Feature Friday: Password Management

I posted about The Interview last Thursday and the next morning I woke to a message from Facebook:

suspicous login attempt

I can’t imagine the login attempt on my Facebook was in reaction to my blog post about The Interview, but as Andy Grove famously said “only the paranoid survive” and so I spent some time changing passwords that morning.

I don’t want to get too much into my personal security setup but I will say this. I try out a bunch of services every week and many of them ask me to create a login. I use a fairly basic login for those services. But for anything that is serious, I like strong passwords that are unique for each service.

I find a password manager to be helpful in managing all of them. The big issue with a password manager is you are creating a single point of failure by using one. But if the alternative is easy to guess passwords that you use frequently, I think going with a password manager is the better alternative. A couple popular ones are Dashlane and 1Password.

I also use two-factor authentication on services that offer it and, as I have posted here, I like using the Authy app to generate the tokens for me on my phone.

One thing I have decided to change in the wake of that Facebook login attempt is to treat social media services differently. I used to think that social media services weren’t “serious security issues” and did not worry too much about them. I’ve decided that isn’t right and I now treat social media services similarly to banking and productivity services (like email and cloud storage).

But even if you lock down your own services tightly, you still have to be worried about what you put into email and other messaging apps because the person you send the messages to you may not be as secure as you are. That’s one of the many lessons from the Sony hack. A friend of mine told me she only puts into email things she is prepared to have read on the nightly news. That’s a high standard and one that I am going to strive for myself. Given the nature of my work, it’s going to be a hard one to reach.

I think we can expect hacking and other forms of attacks on our personal data and systems to increase significantly in the next five years. If you are looking for a good new year’s resolution, I think taking security more seriously, and specifically using unique strong passwords and two-factor auth on all of your important services would be a good one. I already do that but I am always looking to do more of this sort of thing. Andy Grove’s mantra is a good one in this regard.


Comments (Archived):

  1. Mario Cantin

    Point taken.

    1. fredwilson

      well then my work is done today. i’m going to the beach!

      1. CJ

        Saving the world, even while on vacation!

      2. bsoist

        you mean you don’t sit in front of a computer all day πŸ™‚

        1. fredwilson


  2. Avi Deitcher

    I have been using 1Password for years, love it.Curious your thoughts on:1- Why Authy vs just the Google Auth app? They are both HOTP/TOTP2- Thoughts on FIDO https://fidoalliance.org and the “end of passwords”?BTW, just reading Cliff Stoll’s “Cuckoo’s Egg”. What a great read!

    1. fredwilson

      i like authy’s UI. it’s clean and simple and works like a charm

      1. Avi Deitcher

        Thanks, I will try it.

      2. Matt Zagaja

        I started using Authy with Coinbase and have been meaning to move the rest of my logins over.

    2. JimHirshfield

      What’s your reaction to pw managers being a single point of failure? Worthy of concern?

      1. scottythebody

        You could lose all of your unique, impossible-to-remember passwords with one file corruption if you’re not being careful.There was information on the ‘net (I’d have to research and find it) that the NSA was decrypting 1Password files it found on Dropbox and other services. Don’t know how valid this is.To make things like 1Password really usable, you have to use the Dropbox or iCloud type synchronization mechanisms. There is a chance that a poor implementation would cause your passwords to be stored in a non-secure manner on a cloud service. Risk is pretty low, but it’s possible.I’ve had quite a few occasions where I wanted to log into something, but did not have my password manager at the ready (phone was dead, somebody else’s computer, etc.). Same availability issue applies to OTP if you don’t have your token.& others…Personally, I am a BIG believe in password managers and, wherever possible, 2-factor.

        1. JimHirshfield


        2. Avi Deitcher

          I agree with @scottythebody:disqus (and his cool nickname).But the risk is worthwhile. The question is not, how do I eliminate risk, the question is, which of my alternatives is least risk overall. Easy to use well -designed password manager with good encryption algorithm shared in the cloud is least likely to lead to leak.As for the NSA… they probably are breaking into (with or without help) Google, Microsoft, Yahoo, Chase, Citibank, Facebook, etc. etc.And, yes, 2FA wherever I can.

