skysight-inc/HackerNews huggingface dataset:
> A reset link that gets sent to a secondary account that my phone doesn't have access to with a
> unique password stored in a PGP encrypted file with a nice long passphrase only known to me.
> My security question has a gibberish answer.

How do you think the average person resets their password? I'm not talking about 2-factor auth as it applies to someone who keeps a PGP encrypted file on their machine I'm talking about it as it applies to the type of person who complains they can't log into Facebook through this page:

http://www.readwriteweb.com/archives/facebook_wants_to_be_yo...

I'll guarantee they don't have a firewalled second account.
I'm more curious about someone being on Hacker News who doesn't have a cell phone.
Quick question for all you security experts:

Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key?

I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers.

Then again, it's in LastPass's absolute interest that my info never gets leaked, and they've built up a good reputation. Further, at a public terminal my usb drive would need to be connected while I unlock the key, thus possibly exposing my unencrypted key.

Any ideas?
You can still pay by cash, no?
Yes, you can revoke those printed codes or issue more whenever you like.
Well I turned on two-factor authentication and then updated Sparrow (iOS and OS X) with the new password and everything was fine... Until the iOS version constantly kept telling me I had an incorrect password. I tried various troubleshooting tips online but to no avail. Until I can use this with everything I can't use it at all.
formal dress up days

For me, that would be opposite of a good retention strategy.
Every Acer laptop I've worked with has been a gift to me because the hardware broke beyond the original user's capability to fix it (new hard drive/battery). I guess I should thank Acer for making crappy machines that break for the average user, but I can't in good conscience recommend them for a purchase.

I know I'm suffering from small sample size bias here, but everything else I've read about the company confirms my anecdotal experience.
I disagree, those are not arcades, they are bars and nightclubs that happen to have retro games spread throughout. I'm not taking my kids to a nightclub to play arcade games but one or two they mention would be worthy. Although it is nice to see interest in having arcade machines in some form so maybe it'll kick off interest in proper arcades.

From my experience, being someone that spent a great deal of time in arcades as a kid, that the arcade industry practically killed itself. True, consoles were a big competitor but there was nothing like getting in that line to put your token on the machine. Consoles is just friends having fun, arcades were friends and strangers competing. Totally different experience. But the arcades started dying when somebody had the silly idea that people wanted to play cockpit games or big interactive games for more than double the price. The next thing you knew those were the only choices you had. I stopped going at that point. This interest in the retro games that are classic standup machines seems to suggest people just wanted what they had in the first place.
find(1) has an -ls built-in, thought the format is slightly different. You can also use -printf to suit. Also, later GNU finds make some uses of xargs unnecessary.

find -type f -exec ls -ltr {} +
How can I reshape my data in R?
I suspect that one of the major reasons why arcades are still viable in Japan but not the US is because each play costs 100 yen, well over a dollar.

At 25 cents a play, I suspect that most of these places make the majority of their profits from beer & food. If you're too cheap to pay 25 cents for a game, I suspect that you're too cheap to buy your food & drink at the arcade. If so, the arcades are probably glad they don't have your business.
Absolutely. That was the bit that made me continue reading because I liked where the story was going, then it suddenly took a turn for the unexpectedly more awesome :)
Did you know it can provide a one-time pad of ten verification codes to print out and store and it will provide another batch on request?
Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: the average person does not understand the risks nor what they could do to ameliorate them.

Compare the attitude towards security that people have in the physical world with their attitude online. No sane person would ever want to use the same exact key to open their home, car, desk, safety deposit box, etc., because that would obviously be unsafe. Yet most people today will happily use the same easy-to-remember password for all online accounts without giving it a second thought.

Similarly, no sane person would ever lend their wallet and keys to a stranger, because that would obviously be unsafe. Yet most people today will happily walk into an Internet cafe or hotel business center and enter all their online credentials without giving it a second thought.

Providers of online services like Google, Amazon, Apple, etc. will find it difficult to solve the security problem until society has evolved its understanding of, and attitude towards, online security.

--

Edit: softened the tone of the last paragraph to make it more accurately reflects my views.
Next time you ask a question don't act like the answer doesn't count just because it doesn't fit your stupid narrative. If you wanted to talk about how you think average people are too stupid to use 2-factor auth then just say it.

Your post is buried and won't harm others. Move on.
This is great. Do you have any solution for highly sensitive data?
Is there any technical barrier that prevents the swiping machine from accepting another card? If so, you could literally show them that "Look, it isn't working"
If they try to add a new address, Amazon will ask for the payment method to be re-entered.
Jury impacting? No.

