank robbers of our age but without films or hollywood glamourizing it (yet) the same bank robbers.

Crime does pay but it's a shame smart talent is being used to destroy not build. We can't point fingers at specific regions or countries with a depressed economy and expect them to find honest work-they may not exist there when government corruption has already robbed their citizens of the livelihood they were owed. This is not a justification for criminal action but a mere observation of the structural environment giving rise to such behaviours.

<comment><USER26> This story was interesting: [http://www.bbc.com/news/magazine-37735369](http://www.bbc.com/news/magazine-37735369)

I don't see how to stop it though. For areas of the world with few economic opportunities, and little resources to chase you...the risk/reward profile is just too tempting.

<comment><USER27> I remember reading online that to bait the valve half life 2 leaker/hacker to come to the US for authorities to capture, valve sent the hacker a phoney job offer. At the end of the day, all these smart tech workers want is to get paid for their skills.

[https://www.wired.com/2008/11/valve- tricked-h/](https://www.wired.com/2008/11/valve-tricked-h/)

[https://arstechnica.com/gaming/2016/06/what-drove-one- half-l...](https://arstechnica.com/gaming/2016/06/what-drove-one-half- life-2-super-fan-to-hack-into-valves-servers/) (better story)

<comment><USER25> man I really got a new perspective on Gabe. Blatantly deceiving the German guy to cause tremendous harm to his life by colluding with the Gestapo even when Half Life 2 was a tremendous success and none of his precious monies were lost in the process, in fact the leak only raised the profile for Half Life 2 resulting in more sales.

I definitely won't be buying Half Life 3.

TIL Gabe Newell is actually very narrow minded and not a nice guy. Hacking and leaking is also bad but it's not clear that the action led to losses when Half Life 2 was a phenomenal success. It's the deceptive tactic of pretending to offer an olive branch and going back on your word. He should be fucking ashamed of himself.

<comment><USER28> Say someone broke in to your house, rifled through your stuff, and put pictures of your personal things on instagram. Would you not want to press charges?

<comment><USER25> I'm sure you can see the night and day differences. Gabe just got free PR exposure. He should've kept his fucking word and gave the guy a job but instead he got soft.

Tony Montana said it the best: all you really have at the end of your life is your word and your balls and how well you kept them.

</comment></comment></comment></comment></comment></comment><comment><USER29> This is why I would never store any substantial amount of bitcoin on ANY online service, no matter how good their reputation for security.

If the amount is above say, $500 or so, it should be stored in something like a Trezor, where only you have the keys to access it.

</comment><comment><USER30> Related, but not directly to the article:

This post [1] from Kraken covers how to protect yourself from this kind of attack. It's quite thorough. Interesting even if this isn't a concern for you directly.

1 - [http://blog.kraken.com/post/153209105847/security- advisory-m...](http://blog.kraken.com/post/153209105847/security-advisory- mobile-phones)

<comment><USER31> > [http://blog.kraken.com/post/153209105847/security- > advisory-m...](http://blog.kraken.com/post/153209105847/security-advisory- > mobile-phones)

A 40-step instruction "how to make your google account secure" as a proof of the sad state of internet security. No way my parents can do it.

<comment><USER30> It's so true. That post is both thorough and correct, and thoroughly depressing. Luckily your parents probably don't have a lot of bitcoin to protect.

</comment></comment></comment><comment><USER32> If you own any substantial amount of Bitcoin you should really be using a hardware wallet these days to keep it safe from theft.

Ledger Nano s, Trezor, and KeepKey all stop this sort of attack.

<comment><USER33> Why hardware wallet? Why not store encrypted wallets online/somewhere?

<comment><USER34> A hardware wallet allows you to spend coins without exposing the private keys. To spend e.g. a paper wallet, you have to swipe the keys on a computer. Yes, that can be offline, but a HW wallet reduces the amount of possible mistakes in this process.

<comment><USER35> What if the hardware gets stolen or destroyed (or simply breaks)? Is there any way to still get the access to that wallet back somehow?