    3. William Mougayar

      Cool re: 1Password. They are Toronto-based, but have 60+ employees around the world in a distributed manner. You’ll enjoy reading this:http://www.markevans.ca/201

      1. Avi Deitcher

        I really did enjoy that, thank you. I was right, no funding. I interacted with co-founders in their early days, extremely customer-focused. They deserve their success.Re: distributed company. Lots talk the talk, few walk it. One company just asked me to run product for them, but they are honest about requiring everyone on site. Credit to them for that.

        1. William Mougayar

          Did you read the book – Working without pants, chronicling how WordPress/Automattic works? I’m reading now during the holidays.

          1. Avi Deitcher

            No, but it looks great, thank you. One more for the reading list….

    4. Matt A. Myers

      I should go over an idea of mine with you – don’t worry, I’m still focused on ILY. πŸ™‚

      1. Avi Deitcher

        Wish I could stop generating new ideas myself! :-)You got my email and Skype, go ahead.

  3. William Mougayar

    I use 2FA for gmail & Authy for Coinbase, but I’ve been wanting to try 1Password, another fine Canadian startup. Now I will. Happy Boxing Day !

    1. fredwilson

      they celebrate boxing day down here in Anguilla (british colony). which has prompted a spirited debate about the origin of the name “boxing day”. do you know where it comes from?

      1. Avi Deitcher

        I have a vague memory about something relate to gifts in boxes, from when I was growing up in Montreal, but not sure.UPDATE: That’s what Wikipedia says. http://en.wikipedia.org/wik

      2. bsoist

        I asked a Canadian friend twenty years ago and he told me it was the day the packed up all the boxes from Christmas. He swore he was serious, but I never was sure when this guy was fooling around about anything.

      3. William Mougayar

        Today’s modern meaning is “shopping discounts”! Boxing Day sales are notorious, and stores open at 6AM today.But the simple answer is that it has British origins and meant to be the day to thank your servants, when they can take the day off and bring “boxes” (British word for presents) to their families.

      4. johndodds

        Boxes given to staff by aristocracy on this day.

      5. Dale Allyn

        CuisinArt Resort?;)

        1. fredwilson

          no, we rented a house

          1. Dale Allyn

            That’s a nice way to do it. Enjoy your holiday.

    2. Avi Deitcher

      I don’t think AgileBits (the 1P guys) ever took investment money. 100% organic growth. Awesome group.

    3. Matt Zagaja

      I’m a huge fan of 1Password. I purchased the iOS and Mac OS X versions years ago and keep everything in there. They keep improving it. The TouchID integration is incredible.

    4. scottythebody

      I *love* 1Password. Been using it for years. The only problem I have with it is that they always put their products on sale *right after* I’ve purchased them πŸ™‚

  4. LIAD

    Buffett is quoted as saying:Never do anything in life you would be ashamed of seeing printed on the front page of your hometown newspaper for your friends and family to see. – Imagine what an awesome world we would live in if everyone tried to hold themselves to that standard.

    1. CJ

      Boring though. So very, very, boring.

    2. LE

      Typical Buffett idealistic hyperbole. As if Warren never says things to people close to him that he would regret being publicly known. (As I said, “what a prison it must be”).

    3. PhilipSugar

      Really???? Read this article: http://www.cnbc.com/id/2690…Really???? He derides the fact he pays less taxes than his secretary but uses all of the tax breaks and used them aggressively as he came into wealth.Its easy to spout bullshit platitudes.

      1. SubstrateUndertow

        To be fair that tax inequity is systemic and Buffet cannot be expected to waste his money in a vain attempt to solve such a systemic problem at a personal level.It seem perfectly fair to optimize one’s position under the prevailing social contract rules while simultaneously speaking out against their inequity.

        1. PhilipSugar

          Agree but don’t complain about it once you’ve used it to make your money.My rule is if you want to complain put your money where your mouth is. Nothing wrong with him paying more tax than he owes. The government would take it.

    4. ShanaC

      Never do anything in life you would be ashamed of seeing printed on the front page of your hometown newspaper for your friends and family to see.sometimes you feel shame because they easily cause shame for things that are not shameful

    5. Matt A. Myers

      Some people have no shame, even pride themselves on things others would find shameful. It’s all relative, Einstein might say.

