Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Very Good Security

a16z.com

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Very Good Security

#51

Post by cbg0 »

dvdhsu wrote: post #47
vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

I don't think they're YC: http://www.ycombinator.com/companies/

Their list of investors: https://www.crunchbase.com/organization/very-good-security/i...

Re: Very Good Security

#52

Post by cbg0 »

vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

A16Z should look into these alleged practices, given that they are the lead investor in VGS.

Edit: I've sent an e-mail about it.

Re: Very Good Security

#53

Post by zallarak »

danenania wrote: post #32

EnvKey[1] takes a somewhat similar approach to securing credentials/config in that we effectively replace your config with a short token that can be set as an environment variable. This then 'expands' into your full configuration when it's needed. But the crucial difference is that instead of storing sensitive data in plaintext ourselves and then sending out access tokens, we manage an OpenPGP PKI/web-of-trust for yo…

Huge fan on EnvKey. A perfect example of security + usability done right -- they make more convenient to do the right thing in terms of managing sensitive environment variables.

Different niche than VGS, which again, is taking a novel approach to securing sensitive information. You can tell that their founders have had real-world experience from their novel solution; using a proxy to mask and reveal sensitive information.

Re: Very Good Security

#54

Post by zimmerfrei »

amag wrote: post #40
throwawaymath wrote: post #16

I can see why this is an attractive idea to fund, but in my opinion it's the wrong way to resolve the problems highlighted in the article. This is not a technical problem, it's a usability problem. We have had the cryptography necessary to technically fix this for a long time. Replace the single human-memorable token (SSN) with a unique public/private key pair. Then you provide safe authentication by signing verifica…

> Replace the single human-memorable token (SSN) with a unique public/private key pair There are governments that work on solutions to give each citizen a certificate. What I would love to see would be the possibility to issue your own sub-identities that only exhibit as much information as you want/need to share for that specific use case. E.g. if you need to make $20k/yr for a new mobile phone plan, you can issue a…

You have just described IRMA (I Reveal My Attributes) which is an experimental non-profit implementation of a subset of Idemix, a type of ABC (attribute-based credentials) system:

https://privacybydesign.foundation/irma-en/

https://privacybydesign.foundation/irma-explanation/

https://petsymposium.org/2017/papers/hotpets/irma-hotpets.pd...

edit: links

Re: Very Good Security

#55

Post by mdpopescu »

drdaeman wrote: post #37
vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

This sounds weird. What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice. Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to f…

I actually went to the US in that exact scenario - tourist visa, six months, paid peanuts. (This was back in 2000.) Until then, it had been a dream of mine to visit the US and that accomplished that dream.

I have fond memories of that time and I would revisit... but I'll wait until things return to how they were back then. (Start at "no TSA" and go from there.)

Re: Very Good Security

#56

Post by GFischer »

drdaeman wrote: post #37
vgs_interviewee wrote: post #18

Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…

This sounds weird. What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice. Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to f…

Yours was a good question, no idea why you got downvoted. Mdpopescu provided an insightful answer.

Also, it opens up networking opportunities for said developers, maybe they get a better remote contract afterwards.

Re: Very Good Security

#57

Post by kkotak »

tptacek wrote: post #46

This doesn't say anything. They invested in a tokenization company. That's not a new or interesting technology. What am I missing? There are interesting data security companies happening right now. For instance, Matthew Green is doing Zeutro, an ABE company. Think of ABE as Shamir's Secret Sharing on Steroids: you can encrypt data and delegate it out to different people based on boolean expressions. That at least add…

Exactly. I don't see anything new or differentiating here except that A16Z has a louder microphone and is using HN as a stage to announce it. Besides also apparently reveling in the fallacy that if expert are involved, it can't be hacked.

Re: Very Good Security

#58

Post by asimpletune »

throwawaymath wrote: post #16

I can see why this is an attractive idea to fund, but in my opinion it's the wrong way to resolve the problems highlighted in the article. This is not a technical problem, it's a usability problem. We have had the cryptography necessary to technically fix this for a long time. Replace the single human-memorable token (SSN) with a unique public/private key pair. Then you provide safe authentication by signing verifica…

Not to knock your answer, I agree with you that this is a usability problem, but also to be fair, there’s a lot more to the technical side of this than the use of public/private key crypto as you described.

Re: Very Good Security

#59

Post by raesene9 »

wepple wrote: post #38
fefe23 wrote: post #27

Earlier quoted context omitted.

You had me at "cloud providers". If you store the data on some cloud provider, then you are just as bad as what your prospective customers are doing. I don't want any of my sensitive data stored on "some cloud provider". Also, your security strategy apparently boils down to "we'll be REAL CAREFUL, pinky swear!" That strategy does not work, and has never worked before. The whole reason why you think your product is ne…

I’m curious, what’s wrong with storing this type of data in a cloud provider? Also, security aside wouldn’t a16z have invested because the business isn’t “do it more securely”, but “outsource PCI compliance entirely”?

If by outsourcing PCI compliance entirely, they mean "ensure you don't store cardholder data by tokenizing it and we store the real stuff" this is very much not a new solution, so I'd struggle a bit to see the value of a new entrant.

There's already quite a few payment gateways where an e-commerce site can iFrame the payment page (or similar) to ensure that they never see the real cardholder data.

(the fact that this shouldn't really make them out-of-scope for PCI is a different problem)

Re: Very Good Security

#60

Post by asimpletune »

gav wrote: post #23
CiPHPerCoder wrote: post #4

H(ssn) just kicks the problem downstream. - If H is a simple cryptographic hash function, it's not resistant to brute-force attacks to recover the SSN - It's not revokable What we need is something more akin to a Credit Card number. Something like an abstraction layer. It might even be implementable as a UUID. If you need to revoke it, you can do so since it's not cryptographically tied to anything. Failing that, a b…

Exactly, it seems way too complex. I don't know why my insurance company can't give me a 9-digit number that is HASH(SSN + member_id) and tell me to use that instead of my SSN.

It also would need to be salted
Post reply on HN