<comment><USER32> Yes, in the case of the Ledger Nano S for example when you set it up for the first time it gives you a 24 word recovery seed that you write down and keep in the safe place. The seed is created according to a Bitcoin standard (BIP39) If anything happens to your hardware wallet you just buy a new hardware wallet that supports BIP39 and you are back in business.

If you want to be really secure you can engrave your recovery seed into a piece of metal that won't melt in typical house fire temps like brass.

<comment><USER35> Thanks for the detailed answer, exactly what I needed! Would you recommend the Ledger Nano S? It seems like it's half the price of Trezor for some reason.

<comment><USER32> I have a nano, it does the job. Build quality feels cheap but like you said it is half the cost of trezor. Keep key is a trezor clone trezor was first in the space and I think there build quality is better

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> >Windows account, which was the key to his PC.

The windows 10 experience

<comment><USER37> Yeah that part was hard to read.

But Macs work similarly IIRC; if someone has access to your iCloud account, they own your machine as well.

I think this is more of a comment on the cloud-centric-everything-must-live- in-the-cloud-now mentality than anything else.

<comment><USER38> Of course, macOS and Windows 10 both still give you the option of creating user accounts independent of an Apple ID or MS account, which is what I do on my macOS and Windows 10 systems.

But there's good reason these OSes tie local logins to online accounts. The average user is more likely to get frustrated forgetting or not understanding why their email password is not their login password, than the (comparatively) rare scenario that someone will compromise the one-account-to-rule-them-all and wreck all their data. My grandmother confuses her Gmail login with every other online account because they all use the email address as a username.

Also, I'm continually amazed how little normal people care about the data on their computers. I still have all my files from when I was 5 years old on my main machine, but most people only care about bringing over whatever they're currently working on when they get a new machine.

</comment></comment></comment><comment><USER39> It seems unwise, in retrospect, to make the phone company a critical element of a security mechanism, as it has no skin in the game.

<comment><USER40> The whole phone number as primary authentication method seemed liked a bad idea from the beginning, at least to me.

</comment></comment><comment><USER41> I know hindsight is 20/20, but with a wallet that valuable, it would have been prudent to split that into smaller encrypted wallets of, say, $1000 apiece, and only mount what was necessary (partition the external HD).

<comment><USER29> Or just use one of the many devices built for offline cold storage (Trezor, etc).

<comment><USER24> Or move the majority of it to an index fund. Keeping bitcoin in a wallet on your computer is like burying cash in your back yard.

<comment><USER42> 800 coins in BTC vs $64 in a fund...

Sort of misses the point when BTC was going from $0.08 a coin to $1000 a coin.

Most index funds don't offer a $64 to $800,000 trajectory even over 5 years.

</comment></comment></comment></comment><comment><USER43> I am going to coin the term "Bitcoin Rodeo".

It refers to the fact that people get rich from bitcoin if they don't fall off their bull by:

Losing their coins e.g. forgetting a password, throwing away a laptop.

Having their coins hacked from their computer by a Trojan or the mentioned attack.

An exchange loses them or shuts down.

Due to greed you wait it out and bitcoin plummets to zero

Due to greed day trade your stash into the ground.

Due to fear sold your 1000 btc at 10$ each back in the day.

Etc.

<comment><USER44> And this is why Bitcoin is doomed to fail as a genuine currency. Imagine if your bank said they had lost your money and tough luck on you. Or you bank emails you to say they have been hacked and all your money is gone. Or the bank just disappears offline and your money is gone. Or you forget a password and so your bank says sorry, but that means all your money is gone forever.

Great system.

<comment><USER45> Apples and oranges. Your bank doesn't issue currency. Your bank could accept bitcoin and run nearly the same as it runs today.

<comment><USER43> Except that you wouldn't get much legal protection if someone runs off with your bitcoin. A bitcoin transaction is irreversible and unfreezable, so there is not a lot the bank or legal system can do to try and retrieve stolen funds. And there is less of a trace to who the thief is.

As a result you probably aren't going to get the government failure guarantees on bitcoin as you would for fiat. Let alone governments wont want you using a different currency that they can't print.