    6. Twain Twain

      The contrast to Buffett would be “Publish and be damned” which was the Duke of Wellington’s response in 1824 to John Joseph Stockdale who threatened to publish anecdotes of Wellington and his mistress, Harriette Wilson. This was quoted in ‘Wellington β€” The Years of the Sword’ (1969) by Elizabeth Longford.Each of us should have a freedom of expression and not live in fear of our content being misappropriated, misrepresented or misinterpreted.Naturally, some self-editing happens when we’re online but it would be a poorer and less authentic world if we just wrote things that please our friends and family, as per Buffett’s quote.

  5. JJ Donovan

    Another password manager is LastPass.com that has been working well for me. JJD – Revisiting finger print scanners

    1. CJ

      Another Lastpass endorsement.

  6. Nadav Reis

    Great article! This is something we seriously all need to take more care about, even for social media. Did you read about the guy that had his twitter handle (@n) extorted from him by some crazy hackers? It was juuuust social media, but it changed his life.

  7. Ben Longstaff

    I use a different strong password for each service, I have a strong base for each class of site banking / hosting / social media / email / stuff I don’t care about. Then based on the name of the service i mix in related numbers and letters from the site so that each password is unique.e.g. say the strong base for hosting is 1234aBCd! and for hosting I take the 2nd, 4th and 6th letters from the service name and put them in the 1, 3 and last position so my password forrackspace becomes a1k234aBCd!pamazon web services becomesm1z234aBCd!nthis makes them easy to remember and not obviously related

    1. JimHirshfield

      So if one password becomes compromised, the others can be guessed?

      1. bsoist

        Agreed – don’t think it would take too long to figure that one out. Perhaps @benlongstaff:disqus simplified his example here.

        1. JimHirshfield

          Hang on, I’m buying a bunch of gifts for myself on his Amazon account. πŸ˜‰

          1. JimHirshfield

            Nice. But too many stand up desks on your wish list. And besides, you should have asked before chistmas πŸ˜‰

          2. bsoist

            Yeah, sometimes I use my wishlist as a way to share items with Terri to get her opinion. I need to remove all the desks. :)Christmas is 364 days from now.

          3. JimHirshfield

            Well, we’ll see if you’re naughty or nice.

          4. John Revay

            I heard/ read someone talking about getting a stand up desk at ikea for say $ 75.

          5. JimHirshfield

            I believe it.

      2. Ben Longstaff

        If it was a very targeted attack aimed specifically at me and they had managed to compromise two sites in the same class and where trying to get a third maybe.If they had one email account and one social media account that wouldn’t help them to get a hosting account.

  8. CJ

    I’ll tell you what, whoever can disrupt the password and create something easier and stronger will be the richest man in the world.

    1. LE

      Not true. The person that develops a weight loss cure will be the richest!

  9. Eric

    This issue is a pet peeve of mine, because I see so many problems everywhere:1. It drives me bonkers that financial institutions don’t implement two factor authentication across the board. As it is I’m not sure there’s *any* that do.2. As time goes on more and more security is out of users hands. No matter how good my personal security habits are, it’s doesn’t matter if hackers can get into a company’s database. See: Sony, Target, Home Depot. I’m less afraid of someone compromising my password to get into my Facebook account than I am of a hacker getting into Facebook’s servers and downloading millions of accounts worth of data at once, including mine. I *assume* that any tech company has implemented best practices for security, but I can’t really know that.3. Password managers are great, but these really need to be baked in as a low level service, not third party apps. They’re a pain in the ass to use on mobile. (Open App, open Password manager app, lookup password, copy username, switch back to app, paste, switch to password manager, copy password, switch back, paste). And if you’re trying to generate a random password for a new account you’re creating? Forget it. Google/Apple/Microsoft need to get together and create a standard for this stuff. App developers should be able to request a password from the OS with minimal user intervention. Why hasn’t this happened yet?

    1. fredwilson

      i agree with all of your comments

      1. Michael Wynne

        Scarey stifff eha!

    2. Kevin Donovan

      Eric – It is very different when you go outside the U.S. Two-factor authentication is used for almost all banks in Europe and Asia – and has been for almost a decade. In certain regions (Singapore, HK) it is mandated by the banking regulators that all banking include two-factor.Here’s a commercial from HSBC from a few years back: http://www.youtube.com/watch?v=Zf_...

