61–70 of 94 posts
This doesn't say anything. They invested in a tokenization company. That's not a new or interesting technology. What am I missing? There are interesting data security companies happening right now. For instance, Matthew Green is doing Zeutro, an ABE company. Think of ABE as Shamir's Secret Sharing on Steroids: you can encrypt data and delegate it out to different people based on boolean expressions. That at least add…
Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…
EnvKey[1] takes a somewhat similar approach to securing credentials/config in that we effectively replace your config with a short token that can be set as an environment variable. This then 'expands' into your full configuration when it's needed. But the crucial difference is that instead of storing sensitive data in plaintext ourselves and then sending out access tokens, we manage an OpenPGP PKI/web-of-trust for yo…
I get that you are not storing it in the clear, but what if I actually have to use it?
This doesn't say anything. They invested in a tokenization company. That's not a new or interesting technology. What am I missing? There are interesting data security companies happening right now. For instance, Matthew Green is doing Zeutro, an ABE company. Think of ABE as Shamir's Secret Sharing on Steroids: you can encrypt data and delegate it out to different people based on boolean expressions. That at least add…
Exactly. I don't see anything new or differentiating here except that A16Z has a louder microphone and is using HN as a stage to announce it. Besides also apparently reveling in the fallacy that if expert are involved, it can't be hacked.
If an organization is deciding between interacting with VGS hashes/tokens having to proxy requests or deploying a secret store like HashiCorp vault what are the pros/cons? > When it’s time to bill your insurance company, their “reimbursement” code goes through VGS which “reveals” the token and sends the real version to the insurance company. Forgive me if I am wrong, but that means all 3rd party integrations that req…
Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…
I don't think they're YC: http://www.ycombinator.com/companies/
Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…
This sounds weird. What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice. Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to f…
Earlier quoted context omitted.
This sounds weird. What kind of software engineer in their sane mind would want to stay in the US illegally (I don't think one can get any long-term tourist visa?) _and_ get paid peanuts? Even if they really want to live in the US, being poor sounds like a very strange sacrifice. Unless one's a junior developer (where I heard it's hard to compete those days), as far as I know there are a lot of realistic options to f…
I actually went to the US in that exact scenario - tourist visa, six months, paid peanuts. (This was back in 2000.) Until then, it had been a dream of mine to visit the US and that accomplished that dream. I have fond memories of that time and I would revisit... but I'll wait until things return to how they were back then. (Start at "no TSA" and go from there.)
Anonymous account, because of reasons. I interviewed and was offered a job at this company. I turned it down because they had some of the most morally bankrupt leadership I have ever seen in a startup. Frankly, it made me less likely to interview with YC companies at all. Just a quick list of giant red flags- 1. They are violating visa laws by having their employees in the Ukraine lie on their applications and say th…
H(ssn) just kicks the problem downstream. - If H is a simple cryptographic hash function, it's not resistant to brute-force attacks to recover the SSN - It's not revokable What we need is something more akin to a Credit Card number. Something like an abstraction layer. It might even be implementable as a UUID. If you need to revoke it, you can do so since it's not cryptographically tied to anything. Failing that, a b…
(disclaimer: I work at VGS) We offer a variety of various format preserving aliasing algorithms. Only legacy systems tend to choose the SSNs if they have fixed-width columns in their RDBMS that are difficult to change (imagine petabytes of data). The idea behind format preserving aliases is actually based on the NIST SP 800-3G standard[1]. We use FF1 and are actively engaging with the world's leading cryptographers s…