<comment><USER45> No one can "freeze" cash, either, which is what currency is. A number in a bank account can represent us dollars, bitcoin or whatever else. You're talking about two different things here.

I agree with your point about government failure guarantees, however.

<comment><USER43> I was talking about money in a bank account (i.e. an electronic record of a bank's liability to it's customer), rather than cash.

</comment></comment></comment></comment></comment></comment><comment><USER46> I hate the forbes.com website, but a great story. Guy's phone number got hijacked, then they reset his other accounts by sending codes to his phone number on file. Maybe we need 3FA?

<comment><USER47> I still don't understand how jacking his phone yielded his wallet password.

<comment><USER48> One of the accounts that ended up being compromised using his compromised email accounts was his Microsoft account, which he used to log in to Windows 10. Presumably the attackers were able to connect remotely, or maybe download his files out of the cloud, or something. They had the keys to the kingdom.

<comment><USER49> Anyway, the wallet was password protected. Still don't get it.

<comment><USER34> From what the article said, I understood the hard drive the wallet was on was encrypted. Once mounted, the wallet would be accessible to anyone with login access to the OS.

<comment><USER24> I don't understand how they got into his computer in the first place. No amount of 2FA breaching could possibly get somebody into my Windows machine remotely. And not having a password for his wallet makes nonsense whatsoever. I'm thinking Forbes has something wrong.

<comment><USER34> Going by the article, gaining access to his Microsoft account was enough to provide access to his Windows machine. I'm not sure I'd trust Forbes to get this right, but a quick googling indicates that having access to the MS account the main Windows user is linked to will let you recover the admin password.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Coinbase offers FULL digital currency insurance against theft, underwritten via a Lloyds of London Syndicate:

[http://www.coindesk.com/facebooks-ben-davenport-leaves- bitco...](http://www.coindesk.com/facebooks-ben-davenport-leaves-bitcoin- startup-bitgo/)

Lloyds isn't getting involved unless they have an incredibly high degree of satisifaction in security processes, in fact they stripped Elliptic of their first ever "vault" insurance shortly after awarding claiming they didn't like the "publicity".

[http://www.coindesk.com/lloyds-back-bitcoin-insurance- deal-e...](http://www.coindesk.com/lloyds-back-bitcoin-insurance-deal- elliptic-vault/)

<comment><USER50> If you use coinbase, you don't own your bitcoins. Coinbase does, and they pinkie promise to give them back when you ask.

Get a mobile wallet like Mycelium. It's very simple, and you back up your wallet forever with a short string of words. You also retain control of your private keys.

<comment><USER51> The difference being that Lloyd's isn't going insure your personal wallet.

How is using Coinbase different from holding a balance with any other bank?

<comment><USER52> Coinbase unilaterally decided to hold my coins hostage until I submitted a bunch of ID papers to them. This is for coins already in my wallet, not about buying more or selling them and getting cash to my bank account.

<comment><USER53> Do you think they were making sure nobody was stealing from you?

<comment><USER52> I already had 2FA - they force it IIRC. They also refused to delete any of my documents. It was related to connecting with my bank account. (Which they removed, as my Canadian passport somehow means I am not allowed to use banks in the US as a permanent resident.)

</comment></comment></comment></comment></comment></comment><comment><USER50> Why would you go through the rigamorole of encrypting something if it can be undone with a text message?

If you want to store Bitcoin, use (in order of preference) a reasonably secure computer (not an obviously poorly secured windows machine), a secure cell phone (not a $50 backdoored Chinese android phone), or a hardware wallet. Don't use cloud services, web wallets, or anything else that very obviously sucks from a security perspective.

I would be more than willing to trust, say, $50,000 in Bitcoin to an iPhone with a good passcode, running an SPV wallet. Above that and you probably ought to put in the modest investment for a hardware solution.

</comment><comment><USER54> TLDR, don't bind anything valuable to a phone number. If a service wants you to, pick an alternative.

</comment><comment><USER43> This is of course why bitcoin is a bad choice for most people, except for beer money amounts. Despite a lot of security precautions from a savvy user, someone made off with this stash.