    3. John Revay

      Interesting… I thought it would be easier on mobile vs what you describe.

    4. John Revay

      Hi Eric,Does Apple try to solve your concerns w/ Keychain app.Assume this solves this problem if you want to stay w/ the Apollo eco system/platform.

    5. scottythebody

      in the new iOS, 1Password has deep integration and works as a plugin in Safari and can even log into apps that support it. So it’s finally usable πŸ˜‰ That being said, 2-factor is pretty much always a better choice than password.

    6. Matt Busche

      LastPass has great integration with Android now. It pops up up the login you need and you just need to press “enter” to fill the fields.

  10. Richard Heitzmann

    Dashlane (disclosure: Investor) also has the ability to change passwords for you automatically to a secure password in case of insecure password or a security breach as well as the ability to sync the passwords across all of your devices

    1. andrewparker

      How do they automatically change passwords? Back in the heartbleed days, I recall it was painful for customers of password manager software because they had to manually change all their passwords. 1Password said it’s because there is no standard or RFC for third-party password management, so each site implements passwords differently. Does Dashlane solve this issue with screen scraping and emulating a user session with the password change process? What if the password change process requires clicking an email confirmation (nearly all of the well-implemented sites do), can Dashlane automate this step in the process?

      1. Richard Heitzmann

        You are right – heartbleed and the other broad attacks were the driver for the product. It would take 4 hours to go and change all of the passwords to secure distinct passwords. Dashlane does emulate the sessions but also works directly with the top sites to ensure the process doesn’t break. Try it πŸ™‚

        1. leigh

          I only bought 1password a few months ago, and given the expense am unlikely to change unless there is a significant benefit ….. anything important to highlight?

          1. Matt A. Myers

            IMHO this is a kind of utility that should be provided by the world government, for free, to provide everyone with the best tools to be as secure as possible. Safety and security isn’t one of those things we should wait for free market to provide a solution for the 100%.

    2. fredwilson

      i like dashlane Rick. great product.

    3. ShanaC

      how do I try this?

    4. Nick Ambrose

      I wish it integrated better on mobile (both browser and apps). Other than that (and a few weirdnesses in the way it works with multiple gmail accounts) I’m really liking it so far (trying to convince my wife to start using too :)I kind of do wish we could separate our accounts out into- Shared- Mine (personal)- Mine (work)- Hers (personal)Not sure if there is a way to do that though

  11. bsoist

    I am very paranoid about passwords and am particularly careful with new services. I take a similar approach, but I don’t use a password manager. Maybe I misunderstand how they work and are used, but I always thought they created a “one point of failure” problem.As I’ve mentioned here before, I rely heavily on the “forgot password” functionality for services that a) I’ve recently signed up for, or b) I use infrequently. I have learned, though, that this can backfire when used on new services ( OneName ), rebooted services ( Bebo ), or services with notorious UX issues ( Microsoft ).

  12. mike

    Very happy with Dashlane

    1. Mark Watkins

      I just tried Dashlane but it wouldn’t work on my work laptop because of group policies. It turns out it runs from a non-standard location. This is a deal breaker for me, is there a solution?

  13. bsoist

    A friend of mine told me she only puts into email things she is prepared to have read on the nightly news.Friends ask me all the time if I think someone else is reading their email. I always answer the same way – yes.

    1. PhilipSugar

      Forever and Completely Out of ContextThat is most important, and hard for the human mind to remember.Voicemail probably gets deleted (unless the person like me it gets translated into email)Letters probably get thrown away (unless they get scanned)I’d love to hear what people’s policies are on deleting email. I delete mine after six months.Also what their policy is on managing with email. I refuse to allow commitments to be made via email. We have systems for that. When somebody sends me an email saying so and so promised me this, I stomp on their head.Why because this causes the reply all, copy everyone, send a million emails productivity suck.

      1. LE

        Also what their policy is on managing with email. I refuse to allow commitments to be made via email. We have systems for that. When somebody sends me an email saying so and so promised me this, I stomp on their head.Are you talking about the practices of employees or your own personal practice?I delete mine after six months.Wouldn’t it make more sense to archive it somewhere so at least if you ever needed it you could get to it?

