Mailchimp offers 10% discount for using 2-factor security • Hacker News Board

Re: Mailchimp offers 10% discount for using 2-factor security

#31

Post by evilduck » Wed, Mar 27, 2013, 5:33 AM UTC

pavel_lishin wrote: post #12

r00fus wrote: post #11

Earlier quoted context omitted.

The cyclical password change for my dozens of accounts would be a constant pain. Some of these accounts also need to be used on mobile devices where 1password doesn't auto-fill (ie, iPad). Add to that sharing certain of these accounts with spouse/family and you have serious friction to constant credentials updates.

The LastPass app on mobile devices worked great for me; true, it doesn't auto-fill, but copying and pasting the passwords is fairly painless. And I think LastPass also supports multiple Identities, though I'm not sure how that works.

LastPass for iOS will do autofill if you browse through their app. It's not the best UX, but it's nice for when you just need to check something and aren't doing a lot of heavy browsing.

Re: Mailchimp offers 10% discount for using 2-factor security

#32

Post by MichaelApproved » Wed, Mar 27, 2013, 7:48 AM UTC

tnorthcutt wrote: post #25

MichaelApproved wrote: post #23

Earlier quoted context omitted.

How important is a high entropy password for web services that properly encode passwords and limit brute force attempts? It's my understanding that the biggest issue is stolen passwords or captured login cookies that cause the most problems. I'm genuinely curious to hear the argument.

It's probably fairly common that $high_entropy_password != $password_used_elsewhere. In other words, if a user uses a high entropy password, there's a better chance that they're not reusing it elsewhere, thus improving security.

Not that common for me. I know several users who have 1 simple & 1 complicated password that's used depending on the site's requirements. Those two password are used repeatedly.

Re: Mailchimp offers 10% discount for using 2-factor security

#33

Post by ProblemFactory » Wed, Mar 27, 2013, 11:29 AM UTC

benchestnut wrote: post #17

MailChimp founder here. Here's a little back story to Alter Ego, since it does tend to confuse people. There was a time, not long ago, when email providers were under attack and suffering from some major breaches ( http://www.cauce.org/2011/04/epsilon-interactive-breach-the-... ). It's hard to describe the feeling of helplessness when you watch industry peers get systematically attacked like that. We wanted to do wha…

> Someone mentioned the uncertainty of relying on a Google service, considering Google's recent "spring cleaning" of Google Reader.

Google Authenticator is not a service that Google can even shut down. It's an open-source implementation of open standard protocols.

You install a library + few tens lines of code on your server, and users install the app on their phone. After this, no Google server or service is ever touched in the authentication process.

Even if Google decides to pull the app from the store, it's open source: you can build it from source and put a copy up yourself.

Re: Mailchimp offers 10% discount for using 2-factor security

#34

Post by Create » Wed, Mar 27, 2013, 11:35 AM UTC

ProblemFactory wrote: post #33

benchestnut wrote: post #17

MailChimp founder here. Here's a little back story to Alter Ego, since it does tend to confuse people. There was a time, not long ago, when email providers were under attack and suffering from some major breaches ( http://www.cauce.org/2011/04/epsilon-interactive-breach-the-... ). It's hard to describe the feeling of helplessness when you watch industry peers get systematically attacked like that. We wanted to do wha…

> Someone mentioned the uncertainty of relying on a Google service, considering Google's recent "spring cleaning" of Google Reader. Google Authenticator is not a service that Google can even shut down. It's an open-source implementation of open standard protocols. You install a library + few tens lines of code on your server, and users install the app on their phone. After this, no Google server or service is ever to…

Current Version of the Android app is now proprietary and it isn't clear whether the source code repository will be getting any more updates.

Re: Mailchimp offers 10% discount for using 2-factor security

#35

Post by peterwwillis » Wed, Mar 27, 2013, 2:21 PM UTC

tnorthcutt wrote: post #26

peterwwillis wrote: post #10

Earlier quoted context omitted.

There's a page[1] describing why they created AlterEgo. They basically claim everything else was too difficult for people to use - which is funny considering the other companies[2] using Google Authenticator. They also call it "1.5-factor authentication", which is kind of unsettling. AlterEgo is a closed-source online-only service provided by MailChimp, while Google Authenticator is an offline, open-source, standards…

Google Authenticator integration wasn't an option when they launched Alter Ego. https://news.ycombinator.com/item?id=5446230

It's funny they say that, because google authenticator's git repo has commits going back to 2010, and AlterEgo was launched in 2011. Could be a coincidence though.

Edit: Nope. Just confirmed Google Authenticator was released in February 2011 [1], and AlterEgo was released May 2011 [2].

[1] http://techcrunch.com/2011/02/10/google-rolls-out-two-factor...

[2] http://blog.mailchimp.com/introducing-alterego-1-5-factor-au...