Shame he didn't keep them in an exchange. Oh wait...

I always thought had I got in early in bitcoin I'd plan to sell off in tranches at $1, $10, $100 value etc. Then at least when the coins get stolen or worthless I'd have something to show for it.

My prediction: Bitcoin will become worthless in the long term once the crypto is cracked by mathematics, a backdoor or quantum computing

<comment><USER55> Bitcoin is secured by relatively simple algorithms, mostly relying on the SHA-256 hash. If this is broken, the internet has far bigger problems than bitcoin becoming worthless.

<comment><USER56> That's a hell of a strawman. No one claimed SHA-256 is insecure.

</comment></comment></comment><comment><USER57> So if someone steals your microsoft account, they can remotely steal the files on your computer?

And how did they crack a 30 character password? Was it written down somewhere? Or extremely repetitive?

<comment><USER58> The hackers reset his password, and whatever dumb e-mail system the guy was using lets you do this with only your phone.

<comment><USER57> What?

He had the bitcoins stored in an external encrypted hard drive. Then he plugged the hard drive in, and they somehow stole them. They were encrypted with a 30 character password. You can't do a password resent on encryption. I'm asking how did they get the file from his external hard drive, and how did they decrypt it?

</comment></comment></comment><comment><USER59> Couldn't somebody make a phone company with better security? It seems stories about accounts being stolen via the phone company as weak link have been around for several years now.

<comment><USER60> Why would you want to trust the phone company? This is a solved problem, use IP and SSL. Of course you can't implement the really dumb "half factor" SMS authentication this way (because it's shown for what it is.)

</comment></comment><comment><USER61> Please explain how Kanna lost bitcoins if only his accounts were hacked not computer where the wallet is?

I dont get how 2fa is supposed to prevent local hack btw

</comment><comment><USER62> I wrote just 1 year back a similar article but about email:

[https://medium.com/@fpresencia/your-email-is-your- password-5...](https://medium.com/@fpresencia/your-email-is-your- password-5137f4850eec)

</comment><comment><USER63> The word hacker is giving me an identity crisis every time a headline like this comes out.

[http://blog.ikura.co/posts/dear-mainstream- media.html](http://blog.ikura.co/posts/dear-mainstream-media.html)

<comment><USER55> That battle was lost years ago.

</comment></comment><comment><USER33> Question about storing bitcoin. Can I encrypt my bitcoin wallet into a file and store it in S3 (or anywhere in the cloud)?

Is there an app or service that does this without them having access to your bitcoins?

<comment><USER64> Yes and yes. All wallet software that I know of has encryption. Or you can use a brainwallet that is never stored in a file at all (although you might want to keep a paper backup in case your brain has data loss).

<comment> ryan-c > Or you can use a brainwallet that is never stored in a file at all

This is an incredibly bad idea. This publishes an unsalted, unhardened hash of your password to the blockchain to be cracked by anyone. There are bots with large precomputed tables that will instantly steal from especially weak ones.

<comment><USER64> You're right; I was thinking more of HD wallets where you don't choose the seed.

</comment></comment></comment></comment><comment><USER65> Blockchain.info has excellent authentication. First a random identifier, then an email to confirm you're logging in, then the actual account password, then a 2fa code via Authy.

</comment><comment><USER66> > Now, there are more than 5,000. Computers supporting the network

Is this really correct? It sounds low.

<comment><USER67> It's more or less correct, though I think it may only count nodes with forwarded ports.

Running a full node takes 100GB of disk space and some dozens of GB in bandwidth every month. It consumes a lot of ram as well, and if you are running a heavy OS you will often notice your computer is slower.

The cost of running a full node is one of the major reasons people oppose a bigger block size. Most wanting bigger blocks don't run their own full nodes.

</comment></comment><comment><USER68> The lesson here is to always use an Authenticator app over SMS when possible.

<comment><USER53> Just to be extra-clear, I think you mean "instead of," rather than the ambiguous "over." (Though I'd prefer U2F to either.)

</comment></comment><comment><USER69> What is the tl;dr on why SMS is bad for 2fa?