        1. PhilipSugar

          Ok, I should clarify. Planning projects no. Saying I agree to pay something yes.Not deleting is a two edged sword. Yes you have it, but yes you have it. There is a reason to get rid of stuff after a certain amount of time.

          1. LE

            I find email very helpful rather than “contracts” in many cases. The email trail becomes a way to verify what was agreed to and what was not. [1] It really doesn’t to me get any simpler than that. Now of course that depends on who is writing the email and what it is about and the actual transaction. So it may not be the right thing across the board in an organization.I tend to memorialize everything in writing. That way I remember what I say as well as being able to point back to it at a future date if the need arises.An email commitment really isn’t any less or more in practice than an “official” contract. Plus it can be fluid and change which is much harder with a contract. Especially if the changes are minor.If someone is going to give you a hard time they are going to do so regardless of whether your proof is an email or the proof is written in a signed fancy contract. (As a generality of course at least that’s been my experience over the years and prior to email).The problem with not memorializing (changes) is that even if someone is not trying to screw you they may in an honest way forget what they said or what they agreed to. That’s where the problem is. Not the endpoints but the gray areas or in between.[1] I had a case recently where I bought something for someone from a company (entrepreneur) in Canada. In all my communications I made it very clear that we were dealing in CAD not USD. Every single email. The deal was in the low 6 figure CAD range not a small transaction. The deal needed to be done quickly and definitely had to be done by email (seller was traveling). After the transaction was done and the seller was paid the seller also had to do some additional things for the buyer. They refused saying that they were expecting USD not cad. They hung on a sentence where they said something that was about as thin of a thread as could possibly be. Obviously that was no proof but they decided to hang on that to get the extra money. But the point is they had the gold (something to be delivered later) and even if there was a signed contract they could have found something else to hang their hat on if their idea was to extort. (Really bizarre case and luckily for me I had those emails to back up what I did that’s for sure. I can’t even begin to imagine what would happen if I had done all of this by phone with little written backup..)

          2. LE

            There is a reason to get rid of stuff after a certain amount of time.Personal style, to this point I have found over the years many many times that the person with the most information has a great advantage. Having the information doesn’t mean you have to use it but if it supports your point you can use it. And in most cases not with respect to legal process (most things don’t get to that, right?) nobody else can gain access to that. It’s your info to use or not use as you see fit.

    1. Matt Zagaja

      The reaction to that article then lead to this gem: http://thenextweb.com/apple….Swings from “tour security policies are too permeable so hackers can social engineer their way in” to “tour security policies are too strict and I lost my data after forgetting my password.”

      1. John Revay

        Scary – glad he found the key

  14. Fernando Gutierrez

    Is it possible that the login attempt was you using the VPN? I’ve had problems in the past with VPNs because use IP addresses not expected for me by different services. You said you were using an American IP address, not Chinese, but maybe while your set it up you did use others? It is not the most likely scenario, but wanted to put it out in case it gives you some peace of mind.Regarding password managers, I use KeePass. It is open source and it lets you manage different databases. This way, you can have one for lower risk things, another one for banking… each one with a different password. This way the risk is lower because there is no single password that cracks everything.

  15. PWN Tees

    I’ve been happy using Keychain Access. I was one of those idiots putting in my dogs name and 123 so for me this is a huge step up in protecting my online accounts.The one downside is if I’m not home and forget to bring my phone or iPad I pretty much am locked out of my accounts because there is just no chance I’ll remember these passwords.Then again, maybe being disconnected from the digital universe, if only for a few hours here and there, is a good thing sometimes πŸ™‚

  16. andrewparker

    I use an approach to password management that Albert taught me years ago. I have an “algorithm” I can do in my head that uses something from the page of each login to prompt me to enter the correct password. For example (not what I do, but a good example):- Take the domain and strip off the TLD ending (at this site that would be avc)- Add a “!” to the beginning of the domain starts with a vowel, otherwise, use a “&” (at this site it would now be !avc).- interlace the the domain with a number that is the length of the domain (at this site it would now be !a3v3c)- pad the ending with at least 1 capital X, or do more “X” if you need to get to a character minimum for the site. Here it would be !a3v3cXX, assuming your blog has an 8 character minimum.!a3v3cXX is highly unique, won’t fall to a dictionary attack, meets nearly all sites password requirements. The only thing it doesn’t do is meet length requirements to survive a brute force attack. For that, XKCD would say I’m an idiot and I should be doing this instead: http://xkcd.com/936/ . I agree with XKCD on this point, but his approach won’t fit many websites’ password requirements and I don’t want to have to remember two separate algorithms.I could just use 1password, but I don’t like the mobile access workflow. too clunky, at least it was the last time i used it.