They've been excluded from the trial - Samsung's lawyers were late in submitting them.
Point of interest: In one of the press conferences yesterday they said they're planning to push an update to the rover's software soon after they get the X-band antenna deployed (which should have happened already).
I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.
Make sure that you stay in good contact with your early users when you have the most bugs. They will typically understand and be patient. Those that stick around will be your evangelists.
Most of my friends are making more than I make, and I still wouldn't trade jobs with most of them.
Discount MBT Shoes,MBT Chapa GTX,MBT sale - Free Shipping For 2 Pairs
MBT Anti shoes is very benifit for human health.Welcome to our Discount MBT shoes store for the mbt chapa gtx shoes,mbt m.walk shoes and mbt sport shoes.MBT sale with a large discount,action to own one pair
This is major. So big, I almost have tears running down my face.
[1] Temporarily leaving aside, for the sake of everyone's collective sanity, any tangential philosophical debate about whether $8 is a "low" price.

Here's a question: we all know about reducing the price point to garner more sales, and therefore more profit; has anyone done similar studies on what price point elicits the least number of refunds (especially due to buyer's remorse)? $8 seems "low" to me, but only for some items; I suspect that most eBooks wouldn't meet this criteria (although I have payed an order of magnitude more for eBooks and still have a minimal Safari subscription). An eBook at $0.99 I wouldn't see the point in getting a refund, no matter how easy it would be to get it. If it was a really bad book, I might go after the refund just to make a point, however.
2011.

A leak as kbok_ mentions.

SVN contains a copy of the full game. Copyright violation #2.
One prominent non-cat/comic meme isn't quite on the influence level of what Swizec was trying to make 4chan out to be.

My point is that he is vastly overstating its influence. The millions of 4chan users have produced _maybe_ as much influence as a single pop music star.
The upload has been made last year - what's the news?
I can't wait to sign up for Stripe, as soon as they accept currencies besides the USD!

My bank account is in the states, but I need to be able to charge Europeans in euros, Brazilians in reais, Japanese in yen, etc...
With consumer demand in mind. Don't you agree that if an invention didn't see the light of day, doesn't that mean there wasn't a market for it in the first place? Then why does it matters if that invention wasn't put in market, if consumers didn't want it in the first place? Remember we're not trying to give benefits for inventors for no reason. We're trying to give consumers something they want. We're not trying to throw money at inventors to invent random stuff no one cares about. We're trying to create cool new things for consumers. If there is no consumer demand for an invention, why would consumers care if the invention didn't make it to market?
Xbox did lose Microsoft billion(s) and take years to become profitable. But now it is profitable and one of their key products. They could lose billions on the Surface but they can also afford to lose billions. They have lost billions on terrible acquisitions in the last decade. I think it is better to spend the money on products that could help them be competitive.
Six Questions for SpaceX President Gwynne Shotwell
Definitely. The original CD-ROM version contained regular CD audio tracks, so it's easy to rip. It's been in my collection for years.
You're a great designer. You could get a job just as a designer.

Then you know D3. You can sell yourself as a package that can create beautiful visualizations.

Then you made it to the top of HN. This is no coincidence. You got here on purpose. You studied previous post and knew exactly what to make that would interest this crowd.

All that makes you a smart person, way above average. Go charge a lot of money.

Having said that, you're not too much of a marketer.
Sigh... This post reminds me so much of Dan Friedman's PL class. BRB, gonna write some Scheme.
You are the founder of evolup.com. Let us say your product/service becomes a huge success. Seeing your success, existing social games developers want to do the same.

Which action from those existing developers would be best for users?

a) Do not copy your product/service. Continue doing things the old way.

b) Make something different, not because it's better, but only for being different's sake. Forces users to adapt to something new instead of using what they're already used to.

c) Embrace the innovation. Put all that's good about your product/service in their offering. Then iterate through it and improve upon it. Now users have the best of both worlds, they have the brand new innovation, in a format they're used to. And taking benefit from next iterations improved from it.

So where does your preferred option (c) leave you in this scenario? Would you whole-heartedly welcome another player "embracing your innovation"?

If that happens to me, I'll lose all motivation to innovate any further. What is the point after all?
So You Want to be a Business Analyst?
You still need to hunt for phone (on top of that you must have one) to log in...
Oculus Rift: immersive virtual reality headset (1.4m funded)
Automatic Renewal Scams: How to beat them: XM Radio, a case study
Facebook accountholdership has become so mainstream that only people who could be described as "fringe elements" don't have an account. It's like someone (in the developed world) not owning a microwave or a bed.