<comment><USER70> If your password recovery also operates over SMS, it's actually 1fa.

</comment></comment><comment><USER71> So banks come in handy after-all.

I regularly get aggravated about the sensitivity of my bank's fraud screening. I have to call them constantly just to spend my money. But, I am at least reassured about how difficult it is to siphon money from the account.</comment>


Ask HN: Good resources to learn about mission-critical distributed systems? - <AUTHOR> I've been reading up quite a bit on distributed database and compute technologies like Spanner/MapReduce as well as some interesting blog posts on scaling out of Facebook/Twitter/Netflix. That got me wondering how even "harder" problems - like Visa's payments system, or the global stock exchange network, are implemented. In these applications, the problem is inherently planet-scale, correctness is of utmost importance, and latency is still very, very important.<p>I haven't been able to find much online on how applications like these are designed, verified and implemented, so any help will be appreciated! <comment><USER2> Give "Designing Data-Intensive Applications" a read. It's an excellent book on these topics.

[https://dataintensive.net](https://dataintensive.net)

</comment><comment><USER3> This repo was posted a few weeks back.

[https://github.com/donnemartin/system-design- primer](https://github.com/donnemartin/system-design-primer)

</comment><comment><USER4> The books on "Architecture of Open Source Applications" might have what you're looking for.

</comment><comment><USER5> You can start with Prof. Ken Birman's book "Guide to Reliable Distributed Systems: Building High-Assurance Applications and Cloud-Hosted Services".</comment>


WhatsApp is using your IMEI number as password - <AUTHOR> http://samgranger.com/whatsapp-is-using-imei-numbers-as-passwords/

<comment><USER2> An "Ask HN" that's somewhat related:

Is Facebook doing something similar on Android? I have left an application update pending for weeks because Facebook requires access to _Phone Calls_ , which allows the application to "determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like."

This does not sit well with me.

<comment><USER3> I also don't allow any app requiring those details (unless they are needed obviously, like VoIP), but I think what most companies want is the unique serial number, so they can keep a track of how many unique devices are used by them. But since Android does not gives permission at more granular level, I simply don't install any such app, or don't upgrade one which ask for it.

As for Facebook, I am using Tinfoil for Facebook app (It is a website wrapper, essentially). It was faster than whatever app Facebook managed to write.

<comment><USER4> > Tinfoil for Facebook

And Tinfoil is better integrated with the Android system than the official Facebook app. Click a Facebook link in an app or browser - you'll get Tinfoil as an option to view the link but not the official app.

<comment><USER5> What a brilliant name! We need a tinfoil chrome extension.

</comment></comment></comment></comment><comment><USER6> There is no public API on the iPhone to access the IMEI, so at least it is pretty conclusively not using that there.

<comment><USER7> Good post - although for posterity retrieving a phone number doesn't work as described in all cases. Calling `getLine1Number()` on a GSM phone will return the MSISDN, _but_ not all carriers store the MSISDN on the SIM (for security reasons), so it will in some cases return null. This is a somewhat moot point, because there are other ways to find mobile numbers!

As you point out, this is almost certainly an Android specific implementation, because there's no way to get either the MSISDN or the IMEI through iOS using the public API (if it was to transpire that WhatsApp were using private calls to obtain them then that would be another story entirely).

<comment><USER8> MSISDN file on the SIM card (EFmsisdn) is optional and has default access rights allowing you to modify it with just a PIN(CHV1) code (see 3GPP TS 51.011). Therefore, information stored in this file is not very reliable, since everyone knowing the PIN code of the card can change it's content. I do not think it has anything to do with the security reasons...

I do not see anything wrong with using IMEI as a seed for a password generation, the problem is that this number should be encrypted using proper encryption method and not just transformed using MD5 hash function.

</comment></comment></comment><comment><USER9> Small nitpick - MD5 is not technically "encryption"

From the article: " likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top"

MD5 is a digest...not encryption

<comment><USER10> He fixed it.