    1. Fernando Gutierrez

      I used that same approach until recently, but mine was less dependent on the domain (although it used it) so I could always make them longer. The problem I found is that if someone gets hold of 1-2 of your passwords (hacked site), they can understand what your are doing and guess the others. I’m sure yours is more difficult that the example you posted and you can always add some complexity to avoid this, but I decided to try KeePass and never looked back.

    2. fredwilson

      yup. albert has explained that to me as well. this is a better approach than what i do but it takes real discipline to do it

    3. ShanaC

      actually, mobile workflow for nearly all these software suck.

    4. obscurelyfamous

      I used to do this but only somewhat inconsistently since the burden on my fragile brain proved to be too much.I sign up for so many things that I always end up using a quick throwaway password for services where I have tenuous long term commitment. That combined with an approach similar to yours for more regular, and important, things. Ultimately it just means I never remember what approach I used, even hitting up 1password hoping that I saved something.I bet I could solve this with more discipline

    5. graubart

      I use 1password, but my daughter finds it too annoying.For sites where she doesn’t give any personal or financial info, I taught my daughter a similar, yet simpler approach. Use one common, easily remembered password across all sites but insert the first letter of the URL at the start, the last letter at the end, and a non-alpha character like ! after that. So, if the common word was yellow, her password for AVC might be ayellowv! It’s not the perfect system (I wouldn’t use it on my bank account) but for low-risk sites it’s better than just using one password across all. And it’s probably better than 99% of people do.

      1. andrewparker

        This is a great approach, clever. And if you chose a phrase instead of a word, it would survive long brute force attacks too.

  17. Eric Friedman

    I have been using 1Password for the past few years across mobile+desktop and it has worked incredibly well. I was against it at first, but after recent events and my own similar situation it has proved worthwhile.With backup to dropbox and ability to login via web or mobile (even from another machine) has proved invaluable.The only downside is that I create a login for each service I sign up for, but gone are the days of blatantly letting every new service OAuth with my FB or Google credentials. Its quite scary to realize how many services have read/write capabilities to my main accounts.Using a unique 50 character alphanumeric+symbol password every time that I never need to remember + two factor (where possible) has been great.I wrote about it here: http://www.ericgfriedman.co… (shameless plug but its relevant)

  18. kirklove

    I wish someone would hack my account and give my back my $4.99 for renting The Interview.

    1. fredwilson

      ha! i watched it last night with josh and his friend Jonas and our friend John. it was silly but not awful

  19. bfeld

    I’ve been a very happy LastPass user for a long time, especially since I can delegate certain logins to others (my assistant, Amy).

    1. Matt A. Myers

      This is a great feature – didn’t know it existed. Thanks.

    2. Donald E. Foss

      I also like LastPass because a) it supports 2 factor auth by using Google Authenticator if you want, and 2) it will cache passwords locally, encrypted, for offline usage. Lastpass could be taken off the map tomorrow and I could still get to my cache with my strong password to get into Last Pass, and no one can mess with my account on the service itself without access to my Google Authenticator. Someone can also crack 2 services I guess, but I’m reasonable paranoid about passwords, not extreme.Of course, as my CTO pointed out to me, all passwords and password managers are vulnerable to physical attacks on the password owner. If it comes down to access to my password manager of my child’s life, it’s not a tough decision.

  20. andrewparker

    Also, I love that Blizzard offers two-factor auth for my Diablo 3 loot, and yet I still can’t get two factor auth on most of my bank/brokerage accounts. :/

  21. LE

    A friend of mine told me she only puts into email things she is prepared to have read on the nightly news. That’s a high standard and one that I am going to strive for myself. Given the nature of my work, it’s going to be a hard one to reach.One of the down sides to being important enough that what you say is something that would make it on the evening news. But I think this extends way beyond email. Anyone with visibility must have to be constantly aware of how they act and what they say in person. What a prison that must be. Having to be nice to everyone and watch what you say lest they now (especially with the advent of social media) can tweet it to the world.I think you will take 10 steps back if you begin to censor what appears in your emails.One problem of course is if you use gmail and all of your emails are archived there. As opposed to perhaps a home rolled solution whereby you can get old emails if needed but there isn’t a single point of failure where someone can get the entire batch. (Or they can get them easy by legal process for that matter).