Even if the account provided no utility, I don't see why any intelligent person wouldn't maintain one, just to avoid this type of stigma. Maybe you "just don't use it much" because you're "busy with other things".
This has always been the part I don't like about Google's 2-factor auth. Right now, I have one strong password that would have to be compromised to access my email. If I enable 2-factor, suddenly I have (last time I tried it) about 20 new passwords, any one of which could yield access to my email. That does not really seem more secure.
That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe.

Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors.

People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.
CloudSpring | A newbie's guide to Amazon Web Services
> does that mean it can operate 24hrs and 40 minutes a day?

Not if it consumes electrical energy from the batteries faster than the MMRTG replenishes it. Then it needs to "rest" to give the MMRTG a chance to recharge the batteries.

> Or do they have to channel the power into heaters each evening?

Besides 125 watts electric, the MMRTG also continuously outputs 2000 watts of heat. Heat can be pumped around the rover (either for cooling or heating) to keep the instruments at optimal temperature [1][2]

[1] https://www.youtube.com/watch?v=fBtXnug-rgM#t=89s

[2] http://www1.nasa.gov/mission_pages/mars/images/20081209_msl....
No he isn't. Some people (like me or he) are just not stupid enough to buy a device, which would be used on average only once a month.
I used two-factor authentication for about a year, and I just got so sick of it. I had no issue with the whole logging in and using the time-sensitive code from my Android phone. It was the support for all the other Google apps that drove me crazy. I got really tired of needing to generate new temporary passwords for access through iCal, Mail, and I think even sites like StackOverflow. Perhaps I was at a point in life where I had too many new devices and changes going on.

It's the typical security vs accessibility trade-offs. Accessibility won.
They have the signature collection, but it isn't mandatory, and they don't advertise it enough.
Oil-funded climate change skeptic reverses self
Improvements to Apple’s Podcast Application Don’t go Far Enough
> Standard American mobile billing is to bill both parties

That's the most bizarre thing I've heard in weeks. Honestly, I'm still laughing. BOTH for SMS and voice?!! God, that's just crazy. No wonder you Americans hate telco companies so much. And I though 0.25 cents (only for outgoing SMSs) that we pay here is absurd.
They want multiplayer added. Is the thing even setup to handle multiplayer? Eg can the RNG's be synced? Are things determanistic? It looks like a RTS, are there fast rounds that you can sync on?
You can create a new set whenever you want. However, generating a new set invalidates the previous set (so you can revoke access with those tokens if they are lost.
I spend a lot of time here with my kids: http://nickelmaniagames.com/

My 10 and 12 year old boys like playing the old games just as much as I did when I was their age 30 years ago.
Bloatware is only half of the problem that I mention. The hardware components they use are also cheap. I don't mean 'cheap' in the sense of 'good value', I mean 'senselessly cheap' and 'bad value'.

They use the worst 1366x768 TN panels in 15" laptops when the marginal cost of even using a bad TN panel is essentially negligible.

This leads to Acer being fairly profitable when they sell enough machines, but this hasn't been the case for a few years.
Sex and Sexual Orientation Differences in Pupil Dilation Patterns
I would hope that the iPhone would cause a crisis of design. There's nothing dispositive about this memo, of course.
How much each of the top DJs earned last yeear
I like the idea. Seems really powerful and neat. But I can't escape the sense that in classic Lisp and Scheme the data is supposed to be transparent, and this notion of opaque, strongly-typed data came later. When you see all the supporting APIs in Common Lisp for plists and alists and whatnot, it seems to me that 'cons' was the abstraction.
That just means that "we" are selling stuff people would like to buy -- the supply side --, not that they are buying it from "us", or even buying it from anybody at all -- the demand side.

Being able to buy stuff requires money, and one way of getting money is borrowing it. The Euro resulted in incredibly low interest rates for all the EUR countries, making borrowing money very easy. Certain German entities were also very happy to lend out, having lots of spare money.

Having money is not enough, though, you need to have money in a stable currency. So far the Euro has been very stable. Many of the countries that have got the Euro got in by falsifying statistics, something that was widely known at the time.

Finally, Germany engineered it's economy into extreme efficiency. You can do that by being super smart, broadly speaking, and by being super cheap. I guess Germany did the former; it certainly did the latter and Germany's working force suffered for it: increased retirement age, increased VAT, stagnant net real wages, reduced benefits, reduced unemployment, etc.

The end result: We drove our economy with a focus on exporting stuff to countries which can't really afford it, buy pay us with money borrowed from us. If/when they default, we're left with a huge amount of worthless defaulted loans, a huge export oriented economy that suddenly has lost most of its customers and not enough internal demand to make up for it.
Hah, we have a place near where I live called Dorky's Bar Arcade. It's no Dave and Busters, but it is fun.
No, actually he is spot on. The European crisis is layered like an onion and if you peel away the outer layers like banking, sovereign debt and all the things we hear so much about in the press, then you will arrive at the core.