</comment></comment><comment><USER11> This is well-known. I'm curious to know how they get the IMEI on iOS cause there isn't a public API but only an undocumented method on the CoreTelephony.framework. Using a private method is one of the easiest ways to be banned from the App Store. BTW on January 13, 2012, Whatsapp was pulled from the iOS App Store for 4 days. I think they were pardoned by Apple because of the popularity of the application.

</comment><comment><USER12> Deleted post from Google cache: [http://webcache.googleusercontent.com/search?q=cache:samgran...](http://webcache.googleusercontent.com/search?q=cache:samgranger.com/whatsapp- is-using-imei-numbers-as-passwords/)

</comment><comment><USER13> From your post, it seems like you didn't contact WhatsApp before publishing this post. What was your reasoning for going public with this vulnerability before at least trying to contact them and giving them a chance to resolve the issue?

<comment><USER14> This is a well-known design decision on their side. This is not as much a discovery as bringing it up.

<comment><USER15> Is there a particular reason (that you're aware of) for this decision? I'm certainly no expert on the matter, but it seems risky to store everything like that, especially unsalted. LinkedIn, anyone?

<comment><USER14> The problem isn't storing -- remember that we don't know how they store it, we only know how the password is generated. IMEI is intended to be unique and private -- e.g. knowing your IMEI might be enough to report the phone as stolen. If someone knows your IMEI they most likely have enough control over the phone to either completely spoof it or put malicious software on it. This makes it a reasonable tradeoff against implementing "proper" passwords, with their own ton of problems.

<comment><USER16> > IMEI is intended to be unique and private

It's intended to be unique but not secret and not hard to guess. It's a bit like your SSN or a computer's MAC address.

> If someone knows your IMEI they most likely have enough control over the > phone to either completely spoof it or put malicious software on it

Err, no? Your phone can be asked to broadcast it via radio, your phones previous owner / sales clerk knows it, etc, your wife/gf knows it, etc. Now it's trivial for any of those to gain access to your WhatsApp without any active and sophisticated attack requiring physical access.

Sure, with sufficient effort it might be possible for someone sniffing radio or having at some point handled your phone to subvert it in other ways, but this is zero effort.

</comment></comment></comment></comment></comment><comment><USER17> Can anyone explain in general what is the point in WhatsApp which isn't compatible with anything except itself, vs normative XMPP/Jingle client through which one can communicate with any user from federated XMPP servers? I have hard time understanding why new closed (walled garden) IM networks appear in these day and age.

<comment><USER18> It's quite popular in countries where buying SMS credits is not always an afforded cost, but public wifi is everywhere. Basic Android phones are fairly popular and inexpensive given that they double as a web browser and communication device for many.

<comment><USER17> That's understandable, but my question was about creating WhatsApp vs making a regular conformant XMPP/Jingle client which also simply works through TCP and UDP. The later gives free choice of what XMPP server to use and allows communicating with users of other federated servers. WhatsApp allows communicating only with WhatsApp if I understand correctly.

<comment><USER19> I would imagine this is a plus for them, sadly. It's probably easier to extract revenue from a walled garden than an equally user-friendly XMPP client.

</comment></comment></comment></comment><comment><USER20> _If you installed WhatsApp on an Android device for example, your password is likely to be an inverse of your phones IMEI number with an MD5 encryption thrown on top of it (without salt)._

How does OP know this? Was there a leak of "passwords" or did he find this through trial & error?

 _Edit: Just found out that's what it says even on the Wikipedia entry about WhatsApp[1]._

[1]: <http://en.wikipedia.org/wiki/WhatsApp>

<comment><USER21> it's called reverse engineering though. it's much easier to use reverse ios code than that weirdass dex format though imho

<comment><USER22> You can convert .dex files back to .class files, and then use a java decompiler. Not all functions will be properly decompiled but overall it's still quite good. Knowing this, reversing Android apps is actually a lot easier.