    1. Matt Zagaja

      Have heard lots of ruminating on the issue of e-mails, discoverability in legal process, etc. and decided that in the end I will never be as smart and diligent as the engineers and Ph.D.s at Google at protecting my data if I roll my own system. The other issue people raise is discoverability in legal process, but the only difference there is that you are the one that is subpoenaed versus Google. Once that happens burning the hard drive with the e-mails is probably not going to be a good move to make. If you are in business and can hire skilled attorneys then you may trust them more to do a better job to protect your stuff than Google’s, but for the average Joe I think Google’s legal resources are going to do a better job at protecting their stuff to the extent they are able.

      1. LE

        The other issue people raise is discoverability in legal process, but the only difference there is that you are the one that is subpoenaed versus Google.The saying that comes to mind is “he who has the gold, rules”. There is a definite benefit to controlling the info vs. someone else.Nixon was able to erase some of the tape [1] but imagine if he was able on his own without his secretary’s involvement to do more than that (word was Nixon was deficient technically and relied on others for many things as I guess is typical for someone in that position).In any case if some legal issue is coming down the pike it doesn’t land by surprise one day. There is usually advance warning.Look this is an analog situation not an exact precise “this way or that way”. Depends on the circumstances which for each entity is different.My personal feeling (and I’ve said this before) is that what Fred is doing and what USV is doing is important enough that consideration needs to be given to doing things different across the board. In the end they might decide the benefit is not great enough (or puts other con’s into the situation) but the greater cost of having a better security setup overall shouldn’t even play into it at all. [2][1] “Better to be thought a fool than to open up your mouth and remove all doubt”.[2] My guess is that he isn’t staying at Holiday Inn’s on vacation.

    2. ShanaC

      It is a prison. It seems to me life is a prison for most of us, as we’re all saying more and communicating more digitally. it is like we are all living in small towns.

  22. hajak

    I think all sites should get two factor as well as monitoring of strange logins. I invested in Userbin (www.userbin.com) after I got hacked last time.

    1. LE

      Well since you invested in them let me give you some of my thoughts so you can pass them along.Other than the whois info [1] there is nothing on the page that tells me who is operating that service or why I should trust that they have their act together.I love the “assumption of legitimacy” with all of these startups. As if simply having a nice website that looks and quacks like a duck and has the proper dog and pony show is enough that you should trust that they have their shit together.[1] Which thankfully is public a step in the right direction.

      1. Sebastian Wallin

        Hey! I’m one of the co-founders of userbin. I really understand and appreciate your concerns (which I guess are concerns most startups struggle with more or less). Would you mind me asking what information you’d like to see that would make us more trustworthy?

        1. LE

          Hi Sebastian, you, your background, why you are qualified to do this, anyone else who is on the team (and about them), where you are located. Address, phone number all of that. (Going forward you may want to consider getting at least an office in the US or some US presence as well even if just a team member.)

          1. Sebastian Wallin

            Awesome! Thanks a lot. Just, one more thing if you’re up for it: are there any particular qualifications of the team that would be more reassuring to read about than others? We’re currently in private beta and painfully aware of that the information on the website is scarce… which is something that we’ll take care of soon enough.(btw. one of our team members are actually from the US and we’re in the process of setting up an office there). Cheers!

          2. LE

            are there any particular qualifications of the team that would be more reassuring to read about than others?Me? I don’t care what your hobbies are or anything like that (others might of course I guess). Unless they enhance what your product is.I care about in particular why you are qualified to offer “bank level security for web developers”.I know someone who would be interested in working in a place like this (depending on the location of course) but I can’t tell whether I should tell him to contact you because I don’t know anything about you! (yet).

