Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mailchimp offers 10% discount for using 2-factor security

blog.mailchimp.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Mailchimp offers 10% discount for using 2-factor security

#21

Post by paxswill »

harshreality wrote: post #14
cmorrisrsg wrote: post #13

Earlier quoted context omitted.

Lead engineer at MailChimp here. Funny you should mention it, but tomorrow we're going to be launching Google Authenticator and YubiKey integrations with AlterEgo so you can use those as you like. We're also working on a Duo integration, but no ETA there.

BTW, Duo's android app now supports adding TOTP accounts, same as Google Authenticator does (though I'm not sure about QR code support). Duo's app is actually better than GA by allowing rearrangement of accounts, which is a long-standing open bug in GA.

Is that the rearranging bug on iOS? Stupid workaround: Visit the legal button, then try rearranging.

Re: Mailchimp offers 10% discount for using 2-factor security

#22

Post by dave1010uk »

The idea of rewarding customers who behave in a responsible way is very interesting. I'm tempted to see if we can offer discounts to users who use a password with high entropy. Do any other SaaS or ecommerce sites do anything like this? I recall one site adding an "IE tax" (rather than offering a Firefox / Chrome discount). Trying to think if there's any other metrics that could be used to apply discounts.

Re: Mailchimp offers 10% discount for using 2-factor security

#23

Post by MichaelApproved »

dave1010uk wrote: post #22

The idea of rewarding customers who behave in a responsible way is very interesting. I'm tempted to see if we can offer discounts to users who use a password with high entropy. Do any other SaaS or ecommerce sites do anything like this? I recall one site adding an "IE tax" (rather than offering a Firefox / Chrome discount). Trying to think if there's any other metrics that could be used to apply discounts.

How important is a high entropy password for web services that properly encode passwords and limit brute force attempts? It's my understanding that the biggest issue is stolen passwords or captured login cookies that cause the most problems.

I'm genuinely curious to hear the argument.

Re: Mailchimp offers 10% discount for using 2-factor security

#25

Post by tnorthcutt »

MichaelApproved wrote: post #23
dave1010uk wrote: post #22

The idea of rewarding customers who behave in a responsible way is very interesting. I'm tempted to see if we can offer discounts to users who use a password with high entropy. Do any other SaaS or ecommerce sites do anything like this? I recall one site adding an "IE tax" (rather than offering a Firefox / Chrome discount). Trying to think if there's any other metrics that could be used to apply discounts.

How important is a high entropy password for web services that properly encode passwords and limit brute force attempts? It's my understanding that the biggest issue is stolen passwords or captured login cookies that cause the most problems. I'm genuinely curious to hear the argument.

It's probably fairly common that $high_entropy_password != $password_used_elsewhere.

In other words, if a user uses a high entropy password, there's a better chance that they're not reusing it elsewhere, thus improving security.

Re: Mailchimp offers 10% discount for using 2-factor security

#26

Post by tnorthcutt »

peterwwillis wrote: post #10
uptown wrote: post #3

Earlier quoted context omitted.

See Google Reader. When you create your own solutions, you don't have to worry about somebody else changing the rules down the road.

There's a page[1] describing why they created AlterEgo. They basically claim everything else was too difficult for people to use - which is funny considering the other companies[2] using Google Authenticator. They also call it "1.5-factor authentication", which is kind of unsettling. AlterEgo is a closed-source online-only service provided by MailChimp, while Google Authenticator is an offline, open-source, standards…

Google Authenticator integration wasn't an option when they launched Alter Ego. https://news.ycombinator.com/item?id=5446230

Re: Mailchimp offers 10% discount for using 2-factor security

#27

Post by harshreality »

paxswill wrote: post #21
harshreality wrote: post #14

Earlier quoted context omitted.

BTW, Duo's android app now supports adding TOTP accounts, same as Google Authenticator does (though I'm not sure about QR code support). Duo's app is actually better than GA by allowing rearrangement of accounts, which is a long-standing open bug in GA.

Is that the rearranging bug on iOS? Stupid workaround: Visit the legal button, then try rearranging.

On iOS, at least the iphone version I just installed on an ipad to test, accounts can be rearranged in GA.

On Android, there is no rearrangement possible. There's no "edit" button like there is on the ios version, that enables dragging accounts around.

https://code.google.com/p/google-authenticator/issues/detail...

Re: Mailchimp offers 10% discount for using 2-factor security

#28

Post by pfarrell »

benchestnut wrote: post #17

MailChimp founder here. Here's a little back story to Alter Ego, since it does tend to confuse people. There was a time, not long ago, when email providers were under attack and suffering from some major breaches ( http://www.cauce.org/2011/04/epsilon-interactive-breach-the-... ). It's hard to describe the feeling of helplessness when you watch industry peers get systematically attacked like that. We wanted to do wha…

I was a lead engineer at one of the larger email service providers when that attack started. I wasn't at Epsilon, but I did have all my projects put on the backburner and teplaced by two-factor auth, fraud detection etc. that incident helped shape my career (even if it has thrown it totally off track). It is awful to immediately face the full brunt of spear phishing attacks on your business. It suddenly makes you value those security and IT practices that are easy to set aside in the name of moving forward with the product. I didn't have nearly your level of commitment to the company, but I cared about it and didn't want to see us lose the reputation we had worked so hard to gain disappear in a public incident.

Happy to hear MailChimp is investing in data protection. You can bet Ill be enabling it. Keep up the great work.

Re: Mailchimp offers 10% discount for using 2-factor security

#29

Post by zxtang »

dave1010uk wrote: post #22

The idea of rewarding customers who behave in a responsible way is very interesting. I'm tempted to see if we can offer discounts to users who use a password with high entropy. Do any other SaaS or ecommerce sites do anything like this? I recall one site adding an "IE tax" (rather than offering a Firefox / Chrome discount). Trying to think if there's any other metrics that could be used to apply discounts.

It was specifically an IE7 tax by a company called Kogan: http://www.kogan.com/au/blog/new-internet-explorer-7-tax/. And here's the HN discussion: https://news.ycombinator.com/item?id=4109137

Re: Mailchimp offers 10% discount for using 2-factor security

#30

Post by sweis »

benchestnut wrote: post #17

MailChimp founder here. Here's a little back story to Alter Ego, since it does tend to confuse people. There was a time, not long ago, when email providers were under attack and suffering from some major breaches ( http://www.cauce.org/2011/04/epsilon-interactive-breach-the-... ). It's hard to describe the feeling of helplessness when you watch industry peers get systematically attacked like that. We wanted to do wha…

For the record, Google Authenticator has always been open source and is based on open HOTP and TOTP standards. You could always add arbitrary accounts to the mobile app using the key URI format: https://code.google.com/p/google-authenticator/wiki/KeyUriFo...

For example, here's a debug tool written in Javascript that has been online since early 2011: https://google-authenticator.googlecode.com/git/libpam/totp....

Post reply on HN