That core is a inner-European trade imbalance which makes the existence of the Euro blatantly unsustainable. If you look at the overall trade balance between the EU and the rest of the world, you will see that lately, imports have been about 20 % larger than exports.

Germany on the other hand is (and has been for years) an extreme exporter. Now if you add up the numbers, you will see that obviously there must be some very heavy importers within the EU. These importers are the countries that we all know and love from the news reports and the way through which they financed their extreme trade imbalances was through massive private debt (not public debt, that's an outer layer).

Here are some numbers on the trade balances (yeah, I know, it's wikipedia. But they present both figures in a readable manner and they list the sources.):
http://de.wikipedia.org/wiki/Au%C3%9Fenhandelsstatistik#Entw...

Germany was only able to reach its position as such a massive exporter by

1. Being incredibly competitive to begin with
2. Artificially boosting competitiveness by 10+ years of nonexistent wage increases, (also crippling German domestic demand)
3. Having a majority of its most important trading partners locked inside the Euro, so that they couldn't mitigate their trade imbalance through inflation (better cash in your Lira fast...), thus boosting the net worth of German exports

And that number 3 is why this crisis is never going away. Yes, never.

All "they" can do is to repair parts of the outer onion shells, buying time. However, that inner core continues to exert a force towards destabilizing the European system. Every single fix to the trade imbalance problem, probably also all partial fixes, are politically infeasible.

You cannot have a continuous flow of money from one part of the European Economy towards the other without some sort of approximately equal flow of money in the other direction. What kind of flow? If we look at the United States as a group of States that is of roughly equal size and has about the same internal inequalities between states as the EU there emerges a list of transfers that are effective in couteracting trade imbalances:

Social security,
Medicare,
Common Bank Insurance,
Military spending (wanna bet there are per capita more soldiers from Alabama than from Maryland?)
and so on.

If this is what can fix this crisis, then I am all for it. However, it seems that I am part of a minority here in Europe. So collapse it is. Ein Ende mit Schrecken oder ein Schrecken ohne Ende.
> but not if the person that finds it opens up google authenticator (which shows the account the id is used for) and logs in to change the password before i have a chance to.

The person finding your phone would have to either have access to your password, your backup email address or the answer to your security question (which you can write yourself).
For voice I actually like it somewhat better: I hate the European system where the caller can be charged extra because the recipient happens to be on a mobile phone, which you can't always even know before calling. In some cases it can be large; I've been charged $0.30/minute calling a Greek mobile phone in the past, as the caller, when I didn't know I was calling a mobile phone (if it were a landline I would've been charged <$0.10/min). I much prefer the American system where the caller just pays the flat calling-out rate, and it's the owner of the mobile phone who's responsible for the extra cost of mobile.

Paying both ways for SMS is a bit silly, though.
Sounds like the problem is taking care of itself.
hm. Interesting argument against the 'cash back' cards.

The context I've heard of people getting in trouble with this is when they used the card for business purchases and then used the discounts for personal purchases.
Question: How many designers/UX people were in the first meeting about two-factor authentication at Google? How many security engineers?
Well, I mean the rational portion of my brain realizes it and tries to compensate for it, but I don't knock myself out making sure the rational portion is fully engaged when scanning blog posts.
Replacing the factory-as-classroom with help from the Talmud
Do OEM's even provide an option for a clean install (i.e., Windows OS + drivers - bloatware)? I'm fairly sure their factory restore discs are bloatware ridden, too.

And for an average consumer, the idea of doing a clean install is something they have no idea that you can do, how to do or want to do.
At the absolute best, I'd say using an app like Pocket (on Android) on a non-network connected device is probably the safest setup. Granted you'd have to type the passwords in manually, but nothing beats air-gap security, and you'd need to remember just one password.

Also, if you lose your device, you're screwed, unless you've dropbox synced it of course. In which case, you lose the air-gap.
Sounds like a lot of effort, or at least a lot of things to consider. I wonder how many people were completely locked out of their accounts because they enabled 2-factor auth and didn't do all the right things.

The root problem in this story is that things are just too damn interconnected these days. And we're encourage to interconnect them even further (using cellphones to authenticate email, in this case).

Edit:
I think that my reply is not harsh enough. After reading the comments more closely, I see that this a typical IT response to IT failure. 1. Ignore the root cause. (Interconnectedness.) 2. Blame the user. (Implicitly, for not enabling two-factor auth.) 3. Suggest a workaround and dismiss any concerns real-life scenarios. (E.g. loosing your wallet and cellphone in an emergency. Emergencies like that happen more often that you'd think.) 4. Feel smug.