  23. LE

    but as Andy Grove famously said β€œonly the paranoid survive” and so I spent some time changing passwords that morning.I think that in order to be paranoid you have to be cynical to a certain extent. Not in every situation simply because every situation is not mission critical. If you aren’t cynical you very well might be thrown for a loop by not understanding enough about human nature to know that people even if they mean well in the end will do what they need to do to survive.From Grove’s wikipedia page:When he was eight, the Nazis occupied Hungary and deported nearly 500,000 Jews to concentration camps. He and his mother took on false identities and were sheltered by friends.[4] His father was taken to an Eastern Labor Camp to do forced labor, but was reunited with his family after the war. Separately, Grove’s father survived (as my father did) because he was able to do something that was of value. He had a skill that kept him alive. If he wasn’t able to do that (either because he was to old, to young or ill) he would have died. Skills and Value = Survival.

  24. Kevin Stecko

    Facebook has their own type of 2 factor authentication where the facebook app on your phone generates a unique code.I personally use Lastpass and always worry about the single point of failure, but at least Lastpass offers 2 factor auth.

  25. Rick

    Another persona perhaps? I think it was your alter ego that logged into your facebook account Fred. Given all the persona’s on the web today it’s nothing to worry about.

  26. pointsnfigures

    I don’t know how you get out of the email thing. Snail mail makes a comeback? Maybe wax seals and bike messengers?

  27. Shaun Dakin

    I use 2 factor with everything, via the Google authenticator app, I can’t, for the life of me, understand how Authy helps me if I already use 2 factor.

  28. Salt Shaker

    I don’t understand why all banks/financial service companies don’t offer 2FA on every type of account they provide. Fidelity offers it on some accounts but not on their 401K’s, for example. Don’t financial service companies have a vested interest to do so, particularly since account holder liabilities are capped in the event of identity theft or hacking?

    1. scottythebody

      Here in Europe, my banks support it in one of the following ways (ranked by security)1. Token-based login, plus per-transaction batch transaction authorization — my friend’s Czech bank requires a token with a client certificate for login, which builds a mutually-authenticated SSL tunnel (basically impossible to MiTM) and then token-based OTPs to authorize the transactions. That is tight.2. Login with U/P, TAN (Transaction authorization numbers) per batch of orders (signing). These are provided over mobile, and app, or even as pre-printed sheets of paper.When I use my US banks, I’m almost afraid. I mean, what kind of horse shit is “log in image”?

  29. ShanaC

    I use lastpass, but I need to upgrade my security overall, and I know it.worried

  30. Matt A. Myers

    If they knew your password or could successful log-in, albeit blocked in this instance, they could have easily logged-in using a proxy for wherever you regularly do login from.I want an always-two-way authentication for logging-in, not merely for changing or recovering password. I’ll eventually develop this anyhow for the services I’m developing – just a matter of time and resources.

  31. Twain Twain

    There will be the need for 2-step AND biometric security. Barclays and Hitachi announced a device that can even measure our veins and it’s blood flows:* http://www.v3.co.uk/v3-uk/n

  32. Pete Griffiths

    I use a password manager and authy.recommend having multiple password managers but only one with valid data for key content.that way if computer or phone is grabbed at least it isn’t just one pwd manager that has to be hacked.

  33. Joshua McFarlane

    Rely on your memory, and when you forget one of the 500 passwords you have made, resetting the password re-secures the password. That does not mean that someone did not hack your security answers or secondary verification email account, but hmmm… Maybe your security questions or special account verification identifications are what should actually revolve and change to keep accounts secure? Passwords by themselves should become insignificant soon, as hackers algorithms, and da tea mining techniques become more advanced. When they do passwords will become obsoleteI personally feel that wearable are a little invasive, but for Internet security and credit card protection, they may become necessary in the future. .Of course it’s probable that none of that will be required within a few years. Facial recognition, and/or iris scan with the webcam, with a secondary identifier of a fingerprint or perhaps something else seems to be the best way to go.I foresee in the very near future that logging into any of your devices will simply require an. EMF reading using an embedded sensor in your respective device to measure your bodies energy field.. Your bodies own magnetic field, using Tesla metrics, or perhaps some other invisible identifier of energy. Each of our bodies EMF fields output, , I would theorize, has a few unique biometric identifiers that could potentially be used as a replacement for every ID, using simple strategy without having to put an RFID chip on each card.

  34. fredwilson

    dashlane is still invite only. i am eager to get access to that

  35. ShanaC

    I’d love access too. I’m not happy with lastpass