</comment></comment></comment><comment><USER23> While it may not be the case in this scenario (since Sam says in a response on here that he sent them a message a few days ago), everyone should always be responsible in how they disclose flaws or discoveries in software:

<http://en.wikipedia.org/wiki/Responsible_disclosure>

<comment><USER24> > _So just as giving a vendor no time to fix a vulnerability is irresponsible, > so is it even more irresponsible to give that vendor a blank rain check._

[http://kevtownsend.wordpress.com/2012/09/01/java- vulnerabili...](http://kevtownsend.wordpress.com/2012/09/01/java- vulnerability-and-irresponsible-disclosure/)

</comment></comment><comment><USER25> No offense but what is the big deal about this...This seems to be extremely low risk if you can even call it a risk, and hardly a vulnerability..

Every method on your website to "exploit" this is retrieving IMEI number through alternative ways which would mean the phone would be compromised anyway...If someone can compromise the phone who cares about this?

Maybe whatsapp can be accessed more easily but isn't that moot if you already have phone access..If you have phone access already why would an attacker care about whatsapp?

Whatsapp is not necessarily insecure based on this..You are giving whatsapp bad publicity for no reason

I don't even think it's a design flaw that they used that as the password because if someone has phone access, and/or access to their number already then they are probably screwed anyway

please correct me if I'm missing the actual vuln here..

<comment><USER16> Your IMEI isn't secret: not random/hard to guess, and not private. It's like a MAC address. Except you can't change it.

<comment><USER25> This still seems minor. If someone is able to get the number doesn't that spell larger issues than whatsapp? I get the point being made and I understand the potential issue, but I don't see how its a major security problem with whatsapp as I figure things are probably compromised anyway if the user is able to get the IMEI to begin with

<comment><USER16> > If someone is able to get the number doesn't that spell larger issues than > whatsapp?

No, since it's not a secret. Why would outing your IMEI spell large issues?

<comment><USER25> even if you have the users phone nurmber and imei nuumber one would assume u already have access to other info then anyway so who cares about whatsapp Can you easedrop on whatsapp sessions from another phone using this info?

</comment></comment></comment></comment></comment><comment><USER26> Asking users to participate in "two-factor authentication" seems like a great way to match people's personal information to particular devices.

So maybe we have a double-edged sword here. If you want to be able to authenticate you have to give some company the ability to track you and monitor all your activity (which they will try to "monetize"). It sounds sort of tinfoil hat but this is what we are facing.

The reason: We insist on using the web and other "client-server" approaches for almost everything we do using the internet, instead of considering end-to- end, peer-to-peer approaches. Things are so insecure when everyting goes (mostly) unencrypted over the open web via middleman (Facebook servers, Gmail servers, etc.) that we need to try things like "two-factor authentication".

</comment><comment><USER27> This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place.

And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this should just be ignored, but in this specific case the author had probably created the bigger part of the security threat by publishing the article.

<comment><USER28> An unsalted(!) md5(!) is never a perfect solution unless your goal is insecurity. The idea of using the IMEI as unique device dependant string for hash generation is good but you must make it impossible for anyone to find out how the hash is created or it is a glaring security hole (as demonstrated).

Many many apps have permissions to read the IMEI. Just as many have access to the internet. Add whatever permission is needed to find out the device's phone number and you have all you need.

<comment><USER27> I'm assuming that they (WhatsApp) were trying to make the experience as close as possible to SMS without help from the carriers, so by using the phone number (which they verify, by the way) and the phone itself as the credentials -- only one of which most people replace, and that's mostly once every 2-3 years -- is a great idea for getting users to their platform with a minimal security tradeoff, hence in my opinion a perfect solution.

And again, if an app had fooled a user for permissions to get their phone number they could probably just ask for permissions to send and receive SMS's -- which is what some _banks_ (at least here, in Israel) use to verify online accounts.

</comment></comment></comment><comment><USER29> Un-official What's App API for PHP and Python: <https://github.com/venomous0x/WhatsAPI>

</comment><comment><USER30> A reference to <https://github.com/venomous0x/WhatsAPI/> wouldn't hurt you, author.

</comment><comment><USER31> The more scary part of this is that WhatsApp probably has a database with phonenumber/imei number pairs on their servers.

The fact that their API uses the IMEI is not great but relatively low risk.

Wait until their servers get hacked and that list of how-many-million pairs of phone/imei numbers gets released.

Setups like this are time bombs.

</comment><comment><USER32> Though the post is deleted now I suppose this is true. I have a dual-mode GSM/CDMA phone and WhatsApp fails when it switches between modes. The app stays the same so it's clearly polling the ESN (CDMA side) and IMEI (GSM side) to validate. When I switch between active sides of the device, WhatsApp consistently requires a re-validation.

</comment><comment><USER33> Nothing Found Sorry, the post you are looking for is not available. Maybe you want to perform a search?

<comment><AUTHOR> Fixed, sorry!!

</comment></comment><comment><USER34> Whatsapp for iPhone uses a MD5 hash of mac address taken twice. For details look at <http://www.ezioamodio.it/?p=29>

</comment><comment><USER35> Does the deleted post mean that it contained false info?

<comment><AUTHOR> No, I made 2 noobish mistakes.

1) I edited the default wordpress post, dated from May 2) I set the time for the future without noticing (wrong timezone!!)

</comment></comment><comment><USER36> mPhoneNumber = tMgr.getLine1Number(); This doesn't work. The phone number is not stored in the device but is assigned by the operator and stored in (god only knows where) location, at least here in India.

</comment><comment><USER37> "Dial *#06# for IMEI"

Does anyone know any other neat tricks like this?

<comment><USER38> Sure.

On iPhones, try _3001#12345#_ .

On Android it often depends on the specific model you have. Here are some for the Samsung S3:

 _#06# Show IMEI number

_ #0 _# LCD Test Menu

_ # _#4636#_ #* user statistics and Phone Info

 _#0011# Displays status information for the GSM

_ #1234# View SW Version PDA, CSC, MODEM

 _#12580_ 369# SW & HW Info

 _#197328640# Service Mode

_ #32489# (Ciphering Info)

 _#232337# Bluetooth Address

_ #232331# Bluetooth Test Mode

 _#232338# WLAN MAC Address

_ #232339# WLAN Test Mode

 _#0842# Vibra Motor Test Mode

_ #0782# Real Time Clock Test

 _#0673# Audio Test Mode

_ #0 _# General Test Mode

_ #2263# RF Band Selection

 _#872564# USB Logging Control

_ #4238378# GCF Configuration

 _#0283# Audio Loopback Control

_ #1575# GPS Control Menu

 _#3214789650# LBS Test Mode

_ #44336# Sofware Version Info

 _#7780# Factory Reset

_ 2767 _3855# Full Factory Reset

_ #0289# Melody Test Mode

 _#2663# TSP / TSK firmware update

_ #03# NAND Flash S/N

 _#0589# Light Sensor Test Mode

_ #0588# Proximity Sensor Test

 _#3282_ 727336 _# Data Usage Status

_ #7594# Remap Shutdown to End Call TSK

 _#34971539# Camera Firmware

_ #528# WLAN Engineering Mode

 _#7412365# Camera Firmware Menu

_ #07# Test History

 _#3214789# GCF Mode Status

_ #272886# Auto Answer Selection

 _#8736364# OTA Update Menu

_ #301279# HSDPA/HSUPA Control Menu

 _#7353# Quick Test Menu

_ 2767 _4387264636# Sellout SMS / PCODE view

_ #7465625# View Phone Lock Status

 _7465625_ 638 _# Configure Network Lock MCC/MNC

#7465625_638 _# Insert Network Lock Keycode

_ # _#7780#_ #* Factory data reset - Clears Google-account data, system and program settings and installed programs. system will not be deleted, and OEM programs, as well as My Documents (pictures, music, videos)

<comment><USER39> _##7780##_ * _Factory reset_

This seems a bit dangerous. Does it require any kind of password?

<comment><USER40> I just tried it on an HTC Incredible 2 on Verizon. Nothing happened. No error message, just back to the dialer.

EDIT: I see now it was stated these are SIII specific. Guess that explains why nothing happened for me.

</comment></comment></comment></comment><comment><USER21> skype and viber also need your imei to function. the skype example is particularly interesting since it's complementary to the username + password we already have.

</comment><comment><USER41> Any news about the renewed authentification system?</comment>